net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371 };
 372
 373 /* policy for the key attributes */
 374 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 375         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 376         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 377         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 378         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 379         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 380         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 381         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 382         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 383 };
 384
 385 /* policy for the key default flags */
 386 static const struct nla_policy
 387 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 388         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 389         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 390 };
 391
 392 /* policy for WoWLAN attributes */
 393 static const struct nla_policy
 394 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 395         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 396         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 397         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 398         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 399         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 401         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 402         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 404 };
 405
 406 static const struct nla_policy
 407 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 408         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 409         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 410         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 411         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 412         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 413         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 414         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 415                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 416         },
 417         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 418                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 419         },
 420         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 421         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 422         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 423 };
 424
 425 /* policy for GTK rekey offload attributes */
 426 static const struct nla_policy
 427 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 428         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 429         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 430         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 431 };
 432
 433 static const struct nla_policy
 434 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 435         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 436                                                  .len = IEEE80211_MAX_SSID_LEN },
 437         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 438 };
 439
 440 /* ifidx get helper */
 441 static int nl80211_get_ifidx(struct netlink_callback *cb)
 442 {
 443         int res;
 444
 445         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 446                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 447                           nl80211_policy);
 448         if (res)
 449                 return res;
 450
 451         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 452                 return -EINVAL;
 453
 454         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 455         if (!res)
 456                 return -EINVAL;
 457         return res;
 458 }
 459
 460 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 461                                        struct netlink_callback *cb,
 462                                        struct cfg80211_registered_device **rdev,
 463                                        struct net_device **dev)
 464 {
 465         int ifidx = cb->args[0];
 466         int err;
 467
 468         if (!ifidx)
 469                 ifidx = nl80211_get_ifidx(cb);
 470         if (ifidx < 0)
 471                 return ifidx;
 472
 473         cb->args[0] = ifidx;
 474
 475         rtnl_lock();
 476
 477         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 478         if (!*dev) {
 479                 err = -ENODEV;
 480                 goto out_rtnl;
 481         }
 482
 483         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 484         if (IS_ERR(*rdev)) {
 485                 err = PTR_ERR(*rdev);
 486                 goto out_rtnl;
 487         }
 488
 489         return 0;
 490  out_rtnl:
 491         rtnl_unlock();
 492         return err;
 493 }
 494
 495 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 496 {
 497         cfg80211_unlock_rdev(rdev);
 498         rtnl_unlock();
 499 }
 500
 501 /* IE validation */
 502 static bool is_valid_ie_attr(const struct nlattr *attr)
 503 {
 504         const u8 *pos;
 505         int len;
 506
 507         if (!attr)
 508                 return true;
 509
 510         pos = nla_data(attr);
 511         len = nla_len(attr);
 512
 513         while (len) {
 514                 u8 elemlen;
 515
 516                 if (len < 2)
 517                         return false;
 518                 len -= 2;
 519
 520                 elemlen = pos[1];
 521                 if (elemlen > len)
 522                         return false;
 523
 524                 len -= elemlen;
 525                 pos += 2 + elemlen;
 526         }
 527
 528         return true;
 529 }
 530
 531 /* message building helper */
 532 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 533                                    int flags, u8 cmd)
 534 {
 535         /* since there is no private header just add the generic one */
 536         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 537 }
 538
 539 static int nl80211_msg_put_channel(struct sk_buff *msg,
 540                                    struct ieee80211_channel *chan)
 541 {
 542         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 543                         chan->center_freq))
 544                 goto nla_put_failure;
 545
 546         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 547             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 548                 goto nla_put_failure;
 549         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 550             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 551                 goto nla_put_failure;
 552         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 553             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 554                 goto nla_put_failure;
 555         if (chan->flags & IEEE80211_CHAN_RADAR) {
 556                 u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 557                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 558                         goto nla_put_failure;
 559                 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 560                                 chan->dfs_state))
 561                         goto nla_put_failure;
 562                 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
 563                         goto nla_put_failure;
 564         }
 565
 566         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 567                         DBM_TO_MBM(chan->max_power)))
 568                 goto nla_put_failure;
 569
 570         return 0;
 571
 572  nla_put_failure:
 573         return -ENOBUFS;
 574 }
 575
 576 /* netlink command implementations */
 577
 578 struct key_parse {
 579         struct key_params p;
 580         int idx;
 581         int type;
 582         bool def, defmgmt;
 583         bool def_uni, def_multi;
 584 };
 585
 586 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 587 {
 588         struct nlattr *tb[NL80211_KEY_MAX + 1];
 589         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 590                                    nl80211_key_policy);
 591         if (err)
 592                 return err;
 593
 594         k->def = !!tb[NL80211_KEY_DEFAULT];
 595         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 596
 597         if (k->def) {
 598                 k->def_uni = true;
 599                 k->def_multi = true;
 600         }
 601         if (k->defmgmt)
 602                 k->def_multi = true;
 603
 604         if (tb[NL80211_KEY_IDX])
 605                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 606
 607         if (tb[NL80211_KEY_DATA]) {
 608                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 609                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 610         }
 611
 612         if (tb[NL80211_KEY_SEQ]) {
 613                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 614                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 615         }
 616
 617         if (tb[NL80211_KEY_CIPHER])
 618                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 619
 620         if (tb[NL80211_KEY_TYPE]) {
 621                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 622                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 623                         return -EINVAL;
 624         }
 625
 626         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 627                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 628                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 629                                        tb[NL80211_KEY_DEFAULT_TYPES],
 630                                        nl80211_key_default_policy);
 631                 if (err)
 632                         return err;
 633
 634                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 635                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 636         }
 637
 638         return 0;
 639 }
 640
 641 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 642 {
 643         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 644                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 645                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 646         }
 647
 648         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 649                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 650                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 651         }
 652
 653         if (info->attrs[NL80211_ATTR_KEY_IDX])
 654                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 655
 656         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 657                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 658
 659         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 660         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 661
 662         if (k->def) {
 663                 k->def_uni = true;
 664                 k->def_multi = true;
 665         }
 666         if (k->defmgmt)
 667                 k->def_multi = true;
 668
 669         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 670                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 671                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 672                         return -EINVAL;
 673         }
 674
 675         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 676                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 677                 int err = nla_parse_nested(
 678                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 679                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 680                                 nl80211_key_default_policy);
 681                 if (err)
 682                         return err;
 683
 684                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 685                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 686         }
 687
 688         return 0;
 689 }
 690
 691 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 692 {
 693         int err;
 694
 695         memset(k, 0, sizeof(*k));
 696         k->idx = -1;
 697         k->type = -1;
 698
 699         if (info->attrs[NL80211_ATTR_KEY])
 700                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 701         else
 702                 err = nl80211_parse_key_old(info, k);
 703
 704         if (err)
 705                 return err;
 706
 707         if (k->def && k->defmgmt)
 708                 return -EINVAL;
 709
 710         if (k->defmgmt) {
 711                 if (k->def_uni || !k->def_multi)
 712                         return -EINVAL;
 713         }
 714
 715         if (k->idx != -1) {
 716                 if (k->defmgmt) {
 717                         if (k->idx < 4 || k->idx > 5)
 718                                 return -EINVAL;
 719                 } else if (k->def) {
 720                         if (k->idx < 0 || k->idx > 3)
 721                                 return -EINVAL;
 722                 } else {
 723                         if (k->idx < 0 || k->idx > 5)
 724                                 return -EINVAL;
 725                 }
 726         }
 727
 728         return 0;
 729 }
 730
 731 static struct cfg80211_cached_keys *
 732 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 733                        struct nlattr *keys, bool *no_ht)
 734 {
 735         struct key_parse parse;
 736         struct nlattr *key;
 737         struct cfg80211_cached_keys *result;
 738         int rem, err, def = 0;
 739
 740         result = kzalloc(sizeof(*result), GFP_KERNEL);
 741         if (!result)
 742                 return ERR_PTR(-ENOMEM);
 743
 744         result->def = -1;
 745         result->defmgmt = -1;
 746
 747         nla_for_each_nested(key, keys, rem) {
 748                 memset(&parse, 0, sizeof(parse));
 749                 parse.idx = -1;
 750
 751                 err = nl80211_parse_key_new(key, &parse);
 752                 if (err)
 753                         goto error;
 754                 err = -EINVAL;
 755                 if (!parse.p.key)
 756                         goto error;
 757                 if (parse.idx < 0 || parse.idx > 4)
 758                         goto error;
 759                 if (parse.def) {
 760                         if (def)
 761                                 goto error;
 762                         def = 1;
 763                         result->def = parse.idx;
 764                         if (!parse.def_uni || !parse.def_multi)
 765                                 goto error;
 766                 } else if (parse.defmgmt)
 767                         goto error;
 768                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 769                                                      parse.idx, false, NULL);
 770                 if (err)
 771                         goto error;
 772                 result->params[parse.idx].cipher = parse.p.cipher;
 773                 result->params[parse.idx].key_len = parse.p.key_len;
 774                 result->params[parse.idx].key = result->data[parse.idx];
 775                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 776
 777                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 778                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 779                         if (no_ht)
 780                                 *no_ht = true;
 781                 }
 782         }
 783
 784         return result;
 785  error:
 786         kfree(result);
 787         return ERR_PTR(err);
 788 }
 789
 790 static int nl80211_key_allowed(struct wireless_dev *wdev)
 791 {
 792         ASSERT_WDEV_LOCK(wdev);
 793
 794         switch (wdev->iftype) {
 795         case NL80211_IFTYPE_AP:
 796         case NL80211_IFTYPE_AP_VLAN:
 797         case NL80211_IFTYPE_P2P_GO:
 798         case NL80211_IFTYPE_MESH_POINT:
 799                 break;
 800         case NL80211_IFTYPE_ADHOC:
 801                 if (!wdev->current_bss)
 802                         return -ENOLINK;
 803                 break;
 804         case NL80211_IFTYPE_STATION:
 805         case NL80211_IFTYPE_P2P_CLIENT:
 806                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 807                         return -ENOLINK;
 808                 break;
 809         default:
 810                 return -EINVAL;
 811         }
 812
 813         return 0;
 814 }
 815
 816 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 817 {
 818         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 819         int i;
 820
 821         if (!nl_modes)
 822                 goto nla_put_failure;
 823
 824         i = 0;
 825         while (ifmodes) {
 826                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 827                         goto nla_put_failure;
 828                 ifmodes >>= 1;
 829                 i++;
 830         }
 831
 832         nla_nest_end(msg, nl_modes);
 833         return 0;
 834
 835 nla_put_failure:
 836         return -ENOBUFS;
 837 }
 838
 839 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 840                                           struct sk_buff *msg)
 841 {
 842         struct nlattr *nl_combis;
 843         int i, j;
 844
 845         nl_combis = nla_nest_start(msg,
 846                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 847         if (!nl_combis)
 848                 goto nla_put_failure;
 849
 850         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 851                 const struct ieee80211_iface_combination *c;
 852                 struct nlattr *nl_combi, *nl_limits;
 853
 854                 c = &wiphy->iface_combinations[i];
 855
 856                 nl_combi = nla_nest_start(msg, i + 1);
 857                 if (!nl_combi)
 858                         goto nla_put_failure;
 859
 860                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 861                 if (!nl_limits)
 862                         goto nla_put_failure;
 863
 864                 for (j = 0; j < c->n_limits; j++) {
 865                         struct nlattr *nl_limit;
 866
 867                         nl_limit = nla_nest_start(msg, j + 1);
 868                         if (!nl_limit)
 869                                 goto nla_put_failure;
 870                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 871                                         c->limits[j].max))
 872                                 goto nla_put_failure;
 873                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 874                                                 c->limits[j].types))
 875                                 goto nla_put_failure;
 876                         nla_nest_end(msg, nl_limit);
 877                 }
 878
 879                 nla_nest_end(msg, nl_limits);
 880
 881                 if (c->beacon_int_infra_match &&
 882                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 883                         goto nla_put_failure;
 884                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 885                                 c->num_different_channels) ||
 886                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 887                                 c->max_interfaces))
 888                         goto nla_put_failure;
 889                 if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 890                                 c->radar_detect_widths))
 891                         goto nla_put_failure;
 892
 893                 nla_nest_end(msg, nl_combi);
 894         }
 895
 896         nla_nest_end(msg, nl_combis);
 897
 898         return 0;
 899 nla_put_failure:
 900         return -ENOBUFS;
 901 }
 902
 903 #ifdef CONFIG_PM
 904 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 905                                         struct sk_buff *msg)
 906 {
 907         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 908         struct nlattr *nl_tcp;
 909
 910         if (!tcp)
 911                 return 0;
 912
 913         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 914         if (!nl_tcp)
 915                 return -ENOBUFS;
 916
 917         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 918                         tcp->data_payload_max))
 919                 return -ENOBUFS;
 920
 921         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 922                         tcp->data_payload_max))
 923                 return -ENOBUFS;
 924
 925         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 926                 return -ENOBUFS;
 927
 928         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 929                                 sizeof(*tcp->tok), tcp->tok))
 930                 return -ENOBUFS;
 931
 932         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 933                         tcp->data_interval_max))
 934                 return -ENOBUFS;
 935
 936         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 937                         tcp->wake_payload_max))
 938                 return -ENOBUFS;
 939
 940         nla_nest_end(msg, nl_tcp);
 941         return 0;
 942 }
 943 #endif
 944
 945 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 946                               struct cfg80211_registered_device *dev)
 947 {
 948         void *hdr;
 949         struct nlattr *nl_bands, *nl_band;
 950         struct nlattr *nl_freqs, *nl_freq;
 951         struct nlattr *nl_rates, *nl_rate;
 952         struct nlattr *nl_cmds;
 953         enum ieee80211_band band;
 954         struct ieee80211_channel *chan;
 955         struct ieee80211_rate *rate;
 956         int i;
 957         const struct ieee80211_txrx_stypes *mgmt_stypes =
 958                                 dev->wiphy.mgmt_stypes;
 959
 960         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 961         if (!hdr)
 962                 return -1;
 963
 964         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 965             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 966             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 967                         cfg80211_rdev_list_generation) ||
 968             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 969                        dev->wiphy.retry_short) ||
 970             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 971                        dev->wiphy.retry_long) ||
 972             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 973                         dev->wiphy.frag_threshold) ||
 974             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 975                         dev->wiphy.rts_threshold) ||
 976             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 977                        dev->wiphy.coverage_class) ||
 978             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 979                        dev->wiphy.max_scan_ssids) ||
 980             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 981                        dev->wiphy.max_sched_scan_ssids) ||
 982             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 983                         dev->wiphy.max_scan_ie_len) ||
 984             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 985                         dev->wiphy.max_sched_scan_ie_len) ||
 986             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 987                        dev->wiphy.max_match_sets))
 988                 goto nla_put_failure;
 989
 990         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 991             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 992                 goto nla_put_failure;
 993         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 994             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 995                 goto nla_put_failure;
 996         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 997             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 998                 goto nla_put_failure;
 999         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1000             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1001                 goto nla_put_failure;
1002         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1003             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1004                 goto nla_put_failure;
1005         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1006             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1007                 goto nla_put_failure;
1008
1009         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1010                     sizeof(u32) * dev->wiphy.n_cipher_suites,
1011                     dev->wiphy.cipher_suites))
1012                 goto nla_put_failure;
1013
1014         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1015                        dev->wiphy.max_num_pmkids))
1016                 goto nla_put_failure;
1017
1018         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1019             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1020                 goto nla_put_failure;
1021
1022         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1023                         dev->wiphy.available_antennas_tx) ||
1024             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1025                         dev->wiphy.available_antennas_rx))
1026                 goto nla_put_failure;
1027
1028         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1029             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1030                         dev->wiphy.probe_resp_offload))
1031                 goto nla_put_failure;
1032
1033         if ((dev->wiphy.available_antennas_tx ||
1034              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
1035                 u32 tx_ant = 0, rx_ant = 0;
1036                 int res;
1037                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1038                 if (!res) {
1039                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
1040                                         tx_ant) ||
1041                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
1042                                         rx_ant))
1043                                 goto nla_put_failure;
1044                 }
1045         }
1046
1047         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1048                                 dev->wiphy.interface_modes))
1049                 goto nla_put_failure;
1050
1051         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1052         if (!nl_bands)
1053                 goto nla_put_failure;
1054
1055         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1056                 if (!dev->wiphy.bands[band])
1057                         continue;
1058
1059                 nl_band = nla_nest_start(msg, band);
1060                 if (!nl_band)
1061                         goto nla_put_failure;
1062
1063                 /* add HT info */
1064                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
1065                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1066                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
1067                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
1068                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1069                                  dev->wiphy.bands[band]->ht_cap.cap) ||
1070                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1071                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
1072                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1073                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
1074                         goto nla_put_failure;
1075
1076                 /* add VHT info */
1077                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
1078                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1079                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
1080                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
1081                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1082                                  dev->wiphy.bands[band]->vht_cap.cap)))
1083                         goto nla_put_failure;
1084
1085                 /* add frequencies */
1086                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1087                 if (!nl_freqs)
1088                         goto nla_put_failure;
1089
1090                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1091                         nl_freq = nla_nest_start(msg, i);
1092                         if (!nl_freq)
1093                                 goto nla_put_failure;
1094
1095                         chan = &dev->wiphy.bands[band]->channels[i];
1096
1097                         if (nl80211_msg_put_channel(msg, chan))
1098                                 goto nla_put_failure;
1099
1100                         nla_nest_end(msg, nl_freq);
1101                 }
1102
1103                 nla_nest_end(msg, nl_freqs);
1104
1105                 /* add bitrates */
1106                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1107                 if (!nl_rates)
1108                         goto nla_put_failure;
1109
1110                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1111                         nl_rate = nla_nest_start(msg, i);
1112                         if (!nl_rate)
1113                                 goto nla_put_failure;
1114
1115                         rate = &dev->wiphy.bands[band]->bitrates[i];
1116                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1117                                         rate->bitrate))
1118                                 goto nla_put_failure;
1119                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1120                             nla_put_flag(msg,
1121                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1122                                 goto nla_put_failure;
1123
1124                         nla_nest_end(msg, nl_rate);
1125                 }
1126
1127                 nla_nest_end(msg, nl_rates);
1128
1129                 nla_nest_end(msg, nl_band);
1130         }
1131         nla_nest_end(msg, nl_bands);
1132
1133         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1134         if (!nl_cmds)
1135                 goto nla_put_failure;
1136
1137         i = 0;
1138 #define CMD(op, n)                                              \
1139          do {                                                   \
1140                 if (dev->ops->op) {                             \
1141                         i++;                                    \
1142                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1143                                 goto nla_put_failure;           \
1144                 }                                               \
1145         } while (0)
1146
1147         CMD(add_virtual_intf, NEW_INTERFACE);
1148         CMD(change_virtual_intf, SET_INTERFACE);
1149         CMD(add_key, NEW_KEY);
1150         CMD(start_ap, START_AP);
1151         CMD(add_station, NEW_STATION);
1152         CMD(add_mpath, NEW_MPATH);
1153         CMD(update_mesh_config, SET_MESH_CONFIG);
1154         CMD(change_bss, SET_BSS);
1155         CMD(auth, AUTHENTICATE);
1156         CMD(assoc, ASSOCIATE);
1157         CMD(deauth, DEAUTHENTICATE);
1158         CMD(disassoc, DISASSOCIATE);
1159         CMD(join_ibss, JOIN_IBSS);
1160         CMD(join_mesh, JOIN_MESH);
1161         CMD(set_pmksa, SET_PMKSA);
1162         CMD(del_pmksa, DEL_PMKSA);
1163         CMD(flush_pmksa, FLUSH_PMKSA);
1164         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1165                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1166         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1167         CMD(mgmt_tx, FRAME);
1168         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1169         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1170                 i++;
1171                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1172                         goto nla_put_failure;
1173         }
1174         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1175             dev->ops->join_mesh) {
1176                 i++;
1177                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1178                         goto nla_put_failure;
1179         }
1180         CMD(set_wds_peer, SET_WDS_PEER);
1181         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1182                 CMD(tdls_mgmt, TDLS_MGMT);
1183                 CMD(tdls_oper, TDLS_OPER);
1184         }
1185         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1186                 CMD(sched_scan_start, START_SCHED_SCAN);
1187         CMD(probe_client, PROBE_CLIENT);
1188         CMD(set_noack_map, SET_NOACK_MAP);
1189         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1190                 i++;
1191                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1192                         goto nla_put_failure;
1193         }
1194         CMD(start_p2p_device, START_P2P_DEVICE);
1195         CMD(set_mcast_rate, SET_MCAST_RATE);
1196
1197 #ifdef CONFIG_NL80211_TESTMODE
1198         CMD(testmode_cmd, TESTMODE);
1199 #endif
1200
1201 #undef CMD
1202
1203         if (dev->ops->connect || dev->ops->auth) {
1204                 i++;
1205                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1206                         goto nla_put_failure;
1207         }
1208
1209         if (dev->ops->disconnect || dev->ops->deauth) {
1210                 i++;
1211                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1212                         goto nla_put_failure;
1213         }
1214
1215         nla_nest_end(msg, nl_cmds);
1216
1217         if (dev->ops->remain_on_channel &&
1218             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1219             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1220                         dev->wiphy.max_remain_on_channel_duration))
1221                 goto nla_put_failure;
1222
1223         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1224             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1225                 goto nla_put_failure;
1226
1227         if (mgmt_stypes) {
1228                 u16 stypes;
1229                 struct nlattr *nl_ftypes, *nl_ifs;
1230                 enum nl80211_iftype ift;
1231
1232                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1233                 if (!nl_ifs)
1234                         goto nla_put_failure;
1235
1236                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1237                         nl_ftypes = nla_nest_start(msg, ift);
1238                         if (!nl_ftypes)
1239                                 goto nla_put_failure;
1240                         i = 0;
1241                         stypes = mgmt_stypes[ift].tx;
1242                         while (stypes) {
1243                                 if ((stypes & 1) &&
1244                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1245                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1246                                         goto nla_put_failure;
1247                                 stypes >>= 1;
1248                                 i++;
1249                         }
1250                         nla_nest_end(msg, nl_ftypes);
1251                 }
1252
1253                 nla_nest_end(msg, nl_ifs);
1254
1255                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1256                 if (!nl_ifs)
1257                         goto nla_put_failure;
1258
1259                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1260                         nl_ftypes = nla_nest_start(msg, ift);
1261                         if (!nl_ftypes)
1262                                 goto nla_put_failure;
1263                         i = 0;
1264                         stypes = mgmt_stypes[ift].rx;
1265                         while (stypes) {
1266                                 if ((stypes & 1) &&
1267                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1268                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1269                                         goto nla_put_failure;
1270                                 stypes >>= 1;
1271                                 i++;
1272                         }
1273                         nla_nest_end(msg, nl_ftypes);
1274                 }
1275                 nla_nest_end(msg, nl_ifs);
1276         }
1277
1278 #ifdef CONFIG_PM
1279         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1280                 struct nlattr *nl_wowlan;
1281
1282                 nl_wowlan = nla_nest_start(msg,
1283                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1284                 if (!nl_wowlan)
1285                         goto nla_put_failure;
1286
1287                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1288                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1289                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1290                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1291                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1292                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1293                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1294                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1295                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1296                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1297                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1298                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1299                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1301                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1302                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1303                     goto nla_put_failure;
1304                 if (dev->wiphy.wowlan.n_patterns) {
1305                         struct nl80211_wowlan_pattern_support pat = {
1306                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1307                                 .min_pattern_len =
1308                                         dev->wiphy.wowlan.pattern_min_len,
1309                                 .max_pattern_len =
1310                                         dev->wiphy.wowlan.pattern_max_len,
1311                                 .max_pkt_offset =
1312                                         dev->wiphy.wowlan.max_pkt_offset,
1313                         };
1314                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1315                                     sizeof(pat), &pat))
1316                                 goto nla_put_failure;
1317                 }
1318
1319                 if (nl80211_send_wowlan_tcp_caps(dev, msg))
1320                         goto nla_put_failure;
1321
1322                 nla_nest_end(msg, nl_wowlan);
1323         }
1324 #endif
1325
1326         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1327                                 dev->wiphy.software_iftypes))
1328                 goto nla_put_failure;
1329
1330         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1331                 goto nla_put_failure;
1332
1333         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1334             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1335                         dev->wiphy.ap_sme_capa))
1336                 goto nla_put_failure;
1337
1338         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1339                         dev->wiphy.features))
1340                 goto nla_put_failure;
1341
1342         if (dev->wiphy.ht_capa_mod_mask &&
1343             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1344                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1345                     dev->wiphy.ht_capa_mod_mask))
1346                 goto nla_put_failure;
1347
1348         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1349             dev->wiphy.max_acl_mac_addrs &&
1350             nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1351                         dev->wiphy.max_acl_mac_addrs))
1352                 goto nla_put_failure;
1353
1354         return genlmsg_end(msg, hdr);
1355
1356  nla_put_failure:
1357         genlmsg_cancel(msg, hdr);
1358         return -EMSGSIZE;
1359 }
1360
1361 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1362 {
1363         int idx = 0;
1364         int start = cb->args[0];
1365         struct cfg80211_registered_device *dev;
1366
1367         mutex_lock(&cfg80211_mutex);
1368         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1369                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1370                         continue;
1371                 if (++idx <= start)
1372                         continue;
1373                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1374                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1375                                        dev) < 0) {
1376                         idx--;
1377                         break;
1378                 }
1379         }
1380         mutex_unlock(&cfg80211_mutex);
1381
1382         cb->args[0] = idx;
1383
1384         return skb->len;
1385 }
1386
1387 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1388 {
1389         struct sk_buff *msg;
1390         struct cfg80211_registered_device *dev = info->user_ptr[0];
1391
1392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1393         if (!msg)
1394                 return -ENOMEM;
1395
1396         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1397                 nlmsg_free(msg);
1398                 return -ENOBUFS;
1399         }
1400
1401         return genlmsg_reply(msg, info);
1402 }
1403
1404 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1405         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1406         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1407         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1408         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1409         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1410 };
1411
1412 static int parse_txq_params(struct nlattr *tb[],
1413                             struct ieee80211_txq_params *txq_params)
1414 {
1415         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1416             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1417             !tb[NL80211_TXQ_ATTR_AIFS])
1418                 return -EINVAL;
1419
1420         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1421         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1422         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1423         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1424         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1425
1426         if (txq_params->ac >= NL80211_NUM_ACS)
1427                 return -EINVAL;
1428
1429         return 0;
1430 }
1431
1432 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1433 {
1434         /*
1435          * You can only set the channel explicitly for WDS interfaces,
1436          * all others have their channel managed via their respective
1437          * "establish a connection" command (connect, join, ...)
1438          *
1439          * For AP/GO and mesh mode, the channel can be set with the
1440          * channel userspace API, but is only stored and passed to the
1441          * low-level driver when the AP starts or the mesh is joined.
1442          * This is for backward compatibility, userspace can also give
1443          * the channel in the start-ap or join-mesh commands instead.
1444          *
1445          * Monitors are special as they are normally slaved to
1446          * whatever else is going on, so they have their own special
1447          * operation to set the monitor channel if possible.
1448          */
1449         return !wdev ||
1450                 wdev->iftype == NL80211_IFTYPE_AP ||
1451                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1452                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1453                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1454 }
1455
1456 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1457                                  struct genl_info *info,
1458                                  struct cfg80211_chan_def *chandef)
1459 {
1460         u32 control_freq;
1461
1462         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1463                 return -EINVAL;
1464
1465         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1466
1467         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1468         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1469         chandef->center_freq1 = control_freq;
1470         chandef->center_freq2 = 0;
1471
1472         /* Primary channel not allowed */
1473         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1474                 return -EINVAL;
1475
1476         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1477                 enum nl80211_channel_type chantype;
1478
1479                 chantype = nla_get_u32(
1480                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1481
1482                 switch (chantype) {
1483                 case NL80211_CHAN_NO_HT:
1484                 case NL80211_CHAN_HT20:
1485                 case NL80211_CHAN_HT40PLUS:
1486                 case NL80211_CHAN_HT40MINUS:
1487                         cfg80211_chandef_create(chandef, chandef->chan,
1488                                                 chantype);
1489                         break;
1490                 default:
1491                         return -EINVAL;
1492                 }
1493         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1494                 chandef->width =
1495                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1496                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1497                         chandef->center_freq1 =
1498                                 nla_get_u32(
1499                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1500                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1501                         chandef->center_freq2 =
1502                                 nla_get_u32(
1503                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1504         }
1505
1506         if (!cfg80211_chandef_valid(chandef))
1507                 return -EINVAL;
1508
1509         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1510                                      IEEE80211_CHAN_DISABLED))
1511                 return -EINVAL;
1512
1513         return 0;
1514 }
1515
1516 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1517                                  struct wireless_dev *wdev,
1518                                  struct genl_info *info)
1519 {
1520         struct cfg80211_chan_def chandef;
1521         int result;
1522         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1523
1524         if (wdev)
1525                 iftype = wdev->iftype;
1526
1527         if (!nl80211_can_set_dev_channel(wdev))
1528                 return -EOPNOTSUPP;
1529
1530         result = nl80211_parse_chandef(rdev, info, &chandef);
1531         if (result)
1532                 return result;
1533
1534         mutex_lock(&rdev->devlist_mtx);
1535         switch (iftype) {
1536         case NL80211_IFTYPE_AP:
1537         case NL80211_IFTYPE_P2P_GO:
1538                 if (wdev->beacon_interval) {
1539                         result = -EBUSY;
1540                         break;
1541                 }
1542                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1543                         result = -EINVAL;
1544                         break;
1545                 }
1546                 wdev->preset_chandef = chandef;
1547                 result = 0;
1548                 break;
1549         case NL80211_IFTYPE_MESH_POINT:
1550                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1551                 break;
1552         case NL80211_IFTYPE_MONITOR:
1553                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1554                 break;
1555         default:
1556                 result = -EINVAL;
1557         }
1558         mutex_unlock(&rdev->devlist_mtx);
1559
1560         return result;
1561 }
1562
1563 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1564 {
1565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1566         struct net_device *netdev = info->user_ptr[1];
1567
1568         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1569 }
1570
1571 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1572 {
1573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1574         struct net_device *dev = info->user_ptr[1];
1575         struct wireless_dev *wdev = dev->ieee80211_ptr;
1576         const u8 *bssid;
1577
1578         if (!info->attrs[NL80211_ATTR_MAC])
1579                 return -EINVAL;
1580
1581         if (netif_running(dev))
1582                 return -EBUSY;
1583
1584         if (!rdev->ops->set_wds_peer)
1585                 return -EOPNOTSUPP;
1586
1587         if (wdev->iftype != NL80211_IFTYPE_WDS)
1588                 return -EOPNOTSUPP;
1589
1590         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1591         return rdev_set_wds_peer(rdev, dev, bssid);
1592 }
1593
1594
1595 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1596 {
1597         struct cfg80211_registered_device *rdev;
1598         struct net_device *netdev = NULL;
1599         struct wireless_dev *wdev;
1600         int result = 0, rem_txq_params = 0;
1601         struct nlattr *nl_txq_params;
1602         u32 changed;
1603         u8 retry_short = 0, retry_long = 0;
1604         u32 frag_threshold = 0, rts_threshold = 0;
1605         u8 coverage_class = 0;
1606
1607         /*
1608          * Try to find the wiphy and netdev. Normally this
1609          * function shouldn't need the netdev, but this is
1610          * done for backward compatibility -- previously
1611          * setting the channel was done per wiphy, but now
1612          * it is per netdev. Previous userland like hostapd
1613          * also passed a netdev to set_wiphy, so that it is
1614          * possible to let that go to the right netdev!
1615          */
1616         mutex_lock(&cfg80211_mutex);
1617
1618         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1619                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1620
1621                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1622                 if (netdev && netdev->ieee80211_ptr) {
1623                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1624                         mutex_lock(&rdev->mtx);
1625                 } else
1626                         netdev = NULL;
1627         }
1628
1629         if (!netdev) {
1630                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1631                                                   info->attrs);
1632                 if (IS_ERR(rdev)) {
1633                         mutex_unlock(&cfg80211_mutex);
1634                         return PTR_ERR(rdev);
1635                 }
1636                 wdev = NULL;
1637                 netdev = NULL;
1638                 result = 0;
1639
1640                 mutex_lock(&rdev->mtx);
1641         } else
1642                 wdev = netdev->ieee80211_ptr;
1643
1644         /*
1645          * end workaround code, by now the rdev is available
1646          * and locked, and wdev may or may not be NULL.
1647          */
1648
1649         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1650                 result = cfg80211_dev_rename(
1651                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1652
1653         mutex_unlock(&cfg80211_mutex);
1654
1655         if (result)
1656                 goto bad_res;
1657
1658         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1659                 struct ieee80211_txq_params txq_params;
1660                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1661
1662                 if (!rdev->ops->set_txq_params) {
1663                         result = -EOPNOTSUPP;
1664                         goto bad_res;
1665                 }
1666
1667                 if (!netdev) {
1668                         result = -EINVAL;
1669                         goto bad_res;
1670                 }
1671
1672                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1673                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1674                         result = -EINVAL;
1675                         goto bad_res;
1676                 }
1677
1678                 if (!netif_running(netdev)) {
1679                         result = -ENETDOWN;
1680                         goto bad_res;
1681                 }
1682
1683                 nla_for_each_nested(nl_txq_params,
1684                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1685                                     rem_txq_params) {
1686                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1687                                   nla_data(nl_txq_params),
1688                                   nla_len(nl_txq_params),
1689                                   txq_params_policy);
1690                         result = parse_txq_params(tb, &txq_params);
1691                         if (result)
1692                                 goto bad_res;
1693
1694                         result = rdev_set_txq_params(rdev, netdev,
1695                                                      &txq_params);
1696                         if (result)
1697                                 goto bad_res;
1698                 }
1699         }
1700
1701         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1702                 result = __nl80211_set_channel(rdev,
1703                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1704                                 info);
1705                 if (result)
1706                         goto bad_res;
1707         }
1708
1709         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1710                 struct wireless_dev *txp_wdev = wdev;
1711                 enum nl80211_tx_power_setting type;
1712                 int idx, mbm = 0;
1713
1714                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1715                         txp_wdev = NULL;
1716
1717                 if (!rdev->ops->set_tx_power) {
1718                         result = -EOPNOTSUPP;
1719                         goto bad_res;
1720                 }
1721
1722                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1723                 type = nla_get_u32(info->attrs[idx]);
1724
1725                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1726                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1727                         result = -EINVAL;
1728                         goto bad_res;
1729                 }
1730
1731                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1732                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1733                         mbm = nla_get_u32(info->attrs[idx]);
1734                 }
1735
1736                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1737                 if (result)
1738                         goto bad_res;
1739         }
1740
1741         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1742             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1743                 u32 tx_ant, rx_ant;
1744                 if ((!rdev->wiphy.available_antennas_tx &&
1745                      !rdev->wiphy.available_antennas_rx) ||
1746                     !rdev->ops->set_antenna) {
1747                         result = -EOPNOTSUPP;
1748                         goto bad_res;
1749                 }
1750
1751                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1752                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1753
1754                 /* reject antenna configurations which don't match the
1755                  * available antenna masks, except for the "all" mask */
1756                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1757                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1758                         result = -EINVAL;
1759                         goto bad_res;
1760                 }
1761
1762                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1763                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1764
1765                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1766                 if (result)
1767                         goto bad_res;
1768         }
1769
1770         changed = 0;
1771
1772         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1773                 retry_short = nla_get_u8(
1774                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1775                 if (retry_short == 0) {
1776                         result = -EINVAL;
1777                         goto bad_res;
1778                 }
1779                 changed |= WIPHY_PARAM_RETRY_SHORT;
1780         }
1781
1782         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1783                 retry_long = nla_get_u8(
1784                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1785                 if (retry_long == 0) {
1786                         result = -EINVAL;
1787                         goto bad_res;
1788                 }
1789                 changed |= WIPHY_PARAM_RETRY_LONG;
1790         }
1791
1792         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1793                 frag_threshold = nla_get_u32(
1794                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1795                 if (frag_threshold < 256) {
1796                         result = -EINVAL;
1797                         goto bad_res;
1798                 }
1799                 if (frag_threshold != (u32) -1) {
1800                         /*
1801                          * Fragments (apart from the last one) are required to
1802                          * have even length. Make the fragmentation code
1803                          * simpler by stripping LSB should someone try to use
1804                          * odd threshold value.
1805                          */
1806                         frag_threshold &= ~0x1;
1807                 }
1808                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1809         }
1810
1811         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1812                 rts_threshold = nla_get_u32(
1813                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1814                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1815         }
1816
1817         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1818                 coverage_class = nla_get_u8(
1819                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1820                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1821         }
1822
1823         if (changed) {
1824                 u8 old_retry_short, old_retry_long;
1825                 u32 old_frag_threshold, old_rts_threshold;
1826                 u8 old_coverage_class;
1827
1828                 if (!rdev->ops->set_wiphy_params) {
1829                         result = -EOPNOTSUPP;
1830                         goto bad_res;
1831                 }
1832
1833                 old_retry_short = rdev->wiphy.retry_short;
1834                 old_retry_long = rdev->wiphy.retry_long;
1835                 old_frag_threshold = rdev->wiphy.frag_threshold;
1836                 old_rts_threshold = rdev->wiphy.rts_threshold;
1837                 old_coverage_class = rdev->wiphy.coverage_class;
1838
1839                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1840                         rdev->wiphy.retry_short = retry_short;
1841                 if (changed & WIPHY_PARAM_RETRY_LONG)
1842                         rdev->wiphy.retry_long = retry_long;
1843                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1844                         rdev->wiphy.frag_threshold = frag_threshold;
1845                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1846                         rdev->wiphy.rts_threshold = rts_threshold;
1847                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1848                         rdev->wiphy.coverage_class = coverage_class;
1849
1850                 result = rdev_set_wiphy_params(rdev, changed);
1851                 if (result) {
1852                         rdev->wiphy.retry_short = old_retry_short;
1853                         rdev->wiphy.retry_long = old_retry_long;
1854                         rdev->wiphy.frag_threshold = old_frag_threshold;
1855                         rdev->wiphy.rts_threshold = old_rts_threshold;
1856                         rdev->wiphy.coverage_class = old_coverage_class;
1857                 }
1858         }
1859
1860  bad_res:
1861         mutex_unlock(&rdev->mtx);
1862         if (netdev)
1863                 dev_put(netdev);
1864         return result;
1865 }
1866
1867 static inline u64 wdev_id(struct wireless_dev *wdev)
1868 {
1869         return (u64)wdev->identifier |
1870                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1871 }
1872
1873 static int nl80211_send_chandef(struct sk_buff *msg,
1874                                  struct cfg80211_chan_def *chandef)
1875 {
1876         WARN_ON(!cfg80211_chandef_valid(chandef));
1877
1878         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1879                         chandef->chan->center_freq))
1880                 return -ENOBUFS;
1881         switch (chandef->width) {
1882         case NL80211_CHAN_WIDTH_20_NOHT:
1883         case NL80211_CHAN_WIDTH_20:
1884         case NL80211_CHAN_WIDTH_40:
1885                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1886                                 cfg80211_get_chandef_type(chandef)))
1887                         return -ENOBUFS;
1888                 break;
1889         default:
1890                 break;
1891         }
1892         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
1893                 return -ENOBUFS;
1894         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
1895                 return -ENOBUFS;
1896         if (chandef->center_freq2 &&
1897             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
1898                 return -ENOBUFS;
1899         return 0;
1900 }
1901
1902 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1903                               struct cfg80211_registered_device *rdev,
1904                               struct wireless_dev *wdev)
1905 {
1906         struct net_device *dev = wdev->netdev;
1907         void *hdr;
1908
1909         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1910         if (!hdr)
1911                 return -1;
1912
1913         if (dev &&
1914             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1915              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1916                 goto nla_put_failure;
1917
1918         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1919             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1920             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1921             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1922             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1923                         rdev->devlist_generation ^
1924                         (cfg80211_rdev_list_generation << 2)))
1925                 goto nla_put_failure;
1926
1927         if (rdev->ops->get_channel) {
1928                 int ret;
1929                 struct cfg80211_chan_def chandef;
1930
1931                 ret = rdev_get_channel(rdev, wdev, &chandef);
1932                 if (ret == 0) {
1933                         if (nl80211_send_chandef(msg, &chandef))
1934                                 goto nla_put_failure;
1935                 }
1936         }
1937
1938         if (wdev->ssid_len) {
1939                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1940                         goto nla_put_failure;
1941         }
1942
1943         return genlmsg_end(msg, hdr);
1944
1945  nla_put_failure:
1946         genlmsg_cancel(msg, hdr);
1947         return -EMSGSIZE;
1948 }
1949
1950 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1951 {
1952         int wp_idx = 0;
1953         int if_idx = 0;
1954         int wp_start = cb->args[0];
1955         int if_start = cb->args[1];
1956         struct cfg80211_registered_device *rdev;
1957         struct wireless_dev *wdev;
1958
1959         mutex_lock(&cfg80211_mutex);
1960         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1961                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1962                         continue;
1963                 if (wp_idx < wp_start) {
1964                         wp_idx++;
1965                         continue;
1966                 }
1967                 if_idx = 0;
1968
1969                 mutex_lock(&rdev->devlist_mtx);
1970                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1971                         if (if_idx < if_start) {
1972                                 if_idx++;
1973                                 continue;
1974                         }
1975                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1976                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1977                                                rdev, wdev) < 0) {
1978                                 mutex_unlock(&rdev->devlist_mtx);
1979                                 goto out;
1980                         }
1981                         if_idx++;
1982                 }
1983                 mutex_unlock(&rdev->devlist_mtx);
1984
1985                 wp_idx++;
1986         }
1987  out:
1988         mutex_unlock(&cfg80211_mutex);
1989
1990         cb->args[0] = wp_idx;
1991         cb->args[1] = if_idx;
1992
1993         return skb->len;
1994 }
1995
1996 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1997 {
1998         struct sk_buff *msg;
1999         struct cfg80211_registered_device *dev = info->user_ptr[0];
2000         struct wireless_dev *wdev = info->user_ptr[1];
2001
2002         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2003         if (!msg)
2004                 return -ENOMEM;
2005
2006         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2007                                dev, wdev) < 0) {
2008                 nlmsg_free(msg);
2009                 return -ENOBUFS;
2010         }
2011
2012         return genlmsg_reply(msg, info);
2013 }
2014
2015 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2016         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2017         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2018         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2019         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2020         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2021 };
2022
2023 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2024 {
2025         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2026         int flag;
2027
2028         *mntrflags = 0;
2029
2030         if (!nla)
2031                 return -EINVAL;
2032
2033         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2034                              nla, mntr_flags_policy))
2035                 return -EINVAL;
2036
2037         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2038                 if (flags[flag])
2039                         *mntrflags |= (1<<flag);
2040
2041         return 0;
2042 }
2043
2044 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2045                                struct net_device *netdev, u8 use_4addr,
2046                                enum nl80211_iftype iftype)
2047 {
2048         if (!use_4addr) {
2049                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2050                         return -EBUSY;
2051                 return 0;
2052         }
2053
2054         switch (iftype) {
2055         case NL80211_IFTYPE_AP_VLAN:
2056                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2057                         return 0;
2058                 break;
2059         case NL80211_IFTYPE_STATION:
2060                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2061                         return 0;
2062                 break;
2063         default:
2064                 break;
2065         }
2066
2067         return -EOPNOTSUPP;
2068 }
2069
2070 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2071 {
2072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2073         struct vif_params params;
2074         int err;
2075         enum nl80211_iftype otype, ntype;
2076         struct net_device *dev = info->user_ptr[1];
2077         u32 _flags, *flags = NULL;
2078         bool change = false;
2079
2080         memset(&params, 0, sizeof(params));
2081
2082         otype = ntype = dev->ieee80211_ptr->iftype;
2083
2084         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2085                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2086                 if (otype != ntype)
2087                         change = true;
2088                 if (ntype > NL80211_IFTYPE_MAX)
2089                         return -EINVAL;
2090         }
2091
2092         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2093                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2094
2095                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2096                         return -EINVAL;
2097                 if (netif_running(dev))
2098                         return -EBUSY;
2099
2100                 wdev_lock(wdev);
2101                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2102                              IEEE80211_MAX_MESH_ID_LEN);
2103                 wdev->mesh_id_up_len =
2104                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2105                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2106                        wdev->mesh_id_up_len);
2107                 wdev_unlock(wdev);
2108         }
2109
2110         if (info->attrs[NL80211_ATTR_4ADDR]) {
2111                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2112                 change = true;
2113                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2114                 if (err)
2115                         return err;
2116         } else {
2117                 params.use_4addr = -1;
2118         }
2119
2120         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2121                 if (ntype != NL80211_IFTYPE_MONITOR)
2122                         return -EINVAL;
2123                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2124                                           &_flags);
2125                 if (err)
2126                         return err;
2127
2128                 flags = &_flags;
2129                 change = true;
2130         }
2131
2132         if (change)
2133                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2134         else
2135                 err = 0;
2136
2137         if (!err && params.use_4addr != -1)
2138                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2139
2140         return err;
2141 }
2142
2143 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2144 {
2145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2146         struct vif_params params;
2147         struct wireless_dev *wdev;
2148         struct sk_buff *msg;
2149         int err;
2150         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2151         u32 flags;
2152
2153         memset(&params, 0, sizeof(params));
2154
2155         if (!info->attrs[NL80211_ATTR_IFNAME])
2156                 return -EINVAL;
2157
2158         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2159                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2160                 if (type > NL80211_IFTYPE_MAX)
2161                         return -EINVAL;
2162         }
2163
2164         if (!rdev->ops->add_virtual_intf ||
2165             !(rdev->wiphy.interface_modes & (1 << type)))
2166                 return -EOPNOTSUPP;
2167
2168         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2169                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2170                            ETH_ALEN);
2171                 if (!is_valid_ether_addr(params.macaddr))
2172                         return -EADDRNOTAVAIL;
2173         }
2174
2175         if (info->attrs[NL80211_ATTR_4ADDR]) {
2176                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2177                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2178                 if (err)
2179                         return err;
2180         }
2181
2182         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2183         if (!msg)
2184                 return -ENOMEM;
2185
2186         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2187                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2188                                   &flags);
2189         wdev = rdev_add_virtual_intf(rdev,
2190                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2191                                 type, err ? NULL : &flags, &params);
2192         if (IS_ERR(wdev)) {
2193                 nlmsg_free(msg);
2194                 return PTR_ERR(wdev);
2195         }
2196
2197         switch (type) {
2198         case NL80211_IFTYPE_MESH_POINT:
2199                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2200                         break;
2201                 wdev_lock(wdev);
2202                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2203                              IEEE80211_MAX_MESH_ID_LEN);
2204                 wdev->mesh_id_up_len =
2205                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2206                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2207                        wdev->mesh_id_up_len);
2208                 wdev_unlock(wdev);
2209                 break;
2210         case NL80211_IFTYPE_P2P_DEVICE:
2211                 /*
2212                  * P2P Device doesn't have a netdev, so doesn't go
2213                  * through the netdev notifier and must be added here
2214                  */
2215                 mutex_init(&wdev->mtx);
2216                 INIT_LIST_HEAD(&wdev->event_list);
2217                 spin_lock_init(&wdev->event_lock);
2218                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2219                 spin_lock_init(&wdev->mgmt_registrations_lock);
2220
2221                 mutex_lock(&rdev->devlist_mtx);
2222                 wdev->identifier = ++rdev->wdev_id;
2223                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2224                 rdev->devlist_generation++;
2225                 mutex_unlock(&rdev->devlist_mtx);
2226                 break;
2227         default:
2228                 break;
2229         }
2230
2231         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2232                                rdev, wdev) < 0) {
2233                 nlmsg_free(msg);
2234                 return -ENOBUFS;
2235         }
2236
2237         return genlmsg_reply(msg, info);
2238 }
2239
2240 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2241 {
2242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2243         struct wireless_dev *wdev = info->user_ptr[1];
2244
2245         if (!rdev->ops->del_virtual_intf)
2246                 return -EOPNOTSUPP;
2247
2248         /*
2249          * If we remove a wireless device without a netdev then clear
2250          * user_ptr[1] so that nl80211_post_doit won't dereference it
2251          * to check if it needs to do dev_put(). Otherwise it crashes
2252          * since the wdev has been freed, unlike with a netdev where
2253          * we need the dev_put() for the netdev to really be freed.
2254          */
2255         if (!wdev->netdev)
2256                 info->user_ptr[1] = NULL;
2257
2258         return rdev_del_virtual_intf(rdev, wdev);
2259 }
2260
2261 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2262 {
2263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2264         struct net_device *dev = info->user_ptr[1];
2265         u16 noack_map;
2266
2267         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2268                 return -EINVAL;
2269
2270         if (!rdev->ops->set_noack_map)
2271                 return -EOPNOTSUPP;
2272
2273         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2274
2275         return rdev_set_noack_map(rdev, dev, noack_map);
2276 }
2277
2278 struct get_key_cookie {
2279         struct sk_buff *msg;
2280         int error;
2281         int idx;
2282 };
2283
2284 static void get_key_callback(void *c, struct key_params *params)
2285 {
2286         struct nlattr *key;
2287         struct get_key_cookie *cookie = c;
2288
2289         if ((params->key &&
2290              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2291                      params->key_len, params->key)) ||
2292             (params->seq &&
2293              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2294                      params->seq_len, params->seq)) ||
2295             (params->cipher &&
2296              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2297                          params->cipher)))
2298                 goto nla_put_failure;
2299
2300         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2301         if (!key)
2302                 goto nla_put_failure;
2303
2304         if ((params->key &&
2305              nla_put(cookie->msg, NL80211_KEY_DATA,
2306                      params->key_len, params->key)) ||
2307             (params->seq &&
2308              nla_put(cookie->msg, NL80211_KEY_SEQ,
2309                      params->seq_len, params->seq)) ||
2310             (params->cipher &&
2311              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2312                          params->cipher)))
2313                 goto nla_put_failure;
2314
2315         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2316                 goto nla_put_failure;
2317
2318         nla_nest_end(cookie->msg, key);
2319
2320         return;
2321  nla_put_failure:
2322         cookie->error = 1;
2323 }
2324
2325 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2326 {
2327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2328         int err;
2329         struct net_device *dev = info->user_ptr[1];
2330         u8 key_idx = 0;
2331         const u8 *mac_addr = NULL;
2332         bool pairwise;
2333         struct get_key_cookie cookie = {
2334                 .error = 0,
2335         };
2336         void *hdr;
2337         struct sk_buff *msg;
2338
2339         if (info->attrs[NL80211_ATTR_KEY_IDX])
2340                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2341
2342         if (key_idx > 5)
2343                 return -EINVAL;
2344
2345         if (info->attrs[NL80211_ATTR_MAC])
2346                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2347
2348         pairwise = !!mac_addr;
2349         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2350                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2351                 if (kt >= NUM_NL80211_KEYTYPES)
2352                         return -EINVAL;
2353                 if (kt != NL80211_KEYTYPE_GROUP &&
2354                     kt != NL80211_KEYTYPE_PAIRWISE)
2355                         return -EINVAL;
2356                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2357         }
2358
2359         if (!rdev->ops->get_key)
2360                 return -EOPNOTSUPP;
2361
2362         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2363         if (!msg)
2364                 return -ENOMEM;
2365
2366         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2367                              NL80211_CMD_NEW_KEY);
2368         if (IS_ERR(hdr))
2369                 return PTR_ERR(hdr);
2370
2371         cookie.msg = msg;
2372         cookie.idx = key_idx;
2373
2374         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2375             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2376                 goto nla_put_failure;
2377         if (mac_addr &&
2378             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2379                 goto nla_put_failure;
2380
2381         if (pairwise && mac_addr &&
2382             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2383                 return -ENOENT;
2384
2385         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2386                            get_key_callback);
2387
2388         if (err)
2389                 goto free_msg;
2390
2391         if (cookie.error)
2392                 goto nla_put_failure;
2393
2394         genlmsg_end(msg, hdr);
2395         return genlmsg_reply(msg, info);
2396
2397  nla_put_failure:
2398         err = -ENOBUFS;
2399  free_msg:
2400         nlmsg_free(msg);
2401         return err;
2402 }
2403
2404 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2405 {
2406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2407         struct key_parse key;
2408         int err;
2409         struct net_device *dev = info->user_ptr[1];
2410
2411         err = nl80211_parse_key(info, &key);
2412         if (err)
2413                 return err;
2414
2415         if (key.idx < 0)
2416                 return -EINVAL;
2417
2418         /* only support setting default key */
2419         if (!key.def && !key.defmgmt)
2420                 return -EINVAL;
2421
2422         wdev_lock(dev->ieee80211_ptr);
2423
2424         if (key.def) {
2425                 if (!rdev->ops->set_default_key) {
2426                         err = -EOPNOTSUPP;
2427                         goto out;
2428                 }
2429
2430                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2431                 if (err)
2432                         goto out;
2433
2434                 err = rdev_set_default_key(rdev, dev, key.idx,
2435                                                  key.def_uni, key.def_multi);
2436
2437                 if (err)
2438                         goto out;
2439
2440 #ifdef CONFIG_CFG80211_WEXT
2441                 dev->ieee80211_ptr->wext.default_key = key.idx;
2442 #endif
2443         } else {
2444                 if (key.def_uni || !key.def_multi) {
2445                         err = -EINVAL;
2446                         goto out;
2447                 }
2448
2449                 if (!rdev->ops->set_default_mgmt_key) {
2450                         err = -EOPNOTSUPP;
2451                         goto out;
2452                 }
2453
2454                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2455                 if (err)
2456                         goto out;
2457
2458                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2459                 if (err)
2460                         goto out;
2461
2462 #ifdef CONFIG_CFG80211_WEXT
2463                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2464 #endif
2465         }
2466
2467  out:
2468         wdev_unlock(dev->ieee80211_ptr);
2469
2470         return err;
2471 }
2472
2473 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2474 {
2475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2476         int err;
2477         struct net_device *dev = info->user_ptr[1];
2478         struct key_parse key;
2479         const u8 *mac_addr = NULL;
2480
2481         err = nl80211_parse_key(info, &key);
2482         if (err)
2483                 return err;
2484
2485         if (!key.p.key)
2486                 return -EINVAL;
2487
2488         if (info->attrs[NL80211_ATTR_MAC])
2489                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2490
2491         if (key.type == -1) {
2492                 if (mac_addr)
2493                         key.type = NL80211_KEYTYPE_PAIRWISE;
2494                 else
2495                         key.type = NL80211_KEYTYPE_GROUP;
2496         }
2497
2498         /* for now */
2499         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2500             key.type != NL80211_KEYTYPE_GROUP)
2501                 return -EINVAL;
2502
2503         if (!rdev->ops->add_key)
2504                 return -EOPNOTSUPP;
2505
2506         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2507                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2508                                            mac_addr))
2509                 return -EINVAL;
2510
2511         wdev_lock(dev->ieee80211_ptr);
2512         err = nl80211_key_allowed(dev->ieee80211_ptr);
2513         if (!err)
2514                 err = rdev_add_key(rdev, dev, key.idx,
2515                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2516                                     mac_addr, &key.p);
2517         wdev_unlock(dev->ieee80211_ptr);
2518
2519         return err;
2520 }
2521
2522 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2523 {
2524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2525         int err;
2526         struct net_device *dev = info->user_ptr[1];
2527         u8 *mac_addr = NULL;
2528         struct key_parse key;
2529
2530         err = nl80211_parse_key(info, &key);
2531         if (err)
2532                 return err;
2533
2534         if (info->attrs[NL80211_ATTR_MAC])
2535                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2536
2537         if (key.type == -1) {
2538                 if (mac_addr)
2539                         key.type = NL80211_KEYTYPE_PAIRWISE;
2540                 else
2541                         key.type = NL80211_KEYTYPE_GROUP;
2542         }
2543
2544         /* for now */
2545         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2546             key.type != NL80211_KEYTYPE_GROUP)
2547                 return -EINVAL;
2548
2549         if (!rdev->ops->del_key)
2550                 return -EOPNOTSUPP;
2551
2552         wdev_lock(dev->ieee80211_ptr);
2553         err = nl80211_key_allowed(dev->ieee80211_ptr);
2554
2555         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2556             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2557                 err = -ENOENT;
2558
2559         if (!err)
2560                 err = rdev_del_key(rdev, dev, key.idx,
2561                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2562                                    mac_addr);
2563
2564 #ifdef CONFIG_CFG80211_WEXT
2565         if (!err) {
2566                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2567                         dev->ieee80211_ptr->wext.default_key = -1;
2568                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2569                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2570         }
2571 #endif
2572         wdev_unlock(dev->ieee80211_ptr);
2573
2574         return err;
2575 }
2576
2577 /* This function returns an error or the number of nested attributes */
2578 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2579 {
2580         struct nlattr *attr;
2581         int n_entries = 0, tmp;
2582
2583         nla_for_each_nested(attr, nl_attr, tmp) {
2584                 if (nla_len(attr) != ETH_ALEN)
2585                         return -EINVAL;
2586
2587                 n_entries++;
2588         }
2589
2590         return n_entries;
2591 }
2592
2593 /*
2594  * This function parses ACL information and allocates memory for ACL data.
2595  * On successful return, the calling function is responsible to free the
2596  * ACL buffer returned by this function.
2597  */
2598 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2599                                                 struct genl_info *info)
2600 {
2601         enum nl80211_acl_policy acl_policy;
2602         struct nlattr *attr;
2603         struct cfg80211_acl_data *acl;
2604         int i = 0, n_entries, tmp;
2605
2606         if (!wiphy->max_acl_mac_addrs)
2607                 return ERR_PTR(-EOPNOTSUPP);
2608
2609         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2610                 return ERR_PTR(-EINVAL);
2611
2612         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2613         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2614             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2615                 return ERR_PTR(-EINVAL);
2616
2617         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2618                 return ERR_PTR(-EINVAL);
2619
2620         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2621         if (n_entries < 0)
2622                 return ERR_PTR(n_entries);
2623
2624         if (n_entries > wiphy->max_acl_mac_addrs)
2625                 return ERR_PTR(-ENOTSUPP);
2626
2627         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2628                       GFP_KERNEL);
2629         if (!acl)
2630                 return ERR_PTR(-ENOMEM);
2631
2632         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2633                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2634                 i++;
2635         }
2636
2637         acl->n_acl_entries = n_entries;
2638         acl->acl_policy = acl_policy;
2639
2640         return acl;
2641 }
2642
2643 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2644 {
2645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2646         struct net_device *dev = info->user_ptr[1];
2647         struct cfg80211_acl_data *acl;
2648         int err;
2649
2650         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2651             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2652                 return -EOPNOTSUPP;
2653
2654         if (!dev->ieee80211_ptr->beacon_interval)
2655                 return -EINVAL;
2656
2657         acl = parse_acl_data(&rdev->wiphy, info);
2658         if (IS_ERR(acl))
2659                 return PTR_ERR(acl);
2660
2661         err = rdev_set_mac_acl(rdev, dev, acl);
2662
2663         kfree(acl);
2664
2665         return err;
2666 }
2667
2668 static int nl80211_parse_beacon(struct genl_info *info,
2669                                 struct cfg80211_beacon_data *bcn)
2670 {
2671         bool haveinfo = false;
2672
2673         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2674             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2675             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2676             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2677                 return -EINVAL;
2678
2679         memset(bcn, 0, sizeof(*bcn));
2680
2681         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2682                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2683                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2684                 if (!bcn->head_len)
2685                         return -EINVAL;
2686                 haveinfo = true;
2687         }
2688
2689         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2690                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2691                 bcn->tail_len =
2692                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2693                 haveinfo = true;
2694         }
2695
2696         if (!haveinfo)
2697                 return -EINVAL;
2698
2699         if (info->attrs[NL80211_ATTR_IE]) {
2700                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2701                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2702         }
2703
2704         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2705                 bcn->proberesp_ies =
2706                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2707                 bcn->proberesp_ies_len =
2708                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2709         }
2710
2711         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2712                 bcn->assocresp_ies =
2713                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2714                 bcn->assocresp_ies_len =
2715                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2716         }
2717
2718         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2719                 bcn->probe_resp =
2720                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2721                 bcn->probe_resp_len =
2722                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2723         }
2724
2725         return 0;
2726 }
2727
2728 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2729                                    struct cfg80211_ap_settings *params)
2730 {
2731         struct wireless_dev *wdev;
2732         bool ret = false;
2733
2734         mutex_lock(&rdev->devlist_mtx);
2735
2736         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2737                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2738                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2739                         continue;
2740
2741                 if (!wdev->preset_chandef.chan)
2742                         continue;
2743
2744                 params->chandef = wdev->preset_chandef;
2745                 ret = true;
2746                 break;
2747         }
2748
2749         mutex_unlock(&rdev->devlist_mtx);
2750
2751         return ret;
2752 }
2753
2754 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2755                                     enum nl80211_auth_type auth_type,
2756                                     enum nl80211_commands cmd)
2757 {
2758         if (auth_type > NL80211_AUTHTYPE_MAX)
2759                 return false;
2760
2761         switch (cmd) {
2762         case NL80211_CMD_AUTHENTICATE:
2763                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2764                     auth_type == NL80211_AUTHTYPE_SAE)
2765                         return false;
2766                 return true;
2767         case NL80211_CMD_CONNECT:
2768         case NL80211_CMD_START_AP:
2769                 /* SAE not supported yet */
2770                 if (auth_type == NL80211_AUTHTYPE_SAE)
2771                         return false;
2772                 return true;
2773         default:
2774                 return false;
2775         }
2776 }
2777
2778 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2779 {
2780         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2781         struct net_device *dev = info->user_ptr[1];
2782         struct wireless_dev *wdev = dev->ieee80211_ptr;
2783         struct cfg80211_ap_settings params;
2784         int err;
2785         u8 radar_detect_width = 0;
2786
2787         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2788             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2789                 return -EOPNOTSUPP;
2790
2791         if (!rdev->ops->start_ap)
2792                 return -EOPNOTSUPP;
2793
2794         if (wdev->beacon_interval)
2795                 return -EALREADY;
2796
2797         memset(&params, 0, sizeof(params));
2798
2799         /* these are required for START_AP */
2800         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2801             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2802             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2803                 return -EINVAL;
2804
2805         err = nl80211_parse_beacon(info, &params.beacon);
2806         if (err)
2807                 return err;
2808
2809         params.beacon_interval =
2810                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2811         params.dtim_period =
2812                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2813
2814         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2815         if (err)
2816                 return err;
2817
2818         /*
2819          * In theory, some of these attributes should be required here
2820          * but since they were not used when the command was originally
2821          * added, keep them optional for old user space programs to let
2822          * them continue to work with drivers that do not need the
2823          * additional information -- drivers must check!
2824          */
2825         if (info->attrs[NL80211_ATTR_SSID]) {
2826                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2827                 params.ssid_len =
2828                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2829                 if (params.ssid_len == 0 ||
2830                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2831                         return -EINVAL;
2832         }
2833
2834         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2835                 params.hidden_ssid = nla_get_u32(
2836                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2837                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2838                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2839                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2840                         return -EINVAL;
2841         }
2842
2843         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2844
2845         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2846                 params.auth_type = nla_get_u32(
2847                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2848                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2849                                              NL80211_CMD_START_AP))
2850                         return -EINVAL;
2851         } else
2852                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2853
2854         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2855                                       NL80211_MAX_NR_CIPHER_SUITES);
2856         if (err)
2857                 return err;
2858
2859         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2860                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2861                         return -EOPNOTSUPP;
2862                 params.inactivity_timeout = nla_get_u16(
2863                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2864         }
2865
2866         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
2867                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2868                         return -EINVAL;
2869                 params.p2p_ctwindow =
2870                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
2871                 if (params.p2p_ctwindow > 127)
2872                         return -EINVAL;
2873                 if (params.p2p_ctwindow != 0 &&
2874                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
2875                         return -EINVAL;
2876         }
2877
2878         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
2879                 u8 tmp;
2880
2881                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2882                         return -EINVAL;
2883                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
2884                 if (tmp > 1)
2885                         return -EINVAL;
2886                 params.p2p_opp_ps = tmp;
2887                 if (params.p2p_opp_ps != 0 &&
2888                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
2889                         return -EINVAL;
2890         }
2891
2892         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2893                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
2894                 if (err)
2895                         return err;
2896         } else if (wdev->preset_chandef.chan) {
2897                 params.chandef = wdev->preset_chandef;
2898         } else if (!nl80211_get_ap_channel(rdev, &params))
2899                 return -EINVAL;
2900
2901         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2902                 return -EINVAL;
2903
2904         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
2905         if (err < 0)
2906                 return err;
2907         if (err) {
2908                 radar_detect_width = BIT(params.chandef.width);
2909                 params.radar_required = true;
2910         }
2911
2912         mutex_lock(&rdev->devlist_mtx);
2913         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
2914                                            params.chandef.chan,
2915                                            CHAN_MODE_SHARED,
2916                                            radar_detect_width);
2917         mutex_unlock(&rdev->devlist_mtx);
2918
2919         if (err)
2920                 return err;
2921
2922         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
2923                 params.acl = parse_acl_data(&rdev->wiphy, info);
2924                 if (IS_ERR(params.acl))
2925                         return PTR_ERR(params.acl);
2926         }
2927
2928         err = rdev_start_ap(rdev, dev, &params);
2929         if (!err) {
2930                 wdev->preset_chandef = params.chandef;
2931                 wdev->beacon_interval = params.beacon_interval;
2932                 wdev->channel = params.chandef.chan;
2933                 wdev->ssid_len = params.ssid_len;
2934                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2935         }
2936
2937         kfree(params.acl);
2938
2939         return err;
2940 }
2941
2942 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2943 {
2944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2945         struct net_device *dev = info->user_ptr[1];
2946         struct wireless_dev *wdev = dev->ieee80211_ptr;
2947         struct cfg80211_beacon_data params;
2948         int err;
2949
2950         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2951             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2952                 return -EOPNOTSUPP;
2953
2954         if (!rdev->ops->change_beacon)
2955                 return -EOPNOTSUPP;
2956
2957         if (!wdev->beacon_interval)
2958                 return -EINVAL;
2959
2960         err = nl80211_parse_beacon(info, &params);
2961         if (err)
2962                 return err;
2963
2964         return rdev_change_beacon(rdev, dev, &params);
2965 }
2966
2967 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2968 {
2969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2970         struct net_device *dev = info->user_ptr[1];
2971
2972         return cfg80211_stop_ap(rdev, dev);
2973 }
2974
2975 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2976         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2977         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2978         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2979         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2980         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2981         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2982 };
2983
2984 static int parse_station_flags(struct genl_info *info,
2985                                enum nl80211_iftype iftype,
2986                                struct station_parameters *params)
2987 {
2988         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2989         struct nlattr *nla;
2990         int flag;
2991
2992         /*
2993          * Try parsing the new attribute first so userspace
2994          * can specify both for older kernels.
2995          */
2996         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2997         if (nla) {
2998                 struct nl80211_sta_flag_update *sta_flags;
2999
3000                 sta_flags = nla_data(nla);
3001                 params->sta_flags_mask = sta_flags->mask;
3002                 params->sta_flags_set = sta_flags->set;
3003                 if ((params->sta_flags_mask |
3004                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3005                         return -EINVAL;
3006                 return 0;
3007         }
3008
3009         /* if present, parse the old attribute */
3010
3011         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3012         if (!nla)
3013                 return 0;
3014
3015         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3016                              nla, sta_flags_policy))
3017                 return -EINVAL;
3018
3019         /*
3020          * Only allow certain flags for interface types so that
3021          * other attributes are silently ignored. Remember that
3022          * this is backward compatibility code with old userspace
3023          * and shouldn't be hit in other cases anyway.
3024          */
3025         switch (iftype) {
3026         case NL80211_IFTYPE_AP:
3027         case NL80211_IFTYPE_AP_VLAN:
3028         case NL80211_IFTYPE_P2P_GO:
3029                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3030                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3031                                          BIT(NL80211_STA_FLAG_WME) |
3032                                          BIT(NL80211_STA_FLAG_MFP);
3033                 break;
3034         case NL80211_IFTYPE_P2P_CLIENT:
3035         case NL80211_IFTYPE_STATION:
3036                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3037                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3038                 break;
3039         case NL80211_IFTYPE_MESH_POINT:
3040                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3041                                          BIT(NL80211_STA_FLAG_MFP) |
3042                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3043         default:
3044                 return -EINVAL;
3045         }
3046
3047         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3048                 if (flags[flag]) {
3049                         params->sta_flags_set |= (1<<flag);
3050
3051                         /* no longer support new API additions in old API */
3052                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3053                                 return -EINVAL;
3054                 }
3055         }
3056
3057         return 0;
3058 }
3059
3060 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3061                                  int attr)
3062 {
3063         struct nlattr *rate;
3064         u32 bitrate;
3065         u16 bitrate_compat;
3066
3067         rate = nla_nest_start(msg, attr);
3068         if (!rate)
3069                 return false;
3070
3071         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3072         bitrate = cfg80211_calculate_bitrate(info);
3073         /* report 16-bit bitrate only if we can */
3074         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3075         if (bitrate > 0 &&
3076             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3077                 return false;
3078         if (bitrate_compat > 0 &&
3079             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3080                 return false;
3081
3082         if (info->flags & RATE_INFO_FLAGS_MCS) {
3083                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3084                         return false;
3085                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3086                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3087                         return false;
3088                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3089                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3090                         return false;
3091         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3092                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3093                         return false;
3094                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3095                         return false;
3096                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3097                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3098                         return false;
3099                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3100                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3101                         return false;
3102                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3103                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3104                         return false;
3105                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3106                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3107                         return false;
3108                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3109                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3110                         return false;
3111         }
3112
3113         nla_nest_end(msg, rate);
3114         return true;
3115 }
3116
3117 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3118                                 int flags,
3119                                 struct cfg80211_registered_device *rdev,
3120                                 struct net_device *dev,
3121                                 const u8 *mac_addr, struct station_info *sinfo)
3122 {
3123         void *hdr;
3124         struct nlattr *sinfoattr, *bss_param;
3125
3126         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3127         if (!hdr)
3128                 return -1;
3129
3130         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3131             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3132             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3133                 goto nla_put_failure;
3134
3135         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3136         if (!sinfoattr)
3137                 goto nla_put_failure;
3138         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3139             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3140                         sinfo->connected_time))
3141                 goto nla_put_failure;
3142         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3143             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3144                         sinfo->inactive_time))
3145                 goto nla_put_failure;
3146         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3147                               STATION_INFO_RX_BYTES64)) &&
3148             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3149                         (u32)sinfo->rx_bytes))
3150                 goto nla_put_failure;
3151         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3152                               NL80211_STA_INFO_TX_BYTES64)) &&
3153             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3154                         (u32)sinfo->tx_bytes))
3155                 goto nla_put_failure;
3156         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3157             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3158                         sinfo->rx_bytes))
3159                 goto nla_put_failure;
3160         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3161             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3162                         sinfo->tx_bytes))
3163                 goto nla_put_failure;
3164         if ((sinfo->filled & STATION_INFO_LLID) &&
3165             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3166                 goto nla_put_failure;
3167         if ((sinfo->filled & STATION_INFO_PLID) &&
3168             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3169                 goto nla_put_failure;
3170         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3171             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3172                        sinfo->plink_state))
3173                 goto nla_put_failure;
3174         switch (rdev->wiphy.signal_type) {
3175         case CFG80211_SIGNAL_TYPE_MBM:
3176                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3177                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3178                                sinfo->signal))
3179                         goto nla_put_failure;
3180                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3181                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3182                                sinfo->signal_avg))
3183                         goto nla_put_failure;
3184                 break;
3185         default:
3186                 break;
3187         }
3188         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3189                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3190                                           NL80211_STA_INFO_TX_BITRATE))
3191                         goto nla_put_failure;
3192         }
3193         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3194                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3195                                           NL80211_STA_INFO_RX_BITRATE))
3196                         goto nla_put_failure;
3197         }
3198         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3199             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3200                         sinfo->rx_packets))
3201                 goto nla_put_failure;
3202         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3203             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3204                         sinfo->tx_packets))
3205                 goto nla_put_failure;
3206         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3207             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3208                         sinfo->tx_retries))
3209                 goto nla_put_failure;
3210         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3211             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3212                         sinfo->tx_failed))
3213                 goto nla_put_failure;
3214         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3215             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3216                         sinfo->beacon_loss_count))
3217                 goto nla_put_failure;
3218         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3219             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3220                         sinfo->local_pm))
3221                 goto nla_put_failure;
3222         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3223             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3224                         sinfo->peer_pm))
3225                 goto nla_put_failure;
3226         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3227             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3228                         sinfo->nonpeer_pm))
3229                 goto nla_put_failure;
3230         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3231                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3232                 if (!bss_param)
3233                         goto nla_put_failure;
3234
3235                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3236                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3237                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3238                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3239                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3240                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3241                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3242                                sinfo->bss_param.dtim_period) ||
3243                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3244                                 sinfo->bss_param.beacon_interval))
3245                         goto nla_put_failure;
3246
3247                 nla_nest_end(msg, bss_param);
3248         }
3249         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3250             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3251                     sizeof(struct nl80211_sta_flag_update),
3252                     &sinfo->sta_flags))
3253                 goto nla_put_failure;
3254         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3255                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3256                             sinfo->t_offset))
3257                 goto nla_put_failure;
3258         nla_nest_end(msg, sinfoattr);
3259
3260         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3261             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3262                     sinfo->assoc_req_ies))
3263                 goto nla_put_failure;
3264
3265         return genlmsg_end(msg, hdr);
3266
3267  nla_put_failure:
3268         genlmsg_cancel(msg, hdr);
3269         return -EMSGSIZE;
3270 }
3271
3272 static int nl80211_dump_station(struct sk_buff *skb,
3273                                 struct netlink_callback *cb)
3274 {
3275         struct station_info sinfo;
3276         struct cfg80211_registered_device *dev;
3277         struct net_device *netdev;
3278         u8 mac_addr[ETH_ALEN];
3279         int sta_idx = cb->args[1];
3280         int err;
3281
3282         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3283         if (err)
3284                 return err;
3285
3286         if (!dev->ops->dump_station) {
3287                 err = -EOPNOTSUPP;
3288                 goto out_err;
3289         }
3290
3291         while (1) {
3292                 memset(&sinfo, 0, sizeof(sinfo));
3293                 err = rdev_dump_station(dev, netdev, sta_idx,
3294                                         mac_addr, &sinfo);
3295                 if (err == -ENOENT)
3296                         break;
3297                 if (err)
3298                         goto out_err;
3299
3300                 if (nl80211_send_station(skb,
3301                                 NETLINK_CB(cb->skb).portid,
3302                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3303                                 dev, netdev, mac_addr,
3304                                 &sinfo) < 0)
3305                         goto out;
3306
3307                 sta_idx++;
3308         }
3309
3310
3311  out:
3312         cb->args[1] = sta_idx;
3313         err = skb->len;
3314  out_err:
3315         nl80211_finish_netdev_dump(dev);
3316
3317         return err;
3318 }
3319
3320 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3321 {
3322         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3323         struct net_device *dev = info->user_ptr[1];
3324         struct station_info sinfo;
3325         struct sk_buff *msg;
3326         u8 *mac_addr = NULL;
3327         int err;
3328
3329         memset(&sinfo, 0, sizeof(sinfo));
3330
3331         if (!info->attrs[NL80211_ATTR_MAC])
3332                 return -EINVAL;
3333
3334         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3335
3336         if (!rdev->ops->get_station)
3337                 return -EOPNOTSUPP;
3338
3339         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3340         if (err)
3341                 return err;
3342
3343         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3344         if (!msg)
3345                 return -ENOMEM;
3346
3347         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3348                                  rdev, dev, mac_addr, &sinfo) < 0) {
3349                 nlmsg_free(msg);
3350                 return -ENOBUFS;
3351         }
3352
3353         return genlmsg_reply(msg, info);
3354 }
3355
3356 /*
3357  * Get vlan interface making sure it is running and on the right wiphy.
3358  */
3359 static struct net_device *get_vlan(struct genl_info *info,
3360                                    struct cfg80211_registered_device *rdev)
3361 {
3362         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3363         struct net_device *v;
3364         int ret;
3365
3366         if (!vlanattr)
3367                 return NULL;
3368
3369         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3370         if (!v)
3371                 return ERR_PTR(-ENODEV);
3372
3373         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3374                 ret = -EINVAL;
3375                 goto error;
3376         }
3377
3378         if (!netif_running(v)) {
3379                 ret = -ENETDOWN;
3380                 goto error;
3381         }
3382
3383         return v;
3384  error:
3385         dev_put(v);
3386         return ERR_PTR(ret);
3387 }
3388
3389 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3390 {
3391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3392         int err;
3393         struct net_device *dev = info->user_ptr[1];
3394         struct station_parameters params;
3395         u8 *mac_addr = NULL;
3396
3397         memset(&params, 0, sizeof(params));
3398
3399         params.listen_interval = -1;
3400         params.plink_state = -1;
3401
3402         if (info->attrs[NL80211_ATTR_STA_AID])
3403                 return -EINVAL;
3404
3405         if (!info->attrs[NL80211_ATTR_MAC])
3406                 return -EINVAL;
3407
3408         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3409
3410         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3411                 params.supported_rates =
3412                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3413                 params.supported_rates_len =
3414                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3415         }
3416
3417         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
3418             info->attrs[NL80211_ATTR_HT_CAPABILITY])
3419                 return -EINVAL;
3420
3421         if (!rdev->ops->change_station)
3422                 return -EOPNOTSUPP;
3423
3424         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3425                 return -EINVAL;
3426
3427         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3428                 params.plink_action =
3429                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3430
3431         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3432                 params.plink_state =
3433                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3434
3435         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3436                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3437                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3438
3439                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3440                     pm > NL80211_MESH_POWER_MAX)
3441                         return -EINVAL;
3442
3443                 params.local_pm = pm;
3444         }
3445
3446         switch (dev->ieee80211_ptr->iftype) {
3447         case NL80211_IFTYPE_AP:
3448         case NL80211_IFTYPE_AP_VLAN:
3449         case NL80211_IFTYPE_P2P_GO:
3450                 /* disallow mesh-specific things */
3451                 if (params.plink_action)
3452                         return -EINVAL;
3453                 if (params.local_pm)
3454                         return -EINVAL;
3455
3456                 /* TDLS can't be set, ... */
3457                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3458                         return -EINVAL;
3459                 /*
3460                  * ... but don't bother the driver with it. This works around
3461                  * a hostapd/wpa_supplicant issue -- it always includes the
3462                  * TLDS_PEER flag in the mask even for AP mode.
3463                  */
3464                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3465
3466                 /* accept only the listed bits */
3467                 if (params.sta_flags_mask &
3468                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3469                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3470                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3471                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3472                                   BIT(NL80211_STA_FLAG_WME) |
3473                                   BIT(NL80211_STA_FLAG_MFP)))
3474                         return -EINVAL;
3475
3476                 /* but authenticated/associated only if driver handles it */
3477                 if (!(rdev->wiphy.features &
3478                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3479                     params.sta_flags_mask &
3480                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3481                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3482                         return -EINVAL;
3483
3484                 /* reject other things that can't change */
3485                 if (params.supported_rates)
3486                         return -EINVAL;
3487
3488                 /* must be last in here for error handling */
3489                 params.vlan = get_vlan(info, rdev);
3490                 if (IS_ERR(params.vlan))
3491                         return PTR_ERR(params.vlan);
3492                 break;
3493         case NL80211_IFTYPE_P2P_CLIENT:
3494         case NL80211_IFTYPE_STATION:
3495                 /*
3496                  * Don't allow userspace to change the TDLS_PEER flag,
3497                  * but silently ignore attempts to change it since we
3498                  * don't have state here to verify that it doesn't try
3499                  * to change the flag.
3500                  */
3501                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3502                 /* fall through */
3503         case NL80211_IFTYPE_ADHOC:
3504                 /* disallow things sta doesn't support */
3505                 if (params.plink_action)
3506                         return -EINVAL;
3507                 if (params.local_pm)
3508                         return -EINVAL;
3509                 /* reject any changes other than AUTHORIZED */
3510                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3511                         return -EINVAL;
3512                 break;
3513         case NL80211_IFTYPE_MESH_POINT:
3514                 /* disallow things mesh doesn't support */
3515                 if (params.vlan)
3516                         return -EINVAL;
3517                 if (params.supported_rates)
3518                         return -EINVAL;
3519                 /*
3520                  * No special handling for TDLS here -- the userspace
3521                  * mesh code doesn't have this bug.
3522                  */
3523                 if (params.sta_flags_mask &
3524                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3525                                   BIT(NL80211_STA_FLAG_MFP) |
3526                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3527                         return -EINVAL;
3528                 break;
3529         default:
3530                 return -EOPNOTSUPP;
3531         }
3532
3533         /* be aware of params.vlan when changing code here */
3534
3535         err = rdev_change_station(rdev, dev, mac_addr, &params);
3536
3537         if (params.vlan)
3538                 dev_put(params.vlan);
3539
3540         return err;
3541 }
3542
3543 static struct nla_policy
3544 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3545         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3546         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3547 };
3548
3549 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3550 {
3551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3552         int err;
3553         struct net_device *dev = info->user_ptr[1];
3554         struct station_parameters params;
3555         u8 *mac_addr = NULL;
3556
3557         memset(&params, 0, sizeof(params));
3558
3559         if (!info->attrs[NL80211_ATTR_MAC])
3560                 return -EINVAL;
3561
3562         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3563                 return -EINVAL;
3564
3565         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3566                 return -EINVAL;
3567
3568         if (!info->attrs[NL80211_ATTR_STA_AID])
3569                 return -EINVAL;
3570
3571         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3572         params.supported_rates =
3573                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3574         params.supported_rates_len =
3575                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3576         params.listen_interval =
3577                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3578
3579         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3580         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3581                 return -EINVAL;
3582
3583         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3584                 params.ht_capa =
3585                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3586
3587         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3588                 params.vht_capa =
3589                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3590
3591         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3592                 params.plink_action =
3593                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3594
3595         if (!rdev->ops->add_station)
3596                 return -EOPNOTSUPP;
3597
3598         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3599                 return -EINVAL;
3600
3601         switch (dev->ieee80211_ptr->iftype) {
3602         case NL80211_IFTYPE_AP:
3603         case NL80211_IFTYPE_AP_VLAN:
3604         case NL80211_IFTYPE_P2P_GO:
3605                 /* parse WME attributes if sta is WME capable */
3606                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3607                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3608                     info->attrs[NL80211_ATTR_STA_WME]) {
3609                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3610                         struct nlattr *nla;
3611
3612                         nla = info->attrs[NL80211_ATTR_STA_WME];
3613                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3614                                                nl80211_sta_wme_policy);
3615                         if (err)
3616                                 return err;
3617
3618                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3619                                 params.uapsd_queues =
3620                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3621                         if (params.uapsd_queues &
3622                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3623                                 return -EINVAL;
3624
3625                         if (tb[NL80211_STA_WME_MAX_SP])
3626                                 params.max_sp =
3627                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3628
3629                         if (params.max_sp &
3630                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3631                                 return -EINVAL;
3632
3633                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3634                 }
3635                 /* TDLS peers cannot be added */
3636                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3637                         return -EINVAL;
3638                 /* but don't bother the driver with it */
3639                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3640
3641                 /* allow authenticated/associated only if driver handles it */
3642                 if (!(rdev->wiphy.features &
3643                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3644                     params.sta_flags_mask &
3645                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3646                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3647                         return -EINVAL;
3648
3649                 /* must be last in here for error handling */
3650                 params.vlan = get_vlan(info, rdev);
3651                 if (IS_ERR(params.vlan))
3652                         return PTR_ERR(params.vlan);
3653                 break;
3654         case NL80211_IFTYPE_MESH_POINT:
3655                 /* associated is disallowed */
3656                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3657                         return -EINVAL;
3658                 /* TDLS peers cannot be added */
3659                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3660                         return -EINVAL;
3661                 break;
3662         case NL80211_IFTYPE_STATION:
3663                 /* associated is disallowed */
3664                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3665                         return -EINVAL;
3666                 /* Only TDLS peers can be added */
3667                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3668                         return -EINVAL;
3669                 /* Can only add if TDLS ... */
3670                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3671                         return -EOPNOTSUPP;
3672                 /* ... with external setup is supported */
3673                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3674                         return -EOPNOTSUPP;
3675                 break;
3676         default:
3677                 return -EOPNOTSUPP;
3678         }
3679
3680         /* be aware of params.vlan when changing code here */
3681
3682         err = rdev_add_station(rdev, dev, mac_addr, &params);
3683
3684         if (params.vlan)
3685                 dev_put(params.vlan);
3686         return err;
3687 }
3688
3689 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3690 {
3691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3692         struct net_device *dev = info->user_ptr[1];
3693         u8 *mac_addr = NULL;
3694
3695         if (info->attrs[NL80211_ATTR_MAC])
3696                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3697
3698         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3699             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3700             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3701             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3702                 return -EINVAL;
3703
3704         if (!rdev->ops->del_station)
3705                 return -EOPNOTSUPP;
3706
3707         return rdev_del_station(rdev, dev, mac_addr);
3708 }
3709
3710 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3711                                 int flags, struct net_device *dev,
3712                                 u8 *dst, u8 *next_hop,
3713                                 struct mpath_info *pinfo)
3714 {
3715         void *hdr;
3716         struct nlattr *pinfoattr;
3717
3718         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3719         if (!hdr)
3720                 return -1;
3721
3722         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3723             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3724             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3725             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3726                 goto nla_put_failure;
3727
3728         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3729         if (!pinfoattr)
3730                 goto nla_put_failure;
3731         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3732             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3733                         pinfo->frame_qlen))
3734                 goto nla_put_failure;
3735         if (((pinfo->filled & MPATH_INFO_SN) &&
3736              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3737             ((pinfo->filled & MPATH_INFO_METRIC) &&
3738              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3739                          pinfo->metric)) ||
3740             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3741              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3742                          pinfo->exptime)) ||
3743             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3744              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3745                         pinfo->flags)) ||
3746             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3747              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3748                          pinfo->discovery_timeout)) ||
3749             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3750              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3751                         pinfo->discovery_retries)))
3752                 goto nla_put_failure;
3753
3754         nla_nest_end(msg, pinfoattr);
3755
3756         return genlmsg_end(msg, hdr);
3757
3758  nla_put_failure:
3759         genlmsg_cancel(msg, hdr);
3760         return -EMSGSIZE;
3761 }
3762
3763 static int nl80211_dump_mpath(struct sk_buff *skb,
3764                               struct netlink_callback *cb)
3765 {
3766         struct mpath_info pinfo;
3767         struct cfg80211_registered_device *dev;
3768         struct net_device *netdev;
3769         u8 dst[ETH_ALEN];
3770         u8 next_hop[ETH_ALEN];
3771         int path_idx = cb->args[1];
3772         int err;
3773
3774         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3775         if (err)
3776                 return err;
3777
3778         if (!dev->ops->dump_mpath) {
3779                 err = -EOPNOTSUPP;
3780                 goto out_err;
3781         }
3782
3783         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3784                 err = -EOPNOTSUPP;
3785                 goto out_err;
3786         }
3787
3788         while (1) {
3789                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3790                                       &pinfo);
3791                 if (err == -ENOENT)
3792                         break;
3793                 if (err)
3794                         goto out_err;
3795
3796                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3797                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3798                                        netdev, dst, next_hop,
3799                                        &pinfo) < 0)
3800                         goto out;
3801
3802                 path_idx++;
3803         }
3804
3805
3806  out:
3807         cb->args[1] = path_idx;
3808         err = skb->len;
3809  out_err:
3810         nl80211_finish_netdev_dump(dev);
3811         return err;
3812 }
3813
3814 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3815 {
3816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3817         int err;
3818         struct net_device *dev = info->user_ptr[1];
3819         struct mpath_info pinfo;
3820         struct sk_buff *msg;
3821         u8 *dst = NULL;
3822         u8 next_hop[ETH_ALEN];
3823
3824         memset(&pinfo, 0, sizeof(pinfo));
3825
3826         if (!info->attrs[NL80211_ATTR_MAC])
3827                 return -EINVAL;
3828
3829         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3830
3831         if (!rdev->ops->get_mpath)
3832                 return -EOPNOTSUPP;
3833
3834         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3835                 return -EOPNOTSUPP;
3836
3837         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3838         if (err)
3839                 return err;
3840
3841         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3842         if (!msg)
3843                 return -ENOMEM;
3844
3845         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3846                                  dev, dst, next_hop, &pinfo) < 0) {
3847                 nlmsg_free(msg);
3848                 return -ENOBUFS;
3849         }
3850
3851         return genlmsg_reply(msg, info);
3852 }
3853
3854 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3855 {
3856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3857         struct net_device *dev = info->user_ptr[1];
3858         u8 *dst = NULL;
3859         u8 *next_hop = NULL;
3860
3861         if (!info->attrs[NL80211_ATTR_MAC])
3862                 return -EINVAL;
3863
3864         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3865                 return -EINVAL;
3866
3867         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3868         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3869
3870         if (!rdev->ops->change_mpath)
3871                 return -EOPNOTSUPP;
3872
3873         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3874                 return -EOPNOTSUPP;
3875
3876         return rdev_change_mpath(rdev, dev, dst, next_hop);
3877 }
3878
3879 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3880 {
3881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3882         struct net_device *dev = info->user_ptr[1];
3883         u8 *dst = NULL;
3884         u8 *next_hop = NULL;
3885
3886         if (!info->attrs[NL80211_ATTR_MAC])
3887                 return -EINVAL;
3888
3889         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3890                 return -EINVAL;
3891
3892         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3893         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3894
3895         if (!rdev->ops->add_mpath)
3896                 return -EOPNOTSUPP;
3897
3898         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3899                 return -EOPNOTSUPP;
3900
3901         return rdev_add_mpath(rdev, dev, dst, next_hop);
3902 }
3903
3904 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3905 {
3906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3907         struct net_device *dev = info->user_ptr[1];
3908         u8 *dst = NULL;
3909
3910         if (info->attrs[NL80211_ATTR_MAC])
3911                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3912
3913         if (!rdev->ops->del_mpath)
3914                 return -EOPNOTSUPP;
3915
3916         return rdev_del_mpath(rdev, dev, dst);
3917 }
3918
3919 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3920 {
3921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3922         struct net_device *dev = info->user_ptr[1];
3923         struct bss_parameters params;
3924
3925         memset(&params, 0, sizeof(params));
3926         /* default to not changing parameters */
3927         params.use_cts_prot = -1;
3928         params.use_short_preamble = -1;
3929         params.use_short_slot_time = -1;
3930         params.ap_isolate = -1;
3931         params.ht_opmode = -1;
3932         params.p2p_ctwindow = -1;
3933         params.p2p_opp_ps = -1;
3934
3935         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3936                 params.use_cts_prot =
3937                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3938         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3939                 params.use_short_preamble =
3940                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3941         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3942                 params.use_short_slot_time =
3943                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3944         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3945                 params.basic_rates =
3946                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3947                 params.basic_rates_len =
3948                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3949         }
3950         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3951                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3952         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3953                 params.ht_opmode =
3954                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3955
3956         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3957                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3958                         return -EINVAL;
3959                 params.p2p_ctwindow =
3960                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3961                 if (params.p2p_ctwindow < 0)
3962                         return -EINVAL;
3963                 if (params.p2p_ctwindow != 0 &&
3964                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3965                         return -EINVAL;
3966         }
3967
3968         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3969                 u8 tmp;
3970
3971                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3972                         return -EINVAL;
3973                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3974                 if (tmp > 1)
3975                         return -EINVAL;
3976                 params.p2p_opp_ps = tmp;
3977                 if (params.p2p_opp_ps &&
3978                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3979                         return -EINVAL;
3980         }
3981
3982         if (!rdev->ops->change_bss)
3983                 return -EOPNOTSUPP;
3984
3985         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3986             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3987                 return -EOPNOTSUPP;
3988
3989         return rdev_change_bss(rdev, dev, &params);
3990 }
3991
3992 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3993         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3994         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3995         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3996         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3997         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3998         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3999 };
4000
4001 static int parse_reg_rule(struct nlattr *tb[],
4002         struct ieee80211_reg_rule *reg_rule)
4003 {
4004         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4005         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4006
4007         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4008                 return -EINVAL;
4009         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4010                 return -EINVAL;
4011         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4012                 return -EINVAL;
4013         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4014                 return -EINVAL;
4015         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4016                 return -EINVAL;
4017
4018         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4019
4020         freq_range->start_freq_khz =
4021                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4022         freq_range->end_freq_khz =
4023                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4024         freq_range->max_bandwidth_khz =
4025                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4026
4027         power_rule->max_eirp =
4028                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4029
4030         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4031                 power_rule->max_antenna_gain =
4032                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4033
4034         return 0;
4035 }
4036
4037 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4038 {
4039         int r;
4040         char *data = NULL;
4041         enum nl80211_user_reg_hint_type user_reg_hint_type;
4042
4043         /*
4044          * You should only get this when cfg80211 hasn't yet initialized
4045          * completely when built-in to the kernel right between the time
4046          * window between nl80211_init() and regulatory_init(), if that is
4047          * even possible.
4048          */
4049         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4050                 return -EINPROGRESS;
4051
4052         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4053                 return -EINVAL;
4054
4055         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4056
4057         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4058                 user_reg_hint_type =
4059                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4060         else
4061                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4062
4063         switch (user_reg_hint_type) {
4064         case NL80211_USER_REG_HINT_USER:
4065         case NL80211_USER_REG_HINT_CELL_BASE:
4066                 break;
4067         default:
4068                 return -EINVAL;
4069         }
4070
4071         r = regulatory_hint_user(data, user_reg_hint_type);
4072
4073         return r;
4074 }
4075
4076 static int nl80211_get_mesh_config(struct sk_buff *skb,
4077                                    struct genl_info *info)
4078 {
4079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4080         struct net_device *dev = info->user_ptr[1];
4081         struct wireless_dev *wdev = dev->ieee80211_ptr;
4082         struct mesh_config cur_params;
4083         int err = 0;
4084         void *hdr;
4085         struct nlattr *pinfoattr;
4086         struct sk_buff *msg;
4087
4088         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4089                 return -EOPNOTSUPP;
4090
4091         if (!rdev->ops->get_mesh_config)
4092                 return -EOPNOTSUPP;
4093
4094         wdev_lock(wdev);
4095         /* If not connected, get default parameters */
4096         if (!wdev->mesh_id_len)
4097                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4098         else
4099                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4100         wdev_unlock(wdev);
4101
4102         if (err)
4103                 return err;
4104
4105         /* Draw up a netlink message to send back */
4106         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4107         if (!msg)
4108                 return -ENOMEM;
4109         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4110                              NL80211_CMD_GET_MESH_CONFIG);
4111         if (!hdr)
4112                 goto out;
4113         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4114         if (!pinfoattr)
4115                 goto nla_put_failure;
4116         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4117             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4118                         cur_params.dot11MeshRetryTimeout) ||
4119             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4120                         cur_params.dot11MeshConfirmTimeout) ||
4121             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4122                         cur_params.dot11MeshHoldingTimeout) ||
4123             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4124                         cur_params.dot11MeshMaxPeerLinks) ||
4125             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4126                        cur_params.dot11MeshMaxRetries) ||
4127             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4128                        cur_params.dot11MeshTTL) ||
4129             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4130                        cur_params.element_ttl) ||
4131             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4132                        cur_params.auto_open_plinks) ||
4133             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4134                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4135             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4136                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4137             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4138                         cur_params.path_refresh_time) ||
4139             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4140                         cur_params.min_discovery_timeout) ||
4141             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4142                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4143             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4144                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4145             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4146                         cur_params.dot11MeshHWMPperrMinInterval) ||
4147             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4148                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4149             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4150                        cur_params.dot11MeshHWMPRootMode) ||
4151             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4152                         cur_params.dot11MeshHWMPRannInterval) ||
4153             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4154                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4155             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4156                        cur_params.dot11MeshForwarding) ||
4157             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4158                         cur_params.rssi_threshold) ||
4159             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4160                         cur_params.ht_opmode) ||
4161             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4162                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4163             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4164                         cur_params.dot11MeshHWMProotInterval) ||
4165             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4166                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4167             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4168                         cur_params.power_mode) ||
4169             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4170                         cur_params.dot11MeshAwakeWindowDuration))
4171                 goto nla_put_failure;
4172         nla_nest_end(msg, pinfoattr);
4173         genlmsg_end(msg, hdr);
4174         return genlmsg_reply(msg, info);
4175
4176  nla_put_failure:
4177         genlmsg_cancel(msg, hdr);
4178  out:
4179         nlmsg_free(msg);
4180         return -ENOBUFS;
4181 }
4182
4183 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4184         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4185         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4186         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4187         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4188         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4189         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4190         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4191         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4192         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4193         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4194         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4195         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4196         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4197         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4198         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4199         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4200         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4201         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4202         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4203         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4204         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4205         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4206         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4207         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4208         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4209         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4210         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4211 };
4212
4213 static const struct nla_policy
4214         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4215         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4216         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4217         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4218         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4219         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4220                                     .len = IEEE80211_MAX_DATA_LEN },
4221         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4222 };
4223
4224 static int nl80211_parse_mesh_config(struct genl_info *info,
4225                                      struct mesh_config *cfg,
4226                                      u32 *mask_out)
4227 {
4228         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4229         u32 mask = 0;
4230
4231 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4232 do {                                                                        \
4233         if (tb[attr]) {                                                     \
4234                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4235                         return -EINVAL;                                     \
4236                 cfg->param = fn(tb[attr]);                                  \
4237                 mask |= (1 << (attr - 1));                                  \
4238         }                                                                   \
4239 } while (0)
4240
4241
4242         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4243                 return -EINVAL;
4244         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4245                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4246                              nl80211_meshconf_params_policy))
4247                 return -EINVAL;
4248
4249         /* This makes sure that there aren't more than 32 mesh config
4250          * parameters (otherwise our bitfield scheme would not work.) */
4251         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4252
4253         /* Fill in the params struct */
4254         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4255                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4256                                   nla_get_u16);
4257         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4258                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4259                                   nla_get_u16);
4260         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4261                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4262                                   nla_get_u16);
4263         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4264                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4265                                   nla_get_u16);
4266         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4267                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4268                                   nla_get_u8);
4269         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4270                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4271         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4272                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4273                                   nla_get_u8);
4274         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4275                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4276                                   nla_get_u8);
4277         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4278                                   1, 255, mask,
4279                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4280                                   nla_get_u32);
4281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4282                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4283                                   nla_get_u8);
4284         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4285                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4286                                   nla_get_u32);
4287         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4288                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4289                                   nla_get_u16);
4290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4291                                   1, 65535, mask,
4292                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4293                                   nla_get_u32);
4294         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4295                                   1, 65535, mask,
4296                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4297                                   nla_get_u16);
4298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4299                                   1, 65535, mask,
4300                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4301                                   nla_get_u16);
4302         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4303                                   dot11MeshHWMPnetDiameterTraversalTime,
4304                                   1, 65535, mask,
4305                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4306                                   nla_get_u16);
4307         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4308                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4309                                   nla_get_u8);
4310         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4311                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4312                                   nla_get_u16);
4313         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4314                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4315                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4316                                   nla_get_u8);
4317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4318                                   mask, NL80211_MESHCONF_FORWARDING,
4319                                   nla_get_u8);
4320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4321                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4322                                   nla_get_u32);
4323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4324                                   mask, NL80211_MESHCONF_HT_OPMODE,
4325                                   nla_get_u16);
4326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4327                                   1, 65535, mask,
4328                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4329                                   nla_get_u32);
4330         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4331                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4332                                   nla_get_u16);
4333         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4334                                   dot11MeshHWMPconfirmationInterval,
4335                                   1, 65535, mask,
4336                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4337                                   nla_get_u16);
4338         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4339                                   NL80211_MESH_POWER_ACTIVE,
4340                                   NL80211_MESH_POWER_MAX,
4341                                   mask, NL80211_MESHCONF_POWER_MODE,
4342                                   nla_get_u32);
4343         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4344                                   0, 65535, mask,
4345                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4346         if (mask_out)
4347                 *mask_out = mask;
4348
4349         return 0;
4350
4351 #undef FILL_IN_MESH_PARAM_IF_SET
4352 }
4353
4354 static int nl80211_parse_mesh_setup(struct genl_info *info,
4355                                      struct mesh_setup *setup)
4356 {
4357         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4358
4359         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4360                 return -EINVAL;
4361         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4362                              info->attrs[NL80211_ATTR_MESH_SETUP],
4363                              nl80211_mesh_setup_params_policy))
4364                 return -EINVAL;
4365
4366         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4367                 setup->sync_method =
4368                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4369                  IEEE80211_SYNC_METHOD_VENDOR :
4370                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4371
4372         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4373                 setup->path_sel_proto =
4374                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4375                  IEEE80211_PATH_PROTOCOL_VENDOR :
4376                  IEEE80211_PATH_PROTOCOL_HWMP;
4377
4378         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4379                 setup->path_metric =
4380                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4381                  IEEE80211_PATH_METRIC_VENDOR :
4382                  IEEE80211_PATH_METRIC_AIRTIME;
4383
4384
4385         if (tb[NL80211_MESH_SETUP_IE]) {
4386                 struct nlattr *ieattr =
4387                         tb[NL80211_MESH_SETUP_IE];
4388                 if (!is_valid_ie_attr(ieattr))
4389                         return -EINVAL;
4390                 setup->ie = nla_data(ieattr);
4391                 setup->ie_len = nla_len(ieattr);
4392         }
4393         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4394         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4395
4396         return 0;
4397 }
4398
4399 static int nl80211_update_mesh_config(struct sk_buff *skb,
4400                                       struct genl_info *info)
4401 {
4402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4403         struct net_device *dev = info->user_ptr[1];
4404         struct wireless_dev *wdev = dev->ieee80211_ptr;
4405         struct mesh_config cfg;
4406         u32 mask;
4407         int err;
4408
4409         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4410                 return -EOPNOTSUPP;
4411
4412         if (!rdev->ops->update_mesh_config)
4413                 return -EOPNOTSUPP;
4414
4415         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4416         if (err)
4417                 return err;
4418
4419         wdev_lock(wdev);
4420         if (!wdev->mesh_id_len)
4421                 err = -ENOLINK;
4422
4423         if (!err)
4424                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4425
4426         wdev_unlock(wdev);
4427
4428         return err;
4429 }
4430
4431 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4432 {
4433         const struct ieee80211_regdomain *regdom;
4434         struct sk_buff *msg;
4435         void *hdr = NULL;
4436         struct nlattr *nl_reg_rules;
4437         unsigned int i;
4438         int err = -EINVAL;
4439
4440         mutex_lock(&cfg80211_mutex);
4441
4442         if (!cfg80211_regdomain)
4443                 goto out;
4444
4445         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4446         if (!msg) {
4447                 err = -ENOBUFS;
4448                 goto out;
4449         }
4450
4451         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4452                              NL80211_CMD_GET_REG);
4453         if (!hdr)
4454                 goto put_failure;
4455
4456         if (reg_last_request_cell_base() &&
4457             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4458                         NL80211_USER_REG_HINT_CELL_BASE))
4459                 goto nla_put_failure;
4460
4461         rcu_read_lock();
4462         regdom = rcu_dereference(cfg80211_regdomain);
4463
4464         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4465             (regdom->dfs_region &&
4466              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4467                 goto nla_put_failure_rcu;
4468
4469         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4470         if (!nl_reg_rules)
4471                 goto nla_put_failure_rcu;
4472
4473         for (i = 0; i < regdom->n_reg_rules; i++) {
4474                 struct nlattr *nl_reg_rule;
4475                 const struct ieee80211_reg_rule *reg_rule;
4476                 const struct ieee80211_freq_range *freq_range;
4477                 const struct ieee80211_power_rule *power_rule;
4478
4479                 reg_rule = &regdom->reg_rules[i];
4480                 freq_range = &reg_rule->freq_range;
4481                 power_rule = &reg_rule->power_rule;
4482
4483                 nl_reg_rule = nla_nest_start(msg, i);
4484                 if (!nl_reg_rule)
4485                         goto nla_put_failure_rcu;
4486
4487                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4488                                 reg_rule->flags) ||
4489                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4490                                 freq_range->start_freq_khz) ||
4491                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4492                                 freq_range->end_freq_khz) ||
4493                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4494                                 freq_range->max_bandwidth_khz) ||
4495                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4496                                 power_rule->max_antenna_gain) ||
4497                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4498                                 power_rule->max_eirp))
4499                         goto nla_put_failure_rcu;
4500
4501                 nla_nest_end(msg, nl_reg_rule);
4502         }
4503         rcu_read_unlock();
4504
4505         nla_nest_end(msg, nl_reg_rules);
4506
4507         genlmsg_end(msg, hdr);
4508         err = genlmsg_reply(msg, info);
4509         goto out;
4510
4511 nla_put_failure_rcu:
4512         rcu_read_unlock();
4513 nla_put_failure:
4514         genlmsg_cancel(msg, hdr);
4515 put_failure:
4516         nlmsg_free(msg);
4517         err = -EMSGSIZE;
4518 out:
4519         mutex_unlock(&cfg80211_mutex);
4520         return err;
4521 }
4522
4523 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4524 {
4525         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4526         struct nlattr *nl_reg_rule;
4527         char *alpha2 = NULL;
4528         int rem_reg_rules = 0, r = 0;
4529         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4530         u8 dfs_region = 0;
4531         struct ieee80211_regdomain *rd = NULL;
4532
4533         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4534                 return -EINVAL;
4535
4536         if (!info->attrs[NL80211_ATTR_REG_RULES])
4537                 return -EINVAL;
4538
4539         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4540
4541         if (info->attrs[NL80211_ATTR_DFS_REGION])
4542                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4543
4544         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4545                             rem_reg_rules) {
4546                 num_rules++;
4547                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4548                         return -EINVAL;
4549         }
4550
4551         size_of_regd = sizeof(struct ieee80211_regdomain) +
4552                        num_rules * sizeof(struct ieee80211_reg_rule);
4553
4554         rd = kzalloc(size_of_regd, GFP_KERNEL);
4555         if (!rd)
4556                 return -ENOMEM;
4557
4558         rd->n_reg_rules = num_rules;
4559         rd->alpha2[0] = alpha2[0];
4560         rd->alpha2[1] = alpha2[1];
4561
4562         /*
4563          * Disable DFS master mode if the DFS region was
4564          * not supported or known on this kernel.
4565          */
4566         if (reg_supported_dfs_region(dfs_region))
4567                 rd->dfs_region = dfs_region;
4568
4569         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4570                             rem_reg_rules) {
4571                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4572                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4573                           reg_rule_policy);
4574                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4575                 if (r)
4576                         goto bad_reg;
4577
4578                 rule_idx++;
4579
4580                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4581                         r = -EINVAL;
4582                         goto bad_reg;
4583                 }
4584         }
4585
4586         mutex_lock(&cfg80211_mutex);
4587
4588         r = set_regdom(rd);
4589         /* set_regdom took ownership */
4590         rd = NULL;
4591         mutex_unlock(&cfg80211_mutex);
4592
4593  bad_reg:
4594         kfree(rd);
4595         return r;
4596 }
4597
4598 static int validate_scan_freqs(struct nlattr *freqs)
4599 {
4600         struct nlattr *attr1, *attr2;
4601         int n_channels = 0, tmp1, tmp2;
4602
4603         nla_for_each_nested(attr1, freqs, tmp1) {
4604                 n_channels++;
4605                 /*
4606                  * Some hardware has a limited channel list for
4607                  * scanning, and it is pretty much nonsensical
4608                  * to scan for a channel twice, so disallow that
4609                  * and don't require drivers to check that the
4610                  * channel list they get isn't longer than what
4611                  * they can scan, as long as they can scan all
4612                  * the channels they registered at once.
4613                  */
4614                 nla_for_each_nested(attr2, freqs, tmp2)
4615                         if (attr1 != attr2 &&
4616                             nla_get_u32(attr1) == nla_get_u32(attr2))
4617                                 return 0;
4618         }
4619
4620         return n_channels;
4621 }
4622
4623 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4624 {
4625         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4626         struct wireless_dev *wdev = info->user_ptr[1];
4627         struct cfg80211_scan_request *request;
4628         struct nlattr *attr;
4629         struct wiphy *wiphy;
4630         int err, tmp, n_ssids = 0, n_channels, i;
4631         size_t ie_len;
4632
4633         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4634                 return -EINVAL;
4635
4636         wiphy = &rdev->wiphy;
4637
4638         if (!rdev->ops->scan)
4639                 return -EOPNOTSUPP;
4640
4641         if (rdev->scan_req)
4642                 return -EBUSY;
4643
4644         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4645                 n_channels = validate_scan_freqs(
4646                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4647                 if (!n_channels)
4648                         return -EINVAL;
4649         } else {
4650                 enum ieee80211_band band;
4651                 n_channels = 0;
4652
4653                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4654                         if (wiphy->bands[band])
4655                                 n_channels += wiphy->bands[band]->n_channels;
4656         }
4657
4658         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4659                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4660                         n_ssids++;
4661
4662         if (n_ssids > wiphy->max_scan_ssids)
4663                 return -EINVAL;
4664
4665         if (info->attrs[NL80211_ATTR_IE])
4666                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4667         else
4668                 ie_len = 0;
4669
4670         if (ie_len > wiphy->max_scan_ie_len)
4671                 return -EINVAL;
4672
4673         request = kzalloc(sizeof(*request)
4674                         + sizeof(*request->ssids) * n_ssids
4675                         + sizeof(*request->channels) * n_channels
4676                         + ie_len, GFP_KERNEL);
4677         if (!request)
4678                 return -ENOMEM;
4679
4680         if (n_ssids)
4681                 request->ssids = (void *)&request->channels[n_channels];
4682         request->n_ssids = n_ssids;
4683         if (ie_len) {
4684                 if (request->ssids)
4685                         request->ie = (void *)(request->ssids + n_ssids);
4686                 else
4687                         request->ie = (void *)(request->channels + n_channels);
4688         }
4689
4690         i = 0;
4691         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4692                 /* user specified, bail out if channel not found */
4693                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4694                         struct ieee80211_channel *chan;
4695
4696                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4697
4698                         if (!chan) {
4699                                 err = -EINVAL;
4700                                 goto out_free;
4701                         }
4702
4703                         /* ignore disabled channels */
4704                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4705                                 continue;
4706
4707                         request->channels[i] = chan;
4708                         i++;
4709                 }
4710         } else {
4711                 enum ieee80211_band band;
4712
4713                 /* all channels */
4714                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4715                         int j;
4716                         if (!wiphy->bands[band])
4717                                 continue;
4718                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4719                                 struct ieee80211_channel *chan;
4720
4721                                 chan = &wiphy->bands[band]->channels[j];
4722
4723                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4724                                         continue;
4725
4726                                 request->channels[i] = chan;
4727                                 i++;
4728                         }
4729                 }
4730         }
4731
4732         if (!i) {
4733                 err = -EINVAL;
4734                 goto out_free;
4735         }
4736
4737         request->n_channels = i;
4738
4739         i = 0;
4740         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4741                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4742                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4743                                 err = -EINVAL;
4744                                 goto out_free;
4745                         }
4746                         request->ssids[i].ssid_len = nla_len(attr);
4747                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4748                         i++;
4749                 }
4750         }
4751
4752         if (info->attrs[NL80211_ATTR_IE]) {
4753                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4754                 memcpy((void *)request->ie,
4755                        nla_data(info->attrs[NL80211_ATTR_IE]),
4756                        request->ie_len);
4757         }
4758
4759         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4760                 if (wiphy->bands[i])
4761                         request->rates[i] =
4762                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4763
4764         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4765                 nla_for_each_nested(attr,
4766                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4767                                     tmp) {
4768                         enum ieee80211_band band = nla_type(attr);
4769
4770                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4771                                 err = -EINVAL;
4772                                 goto out_free;
4773                         }
4774                         err = ieee80211_get_ratemask(wiphy->bands[band],
4775                                                      nla_data(attr),
4776                                                      nla_len(attr),
4777                                                      &request->rates[band]);
4778                         if (err)
4779                                 goto out_free;
4780                 }
4781         }
4782
4783         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4784                 request->flags = nla_get_u32(
4785                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4786                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4787                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4788                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4789                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4790                         err = -EOPNOTSUPP;
4791                         goto out_free;
4792                 }
4793         }
4794
4795         request->no_cck =
4796                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4797
4798         request->wdev = wdev;
4799         request->wiphy = &rdev->wiphy;
4800         request->scan_start = jiffies;
4801
4802         rdev->scan_req = request;
4803         err = rdev_scan(rdev, request);
4804
4805         if (!err) {
4806                 nl80211_send_scan_start(rdev, wdev);
4807                 if (wdev->netdev)
4808                         dev_hold(wdev->netdev);
4809         } else {
4810  out_free:
4811                 rdev->scan_req = NULL;
4812                 kfree(request);
4813         }
4814
4815         return err;
4816 }
4817
4818 static int nl80211_start_sched_scan(struct sk_buff *skb,
4819                                     struct genl_info *info)
4820 {
4821         struct cfg80211_sched_scan_request *request;
4822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4823         struct net_device *dev = info->user_ptr[1];
4824         struct nlattr *attr;
4825         struct wiphy *wiphy;
4826         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4827         u32 interval;
4828         enum ieee80211_band band;
4829         size_t ie_len;
4830         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4831
4832         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4833             !rdev->ops->sched_scan_start)
4834                 return -EOPNOTSUPP;
4835
4836         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4837                 return -EINVAL;
4838
4839         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4840                 return -EINVAL;
4841
4842         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4843         if (interval == 0)
4844                 return -EINVAL;
4845
4846         wiphy = &rdev->wiphy;
4847
4848         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4849                 n_channels = validate_scan_freqs(
4850                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4851                 if (!n_channels)
4852                         return -EINVAL;
4853         } else {
4854                 n_channels = 0;
4855
4856                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4857                         if (wiphy->bands[band])
4858                                 n_channels += wiphy->bands[band]->n_channels;
4859         }
4860
4861         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4862                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4863                                     tmp)
4864                         n_ssids++;
4865
4866         if (n_ssids > wiphy->max_sched_scan_ssids)
4867                 return -EINVAL;
4868
4869         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4870                 nla_for_each_nested(attr,
4871                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4872                                     tmp)
4873                         n_match_sets++;
4874
4875         if (n_match_sets > wiphy->max_match_sets)
4876                 return -EINVAL;
4877
4878         if (info->attrs[NL80211_ATTR_IE])
4879                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4880         else
4881                 ie_len = 0;
4882
4883         if (ie_len > wiphy->max_sched_scan_ie_len)
4884                 return -EINVAL;
4885
4886         mutex_lock(&rdev->sched_scan_mtx);
4887
4888         if (rdev->sched_scan_req) {
4889                 err = -EINPROGRESS;
4890                 goto out;
4891         }
4892
4893         request = kzalloc(sizeof(*request)
4894                         + sizeof(*request->ssids) * n_ssids
4895                         + sizeof(*request->match_sets) * n_match_sets
4896                         + sizeof(*request->channels) * n_channels
4897                         + ie_len, GFP_KERNEL);
4898         if (!request) {
4899                 err = -ENOMEM;
4900                 goto out;
4901         }
4902
4903         if (n_ssids)
4904                 request->ssids = (void *)&request->channels[n_channels];
4905         request->n_ssids = n_ssids;
4906         if (ie_len) {
4907                 if (request->ssids)
4908                         request->ie = (void *)(request->ssids + n_ssids);
4909                 else
4910                         request->ie = (void *)(request->channels + n_channels);
4911         }
4912
4913         if (n_match_sets) {
4914                 if (request->ie)
4915                         request->match_sets = (void *)(request->ie + ie_len);
4916                 else if (request->ssids)
4917                         request->match_sets =
4918                                 (void *)(request->ssids + n_ssids);
4919                 else
4920                         request->match_sets =
4921                                 (void *)(request->channels + n_channels);
4922         }
4923         request->n_match_sets = n_match_sets;
4924
4925         i = 0;
4926         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4927                 /* user specified, bail out if channel not found */
4928                 nla_for_each_nested(attr,
4929                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4930                                     tmp) {
4931                         struct ieee80211_channel *chan;
4932
4933                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4934
4935                         if (!chan) {
4936                                 err = -EINVAL;
4937                                 goto out_free;
4938                         }
4939
4940                         /* ignore disabled channels */
4941                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4942                                 continue;
4943
4944                         request->channels[i] = chan;
4945                         i++;
4946                 }
4947         } else {
4948                 /* all channels */
4949                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4950                         int j;
4951                         if (!wiphy->bands[band])
4952                                 continue;
4953                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4954                                 struct ieee80211_channel *chan;
4955
4956                                 chan = &wiphy->bands[band]->channels[j];
4957
4958                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4959                                         continue;
4960
4961                                 request->channels[i] = chan;
4962                                 i++;
4963                         }
4964                 }
4965         }
4966
4967         if (!i) {
4968                 err = -EINVAL;
4969                 goto out_free;
4970         }
4971
4972         request->n_channels = i;
4973
4974         i = 0;
4975         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4976                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4977                                     tmp) {
4978                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4979                                 err = -EINVAL;
4980                                 goto out_free;
4981                         }
4982                         request->ssids[i].ssid_len = nla_len(attr);
4983                         memcpy(request->ssids[i].ssid, nla_data(attr),
4984                                nla_len(attr));
4985                         i++;
4986                 }
4987         }
4988
4989         i = 0;
4990         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4991                 nla_for_each_nested(attr,
4992                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4993                                     tmp) {
4994                         struct nlattr *ssid, *rssi;
4995
4996                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4997                                   nla_data(attr), nla_len(attr),
4998                                   nl80211_match_policy);
4999                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5000                         if (ssid) {
5001                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5002                                         err = -EINVAL;
5003                                         goto out_free;
5004                                 }
5005                                 memcpy(request->match_sets[i].ssid.ssid,
5006                                        nla_data(ssid), nla_len(ssid));
5007                                 request->match_sets[i].ssid.ssid_len =
5008                                         nla_len(ssid);
5009                         }
5010                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5011                         if (rssi)
5012                                 request->rssi_thold = nla_get_u32(rssi);
5013                         else
5014                                 request->rssi_thold =
5015                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5016                         i++;
5017                 }
5018         }
5019
5020         if (info->attrs[NL80211_ATTR_IE]) {
5021                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5022                 memcpy((void *)request->ie,
5023                        nla_data(info->attrs[NL80211_ATTR_IE]),
5024                        request->ie_len);
5025         }
5026
5027         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5028                 request->flags = nla_get_u32(
5029                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5030                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5031                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5032                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5033                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5034                         err = -EOPNOTSUPP;
5035                         goto out_free;
5036                 }
5037         }
5038
5039         request->dev = dev;
5040         request->wiphy = &rdev->wiphy;
5041         request->interval = interval;
5042         request->scan_start = jiffies;
5043
5044         err = rdev_sched_scan_start(rdev, dev, request);
5045         if (!err) {
5046                 rdev->sched_scan_req = request;
5047                 nl80211_send_sched_scan(rdev, dev,
5048                                         NL80211_CMD_START_SCHED_SCAN);
5049                 goto out;
5050         }
5051
5052 out_free:
5053         kfree(request);
5054 out:
5055         mutex_unlock(&rdev->sched_scan_mtx);
5056         return err;
5057 }
5058
5059 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5060                                    struct genl_info *info)
5061 {
5062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5063         int err;
5064
5065         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5066             !rdev->ops->sched_scan_stop)
5067                 return -EOPNOTSUPP;
5068
5069         mutex_lock(&rdev->sched_scan_mtx);
5070         err = __cfg80211_stop_sched_scan(rdev, false);
5071         mutex_unlock(&rdev->sched_scan_mtx);
5072
5073         return err;
5074 }
5075
5076 static int nl80211_start_radar_detection(struct sk_buff *skb,
5077                                          struct genl_info *info)
5078 {
5079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5080         struct net_device *dev = info->user_ptr[1];
5081         struct wireless_dev *wdev = dev->ieee80211_ptr;
5082         struct cfg80211_chan_def chandef;
5083         int err;
5084
5085         err = nl80211_parse_chandef(rdev, info, &chandef);
5086         if (err)
5087                 return err;
5088
5089         if (wdev->cac_started)
5090                 return -EBUSY;
5091
5092         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5093         if (err < 0)
5094                 return err;
5095
5096         if (err == 0)
5097                 return -EINVAL;
5098
5099         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5100                 return -EINVAL;
5101
5102         if (!rdev->ops->start_radar_detection)
5103                 return -EOPNOTSUPP;
5104
5105         mutex_lock(&rdev->devlist_mtx);
5106         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5107                                            chandef.chan, CHAN_MODE_SHARED,
5108                                            BIT(chandef.width));
5109         if (err)
5110                 goto err_locked;
5111
5112         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5113         if (!err) {
5114                 wdev->channel = chandef.chan;
5115                 wdev->cac_started = true;
5116                 wdev->cac_start_time = jiffies;
5117         }
5118 err_locked:
5119         mutex_unlock(&rdev->devlist_mtx);
5120
5121         return err;
5122 }
5123
5124 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5125                             u32 seq, int flags,
5126                             struct cfg80211_registered_device *rdev,
5127                             struct wireless_dev *wdev,
5128                             struct cfg80211_internal_bss *intbss)
5129 {
5130         struct cfg80211_bss *res = &intbss->pub;
5131         const struct cfg80211_bss_ies *ies;
5132         void *hdr;
5133         struct nlattr *bss;
5134         bool tsf = false;
5135
5136         ASSERT_WDEV_LOCK(wdev);
5137
5138         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5139                              NL80211_CMD_NEW_SCAN_RESULTS);
5140         if (!hdr)
5141                 return -1;
5142
5143         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5144
5145         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5146             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5147                 goto nla_put_failure;
5148
5149         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5150         if (!bss)
5151                 goto nla_put_failure;
5152         if ((!is_zero_ether_addr(res->bssid) &&
5153              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5154                 goto nla_put_failure;
5155
5156         rcu_read_lock();
5157         ies = rcu_dereference(res->ies);
5158         if (ies) {
5159                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5160                         goto fail_unlock_rcu;
5161                 tsf = true;
5162                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5163                                         ies->len, ies->data))
5164                         goto fail_unlock_rcu;
5165         }
5166         ies = rcu_dereference(res->beacon_ies);
5167         if (ies) {
5168                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5169                         goto fail_unlock_rcu;
5170                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5171                                         ies->len, ies->data))
5172                         goto fail_unlock_rcu;
5173         }
5174         rcu_read_unlock();
5175
5176         if (res->beacon_interval &&
5177             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5178                 goto nla_put_failure;
5179         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5180             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5181             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5182                         jiffies_to_msecs(jiffies - intbss->ts)))
5183                 goto nla_put_failure;
5184
5185         switch (rdev->wiphy.signal_type) {
5186         case CFG80211_SIGNAL_TYPE_MBM:
5187                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5188                         goto nla_put_failure;
5189                 break;
5190         case CFG80211_SIGNAL_TYPE_UNSPEC:
5191                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5192                         goto nla_put_failure;
5193                 break;
5194         default:
5195                 break;
5196         }
5197
5198         switch (wdev->iftype) {
5199         case NL80211_IFTYPE_P2P_CLIENT:
5200         case NL80211_IFTYPE_STATION:
5201                 if (intbss == wdev->current_bss &&
5202                     nla_put_u32(msg, NL80211_BSS_STATUS,
5203                                 NL80211_BSS_STATUS_ASSOCIATED))
5204                         goto nla_put_failure;
5205                 break;
5206         case NL80211_IFTYPE_ADHOC:
5207                 if (intbss == wdev->current_bss &&
5208                     nla_put_u32(msg, NL80211_BSS_STATUS,
5209                                 NL80211_BSS_STATUS_IBSS_JOINED))
5210                         goto nla_put_failure;
5211                 break;
5212         default:
5213                 break;
5214         }
5215
5216         nla_nest_end(msg, bss);
5217
5218         return genlmsg_end(msg, hdr);
5219
5220  fail_unlock_rcu:
5221         rcu_read_unlock();
5222  nla_put_failure:
5223         genlmsg_cancel(msg, hdr);
5224         return -EMSGSIZE;
5225 }
5226
5227 static int nl80211_dump_scan(struct sk_buff *skb,
5228                              struct netlink_callback *cb)
5229 {
5230         struct cfg80211_registered_device *rdev;
5231         struct net_device *dev;
5232         struct cfg80211_internal_bss *scan;
5233         struct wireless_dev *wdev;
5234         int start = cb->args[1], idx = 0;
5235         int err;
5236
5237         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5238         if (err)
5239                 return err;
5240
5241         wdev = dev->ieee80211_ptr;
5242
5243         wdev_lock(wdev);
5244         spin_lock_bh(&rdev->bss_lock);
5245         cfg80211_bss_expire(rdev);
5246
5247         cb->seq = rdev->bss_generation;
5248
5249         list_for_each_entry(scan, &rdev->bss_list, list) {
5250                 if (++idx <= start)
5251                         continue;
5252                 if (nl80211_send_bss(skb, cb,
5253                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5254                                 rdev, wdev, scan) < 0) {
5255                         idx--;
5256                         break;
5257                 }
5258         }
5259
5260         spin_unlock_bh(&rdev->bss_lock);
5261         wdev_unlock(wdev);
5262
5263         cb->args[1] = idx;
5264         nl80211_finish_netdev_dump(rdev);
5265
5266         return skb->len;
5267 }
5268
5269 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5270                                 int flags, struct net_device *dev,
5271                                 struct survey_info *survey)
5272 {
5273         void *hdr;
5274         struct nlattr *infoattr;
5275
5276         hdr = nl80211hdr_put(msg, portid, seq, flags,
5277                              NL80211_CMD_NEW_SURVEY_RESULTS);
5278         if (!hdr)
5279                 return -ENOMEM;
5280
5281         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5282                 goto nla_put_failure;
5283
5284         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5285         if (!infoattr)
5286                 goto nla_put_failure;
5287
5288         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5289                         survey->channel->center_freq))
5290                 goto nla_put_failure;
5291
5292         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5293             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5294                 goto nla_put_failure;
5295         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5296             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5297                 goto nla_put_failure;
5298         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5299             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5300                         survey->channel_time))
5301                 goto nla_put_failure;
5302         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5303             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5304                         survey->channel_time_busy))
5305                 goto nla_put_failure;
5306         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5307             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5308                         survey->channel_time_ext_busy))
5309                 goto nla_put_failure;
5310         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5311             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5312                         survey->channel_time_rx))
5313                 goto nla_put_failure;
5314         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5315             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5316                         survey->channel_time_tx))
5317                 goto nla_put_failure;
5318
5319         nla_nest_end(msg, infoattr);
5320
5321         return genlmsg_end(msg, hdr);
5322
5323  nla_put_failure:
5324         genlmsg_cancel(msg, hdr);
5325         return -EMSGSIZE;
5326 }
5327
5328 static int nl80211_dump_survey(struct sk_buff *skb,
5329                         struct netlink_callback *cb)
5330 {
5331         struct survey_info survey;
5332         struct cfg80211_registered_device *dev;
5333         struct net_device *netdev;
5334         int survey_idx = cb->args[1];
5335         int res;
5336
5337         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5338         if (res)
5339                 return res;
5340
5341         if (!dev->ops->dump_survey) {
5342                 res = -EOPNOTSUPP;
5343                 goto out_err;
5344         }
5345
5346         while (1) {
5347                 struct ieee80211_channel *chan;
5348
5349                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5350                 if (res == -ENOENT)
5351                         break;
5352                 if (res)
5353                         goto out_err;
5354
5355                 /* Survey without a channel doesn't make sense */
5356                 if (!survey.channel) {
5357                         res = -EINVAL;
5358                         goto out;
5359                 }
5360
5361                 chan = ieee80211_get_channel(&dev->wiphy,
5362                                              survey.channel->center_freq);
5363                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5364                         survey_idx++;
5365                         continue;
5366                 }
5367
5368                 if (nl80211_send_survey(skb,
5369                                 NETLINK_CB(cb->skb).portid,
5370                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5371                                 netdev,
5372                                 &survey) < 0)
5373                         goto out;
5374                 survey_idx++;
5375         }
5376
5377  out:
5378         cb->args[1] = survey_idx;
5379         res = skb->len;
5380  out_err:
5381         nl80211_finish_netdev_dump(dev);
5382         return res;
5383 }
5384
5385 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5386 {
5387         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5388                                   NL80211_WPA_VERSION_2));
5389 }
5390
5391 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5392 {
5393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5394         struct net_device *dev = info->user_ptr[1];
5395         struct ieee80211_channel *chan;
5396         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5397         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5398         enum nl80211_auth_type auth_type;
5399         struct key_parse key;
5400         bool local_state_change;
5401
5402         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5403                 return -EINVAL;
5404
5405         if (!info->attrs[NL80211_ATTR_MAC])
5406                 return -EINVAL;
5407
5408         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5409                 return -EINVAL;
5410
5411         if (!info->attrs[NL80211_ATTR_SSID])
5412                 return -EINVAL;
5413
5414         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5415                 return -EINVAL;
5416
5417         err = nl80211_parse_key(info, &key);
5418         if (err)
5419                 return err;
5420
5421         if (key.idx >= 0) {
5422                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5423                         return -EINVAL;
5424                 if (!key.p.key || !key.p.key_len)
5425                         return -EINVAL;
5426                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5427                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5428                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5429                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5430                         return -EINVAL;
5431                 if (key.idx > 4)
5432                         return -EINVAL;
5433         } else {
5434                 key.p.key_len = 0;
5435                 key.p.key = NULL;
5436         }
5437
5438         if (key.idx >= 0) {
5439                 int i;
5440                 bool ok = false;
5441                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5442                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5443                                 ok = true;
5444                                 break;
5445                         }
5446                 }
5447                 if (!ok)
5448                         return -EINVAL;
5449         }
5450
5451         if (!rdev->ops->auth)
5452                 return -EOPNOTSUPP;
5453
5454         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5455             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5456                 return -EOPNOTSUPP;
5457
5458         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5459         chan = ieee80211_get_channel(&rdev->wiphy,
5460                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5461         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5462                 return -EINVAL;
5463
5464         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5465         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5466
5467         if (info->attrs[NL80211_ATTR_IE]) {
5468                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5469                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5470         }
5471
5472         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5473         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5474                 return -EINVAL;
5475
5476         if (auth_type == NL80211_AUTHTYPE_SAE &&
5477             !info->attrs[NL80211_ATTR_SAE_DATA])
5478                 return -EINVAL;
5479
5480         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5481                 if (auth_type != NL80211_AUTHTYPE_SAE)
5482                         return -EINVAL;
5483                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5484                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5485                 /* need to include at least Auth Transaction and Status Code */
5486                 if (sae_data_len < 4)
5487                         return -EINVAL;
5488         }
5489
5490         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5491
5492         /*
5493          * Since we no longer track auth state, ignore
5494          * requests to only change local state.
5495          */
5496         if (local_state_change)
5497                 return 0;
5498
5499         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5500                                   ssid, ssid_len, ie, ie_len,
5501                                   key.p.key, key.p.key_len, key.idx,
5502                                   sae_data, sae_data_len);
5503 }
5504
5505 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5506                                    struct genl_info *info,
5507                                    struct cfg80211_crypto_settings *settings,
5508                                    int cipher_limit)
5509 {
5510         memset(settings, 0, sizeof(*settings));
5511
5512         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5513
5514         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5515                 u16 proto;
5516                 proto = nla_get_u16(
5517                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5518                 settings->control_port_ethertype = cpu_to_be16(proto);
5519                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5520                     proto != ETH_P_PAE)
5521                         return -EINVAL;
5522                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5523                         settings->control_port_no_encrypt = true;
5524         } else
5525                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5526
5527         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5528                 void *data;
5529                 int len, i;
5530
5531                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5532                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5533                 settings->n_ciphers_pairwise = len / sizeof(u32);
5534
5535                 if (len % sizeof(u32))
5536                         return -EINVAL;
5537
5538                 if (settings->n_ciphers_pairwise > cipher_limit)
5539                         return -EINVAL;
5540
5541                 memcpy(settings->ciphers_pairwise, data, len);
5542
5543                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5544                         if (!cfg80211_supported_cipher_suite(
5545                                         &rdev->wiphy,
5546                                         settings->ciphers_pairwise[i]))
5547                                 return -EINVAL;
5548         }
5549
5550         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5551                 settings->cipher_group =
5552                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5553                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5554                                                      settings->cipher_group))
5555                         return -EINVAL;
5556         }
5557
5558         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5559                 settings->wpa_versions =
5560                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5561                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5562                         return -EINVAL;
5563         }
5564
5565         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5566                 void *data;
5567                 int len;
5568
5569                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5570                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5571                 settings->n_akm_suites = len / sizeof(u32);
5572
5573                 if (len % sizeof(u32))
5574                         return -EINVAL;
5575
5576                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5577                         return -EINVAL;
5578
5579                 memcpy(settings->akm_suites, data, len);
5580         }
5581
5582         return 0;
5583 }
5584
5585 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5586 {
5587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5588         struct net_device *dev = info->user_ptr[1];
5589         struct cfg80211_crypto_settings crypto;
5590         struct ieee80211_channel *chan;
5591         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5592         int err, ssid_len, ie_len = 0;
5593         bool use_mfp = false;
5594         u32 flags = 0;
5595         struct ieee80211_ht_cap *ht_capa = NULL;
5596         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5597
5598         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5599                 return -EINVAL;
5600
5601         if (!info->attrs[NL80211_ATTR_MAC] ||
5602             !info->attrs[NL80211_ATTR_SSID] ||
5603             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5604                 return -EINVAL;
5605
5606         if (!rdev->ops->assoc)
5607                 return -EOPNOTSUPP;
5608
5609         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5610             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5611                 return -EOPNOTSUPP;
5612
5613         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5614
5615         chan = ieee80211_get_channel(&rdev->wiphy,
5616                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5617         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5618                 return -EINVAL;
5619
5620         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5621         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5622
5623         if (info->attrs[NL80211_ATTR_IE]) {
5624                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5625                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5626         }
5627
5628         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5629                 enum nl80211_mfp mfp =
5630                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5631                 if (mfp == NL80211_MFP_REQUIRED)
5632                         use_mfp = true;
5633                 else if (mfp != NL80211_MFP_NO)
5634                         return -EINVAL;
5635         }
5636
5637         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5638                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5639
5640         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5641                 flags |= ASSOC_REQ_DISABLE_HT;
5642
5643         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5644                 ht_capa_mask =
5645                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5646
5647         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5648                 if (!ht_capa_mask)
5649                         return -EINVAL;
5650                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5651         }
5652
5653         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5654         if (!err)
5655                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5656                                           ssid, ssid_len, ie, ie_len, use_mfp,
5657                                           &crypto, flags, ht_capa,
5658                                           ht_capa_mask);
5659
5660         return err;
5661 }
5662
5663 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5664 {
5665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5666         struct net_device *dev = info->user_ptr[1];
5667         const u8 *ie = NULL, *bssid;
5668         int ie_len = 0;
5669         u16 reason_code;
5670         bool local_state_change;
5671
5672         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5673                 return -EINVAL;
5674
5675         if (!info->attrs[NL80211_ATTR_MAC])
5676                 return -EINVAL;
5677
5678         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5679                 return -EINVAL;
5680
5681         if (!rdev->ops->deauth)
5682                 return -EOPNOTSUPP;
5683
5684         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5685             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5686                 return -EOPNOTSUPP;
5687
5688         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5689
5690         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5691         if (reason_code == 0) {
5692                 /* Reason Code 0 is reserved */
5693                 return -EINVAL;
5694         }
5695
5696         if (info->attrs[NL80211_ATTR_IE]) {
5697                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5698                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5699         }
5700
5701         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5702
5703         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5704                                     local_state_change);
5705 }
5706
5707 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5708 {
5709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5710         struct net_device *dev = info->user_ptr[1];
5711         const u8 *ie = NULL, *bssid;
5712         int ie_len = 0;
5713         u16 reason_code;
5714         bool local_state_change;
5715
5716         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5717                 return -EINVAL;
5718
5719         if (!info->attrs[NL80211_ATTR_MAC])
5720                 return -EINVAL;
5721
5722         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5723                 return -EINVAL;
5724
5725         if (!rdev->ops->disassoc)
5726                 return -EOPNOTSUPP;
5727
5728         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5729             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5730                 return -EOPNOTSUPP;
5731
5732         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5733
5734         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5735         if (reason_code == 0) {
5736                 /* Reason Code 0 is reserved */
5737                 return -EINVAL;
5738         }
5739
5740         if (info->attrs[NL80211_ATTR_IE]) {
5741                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5742                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5743         }
5744
5745         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5746
5747         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5748                                       local_state_change);
5749 }
5750
5751 static bool
5752 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5753                          int mcast_rate[IEEE80211_NUM_BANDS],
5754                          int rateval)
5755 {
5756         struct wiphy *wiphy = &rdev->wiphy;
5757         bool found = false;
5758         int band, i;
5759
5760         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5761                 struct ieee80211_supported_band *sband;
5762
5763                 sband = wiphy->bands[band];
5764                 if (!sband)
5765                         continue;
5766
5767                 for (i = 0; i < sband->n_bitrates; i++) {
5768                         if (sband->bitrates[i].bitrate == rateval) {
5769                                 mcast_rate[band] = i + 1;
5770                                 found = true;
5771                                 break;
5772                         }
5773                 }
5774         }
5775
5776         return found;
5777 }
5778
5779 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5780 {
5781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5782         struct net_device *dev = info->user_ptr[1];
5783         struct cfg80211_ibss_params ibss;
5784         struct wiphy *wiphy;
5785         struct cfg80211_cached_keys *connkeys = NULL;
5786         int err;
5787
5788         memset(&ibss, 0, sizeof(ibss));
5789
5790         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5791                 return -EINVAL;
5792
5793         if (!info->attrs[NL80211_ATTR_SSID] ||
5794             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5795                 return -EINVAL;
5796
5797         ibss.beacon_interval = 100;
5798
5799         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5800                 ibss.beacon_interval =
5801                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5802                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5803                         return -EINVAL;
5804         }
5805
5806         if (!rdev->ops->join_ibss)
5807                 return -EOPNOTSUPP;
5808
5809         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5810                 return -EOPNOTSUPP;
5811
5812         wiphy = &rdev->wiphy;
5813
5814         if (info->attrs[NL80211_ATTR_MAC]) {
5815                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5816
5817                 if (!is_valid_ether_addr(ibss.bssid))
5818                         return -EINVAL;
5819         }
5820         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5821         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5822
5823         if (info->attrs[NL80211_ATTR_IE]) {
5824                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5825                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5826         }
5827
5828         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
5829         if (err)
5830                 return err;
5831
5832         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
5833                 return -EINVAL;
5834
5835         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
5836                 return -EINVAL;
5837         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
5838             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
5839                 return -EINVAL;
5840
5841         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5842         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5843
5844         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5845                 u8 *rates =
5846                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5847                 int n_rates =
5848                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5849                 struct ieee80211_supported_band *sband =
5850                         wiphy->bands[ibss.chandef.chan->band];
5851
5852                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5853                                              &ibss.basic_rates);
5854                 if (err)
5855                         return err;
5856         }
5857
5858         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5859             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5860                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5861                 return -EINVAL;
5862
5863         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5864                 bool no_ht = false;
5865
5866                 connkeys = nl80211_parse_connkeys(rdev,
5867                                           info->attrs[NL80211_ATTR_KEYS],
5868                                           &no_ht);
5869                 if (IS_ERR(connkeys))
5870                         return PTR_ERR(connkeys);
5871
5872                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
5873                     no_ht) {
5874                         kfree(connkeys);
5875                         return -EINVAL;
5876                 }
5877         }
5878
5879         ibss.control_port =
5880                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5881
5882         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5883         if (err)
5884                 kfree(connkeys);
5885         return err;
5886 }
5887
5888 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5889 {
5890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5891         struct net_device *dev = info->user_ptr[1];
5892
5893         if (!rdev->ops->leave_ibss)
5894                 return -EOPNOTSUPP;
5895
5896         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5897                 return -EOPNOTSUPP;
5898
5899         return cfg80211_leave_ibss(rdev, dev, false);
5900 }
5901
5902 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5903 {
5904         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5905         struct net_device *dev = info->user_ptr[1];
5906         int mcast_rate[IEEE80211_NUM_BANDS];
5907         u32 nla_rate;
5908         int err;
5909
5910         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5911             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5912                 return -EOPNOTSUPP;
5913
5914         if (!rdev->ops->set_mcast_rate)
5915                 return -EOPNOTSUPP;
5916
5917         memset(mcast_rate, 0, sizeof(mcast_rate));
5918
5919         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5920                 return -EINVAL;
5921
5922         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
5923         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
5924                 return -EINVAL;
5925
5926         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
5927
5928         return err;
5929 }
5930
5931
5932 #ifdef CONFIG_NL80211_TESTMODE
5933 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5934         .name = "testmode",
5935 };
5936
5937 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5938 {
5939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5940         int err;
5941
5942         if (!info->attrs[NL80211_ATTR_TESTDATA])
5943                 return -EINVAL;
5944
5945         err = -EOPNOTSUPP;
5946         if (rdev->ops->testmode_cmd) {
5947                 rdev->testmode_info = info;
5948                 err = rdev_testmode_cmd(rdev,
5949                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5950                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5951                 rdev->testmode_info = NULL;
5952         }
5953
5954         return err;
5955 }
5956
5957 static int nl80211_testmode_dump(struct sk_buff *skb,
5958                                  struct netlink_callback *cb)
5959 {
5960         struct cfg80211_registered_device *rdev;
5961         int err;
5962         long phy_idx;
5963         void *data = NULL;
5964         int data_len = 0;
5965
5966         if (cb->args[0]) {
5967                 /*
5968                  * 0 is a valid index, but not valid for args[0],
5969                  * so we need to offset by 1.
5970                  */
5971                 phy_idx = cb->args[0] - 1;
5972         } else {
5973                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5974                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5975                                   nl80211_policy);
5976                 if (err)
5977                         return err;
5978
5979                 mutex_lock(&cfg80211_mutex);
5980                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5981                                                   nl80211_fam.attrbuf);
5982                 if (IS_ERR(rdev)) {
5983                         mutex_unlock(&cfg80211_mutex);
5984                         return PTR_ERR(rdev);
5985                 }
5986                 phy_idx = rdev->wiphy_idx;
5987                 rdev = NULL;
5988                 mutex_unlock(&cfg80211_mutex);
5989
5990                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5991                         cb->args[1] =
5992                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5993         }
5994
5995         if (cb->args[1]) {
5996                 data = nla_data((void *)cb->args[1]);
5997                 data_len = nla_len((void *)cb->args[1]);
5998         }
5999
6000         mutex_lock(&cfg80211_mutex);
6001         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6002         if (!rdev) {
6003                 mutex_unlock(&cfg80211_mutex);
6004                 return -ENOENT;
6005         }
6006         cfg80211_lock_rdev(rdev);
6007         mutex_unlock(&cfg80211_mutex);
6008
6009         if (!rdev->ops->testmode_dump) {
6010                 err = -EOPNOTSUPP;
6011                 goto out_err;
6012         }
6013
6014         while (1) {
6015                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6016                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6017                                            NL80211_CMD_TESTMODE);
6018                 struct nlattr *tmdata;
6019
6020                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6021                         genlmsg_cancel(skb, hdr);
6022                         break;
6023                 }
6024
6025                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6026                 if (!tmdata) {
6027                         genlmsg_cancel(skb, hdr);
6028                         break;
6029                 }
6030                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6031                 nla_nest_end(skb, tmdata);
6032
6033                 if (err == -ENOBUFS || err == -ENOENT) {
6034                         genlmsg_cancel(skb, hdr);
6035                         break;
6036                 } else if (err) {
6037                         genlmsg_cancel(skb, hdr);
6038                         goto out_err;
6039                 }
6040
6041                 genlmsg_end(skb, hdr);
6042         }
6043
6044         err = skb->len;
6045         /* see above */
6046         cb->args[0] = phy_idx + 1;
6047  out_err:
6048         cfg80211_unlock_rdev(rdev);
6049         return err;
6050 }
6051
6052 static struct sk_buff *
6053 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6054                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6055 {
6056         struct sk_buff *skb;
6057         void *hdr;
6058         struct nlattr *data;
6059
6060         skb = nlmsg_new(approxlen + 100, gfp);
6061         if (!skb)
6062                 return NULL;
6063
6064         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6065         if (!hdr) {
6066                 kfree_skb(skb);
6067                 return NULL;
6068         }
6069
6070         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6071                 goto nla_put_failure;
6072         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6073
6074         ((void **)skb->cb)[0] = rdev;
6075         ((void **)skb->cb)[1] = hdr;
6076         ((void **)skb->cb)[2] = data;
6077
6078         return skb;
6079
6080  nla_put_failure:
6081         kfree_skb(skb);
6082         return NULL;
6083 }
6084
6085 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6086                                                   int approxlen)
6087 {
6088         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6089
6090         if (WARN_ON(!rdev->testmode_info))
6091                 return NULL;
6092
6093         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6094                                 rdev->testmode_info->snd_portid,
6095                                 rdev->testmode_info->snd_seq,
6096                                 GFP_KERNEL);
6097 }
6098 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6099
6100 int cfg80211_testmode_reply(struct sk_buff *skb)
6101 {
6102         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6103         void *hdr = ((void **)skb->cb)[1];
6104         struct nlattr *data = ((void **)skb->cb)[2];
6105
6106         if (WARN_ON(!rdev->testmode_info)) {
6107                 kfree_skb(skb);
6108                 return -EINVAL;
6109         }
6110
6111         nla_nest_end(skb, data);
6112         genlmsg_end(skb, hdr);
6113         return genlmsg_reply(skb, rdev->testmode_info);
6114 }
6115 EXPORT_SYMBOL(cfg80211_testmode_reply);
6116
6117 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6118                                                   int approxlen, gfp_t gfp)
6119 {
6120         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6121
6122         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6123 }
6124 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6125
6126 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6127 {
6128         void *hdr = ((void **)skb->cb)[1];
6129         struct nlattr *data = ((void **)skb->cb)[2];
6130
6131         nla_nest_end(skb, data);
6132         genlmsg_end(skb, hdr);
6133         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6134 }
6135 EXPORT_SYMBOL(cfg80211_testmode_event);
6136 #endif
6137
6138 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6139 {
6140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6141         struct net_device *dev = info->user_ptr[1];
6142         struct cfg80211_connect_params connect;
6143         struct wiphy *wiphy;
6144         struct cfg80211_cached_keys *connkeys = NULL;
6145         int err;
6146
6147         memset(&connect, 0, sizeof(connect));
6148
6149         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6150                 return -EINVAL;
6151
6152         if (!info->attrs[NL80211_ATTR_SSID] ||
6153             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6154                 return -EINVAL;
6155
6156         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6157                 connect.auth_type =
6158                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6159                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6160                                              NL80211_CMD_CONNECT))
6161                         return -EINVAL;
6162         } else
6163                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6164
6165         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6166
6167         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6168                                       NL80211_MAX_NR_CIPHER_SUITES);
6169         if (err)
6170                 return err;
6171
6172         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6173             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6174                 return -EOPNOTSUPP;
6175
6176         wiphy = &rdev->wiphy;
6177
6178         connect.bg_scan_period = -1;
6179         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6180                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6181                 connect.bg_scan_period =
6182                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6183         }
6184
6185         if (info->attrs[NL80211_ATTR_MAC])
6186                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6187         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6188         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6189
6190         if (info->attrs[NL80211_ATTR_IE]) {
6191                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6192                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6193         }
6194
6195         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6196                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6197                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6198                     connect.mfp != NL80211_MFP_NO)
6199                         return -EINVAL;
6200         } else {
6201                 connect.mfp = NL80211_MFP_NO;
6202         }
6203
6204         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6205                 connect.channel =
6206                         ieee80211_get_channel(wiphy,
6207                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6208                 if (!connect.channel ||
6209                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6210                         return -EINVAL;
6211         }
6212
6213         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6214                 connkeys = nl80211_parse_connkeys(rdev,
6215                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6216                 if (IS_ERR(connkeys))
6217                         return PTR_ERR(connkeys);
6218         }
6219
6220         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6221                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6222
6223         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6224                 memcpy(&connect.ht_capa_mask,
6225                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6226                        sizeof(connect.ht_capa_mask));
6227
6228         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6229                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6230                         kfree(connkeys);
6231                         return -EINVAL;
6232                 }
6233                 memcpy(&connect.ht_capa,
6234                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6235                        sizeof(connect.ht_capa));
6236         }
6237
6238         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6239         if (err)
6240                 kfree(connkeys);
6241         return err;
6242 }
6243
6244 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6245 {
6246         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6247         struct net_device *dev = info->user_ptr[1];
6248         u16 reason;
6249
6250         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6251                 reason = WLAN_REASON_DEAUTH_LEAVING;
6252         else
6253                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6254
6255         if (reason == 0)
6256                 return -EINVAL;
6257
6258         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6259             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6260                 return -EOPNOTSUPP;
6261
6262         return cfg80211_disconnect(rdev, dev, reason, true);
6263 }
6264
6265 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6266 {
6267         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6268         struct net *net;
6269         int err;
6270         u32 pid;
6271
6272         if (!info->attrs[NL80211_ATTR_PID])
6273                 return -EINVAL;
6274
6275         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6276
6277         net = get_net_ns_by_pid(pid);
6278         if (IS_ERR(net))
6279                 return PTR_ERR(net);
6280
6281         err = 0;
6282
6283         /* check if anything to do */
6284         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6285                 err = cfg80211_switch_netns(rdev, net);
6286
6287         put_net(net);
6288         return err;
6289 }
6290
6291 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6292 {
6293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6294         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6295                         struct cfg80211_pmksa *pmksa) = NULL;
6296         struct net_device *dev = info->user_ptr[1];
6297         struct cfg80211_pmksa pmksa;
6298
6299         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6300
6301         if (!info->attrs[NL80211_ATTR_MAC])
6302                 return -EINVAL;
6303
6304         if (!info->attrs[NL80211_ATTR_PMKID])
6305                 return -EINVAL;
6306
6307         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6308         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6309
6310         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6311             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6312                 return -EOPNOTSUPP;
6313
6314         switch (info->genlhdr->cmd) {
6315         case NL80211_CMD_SET_PMKSA:
6316                 rdev_ops = rdev->ops->set_pmksa;
6317                 break;
6318         case NL80211_CMD_DEL_PMKSA:
6319                 rdev_ops = rdev->ops->del_pmksa;
6320                 break;
6321         default:
6322                 WARN_ON(1);
6323                 break;
6324         }
6325
6326         if (!rdev_ops)
6327                 return -EOPNOTSUPP;
6328
6329         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6330 }
6331
6332 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6333 {
6334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6335         struct net_device *dev = info->user_ptr[1];
6336
6337         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6338             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6339                 return -EOPNOTSUPP;
6340
6341         if (!rdev->ops->flush_pmksa)
6342                 return -EOPNOTSUPP;
6343
6344         return rdev_flush_pmksa(rdev, dev);
6345 }
6346
6347 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6348 {
6349         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6350         struct net_device *dev = info->user_ptr[1];
6351         u8 action_code, dialog_token;
6352         u16 status_code;
6353         u8 *peer;
6354
6355         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6356             !rdev->ops->tdls_mgmt)
6357                 return -EOPNOTSUPP;
6358
6359         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6360             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6361             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6362             !info->attrs[NL80211_ATTR_IE] ||
6363             !info->attrs[NL80211_ATTR_MAC])
6364                 return -EINVAL;
6365
6366         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6367         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6368         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6369         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6370
6371         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6372                               dialog_token, status_code,
6373                               nla_data(info->attrs[NL80211_ATTR_IE]),
6374                               nla_len(info->attrs[NL80211_ATTR_IE]));
6375 }
6376
6377 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6378 {
6379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6380         struct net_device *dev = info->user_ptr[1];
6381         enum nl80211_tdls_operation operation;
6382         u8 *peer;
6383
6384         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6385             !rdev->ops->tdls_oper)
6386                 return -EOPNOTSUPP;
6387
6388         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6389             !info->attrs[NL80211_ATTR_MAC])
6390                 return -EINVAL;
6391
6392         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6393         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6394
6395         return rdev_tdls_oper(rdev, dev, peer, operation);
6396 }
6397
6398 static int nl80211_remain_on_channel(struct sk_buff *skb,
6399                                      struct genl_info *info)
6400 {
6401         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6402         struct wireless_dev *wdev = info->user_ptr[1];
6403         struct cfg80211_chan_def chandef;
6404         struct sk_buff *msg;
6405         void *hdr;
6406         u64 cookie;
6407         u32 duration;
6408         int err;
6409
6410         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6411             !info->attrs[NL80211_ATTR_DURATION])
6412                 return -EINVAL;
6413
6414         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6415
6416         if (!rdev->ops->remain_on_channel ||
6417             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6418                 return -EOPNOTSUPP;
6419
6420         /*
6421          * We should be on that channel for at least a minimum amount of
6422          * time (10ms) but no longer than the driver supports.
6423          */
6424         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6425             duration > rdev->wiphy.max_remain_on_channel_duration)
6426                 return -EINVAL;
6427
6428         err = nl80211_parse_chandef(rdev, info, &chandef);
6429         if (err)
6430                 return err;
6431
6432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6433         if (!msg)
6434                 return -ENOMEM;
6435
6436         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6437                              NL80211_CMD_REMAIN_ON_CHANNEL);
6438
6439         if (IS_ERR(hdr)) {
6440                 err = PTR_ERR(hdr);
6441                 goto free_msg;
6442         }
6443
6444         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6445                                      duration, &cookie);
6446
6447         if (err)
6448                 goto free_msg;
6449
6450         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6451                 goto nla_put_failure;
6452
6453         genlmsg_end(msg, hdr);
6454
6455         return genlmsg_reply(msg, info);
6456
6457  nla_put_failure:
6458         err = -ENOBUFS;
6459  free_msg:
6460         nlmsg_free(msg);
6461         return err;
6462 }
6463
6464 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6465                                             struct genl_info *info)
6466 {
6467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6468         struct wireless_dev *wdev = info->user_ptr[1];
6469         u64 cookie;
6470
6471         if (!info->attrs[NL80211_ATTR_COOKIE])
6472                 return -EINVAL;
6473
6474         if (!rdev->ops->cancel_remain_on_channel)
6475                 return -EOPNOTSUPP;
6476
6477         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6478
6479         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6480 }
6481
6482 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6483                            u8 *rates, u8 rates_len)
6484 {
6485         u8 i;
6486         u32 mask = 0;
6487
6488         for (i = 0; i < rates_len; i++) {
6489                 int rate = (rates[i] & 0x7f) * 5;
6490                 int ridx;
6491                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6492                         struct ieee80211_rate *srate =
6493                                 &sband->bitrates[ridx];
6494                         if (rate == srate->bitrate) {
6495                                 mask |= 1 << ridx;
6496                                 break;
6497                         }
6498                 }
6499                 if (ridx == sband->n_bitrates)
6500                         return 0; /* rate not found */
6501         }
6502
6503         return mask;
6504 }
6505
6506 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6507                                u8 *rates, u8 rates_len,
6508                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6509 {
6510         u8 i;
6511
6512         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6513
6514         for (i = 0; i < rates_len; i++) {
6515                 int ridx, rbit;
6516
6517                 ridx = rates[i] / 8;
6518                 rbit = BIT(rates[i] % 8);
6519
6520                 /* check validity */
6521                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6522                         return false;
6523
6524                 /* check availability */
6525                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6526                         mcs[ridx] |= rbit;
6527                 else
6528                         return false;
6529         }
6530
6531         return true;
6532 }
6533
6534 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6535         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6536                                     .len = NL80211_MAX_SUPP_RATES },
6537         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6538                                  .len = NL80211_MAX_SUPP_HT_RATES },
6539 };
6540
6541 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6542                                        struct genl_info *info)
6543 {
6544         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6546         struct cfg80211_bitrate_mask mask;
6547         int rem, i;
6548         struct net_device *dev = info->user_ptr[1];
6549         struct nlattr *tx_rates;
6550         struct ieee80211_supported_band *sband;
6551
6552         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6553                 return -EINVAL;
6554
6555         if (!rdev->ops->set_bitrate_mask)
6556                 return -EOPNOTSUPP;
6557
6558         memset(&mask, 0, sizeof(mask));
6559         /* Default to all rates enabled */
6560         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6561                 sband = rdev->wiphy.bands[i];
6562                 mask.control[i].legacy =
6563                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6564                 if (sband)
6565                         memcpy(mask.control[i].mcs,
6566                                sband->ht_cap.mcs.rx_mask,
6567                                sizeof(mask.control[i].mcs));
6568                 else
6569                         memset(mask.control[i].mcs, 0,
6570                                sizeof(mask.control[i].mcs));
6571         }
6572
6573         /*
6574          * The nested attribute uses enum nl80211_band as the index. This maps
6575          * directly to the enum ieee80211_band values used in cfg80211.
6576          */
6577         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6578         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6579         {
6580                 enum ieee80211_band band = nla_type(tx_rates);
6581                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6582                         return -EINVAL;
6583                 sband = rdev->wiphy.bands[band];
6584                 if (sband == NULL)
6585                         return -EINVAL;
6586                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6587                           nla_len(tx_rates), nl80211_txattr_policy);
6588                 if (tb[NL80211_TXRATE_LEGACY]) {
6589                         mask.control[band].legacy = rateset_to_mask(
6590                                 sband,
6591                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6592                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6593                         if ((mask.control[band].legacy == 0) &&
6594                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6595                                 return -EINVAL;
6596                 }
6597                 if (tb[NL80211_TXRATE_MCS]) {
6598                         if (!ht_rateset_to_mask(
6599                                         sband,
6600                                         nla_data(tb[NL80211_TXRATE_MCS]),
6601                                         nla_len(tb[NL80211_TXRATE_MCS]),
6602                                         mask.control[band].mcs))
6603                                 return -EINVAL;
6604                 }
6605
6606                 if (mask.control[band].legacy == 0) {
6607                         /* don't allow empty legacy rates if HT
6608                          * is not even supported. */
6609                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6610                                 return -EINVAL;
6611
6612                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6613                                 if (mask.control[band].mcs[i])
6614                                         break;
6615
6616                         /* legacy and mcs rates may not be both empty */
6617                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6618                                 return -EINVAL;
6619                 }
6620         }
6621
6622         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6623 }
6624
6625 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6626 {
6627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6628         struct wireless_dev *wdev = info->user_ptr[1];
6629         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6630
6631         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6632                 return -EINVAL;
6633
6634         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6635                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6636
6637         switch (wdev->iftype) {
6638         case NL80211_IFTYPE_STATION:
6639         case NL80211_IFTYPE_ADHOC:
6640         case NL80211_IFTYPE_P2P_CLIENT:
6641         case NL80211_IFTYPE_AP:
6642         case NL80211_IFTYPE_AP_VLAN:
6643         case NL80211_IFTYPE_MESH_POINT:
6644         case NL80211_IFTYPE_P2P_GO:
6645         case NL80211_IFTYPE_P2P_DEVICE:
6646                 break;
6647         default:
6648                 return -EOPNOTSUPP;
6649         }
6650
6651         /* not much point in registering if we can't reply */
6652         if (!rdev->ops->mgmt_tx)
6653                 return -EOPNOTSUPP;
6654
6655         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6656                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6657                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6658 }
6659
6660 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6661 {
6662         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6663         struct wireless_dev *wdev = info->user_ptr[1];
6664         struct cfg80211_chan_def chandef;
6665         int err;
6666         void *hdr = NULL;
6667         u64 cookie;
6668         struct sk_buff *msg = NULL;
6669         unsigned int wait = 0;
6670         bool offchan, no_cck, dont_wait_for_ack;
6671
6672         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6673
6674         if (!info->attrs[NL80211_ATTR_FRAME])
6675                 return -EINVAL;
6676
6677         if (!rdev->ops->mgmt_tx)
6678                 return -EOPNOTSUPP;
6679
6680         switch (wdev->iftype) {
6681         case NL80211_IFTYPE_STATION:
6682         case NL80211_IFTYPE_ADHOC:
6683         case NL80211_IFTYPE_P2P_CLIENT:
6684         case NL80211_IFTYPE_AP:
6685         case NL80211_IFTYPE_AP_VLAN:
6686         case NL80211_IFTYPE_MESH_POINT:
6687         case NL80211_IFTYPE_P2P_GO:
6688         case NL80211_IFTYPE_P2P_DEVICE:
6689                 break;
6690         default:
6691                 return -EOPNOTSUPP;
6692         }
6693
6694         if (info->attrs[NL80211_ATTR_DURATION]) {
6695                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6696                         return -EINVAL;
6697                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6698
6699                 /*
6700                  * We should wait on the channel for at least a minimum amount
6701                  * of time (10ms) but no longer than the driver supports.
6702                  */
6703                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6704                     wait > rdev->wiphy.max_remain_on_channel_duration)
6705                         return -EINVAL;
6706
6707         }
6708
6709         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6710
6711         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6712                 return -EINVAL;
6713
6714         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6715
6716         err = nl80211_parse_chandef(rdev, info, &chandef);
6717         if (err)
6718                 return err;
6719
6720         if (!dont_wait_for_ack) {
6721                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6722                 if (!msg)
6723                         return -ENOMEM;
6724
6725                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6726                                      NL80211_CMD_FRAME);
6727
6728                 if (IS_ERR(hdr)) {
6729                         err = PTR_ERR(hdr);
6730                         goto free_msg;
6731                 }
6732         }
6733
6734         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
6735                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6736                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6737                                     no_cck, dont_wait_for_ack, &cookie);
6738         if (err)
6739                 goto free_msg;
6740
6741         if (msg) {
6742                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6743                         goto nla_put_failure;
6744
6745                 genlmsg_end(msg, hdr);
6746                 return genlmsg_reply(msg, info);
6747         }
6748
6749         return 0;
6750
6751  nla_put_failure:
6752         err = -ENOBUFS;
6753  free_msg:
6754         nlmsg_free(msg);
6755         return err;
6756 }
6757
6758 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6759 {
6760         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6761         struct wireless_dev *wdev = info->user_ptr[1];
6762         u64 cookie;
6763
6764         if (!info->attrs[NL80211_ATTR_COOKIE])
6765                 return -EINVAL;
6766
6767         if (!rdev->ops->mgmt_tx_cancel_wait)
6768                 return -EOPNOTSUPP;
6769
6770         switch (wdev->iftype) {
6771         case NL80211_IFTYPE_STATION:
6772         case NL80211_IFTYPE_ADHOC:
6773         case NL80211_IFTYPE_P2P_CLIENT:
6774         case NL80211_IFTYPE_AP:
6775         case NL80211_IFTYPE_AP_VLAN:
6776         case NL80211_IFTYPE_P2P_GO:
6777         case NL80211_IFTYPE_P2P_DEVICE:
6778                 break;
6779         default:
6780                 return -EOPNOTSUPP;
6781         }
6782
6783         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6784
6785         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6786 }
6787
6788 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6789 {
6790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6791         struct wireless_dev *wdev;
6792         struct net_device *dev = info->user_ptr[1];
6793         u8 ps_state;
6794         bool state;
6795         int err;
6796
6797         if (!info->attrs[NL80211_ATTR_PS_STATE])
6798                 return -EINVAL;
6799
6800         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6801
6802         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6803                 return -EINVAL;
6804
6805         wdev = dev->ieee80211_ptr;
6806
6807         if (!rdev->ops->set_power_mgmt)
6808                 return -EOPNOTSUPP;
6809
6810         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6811
6812         if (state == wdev->ps)
6813                 return 0;
6814
6815         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6816         if (!err)
6817                 wdev->ps = state;
6818         return err;
6819 }
6820
6821 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6822 {
6823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6824         enum nl80211_ps_state ps_state;
6825         struct wireless_dev *wdev;
6826         struct net_device *dev = info->user_ptr[1];
6827         struct sk_buff *msg;
6828         void *hdr;
6829         int err;
6830
6831         wdev = dev->ieee80211_ptr;
6832
6833         if (!rdev->ops->set_power_mgmt)
6834                 return -EOPNOTSUPP;
6835
6836         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6837         if (!msg)
6838                 return -ENOMEM;
6839
6840         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6841                              NL80211_CMD_GET_POWER_SAVE);
6842         if (!hdr) {
6843                 err = -ENOBUFS;
6844                 goto free_msg;
6845         }
6846
6847         if (wdev->ps)
6848                 ps_state = NL80211_PS_ENABLED;
6849         else
6850                 ps_state = NL80211_PS_DISABLED;
6851
6852         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6853                 goto nla_put_failure;
6854
6855         genlmsg_end(msg, hdr);
6856         return genlmsg_reply(msg, info);
6857
6858  nla_put_failure:
6859         err = -ENOBUFS;
6860  free_msg:
6861         nlmsg_free(msg);
6862         return err;
6863 }
6864
6865 static struct nla_policy
6866 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6867         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6868         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6869         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6870         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6871         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6872         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6873 };
6874
6875 static int nl80211_set_cqm_txe(struct genl_info *info,
6876                                u32 rate, u32 pkts, u32 intvl)
6877 {
6878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6879         struct wireless_dev *wdev;
6880         struct net_device *dev = info->user_ptr[1];
6881
6882         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
6883                 return -EINVAL;
6884
6885         wdev = dev->ieee80211_ptr;
6886
6887         if (!rdev->ops->set_cqm_txe_config)
6888                 return -EOPNOTSUPP;
6889
6890         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6891             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6892                 return -EOPNOTSUPP;
6893
6894         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6895 }
6896
6897 static int nl80211_set_cqm_rssi(struct genl_info *info,
6898                                 s32 threshold, u32 hysteresis)
6899 {
6900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6901         struct wireless_dev *wdev;
6902         struct net_device *dev = info->user_ptr[1];
6903
6904         if (threshold > 0)
6905                 return -EINVAL;
6906
6907         wdev = dev->ieee80211_ptr;
6908
6909         if (!rdev->ops->set_cqm_rssi_config)
6910                 return -EOPNOTSUPP;
6911
6912         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6913             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6914                 return -EOPNOTSUPP;
6915
6916         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6917 }
6918
6919 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6920 {
6921         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6922         struct nlattr *cqm;
6923         int err;
6924
6925         cqm = info->attrs[NL80211_ATTR_CQM];
6926         if (!cqm) {
6927                 err = -EINVAL;
6928                 goto out;
6929         }
6930
6931         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6932                                nl80211_attr_cqm_policy);
6933         if (err)
6934                 goto out;
6935
6936         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6937             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6938                 s32 threshold;
6939                 u32 hysteresis;
6940                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6941                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6942                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6943         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6944                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6945                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6946                 u32 rate, pkts, intvl;
6947                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6948                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6949                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6950                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6951         } else
6952                 err = -EINVAL;
6953
6954 out:
6955         return err;
6956 }
6957
6958 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6959 {
6960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6961         struct net_device *dev = info->user_ptr[1];
6962         struct mesh_config cfg;
6963         struct mesh_setup setup;
6964         int err;
6965
6966         /* start with default */
6967         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6968         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6969
6970         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6971                 /* and parse parameters if given */
6972                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6973                 if (err)
6974                         return err;
6975         }
6976
6977         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6978             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6979                 return -EINVAL;
6980
6981         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6982         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6983
6984         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6985             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6986                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6987                         return -EINVAL;
6988
6989         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6990                 setup.beacon_interval =
6991                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6992                 if (setup.beacon_interval < 10 ||
6993                     setup.beacon_interval > 10000)
6994                         return -EINVAL;
6995         }
6996
6997         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
6998                 setup.dtim_period =
6999                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7000                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7001                         return -EINVAL;
7002         }
7003
7004         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7005                 /* parse additional setup parameters if given */
7006                 err = nl80211_parse_mesh_setup(info, &setup);
7007                 if (err)
7008                         return err;
7009         }
7010
7011         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7012                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7013                 if (err)
7014                         return err;
7015         } else {
7016                 /* cfg80211_join_mesh() will sort it out */
7017                 setup.chandef.chan = NULL;
7018         }
7019
7020         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7021 }
7022
7023 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7024 {
7025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7026         struct net_device *dev = info->user_ptr[1];
7027
7028         return cfg80211_leave_mesh(rdev, dev);
7029 }
7030
7031 #ifdef CONFIG_PM
7032 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7033                                         struct cfg80211_registered_device *rdev)
7034 {
7035         struct nlattr *nl_pats, *nl_pat;
7036         int i, pat_len;
7037
7038         if (!rdev->wowlan->n_patterns)
7039                 return 0;
7040
7041         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7042         if (!nl_pats)
7043                 return -ENOBUFS;
7044
7045         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7046                 nl_pat = nla_nest_start(msg, i + 1);
7047                 if (!nl_pat)
7048                         return -ENOBUFS;
7049                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7050                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7051                             DIV_ROUND_UP(pat_len, 8),
7052                             rdev->wowlan->patterns[i].mask) ||
7053                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7054                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7055                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7056                                 rdev->wowlan->patterns[i].pkt_offset))
7057                         return -ENOBUFS;
7058                 nla_nest_end(msg, nl_pat);
7059         }
7060         nla_nest_end(msg, nl_pats);
7061
7062         return 0;
7063 }
7064
7065 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7066                                    struct cfg80211_wowlan_tcp *tcp)
7067 {
7068         struct nlattr *nl_tcp;
7069
7070         if (!tcp)
7071                 return 0;
7072
7073         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7074         if (!nl_tcp)
7075                 return -ENOBUFS;
7076
7077         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7078             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7079             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7080             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7081             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7082             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7083                     tcp->payload_len, tcp->payload) ||
7084             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7085                         tcp->data_interval) ||
7086             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7087                     tcp->wake_len, tcp->wake_data) ||
7088             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7089                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7090                 return -ENOBUFS;
7091
7092         if (tcp->payload_seq.len &&
7093             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7094                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7095                 return -ENOBUFS;
7096
7097         if (tcp->payload_tok.len &&
7098             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7099                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7100                     &tcp->payload_tok))
7101                 return -ENOBUFS;
7102
7103         return 0;
7104 }
7105
7106 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7107 {
7108         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7109         struct sk_buff *msg;
7110         void *hdr;
7111         u32 size = NLMSG_DEFAULT_SIZE;
7112
7113         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7114             !rdev->wiphy.wowlan.tcp)
7115                 return -EOPNOTSUPP;
7116
7117         if (rdev->wowlan && rdev->wowlan->tcp) {
7118                 /* adjust size to have room for all the data */
7119                 size += rdev->wowlan->tcp->tokens_size +
7120                         rdev->wowlan->tcp->payload_len +
7121                         rdev->wowlan->tcp->wake_len +
7122                         rdev->wowlan->tcp->wake_len / 8;
7123         }
7124
7125         msg = nlmsg_new(size, GFP_KERNEL);
7126         if (!msg)
7127                 return -ENOMEM;
7128
7129         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7130                              NL80211_CMD_GET_WOWLAN);
7131         if (!hdr)
7132                 goto nla_put_failure;
7133
7134         if (rdev->wowlan) {
7135                 struct nlattr *nl_wowlan;
7136
7137                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7138                 if (!nl_wowlan)
7139                         goto nla_put_failure;
7140
7141                 if ((rdev->wowlan->any &&
7142                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7143                     (rdev->wowlan->disconnect &&
7144                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7145                     (rdev->wowlan->magic_pkt &&
7146                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7147                     (rdev->wowlan->gtk_rekey_failure &&
7148                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7149                     (rdev->wowlan->eap_identity_req &&
7150                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7151                     (rdev->wowlan->four_way_handshake &&
7152                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7153                     (rdev->wowlan->rfkill_release &&
7154                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7155                         goto nla_put_failure;
7156
7157                 if (nl80211_send_wowlan_patterns(msg, rdev))
7158                         goto nla_put_failure;
7159
7160                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7161                         goto nla_put_failure;
7162
7163                 nla_nest_end(msg, nl_wowlan);
7164         }
7165
7166         genlmsg_end(msg, hdr);
7167         return genlmsg_reply(msg, info);
7168
7169 nla_put_failure:
7170         nlmsg_free(msg);
7171         return -ENOBUFS;
7172 }
7173
7174 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7175                                     struct nlattr *attr,
7176                                     struct cfg80211_wowlan *trig)
7177 {
7178         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7179         struct cfg80211_wowlan_tcp *cfg;
7180         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7181         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7182         u32 size;
7183         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7184         int err, port;
7185
7186         if (!rdev->wiphy.wowlan.tcp)
7187                 return -EINVAL;
7188
7189         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7190                         nla_data(attr), nla_len(attr),
7191                         nl80211_wowlan_tcp_policy);
7192         if (err)
7193                 return err;
7194
7195         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7196             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7197             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7198             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7199             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7200             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7201             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7202             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7203                 return -EINVAL;
7204
7205         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7206         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7207                 return -EINVAL;
7208
7209         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7210                         rdev->wiphy.wowlan.tcp->data_interval_max)
7211                 return -EINVAL;
7212
7213         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7214         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7215                 return -EINVAL;
7216
7217         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7218         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7219                 return -EINVAL;
7220
7221         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7222                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7223
7224                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7225                 tokens_size = tokln - sizeof(*tok);
7226
7227                 if (!tok->len || tokens_size % tok->len)
7228                         return -EINVAL;
7229                 if (!rdev->wiphy.wowlan.tcp->tok)
7230                         return -EINVAL;
7231                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7232                         return -EINVAL;
7233                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7234                         return -EINVAL;
7235                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7236                         return -EINVAL;
7237                 if (tok->offset + tok->len > data_size)
7238                         return -EINVAL;
7239         }
7240
7241         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7242                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7243                 if (!rdev->wiphy.wowlan.tcp->seq)
7244                         return -EINVAL;
7245                 if (seq->len == 0 || seq->len > 4)
7246                         return -EINVAL;
7247                 if (seq->len + seq->offset > data_size)
7248                         return -EINVAL;
7249         }
7250
7251         size = sizeof(*cfg);
7252         size += data_size;
7253         size += wake_size + wake_mask_size;
7254         size += tokens_size;
7255
7256         cfg = kzalloc(size, GFP_KERNEL);
7257         if (!cfg)
7258                 return -ENOMEM;
7259         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7260         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7261         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7262                ETH_ALEN);
7263         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7264                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7265         else
7266                 port = 0;
7267 #ifdef CONFIG_INET
7268         /* allocate a socket and port for it and use it */
7269         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7270                             IPPROTO_TCP, &cfg->sock, 1);
7271         if (err) {
7272                 kfree(cfg);
7273                 return err;
7274         }
7275         if (inet_csk_get_port(cfg->sock->sk, port)) {
7276                 sock_release(cfg->sock);
7277                 kfree(cfg);
7278                 return -EADDRINUSE;
7279         }
7280         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7281 #else
7282         if (!port) {
7283                 kfree(cfg);
7284                 return -EINVAL;
7285         }
7286         cfg->src_port = port;
7287 #endif
7288
7289         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7290         cfg->payload_len = data_size;
7291         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7292         memcpy((void *)cfg->payload,
7293                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7294                data_size);
7295         if (seq)
7296                 cfg->payload_seq = *seq;
7297         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7298         cfg->wake_len = wake_size;
7299         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7300         memcpy((void *)cfg->wake_data,
7301                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7302                wake_size);
7303         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7304                          data_size + wake_size;
7305         memcpy((void *)cfg->wake_mask,
7306                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7307                wake_mask_size);
7308         if (tok) {
7309                 cfg->tokens_size = tokens_size;
7310                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7311         }
7312
7313         trig->tcp = cfg;
7314
7315         return 0;
7316 }
7317
7318 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7319 {
7320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7321         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7322         struct cfg80211_wowlan new_triggers = {};
7323         struct cfg80211_wowlan *ntrig;
7324         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7325         int err, i;
7326         bool prev_enabled = rdev->wowlan;
7327
7328         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7329             !rdev->wiphy.wowlan.tcp)
7330                 return -EOPNOTSUPP;
7331
7332         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7333                 cfg80211_rdev_free_wowlan(rdev);
7334                 rdev->wowlan = NULL;
7335                 goto set_wakeup;
7336         }
7337
7338         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7339                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7340                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7341                         nl80211_wowlan_policy);
7342         if (err)
7343                 return err;
7344
7345         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7346                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7347                         return -EINVAL;
7348                 new_triggers.any = true;
7349         }
7350
7351         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7352                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7353                         return -EINVAL;
7354                 new_triggers.disconnect = true;
7355         }
7356
7357         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7358                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7359                         return -EINVAL;
7360                 new_triggers.magic_pkt = true;
7361         }
7362
7363         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7364                 return -EINVAL;
7365
7366         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7367                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7368                         return -EINVAL;
7369                 new_triggers.gtk_rekey_failure = true;
7370         }
7371
7372         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7373                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7374                         return -EINVAL;
7375                 new_triggers.eap_identity_req = true;
7376         }
7377
7378         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7379                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7380                         return -EINVAL;
7381                 new_triggers.four_way_handshake = true;
7382         }
7383
7384         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7385                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7386                         return -EINVAL;
7387                 new_triggers.rfkill_release = true;
7388         }
7389
7390         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7391                 struct nlattr *pat;
7392                 int n_patterns = 0;
7393                 int rem, pat_len, mask_len, pkt_offset;
7394                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7395
7396                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7397                                     rem)
7398                         n_patterns++;
7399                 if (n_patterns > wowlan->n_patterns)
7400                         return -EINVAL;
7401
7402                 new_triggers.patterns = kcalloc(n_patterns,
7403                                                 sizeof(new_triggers.patterns[0]),
7404                                                 GFP_KERNEL);
7405                 if (!new_triggers.patterns)
7406                         return -ENOMEM;
7407
7408                 new_triggers.n_patterns = n_patterns;
7409                 i = 0;
7410
7411                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7412                                     rem) {
7413                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7414                                   nla_data(pat), nla_len(pat), NULL);
7415                         err = -EINVAL;
7416                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7417                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7418                                 goto error;
7419                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7420                         mask_len = DIV_ROUND_UP(pat_len, 8);
7421                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7422                             mask_len)
7423                                 goto error;
7424                         if (pat_len > wowlan->pattern_max_len ||
7425                             pat_len < wowlan->pattern_min_len)
7426                                 goto error;
7427
7428                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7429                                 pkt_offset = 0;
7430                         else
7431                                 pkt_offset = nla_get_u32(
7432                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7433                         if (pkt_offset > wowlan->max_pkt_offset)
7434                                 goto error;
7435                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7436
7437                         new_triggers.patterns[i].mask =
7438                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7439                         if (!new_triggers.patterns[i].mask) {
7440                                 err = -ENOMEM;
7441                                 goto error;
7442                         }
7443                         new_triggers.patterns[i].pattern =
7444                                 new_triggers.patterns[i].mask + mask_len;
7445                         memcpy(new_triggers.patterns[i].mask,
7446                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7447                                mask_len);
7448                         new_triggers.patterns[i].pattern_len = pat_len;
7449                         memcpy(new_triggers.patterns[i].pattern,
7450                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7451                                pat_len);
7452                         i++;
7453                 }
7454         }
7455
7456         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7457                 err = nl80211_parse_wowlan_tcp(
7458                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7459                         &new_triggers);
7460                 if (err)
7461                         goto error;
7462         }
7463
7464         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7465         if (!ntrig) {
7466                 err = -ENOMEM;
7467                 goto error;
7468         }
7469         cfg80211_rdev_free_wowlan(rdev);
7470         rdev->wowlan = ntrig;
7471
7472  set_wakeup:
7473         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7474                 rdev_set_wakeup(rdev, rdev->wowlan);
7475
7476         return 0;
7477  error:
7478         for (i = 0; i < new_triggers.n_patterns; i++)
7479                 kfree(new_triggers.patterns[i].mask);
7480         kfree(new_triggers.patterns);
7481         if (new_triggers.tcp && new_triggers.tcp->sock)
7482                 sock_release(new_triggers.tcp->sock);
7483         kfree(new_triggers.tcp);
7484         return err;
7485 }
7486 #endif
7487
7488 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7489 {
7490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7491         struct net_device *dev = info->user_ptr[1];
7492         struct wireless_dev *wdev = dev->ieee80211_ptr;
7493         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7494         struct cfg80211_gtk_rekey_data rekey_data;
7495         int err;
7496
7497         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7498                 return -EINVAL;
7499
7500         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7501                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7502                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7503                         nl80211_rekey_policy);
7504         if (err)
7505                 return err;
7506
7507         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7508                 return -ERANGE;
7509         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7510                 return -ERANGE;
7511         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7512                 return -ERANGE;
7513
7514         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7515                NL80211_KEK_LEN);
7516         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7517                NL80211_KCK_LEN);
7518         memcpy(rekey_data.replay_ctr,
7519                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7520                NL80211_REPLAY_CTR_LEN);
7521
7522         wdev_lock(wdev);
7523         if (!wdev->current_bss) {
7524                 err = -ENOTCONN;
7525                 goto out;
7526         }
7527
7528         if (!rdev->ops->set_rekey_data) {
7529                 err = -EOPNOTSUPP;
7530                 goto out;
7531         }
7532
7533         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7534  out:
7535         wdev_unlock(wdev);
7536         return err;
7537 }
7538
7539 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7540                                              struct genl_info *info)
7541 {
7542         struct net_device *dev = info->user_ptr[1];
7543         struct wireless_dev *wdev = dev->ieee80211_ptr;
7544
7545         if (wdev->iftype != NL80211_IFTYPE_AP &&
7546             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7547                 return -EINVAL;
7548
7549         if (wdev->ap_unexpected_nlportid)
7550                 return -EBUSY;
7551
7552         wdev->ap_unexpected_nlportid = info->snd_portid;
7553         return 0;
7554 }
7555
7556 static int nl80211_probe_client(struct sk_buff *skb,
7557                                 struct genl_info *info)
7558 {
7559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7560         struct net_device *dev = info->user_ptr[1];
7561         struct wireless_dev *wdev = dev->ieee80211_ptr;
7562         struct sk_buff *msg;
7563         void *hdr;
7564         const u8 *addr;
7565         u64 cookie;
7566         int err;
7567
7568         if (wdev->iftype != NL80211_IFTYPE_AP &&
7569             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7570                 return -EOPNOTSUPP;
7571
7572         if (!info->attrs[NL80211_ATTR_MAC])
7573                 return -EINVAL;
7574
7575         if (!rdev->ops->probe_client)
7576                 return -EOPNOTSUPP;
7577
7578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7579         if (!msg)
7580                 return -ENOMEM;
7581
7582         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7583                              NL80211_CMD_PROBE_CLIENT);
7584
7585         if (IS_ERR(hdr)) {
7586                 err = PTR_ERR(hdr);
7587                 goto free_msg;
7588         }
7589
7590         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7591
7592         err = rdev_probe_client(rdev, dev, addr, &cookie);
7593         if (err)
7594                 goto free_msg;
7595
7596         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7597                 goto nla_put_failure;
7598
7599         genlmsg_end(msg, hdr);
7600
7601         return genlmsg_reply(msg, info);
7602
7603  nla_put_failure:
7604         err = -ENOBUFS;
7605  free_msg:
7606         nlmsg_free(msg);
7607         return err;
7608 }
7609
7610 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7611 {
7612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7613         struct cfg80211_beacon_registration *reg, *nreg;
7614         int rv;
7615
7616         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
7617                 return -EOPNOTSUPP;
7618
7619         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
7620         if (!nreg)
7621                 return -ENOMEM;
7622
7623         /* First, check if already registered. */
7624         spin_lock_bh(&rdev->beacon_registrations_lock);
7625         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
7626                 if (reg->nlportid == info->snd_portid) {
7627                         rv = -EALREADY;
7628                         goto out_err;
7629                 }
7630         }
7631         /* Add it to the list */
7632         nreg->nlportid = info->snd_portid;
7633         list_add(&nreg->list, &rdev->beacon_registrations);
7634
7635         spin_unlock_bh(&rdev->beacon_registrations_lock);
7636
7637         return 0;
7638 out_err:
7639         spin_unlock_bh(&rdev->beacon_registrations_lock);
7640         kfree(nreg);
7641         return rv;
7642 }
7643
7644 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
7645 {
7646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7647         struct wireless_dev *wdev = info->user_ptr[1];
7648         int err;
7649
7650         if (!rdev->ops->start_p2p_device)
7651                 return -EOPNOTSUPP;
7652
7653         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7654                 return -EOPNOTSUPP;
7655
7656         if (wdev->p2p_started)
7657                 return 0;
7658
7659         mutex_lock(&rdev->devlist_mtx);
7660         err = cfg80211_can_add_interface(rdev, wdev->iftype);
7661         mutex_unlock(&rdev->devlist_mtx);
7662         if (err)
7663                 return err;
7664
7665         err = rdev_start_p2p_device(rdev, wdev);
7666         if (err)
7667                 return err;
7668
7669         wdev->p2p_started = true;
7670         mutex_lock(&rdev->devlist_mtx);
7671         rdev->opencount++;
7672         mutex_unlock(&rdev->devlist_mtx);
7673
7674         return 0;
7675 }
7676
7677 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7678 {
7679         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7680         struct wireless_dev *wdev = info->user_ptr[1];
7681
7682         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7683                 return -EOPNOTSUPP;
7684
7685         if (!rdev->ops->stop_p2p_device)
7686                 return -EOPNOTSUPP;
7687
7688         if (!wdev->p2p_started)
7689                 return 0;
7690
7691         rdev_stop_p2p_device(rdev, wdev);
7692         wdev->p2p_started = false;
7693
7694         mutex_lock(&rdev->devlist_mtx);
7695         rdev->opencount--;
7696         mutex_unlock(&rdev->devlist_mtx);
7697
7698         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7699                 rdev->scan_req->aborted = true;
7700                 ___cfg80211_scan_done(rdev, true);
7701         }
7702
7703         return 0;
7704 }
7705
7706 #define NL80211_FLAG_NEED_WIPHY         0x01
7707 #define NL80211_FLAG_NEED_NETDEV        0x02
7708 #define NL80211_FLAG_NEED_RTNL          0x04
7709 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7710 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7711                                          NL80211_FLAG_CHECK_NETDEV_UP)
7712 #define NL80211_FLAG_NEED_WDEV          0x10
7713 /* If a netdev is associated, it must be UP, P2P must be started */
7714 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7715                                          NL80211_FLAG_CHECK_NETDEV_UP)
7716
7717 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7718                             struct genl_info *info)
7719 {
7720         struct cfg80211_registered_device *rdev;
7721         struct wireless_dev *wdev;
7722         struct net_device *dev;
7723         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7724
7725         if (rtnl)
7726                 rtnl_lock();
7727
7728         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7729                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7730                 if (IS_ERR(rdev)) {
7731                         if (rtnl)
7732                                 rtnl_unlock();
7733                         return PTR_ERR(rdev);
7734                 }
7735                 info->user_ptr[0] = rdev;
7736         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7737                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7738                 mutex_lock(&cfg80211_mutex);
7739                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7740                                                   info->attrs);
7741                 if (IS_ERR(wdev)) {
7742                         mutex_unlock(&cfg80211_mutex);
7743                         if (rtnl)
7744                                 rtnl_unlock();
7745                         return PTR_ERR(wdev);
7746                 }
7747
7748                 dev = wdev->netdev;
7749                 rdev = wiphy_to_dev(wdev->wiphy);
7750
7751                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7752                         if (!dev) {
7753                                 mutex_unlock(&cfg80211_mutex);
7754                                 if (rtnl)
7755                                         rtnl_unlock();
7756                                 return -EINVAL;
7757                         }
7758
7759                         info->user_ptr[1] = dev;
7760                 } else {
7761                         info->user_ptr[1] = wdev;
7762                 }
7763
7764                 if (dev) {
7765                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7766                             !netif_running(dev)) {
7767                                 mutex_unlock(&cfg80211_mutex);
7768                                 if (rtnl)
7769                                         rtnl_unlock();
7770                                 return -ENETDOWN;
7771                         }
7772
7773                         dev_hold(dev);
7774                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7775                         if (!wdev->p2p_started) {
7776                                 mutex_unlock(&cfg80211_mutex);
7777                                 if (rtnl)
7778                                         rtnl_unlock();
7779                                 return -ENETDOWN;
7780                         }
7781                 }
7782
7783                 cfg80211_lock_rdev(rdev);
7784
7785                 mutex_unlock(&cfg80211_mutex);
7786
7787                 info->user_ptr[0] = rdev;
7788         }
7789
7790         return 0;
7791 }
7792
7793 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7794                               struct genl_info *info)
7795 {
7796         if (info->user_ptr[0])
7797                 cfg80211_unlock_rdev(info->user_ptr[0]);
7798         if (info->user_ptr[1]) {
7799                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7800                         struct wireless_dev *wdev = info->user_ptr[1];
7801
7802                         if (wdev->netdev)
7803                                 dev_put(wdev->netdev);
7804                 } else {
7805                         dev_put(info->user_ptr[1]);
7806                 }
7807         }
7808         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7809                 rtnl_unlock();
7810 }
7811
7812 static struct genl_ops nl80211_ops[] = {
7813         {
7814                 .cmd = NL80211_CMD_GET_WIPHY,
7815                 .doit = nl80211_get_wiphy,
7816                 .dumpit = nl80211_dump_wiphy,
7817                 .policy = nl80211_policy,
7818                 /* can be retrieved by unprivileged users */
7819                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7820         },
7821         {
7822                 .cmd = NL80211_CMD_SET_WIPHY,
7823                 .doit = nl80211_set_wiphy,
7824                 .policy = nl80211_policy,
7825                 .flags = GENL_ADMIN_PERM,
7826                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7827         },
7828         {
7829                 .cmd = NL80211_CMD_GET_INTERFACE,
7830                 .doit = nl80211_get_interface,
7831                 .dumpit = nl80211_dump_interface,
7832                 .policy = nl80211_policy,
7833                 /* can be retrieved by unprivileged users */
7834                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7835         },
7836         {
7837                 .cmd = NL80211_CMD_SET_INTERFACE,
7838                 .doit = nl80211_set_interface,
7839                 .policy = nl80211_policy,
7840                 .flags = GENL_ADMIN_PERM,
7841                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7842                                   NL80211_FLAG_NEED_RTNL,
7843         },
7844         {
7845                 .cmd = NL80211_CMD_NEW_INTERFACE,
7846                 .doit = nl80211_new_interface,
7847                 .policy = nl80211_policy,
7848                 .flags = GENL_ADMIN_PERM,
7849                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7850                                   NL80211_FLAG_NEED_RTNL,
7851         },
7852         {
7853                 .cmd = NL80211_CMD_DEL_INTERFACE,
7854                 .doit = nl80211_del_interface,
7855                 .policy = nl80211_policy,
7856                 .flags = GENL_ADMIN_PERM,
7857                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7858                                   NL80211_FLAG_NEED_RTNL,
7859         },
7860         {
7861                 .cmd = NL80211_CMD_GET_KEY,
7862                 .doit = nl80211_get_key,
7863                 .policy = nl80211_policy,
7864                 .flags = GENL_ADMIN_PERM,
7865                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7866                                   NL80211_FLAG_NEED_RTNL,
7867         },
7868         {
7869                 .cmd = NL80211_CMD_SET_KEY,
7870                 .doit = nl80211_set_key,
7871                 .policy = nl80211_policy,
7872                 .flags = GENL_ADMIN_PERM,
7873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7874                                   NL80211_FLAG_NEED_RTNL,
7875         },
7876         {
7877                 .cmd = NL80211_CMD_NEW_KEY,
7878                 .doit = nl80211_new_key,
7879                 .policy = nl80211_policy,
7880                 .flags = GENL_ADMIN_PERM,
7881                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7882                                   NL80211_FLAG_NEED_RTNL,
7883         },
7884         {
7885                 .cmd = NL80211_CMD_DEL_KEY,
7886                 .doit = nl80211_del_key,
7887                 .policy = nl80211_policy,
7888                 .flags = GENL_ADMIN_PERM,
7889                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7890                                   NL80211_FLAG_NEED_RTNL,
7891         },
7892         {
7893                 .cmd = NL80211_CMD_SET_BEACON,
7894                 .policy = nl80211_policy,
7895                 .flags = GENL_ADMIN_PERM,
7896                 .doit = nl80211_set_beacon,
7897                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7898                                   NL80211_FLAG_NEED_RTNL,
7899         },
7900         {
7901                 .cmd = NL80211_CMD_START_AP,
7902                 .policy = nl80211_policy,
7903                 .flags = GENL_ADMIN_PERM,
7904                 .doit = nl80211_start_ap,
7905                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7906                                   NL80211_FLAG_NEED_RTNL,
7907         },
7908         {
7909                 .cmd = NL80211_CMD_STOP_AP,
7910                 .policy = nl80211_policy,
7911                 .flags = GENL_ADMIN_PERM,
7912                 .doit = nl80211_stop_ap,
7913                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7914                                   NL80211_FLAG_NEED_RTNL,
7915         },
7916         {
7917                 .cmd = NL80211_CMD_GET_STATION,
7918                 .doit = nl80211_get_station,
7919                 .dumpit = nl80211_dump_station,
7920                 .policy = nl80211_policy,
7921                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7922                                   NL80211_FLAG_NEED_RTNL,
7923         },
7924         {
7925                 .cmd = NL80211_CMD_SET_STATION,
7926                 .doit = nl80211_set_station,
7927                 .policy = nl80211_policy,
7928                 .flags = GENL_ADMIN_PERM,
7929                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7930                                   NL80211_FLAG_NEED_RTNL,
7931         },
7932         {
7933                 .cmd = NL80211_CMD_NEW_STATION,
7934                 .doit = nl80211_new_station,
7935                 .policy = nl80211_policy,
7936                 .flags = GENL_ADMIN_PERM,
7937                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7938                                   NL80211_FLAG_NEED_RTNL,
7939         },
7940         {
7941                 .cmd = NL80211_CMD_DEL_STATION,
7942                 .doit = nl80211_del_station,
7943                 .policy = nl80211_policy,
7944                 .flags = GENL_ADMIN_PERM,
7945                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7946                                   NL80211_FLAG_NEED_RTNL,
7947         },
7948         {
7949                 .cmd = NL80211_CMD_GET_MPATH,
7950                 .doit = nl80211_get_mpath,
7951                 .dumpit = nl80211_dump_mpath,
7952                 .policy = nl80211_policy,
7953                 .flags = GENL_ADMIN_PERM,
7954                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7955                                   NL80211_FLAG_NEED_RTNL,
7956         },
7957         {
7958                 .cmd = NL80211_CMD_SET_MPATH,
7959                 .doit = nl80211_set_mpath,
7960                 .policy = nl80211_policy,
7961                 .flags = GENL_ADMIN_PERM,
7962                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7963                                   NL80211_FLAG_NEED_RTNL,
7964         },
7965         {
7966                 .cmd = NL80211_CMD_NEW_MPATH,
7967                 .doit = nl80211_new_mpath,
7968                 .policy = nl80211_policy,
7969                 .flags = GENL_ADMIN_PERM,
7970                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7971                                   NL80211_FLAG_NEED_RTNL,
7972         },
7973         {
7974                 .cmd = NL80211_CMD_DEL_MPATH,
7975                 .doit = nl80211_del_mpath,
7976                 .policy = nl80211_policy,
7977                 .flags = GENL_ADMIN_PERM,
7978                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7979                                   NL80211_FLAG_NEED_RTNL,
7980         },
7981         {
7982                 .cmd = NL80211_CMD_SET_BSS,
7983                 .doit = nl80211_set_bss,
7984                 .policy = nl80211_policy,
7985                 .flags = GENL_ADMIN_PERM,
7986                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7987                                   NL80211_FLAG_NEED_RTNL,
7988         },
7989         {
7990                 .cmd = NL80211_CMD_GET_REG,
7991                 .doit = nl80211_get_reg,
7992                 .policy = nl80211_policy,
7993                 /* can be retrieved by unprivileged users */
7994         },
7995         {
7996                 .cmd = NL80211_CMD_SET_REG,
7997                 .doit = nl80211_set_reg,
7998                 .policy = nl80211_policy,
7999                 .flags = GENL_ADMIN_PERM,
8000         },
8001         {
8002                 .cmd = NL80211_CMD_REQ_SET_REG,
8003                 .doit = nl80211_req_set_reg,
8004                 .policy = nl80211_policy,
8005                 .flags = GENL_ADMIN_PERM,
8006         },
8007         {
8008                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8009                 .doit = nl80211_get_mesh_config,
8010                 .policy = nl80211_policy,
8011                 /* can be retrieved by unprivileged users */
8012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8013                                   NL80211_FLAG_NEED_RTNL,
8014         },
8015         {
8016                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8017                 .doit = nl80211_update_mesh_config,
8018                 .policy = nl80211_policy,
8019                 .flags = GENL_ADMIN_PERM,
8020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8021                                   NL80211_FLAG_NEED_RTNL,
8022         },
8023         {
8024                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8025                 .doit = nl80211_trigger_scan,
8026                 .policy = nl80211_policy,
8027                 .flags = GENL_ADMIN_PERM,
8028                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8029                                   NL80211_FLAG_NEED_RTNL,
8030         },
8031         {
8032                 .cmd = NL80211_CMD_GET_SCAN,
8033                 .policy = nl80211_policy,
8034                 .dumpit = nl80211_dump_scan,
8035         },
8036         {
8037                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8038                 .doit = nl80211_start_sched_scan,
8039                 .policy = nl80211_policy,
8040                 .flags = GENL_ADMIN_PERM,
8041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8042                                   NL80211_FLAG_NEED_RTNL,
8043         },
8044         {
8045                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8046                 .doit = nl80211_stop_sched_scan,
8047                 .policy = nl80211_policy,
8048                 .flags = GENL_ADMIN_PERM,
8049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8050                                   NL80211_FLAG_NEED_RTNL,
8051         },
8052         {
8053                 .cmd = NL80211_CMD_AUTHENTICATE,
8054                 .doit = nl80211_authenticate,
8055                 .policy = nl80211_policy,
8056                 .flags = GENL_ADMIN_PERM,
8057                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8058                                   NL80211_FLAG_NEED_RTNL,
8059         },
8060         {
8061                 .cmd = NL80211_CMD_ASSOCIATE,
8062                 .doit = nl80211_associate,
8063                 .policy = nl80211_policy,
8064                 .flags = GENL_ADMIN_PERM,
8065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8066                                   NL80211_FLAG_NEED_RTNL,
8067         },
8068         {
8069                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8070                 .doit = nl80211_deauthenticate,
8071                 .policy = nl80211_policy,
8072                 .flags = GENL_ADMIN_PERM,
8073                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8074                                   NL80211_FLAG_NEED_RTNL,
8075         },
8076         {
8077                 .cmd = NL80211_CMD_DISASSOCIATE,
8078                 .doit = nl80211_disassociate,
8079                 .policy = nl80211_policy,
8080                 .flags = GENL_ADMIN_PERM,
8081                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8082                                   NL80211_FLAG_NEED_RTNL,
8083         },
8084         {
8085                 .cmd = NL80211_CMD_JOIN_IBSS,
8086                 .doit = nl80211_join_ibss,
8087                 .policy = nl80211_policy,
8088                 .flags = GENL_ADMIN_PERM,
8089                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8090                                   NL80211_FLAG_NEED_RTNL,
8091         },
8092         {
8093                 .cmd = NL80211_CMD_LEAVE_IBSS,
8094                 .doit = nl80211_leave_ibss,
8095                 .policy = nl80211_policy,
8096                 .flags = GENL_ADMIN_PERM,
8097                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8098                                   NL80211_FLAG_NEED_RTNL,
8099         },
8100 #ifdef CONFIG_NL80211_TESTMODE
8101         {
8102                 .cmd = NL80211_CMD_TESTMODE,
8103                 .doit = nl80211_testmode_do,
8104                 .dumpit = nl80211_testmode_dump,
8105                 .policy = nl80211_policy,
8106                 .flags = GENL_ADMIN_PERM,
8107                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8108                                   NL80211_FLAG_NEED_RTNL,
8109         },
8110 #endif
8111         {
8112                 .cmd = NL80211_CMD_CONNECT,
8113                 .doit = nl80211_connect,
8114                 .policy = nl80211_policy,
8115                 .flags = GENL_ADMIN_PERM,
8116                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8117                                   NL80211_FLAG_NEED_RTNL,
8118         },
8119         {
8120                 .cmd = NL80211_CMD_DISCONNECT,
8121                 .doit = nl80211_disconnect,
8122                 .policy = nl80211_policy,
8123                 .flags = GENL_ADMIN_PERM,
8124                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8125                                   NL80211_FLAG_NEED_RTNL,
8126         },
8127         {
8128                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8129                 .doit = nl80211_wiphy_netns,
8130                 .policy = nl80211_policy,
8131                 .flags = GENL_ADMIN_PERM,
8132                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8133                                   NL80211_FLAG_NEED_RTNL,
8134         },
8135         {
8136                 .cmd = NL80211_CMD_GET_SURVEY,
8137                 .policy = nl80211_policy,
8138                 .dumpit = nl80211_dump_survey,
8139         },
8140         {
8141                 .cmd = NL80211_CMD_SET_PMKSA,
8142                 .doit = nl80211_setdel_pmksa,
8143                 .policy = nl80211_policy,
8144                 .flags = GENL_ADMIN_PERM,
8145                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8146                                   NL80211_FLAG_NEED_RTNL,
8147         },
8148         {
8149                 .cmd = NL80211_CMD_DEL_PMKSA,
8150                 .doit = nl80211_setdel_pmksa,
8151                 .policy = nl80211_policy,
8152                 .flags = GENL_ADMIN_PERM,
8153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8154                                   NL80211_FLAG_NEED_RTNL,
8155         },
8156         {
8157                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8158                 .doit = nl80211_flush_pmksa,
8159                 .policy = nl80211_policy,
8160                 .flags = GENL_ADMIN_PERM,
8161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8162                                   NL80211_FLAG_NEED_RTNL,
8163         },
8164         {
8165                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8166                 .doit = nl80211_remain_on_channel,
8167                 .policy = nl80211_policy,
8168                 .flags = GENL_ADMIN_PERM,
8169                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8170                                   NL80211_FLAG_NEED_RTNL,
8171         },
8172         {
8173                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8174                 .doit = nl80211_cancel_remain_on_channel,
8175                 .policy = nl80211_policy,
8176                 .flags = GENL_ADMIN_PERM,
8177                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8178                                   NL80211_FLAG_NEED_RTNL,
8179         },
8180         {
8181                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8182                 .doit = nl80211_set_tx_bitrate_mask,
8183                 .policy = nl80211_policy,
8184                 .flags = GENL_ADMIN_PERM,
8185                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8186                                   NL80211_FLAG_NEED_RTNL,
8187         },
8188         {
8189                 .cmd = NL80211_CMD_REGISTER_FRAME,
8190                 .doit = nl80211_register_mgmt,
8191                 .policy = nl80211_policy,
8192                 .flags = GENL_ADMIN_PERM,
8193                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8194                                   NL80211_FLAG_NEED_RTNL,
8195         },
8196         {
8197                 .cmd = NL80211_CMD_FRAME,
8198                 .doit = nl80211_tx_mgmt,
8199                 .policy = nl80211_policy,
8200                 .flags = GENL_ADMIN_PERM,
8201                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8202                                   NL80211_FLAG_NEED_RTNL,
8203         },
8204         {
8205                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8206                 .doit = nl80211_tx_mgmt_cancel_wait,
8207                 .policy = nl80211_policy,
8208                 .flags = GENL_ADMIN_PERM,
8209                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8210                                   NL80211_FLAG_NEED_RTNL,
8211         },
8212         {
8213                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8214                 .doit = nl80211_set_power_save,
8215                 .policy = nl80211_policy,
8216                 .flags = GENL_ADMIN_PERM,
8217                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8218                                   NL80211_FLAG_NEED_RTNL,
8219         },
8220         {
8221                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8222                 .doit = nl80211_get_power_save,
8223                 .policy = nl80211_policy,
8224                 /* can be retrieved by unprivileged users */
8225                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8226                                   NL80211_FLAG_NEED_RTNL,
8227         },
8228         {
8229                 .cmd = NL80211_CMD_SET_CQM,
8230                 .doit = nl80211_set_cqm,
8231                 .policy = nl80211_policy,
8232                 .flags = GENL_ADMIN_PERM,
8233                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8234                                   NL80211_FLAG_NEED_RTNL,
8235         },
8236         {
8237                 .cmd = NL80211_CMD_SET_CHANNEL,
8238                 .doit = nl80211_set_channel,
8239                 .policy = nl80211_policy,
8240                 .flags = GENL_ADMIN_PERM,
8241                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8242                                   NL80211_FLAG_NEED_RTNL,
8243         },
8244         {
8245                 .cmd = NL80211_CMD_SET_WDS_PEER,
8246                 .doit = nl80211_set_wds_peer,
8247                 .policy = nl80211_policy,
8248                 .flags = GENL_ADMIN_PERM,
8249                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8250                                   NL80211_FLAG_NEED_RTNL,
8251         },
8252         {
8253                 .cmd = NL80211_CMD_JOIN_MESH,
8254                 .doit = nl80211_join_mesh,
8255                 .policy = nl80211_policy,
8256                 .flags = GENL_ADMIN_PERM,
8257                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8258                                   NL80211_FLAG_NEED_RTNL,
8259         },
8260         {
8261                 .cmd = NL80211_CMD_LEAVE_MESH,
8262                 .doit = nl80211_leave_mesh,
8263                 .policy = nl80211_policy,
8264                 .flags = GENL_ADMIN_PERM,
8265                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8266                                   NL80211_FLAG_NEED_RTNL,
8267         },
8268 #ifdef CONFIG_PM
8269         {
8270                 .cmd = NL80211_CMD_GET_WOWLAN,
8271                 .doit = nl80211_get_wowlan,
8272                 .policy = nl80211_policy,
8273                 /* can be retrieved by unprivileged users */
8274                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8275                                   NL80211_FLAG_NEED_RTNL,
8276         },
8277         {
8278                 .cmd = NL80211_CMD_SET_WOWLAN,
8279                 .doit = nl80211_set_wowlan,
8280                 .policy = nl80211_policy,
8281                 .flags = GENL_ADMIN_PERM,
8282                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8283                                   NL80211_FLAG_NEED_RTNL,
8284         },
8285 #endif
8286         {
8287                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8288                 .doit = nl80211_set_rekey_data,
8289                 .policy = nl80211_policy,
8290                 .flags = GENL_ADMIN_PERM,
8291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8292                                   NL80211_FLAG_NEED_RTNL,
8293         },
8294         {
8295                 .cmd = NL80211_CMD_TDLS_MGMT,
8296                 .doit = nl80211_tdls_mgmt,
8297                 .policy = nl80211_policy,
8298                 .flags = GENL_ADMIN_PERM,
8299                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8300                                   NL80211_FLAG_NEED_RTNL,
8301         },
8302         {
8303                 .cmd = NL80211_CMD_TDLS_OPER,
8304                 .doit = nl80211_tdls_oper,
8305                 .policy = nl80211_policy,
8306                 .flags = GENL_ADMIN_PERM,
8307                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8308                                   NL80211_FLAG_NEED_RTNL,
8309         },
8310         {
8311                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8312                 .doit = nl80211_register_unexpected_frame,
8313                 .policy = nl80211_policy,
8314                 .flags = GENL_ADMIN_PERM,
8315                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8316                                   NL80211_FLAG_NEED_RTNL,
8317         },
8318         {
8319                 .cmd = NL80211_CMD_PROBE_CLIENT,
8320                 .doit = nl80211_probe_client,
8321                 .policy = nl80211_policy,
8322                 .flags = GENL_ADMIN_PERM,
8323                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8324                                   NL80211_FLAG_NEED_RTNL,
8325         },
8326         {
8327                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8328                 .doit = nl80211_register_beacons,
8329                 .policy = nl80211_policy,
8330                 .flags = GENL_ADMIN_PERM,
8331                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8332                                   NL80211_FLAG_NEED_RTNL,
8333         },
8334         {
8335                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8336                 .doit = nl80211_set_noack_map,
8337                 .policy = nl80211_policy,
8338                 .flags = GENL_ADMIN_PERM,
8339                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8340                                   NL80211_FLAG_NEED_RTNL,
8341         },
8342         {
8343                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8344                 .doit = nl80211_start_p2p_device,
8345                 .policy = nl80211_policy,
8346                 .flags = GENL_ADMIN_PERM,
8347                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8348                                   NL80211_FLAG_NEED_RTNL,
8349         },
8350         {
8351                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8352                 .doit = nl80211_stop_p2p_device,
8353                 .policy = nl80211_policy,
8354                 .flags = GENL_ADMIN_PERM,
8355                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8356                                   NL80211_FLAG_NEED_RTNL,
8357         },
8358         {
8359                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8360                 .doit = nl80211_set_mcast_rate,
8361                 .policy = nl80211_policy,
8362                 .flags = GENL_ADMIN_PERM,
8363                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8364                                   NL80211_FLAG_NEED_RTNL,
8365         },
8366         {
8367                 .cmd = NL80211_CMD_SET_MAC_ACL,
8368                 .doit = nl80211_set_mac_acl,
8369                 .policy = nl80211_policy,
8370                 .flags = GENL_ADMIN_PERM,
8371                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8372                                   NL80211_FLAG_NEED_RTNL,
8373         },
8374         {
8375                 .cmd = NL80211_CMD_RADAR_DETECT,
8376                 .doit = nl80211_start_radar_detection,
8377                 .policy = nl80211_policy,
8378                 .flags = GENL_ADMIN_PERM,
8379                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8380                                   NL80211_FLAG_NEED_RTNL,
8381         },
8382 };
8383
8384 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8385         .name = "mlme",
8386 };
8387
8388 /* multicast groups */
8389 static struct genl_multicast_group nl80211_config_mcgrp = {
8390         .name = "config",
8391 };
8392 static struct genl_multicast_group nl80211_scan_mcgrp = {
8393         .name = "scan",
8394 };
8395 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8396         .name = "regulatory",
8397 };
8398
8399 /* notification functions */
8400
8401 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8402 {
8403         struct sk_buff *msg;
8404
8405         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8406         if (!msg)
8407                 return;
8408
8409         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
8410                 nlmsg_free(msg);
8411                 return;
8412         }
8413
8414         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8415                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8416 }
8417
8418 static int nl80211_add_scan_req(struct sk_buff *msg,
8419                                 struct cfg80211_registered_device *rdev)
8420 {
8421         struct cfg80211_scan_request *req = rdev->scan_req;
8422         struct nlattr *nest;
8423         int i;
8424
8425         ASSERT_RDEV_LOCK(rdev);
8426
8427         if (WARN_ON(!req))
8428                 return 0;
8429
8430         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8431         if (!nest)
8432                 goto nla_put_failure;
8433         for (i = 0; i < req->n_ssids; i++) {
8434                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8435                         goto nla_put_failure;
8436         }
8437         nla_nest_end(msg, nest);
8438
8439         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8440         if (!nest)
8441                 goto nla_put_failure;
8442         for (i = 0; i < req->n_channels; i++) {
8443                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8444                         goto nla_put_failure;
8445         }
8446         nla_nest_end(msg, nest);
8447
8448         if (req->ie &&
8449             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8450                 goto nla_put_failure;
8451
8452         if (req->flags)
8453                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8454
8455         return 0;
8456  nla_put_failure:
8457         return -ENOBUFS;
8458 }
8459
8460 static int nl80211_send_scan_msg(struct sk_buff *msg,
8461                                  struct cfg80211_registered_device *rdev,
8462                                  struct wireless_dev *wdev,
8463                                  u32 portid, u32 seq, int flags,
8464                                  u32 cmd)
8465 {
8466         void *hdr;
8467
8468         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8469         if (!hdr)
8470                 return -1;
8471
8472         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8473             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8474                                          wdev->netdev->ifindex)) ||
8475             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8476                 goto nla_put_failure;
8477
8478         /* ignore errors and send incomplete event anyway */
8479         nl80211_add_scan_req(msg, rdev);
8480
8481         return genlmsg_end(msg, hdr);
8482
8483  nla_put_failure:
8484         genlmsg_cancel(msg, hdr);
8485         return -EMSGSIZE;
8486 }
8487
8488 static int
8489 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8490                             struct cfg80211_registered_device *rdev,
8491                             struct net_device *netdev,
8492                             u32 portid, u32 seq, int flags, u32 cmd)
8493 {
8494         void *hdr;
8495
8496         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8497         if (!hdr)
8498                 return -1;
8499
8500         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8501             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8502                 goto nla_put_failure;
8503
8504         return genlmsg_end(msg, hdr);
8505
8506  nla_put_failure:
8507         genlmsg_cancel(msg, hdr);
8508         return -EMSGSIZE;
8509 }
8510
8511 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8512                              struct wireless_dev *wdev)
8513 {
8514         struct sk_buff *msg;
8515
8516         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8517         if (!msg)
8518                 return;
8519
8520         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8521                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8522                 nlmsg_free(msg);
8523                 return;
8524         }
8525
8526         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8527                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8528 }
8529
8530 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8531                             struct wireless_dev *wdev)
8532 {
8533         struct sk_buff *msg;
8534
8535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8536         if (!msg)
8537                 return;
8538
8539         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8540                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8541                 nlmsg_free(msg);
8542                 return;
8543         }
8544
8545         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8546                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8547 }
8548
8549 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8550                                struct wireless_dev *wdev)
8551 {
8552         struct sk_buff *msg;
8553
8554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8555         if (!msg)
8556                 return;
8557
8558         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8559                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8560                 nlmsg_free(msg);
8561                 return;
8562         }
8563
8564         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8565                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8566 }
8567
8568 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8569                                      struct net_device *netdev)
8570 {
8571         struct sk_buff *msg;
8572
8573         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8574         if (!msg)
8575                 return;
8576
8577         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8578                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
8579                 nlmsg_free(msg);
8580                 return;
8581         }
8582
8583         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8584                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8585 }
8586
8587 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
8588                              struct net_device *netdev, u32 cmd)
8589 {
8590         struct sk_buff *msg;
8591
8592         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8593         if (!msg)
8594                 return;
8595
8596         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
8597                 nlmsg_free(msg);
8598                 return;
8599         }
8600
8601         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8602                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8603 }
8604
8605 /*
8606  * This can happen on global regulatory changes or device specific settings
8607  * based on custom world regulatory domains.
8608  */
8609 void nl80211_send_reg_change_event(struct regulatory_request *request)
8610 {
8611         struct sk_buff *msg;
8612         void *hdr;
8613
8614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8615         if (!msg)
8616                 return;
8617
8618         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
8619         if (!hdr) {
8620                 nlmsg_free(msg);
8621                 return;
8622         }
8623
8624         /* Userspace can always count this one always being set */
8625         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
8626                 goto nla_put_failure;
8627
8628         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
8629                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8630                                NL80211_REGDOM_TYPE_WORLD))
8631                         goto nla_put_failure;
8632         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
8633                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8634                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
8635                         goto nla_put_failure;
8636         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
8637                    request->intersect) {
8638                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8639                                NL80211_REGDOM_TYPE_INTERSECTION))
8640                         goto nla_put_failure;
8641         } else {
8642                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8643                                NL80211_REGDOM_TYPE_COUNTRY) ||
8644                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
8645                                    request->alpha2))
8646                         goto nla_put_failure;
8647         }
8648
8649         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
8650             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
8651                 goto nla_put_failure;
8652
8653         genlmsg_end(msg, hdr);
8654
8655         rcu_read_lock();
8656         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8657                                 GFP_ATOMIC);
8658         rcu_read_unlock();
8659
8660         return;
8661
8662 nla_put_failure:
8663         genlmsg_cancel(msg, hdr);
8664         nlmsg_free(msg);
8665 }
8666
8667 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
8668                                     struct net_device *netdev,
8669                                     const u8 *buf, size_t len,
8670                                     enum nl80211_commands cmd, gfp_t gfp)
8671 {
8672         struct sk_buff *msg;
8673         void *hdr;
8674
8675         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8676         if (!msg)
8677                 return;
8678
8679         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8680         if (!hdr) {
8681                 nlmsg_free(msg);
8682                 return;
8683         }
8684
8685         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8686             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8687             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8688                 goto nla_put_failure;
8689
8690         genlmsg_end(msg, hdr);
8691
8692         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8693                                 nl80211_mlme_mcgrp.id, gfp);
8694         return;
8695
8696  nla_put_failure:
8697         genlmsg_cancel(msg, hdr);
8698         nlmsg_free(msg);
8699 }
8700
8701 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8702                           struct net_device *netdev, const u8 *buf,
8703                           size_t len, gfp_t gfp)
8704 {
8705         nl80211_send_mlme_event(rdev, netdev, buf, len,
8706                                 NL80211_CMD_AUTHENTICATE, gfp);
8707 }
8708
8709 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8710                            struct net_device *netdev, const u8 *buf,
8711                            size_t len, gfp_t gfp)
8712 {
8713         nl80211_send_mlme_event(rdev, netdev, buf, len,
8714                                 NL80211_CMD_ASSOCIATE, gfp);
8715 }
8716
8717 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8718                          struct net_device *netdev, const u8 *buf,
8719                          size_t len, gfp_t gfp)
8720 {
8721         nl80211_send_mlme_event(rdev, netdev, buf, len,
8722                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8723 }
8724
8725 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8726                            struct net_device *netdev, const u8 *buf,
8727                            size_t len, gfp_t gfp)
8728 {
8729         nl80211_send_mlme_event(rdev, netdev, buf, len,
8730                                 NL80211_CMD_DISASSOCIATE, gfp);
8731 }
8732
8733 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8734                                 struct net_device *netdev, const u8 *buf,
8735                                 size_t len, gfp_t gfp)
8736 {
8737         nl80211_send_mlme_event(rdev, netdev, buf, len,
8738                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8739 }
8740
8741 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8742                                   struct net_device *netdev, const u8 *buf,
8743                                   size_t len, gfp_t gfp)
8744 {
8745         nl80211_send_mlme_event(rdev, netdev, buf, len,
8746                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8747 }
8748
8749 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8750                                       struct net_device *netdev, int cmd,
8751                                       const u8 *addr, gfp_t gfp)
8752 {
8753         struct sk_buff *msg;
8754         void *hdr;
8755
8756         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8757         if (!msg)
8758                 return;
8759
8760         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8761         if (!hdr) {
8762                 nlmsg_free(msg);
8763                 return;
8764         }
8765
8766         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8767             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8768             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8769             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8770                 goto nla_put_failure;
8771
8772         genlmsg_end(msg, hdr);
8773
8774         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8775                                 nl80211_mlme_mcgrp.id, gfp);
8776         return;
8777
8778  nla_put_failure:
8779         genlmsg_cancel(msg, hdr);
8780         nlmsg_free(msg);
8781 }
8782
8783 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8784                                struct net_device *netdev, const u8 *addr,
8785                                gfp_t gfp)
8786 {
8787         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8788                                   addr, gfp);
8789 }
8790
8791 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8792                                 struct net_device *netdev, const u8 *addr,
8793                                 gfp_t gfp)
8794 {
8795         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8796                                   addr, gfp);
8797 }
8798
8799 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8800                                  struct net_device *netdev, const u8 *bssid,
8801                                  const u8 *req_ie, size_t req_ie_len,
8802                                  const u8 *resp_ie, size_t resp_ie_len,
8803                                  u16 status, gfp_t gfp)
8804 {
8805         struct sk_buff *msg;
8806         void *hdr;
8807
8808         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8809         if (!msg)
8810                 return;
8811
8812         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8813         if (!hdr) {
8814                 nlmsg_free(msg);
8815                 return;
8816         }
8817
8818         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8819             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8820             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8821             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8822             (req_ie &&
8823              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8824             (resp_ie &&
8825              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8826                 goto nla_put_failure;
8827
8828         genlmsg_end(msg, hdr);
8829
8830         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8831                                 nl80211_mlme_mcgrp.id, gfp);
8832         return;
8833
8834  nla_put_failure:
8835         genlmsg_cancel(msg, hdr);
8836         nlmsg_free(msg);
8837
8838 }
8839
8840 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8841                          struct net_device *netdev, const u8 *bssid,
8842                          const u8 *req_ie, size_t req_ie_len,
8843                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8844 {
8845         struct sk_buff *msg;
8846         void *hdr;
8847
8848         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8849         if (!msg)
8850                 return;
8851
8852         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8853         if (!hdr) {
8854                 nlmsg_free(msg);
8855                 return;
8856         }
8857
8858         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8859             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8860             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8861             (req_ie &&
8862              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8863             (resp_ie &&
8864              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8865                 goto nla_put_failure;
8866
8867         genlmsg_end(msg, hdr);
8868
8869         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8870                                 nl80211_mlme_mcgrp.id, gfp);
8871         return;
8872
8873  nla_put_failure:
8874         genlmsg_cancel(msg, hdr);
8875         nlmsg_free(msg);
8876
8877 }
8878
8879 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8880                                struct net_device *netdev, u16 reason,
8881                                const u8 *ie, size_t ie_len, bool from_ap)
8882 {
8883         struct sk_buff *msg;
8884         void *hdr;
8885
8886         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8887         if (!msg)
8888                 return;
8889
8890         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8891         if (!hdr) {
8892                 nlmsg_free(msg);
8893                 return;
8894         }
8895
8896         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8897             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8898             (from_ap && reason &&
8899              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8900             (from_ap &&
8901              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8902             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8903                 goto nla_put_failure;
8904
8905         genlmsg_end(msg, hdr);
8906
8907         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8908                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8909         return;
8910
8911  nla_put_failure:
8912         genlmsg_cancel(msg, hdr);
8913         nlmsg_free(msg);
8914
8915 }
8916
8917 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8918                              struct net_device *netdev, const u8 *bssid,
8919                              gfp_t gfp)
8920 {
8921         struct sk_buff *msg;
8922         void *hdr;
8923
8924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8925         if (!msg)
8926                 return;
8927
8928         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8929         if (!hdr) {
8930                 nlmsg_free(msg);
8931                 return;
8932         }
8933
8934         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8935             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8936             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8937                 goto nla_put_failure;
8938
8939         genlmsg_end(msg, hdr);
8940
8941         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8942                                 nl80211_mlme_mcgrp.id, gfp);
8943         return;
8944
8945  nla_put_failure:
8946         genlmsg_cancel(msg, hdr);
8947         nlmsg_free(msg);
8948 }
8949
8950 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8951                 struct net_device *netdev,
8952                 const u8 *macaddr, const u8* ie, u8 ie_len,
8953                 gfp_t gfp)
8954 {
8955         struct sk_buff *msg;
8956         void *hdr;
8957
8958         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8959         if (!msg)
8960                 return;
8961
8962         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8963         if (!hdr) {
8964                 nlmsg_free(msg);
8965                 return;
8966         }
8967
8968         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8969             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8970             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8971             (ie_len && ie &&
8972              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8973                 goto nla_put_failure;
8974
8975         genlmsg_end(msg, hdr);
8976
8977         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8978                                 nl80211_mlme_mcgrp.id, gfp);
8979         return;
8980
8981  nla_put_failure:
8982         genlmsg_cancel(msg, hdr);
8983         nlmsg_free(msg);
8984 }
8985
8986 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8987                                  struct net_device *netdev, const u8 *addr,
8988                                  enum nl80211_key_type key_type, int key_id,
8989                                  const u8 *tsc, gfp_t gfp)
8990 {
8991         struct sk_buff *msg;
8992         void *hdr;
8993
8994         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8995         if (!msg)
8996                 return;
8997
8998         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8999         if (!hdr) {
9000                 nlmsg_free(msg);
9001                 return;
9002         }
9003
9004         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9005             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9006             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9007             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9008             (key_id != -1 &&
9009              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9010             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9011                 goto nla_put_failure;
9012
9013         genlmsg_end(msg, hdr);
9014
9015         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9016                                 nl80211_mlme_mcgrp.id, gfp);
9017         return;
9018
9019  nla_put_failure:
9020         genlmsg_cancel(msg, hdr);
9021         nlmsg_free(msg);
9022 }
9023
9024 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9025                                     struct ieee80211_channel *channel_before,
9026                                     struct ieee80211_channel *channel_after)
9027 {
9028         struct sk_buff *msg;
9029         void *hdr;
9030         struct nlattr *nl_freq;
9031
9032         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9033         if (!msg)
9034                 return;
9035
9036         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9037         if (!hdr) {
9038                 nlmsg_free(msg);
9039                 return;
9040         }
9041
9042         /*
9043          * Since we are applying the beacon hint to a wiphy we know its
9044          * wiphy_idx is valid
9045          */
9046         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9047                 goto nla_put_failure;
9048
9049         /* Before */
9050         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9051         if (!nl_freq)
9052                 goto nla_put_failure;
9053         if (nl80211_msg_put_channel(msg, channel_before))
9054                 goto nla_put_failure;
9055         nla_nest_end(msg, nl_freq);
9056
9057         /* After */
9058         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9059         if (!nl_freq)
9060                 goto nla_put_failure;
9061         if (nl80211_msg_put_channel(msg, channel_after))
9062                 goto nla_put_failure;
9063         nla_nest_end(msg, nl_freq);
9064
9065         genlmsg_end(msg, hdr);
9066
9067         rcu_read_lock();
9068         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9069                                 GFP_ATOMIC);
9070         rcu_read_unlock();
9071
9072         return;
9073
9074 nla_put_failure:
9075         genlmsg_cancel(msg, hdr);
9076         nlmsg_free(msg);
9077 }
9078
9079 static void nl80211_send_remain_on_chan_event(
9080         int cmd, struct cfg80211_registered_device *rdev,
9081         struct wireless_dev *wdev, u64 cookie,
9082         struct ieee80211_channel *chan,
9083         unsigned int duration, gfp_t gfp)
9084 {
9085         struct sk_buff *msg;
9086         void *hdr;
9087
9088         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9089         if (!msg)
9090                 return;
9091
9092         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9093         if (!hdr) {
9094                 nlmsg_free(msg);
9095                 return;
9096         }
9097
9098         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9099             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9100                                          wdev->netdev->ifindex)) ||
9101             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9102             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9103             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9104                         NL80211_CHAN_NO_HT) ||
9105             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9106                 goto nla_put_failure;
9107
9108         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9109             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9110                 goto nla_put_failure;
9111
9112         genlmsg_end(msg, hdr);
9113
9114         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9115                                 nl80211_mlme_mcgrp.id, gfp);
9116         return;
9117
9118  nla_put_failure:
9119         genlmsg_cancel(msg, hdr);
9120         nlmsg_free(msg);
9121 }
9122
9123 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
9124                                     struct wireless_dev *wdev, u64 cookie,
9125                                     struct ieee80211_channel *chan,
9126                                     unsigned int duration, gfp_t gfp)
9127 {
9128         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9129                                           rdev, wdev, cookie, chan,
9130                                           duration, gfp);
9131 }
9132
9133 void nl80211_send_remain_on_channel_cancel(
9134         struct cfg80211_registered_device *rdev,
9135         struct wireless_dev *wdev,
9136         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
9137 {
9138         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9139                                           rdev, wdev, cookie, chan, 0, gfp);
9140 }
9141
9142 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
9143                             struct net_device *dev, const u8 *mac_addr,
9144                             struct station_info *sinfo, gfp_t gfp)
9145 {
9146         struct sk_buff *msg;
9147
9148         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9149         if (!msg)
9150                 return;
9151
9152         if (nl80211_send_station(msg, 0, 0, 0,
9153                                  rdev, dev, mac_addr, sinfo) < 0) {
9154                 nlmsg_free(msg);
9155                 return;
9156         }
9157
9158         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9159                                 nl80211_mlme_mcgrp.id, gfp);
9160 }
9161
9162 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
9163                                 struct net_device *dev, const u8 *mac_addr,
9164                                 gfp_t gfp)
9165 {
9166         struct sk_buff *msg;
9167         void *hdr;
9168
9169         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9170         if (!msg)
9171                 return;
9172
9173         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9174         if (!hdr) {
9175                 nlmsg_free(msg);
9176                 return;
9177         }
9178
9179         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9180             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9181                 goto nla_put_failure;
9182
9183         genlmsg_end(msg, hdr);
9184
9185         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9186                                 nl80211_mlme_mcgrp.id, gfp);
9187         return;
9188
9189  nla_put_failure:
9190         genlmsg_cancel(msg, hdr);
9191         nlmsg_free(msg);
9192 }
9193
9194 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
9195                                     struct net_device *dev, const u8 *mac_addr,
9196                                     enum nl80211_connect_failed_reason reason,
9197                                     gfp_t gfp)
9198 {
9199         struct sk_buff *msg;
9200         void *hdr;
9201
9202         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9203         if (!msg)
9204                 return;
9205
9206         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9207         if (!hdr) {
9208                 nlmsg_free(msg);
9209                 return;
9210         }
9211
9212         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9213             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9214             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9215                 goto nla_put_failure;
9216
9217         genlmsg_end(msg, hdr);
9218
9219         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9220                                 nl80211_mlme_mcgrp.id, gfp);
9221         return;
9222
9223  nla_put_failure:
9224         genlmsg_cancel(msg, hdr);
9225         nlmsg_free(msg);
9226 }
9227
9228 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9229                                        const u8 *addr, gfp_t gfp)
9230 {
9231         struct wireless_dev *wdev = dev->ieee80211_ptr;
9232         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9233         struct sk_buff *msg;
9234         void *hdr;
9235         int err;
9236         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9237
9238         if (!nlportid)
9239                 return false;
9240
9241         msg = nlmsg_new(100, gfp);
9242         if (!msg)
9243                 return true;
9244
9245         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9246         if (!hdr) {
9247                 nlmsg_free(msg);
9248                 return true;
9249         }
9250
9251         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9252             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9253             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9254                 goto nla_put_failure;
9255
9256         err = genlmsg_end(msg, hdr);
9257         if (err < 0) {
9258                 nlmsg_free(msg);
9259                 return true;
9260         }
9261
9262         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9263         return true;
9264
9265  nla_put_failure:
9266         genlmsg_cancel(msg, hdr);
9267         nlmsg_free(msg);
9268         return true;
9269 }
9270
9271 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
9272 {
9273         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9274                                           addr, gfp);
9275 }
9276
9277 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
9278                                     const u8 *addr, gfp_t gfp)
9279 {
9280         return __nl80211_unexpected_frame(dev,
9281                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9282                                           addr, gfp);
9283 }
9284
9285 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9286                       struct wireless_dev *wdev, u32 nlportid,
9287                       int freq, int sig_dbm,
9288                       const u8 *buf, size_t len, gfp_t gfp)
9289 {
9290         struct net_device *netdev = wdev->netdev;
9291         struct sk_buff *msg;
9292         void *hdr;
9293
9294         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9295         if (!msg)
9296                 return -ENOMEM;
9297
9298         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9299         if (!hdr) {
9300                 nlmsg_free(msg);
9301                 return -ENOMEM;
9302         }
9303
9304         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9305             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9306                                         netdev->ifindex)) ||
9307             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9308             (sig_dbm &&
9309              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9310             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9311                 goto nla_put_failure;
9312
9313         genlmsg_end(msg, hdr);
9314
9315         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9316
9317  nla_put_failure:
9318         genlmsg_cancel(msg, hdr);
9319         nlmsg_free(msg);
9320         return -ENOBUFS;
9321 }
9322
9323 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
9324                                  struct wireless_dev *wdev, u64 cookie,
9325                                  const u8 *buf, size_t len, bool ack,
9326                                  gfp_t gfp)
9327 {
9328         struct net_device *netdev = wdev->netdev;
9329         struct sk_buff *msg;
9330         void *hdr;
9331
9332         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9333         if (!msg)
9334                 return;
9335
9336         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9337         if (!hdr) {
9338                 nlmsg_free(msg);
9339                 return;
9340         }
9341
9342         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9343             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9344                                    netdev->ifindex)) ||
9345             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9346             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9347             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9348                 goto nla_put_failure;
9349
9350         genlmsg_end(msg, hdr);
9351
9352         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9353         return;
9354
9355  nla_put_failure:
9356         genlmsg_cancel(msg, hdr);
9357         nlmsg_free(msg);
9358 }
9359
9360 void
9361 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
9362                              struct net_device *netdev,
9363                              enum nl80211_cqm_rssi_threshold_event rssi_event,
9364                              gfp_t gfp)
9365 {
9366         struct sk_buff *msg;
9367         struct nlattr *pinfoattr;
9368         void *hdr;
9369
9370         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9371         if (!msg)
9372                 return;
9373
9374         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9375         if (!hdr) {
9376                 nlmsg_free(msg);
9377                 return;
9378         }
9379
9380         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9381             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9382                 goto nla_put_failure;
9383
9384         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9385         if (!pinfoattr)
9386                 goto nla_put_failure;
9387
9388         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9389                         rssi_event))
9390                 goto nla_put_failure;
9391
9392         nla_nest_end(msg, pinfoattr);
9393
9394         genlmsg_end(msg, hdr);
9395
9396         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9397                                 nl80211_mlme_mcgrp.id, gfp);
9398         return;
9399
9400  nla_put_failure:
9401         genlmsg_cancel(msg, hdr);
9402         nlmsg_free(msg);
9403 }
9404
9405 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9406                               struct net_device *netdev, const u8 *bssid,
9407                               const u8 *replay_ctr, gfp_t gfp)
9408 {
9409         struct sk_buff *msg;
9410         struct nlattr *rekey_attr;
9411         void *hdr;
9412
9413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9414         if (!msg)
9415                 return;
9416
9417         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9418         if (!hdr) {
9419                 nlmsg_free(msg);
9420                 return;
9421         }
9422
9423         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9424             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9425             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9426                 goto nla_put_failure;
9427
9428         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9429         if (!rekey_attr)
9430                 goto nla_put_failure;
9431
9432         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9433                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9434                 goto nla_put_failure;
9435
9436         nla_nest_end(msg, rekey_attr);
9437
9438         genlmsg_end(msg, hdr);
9439
9440         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9441                                 nl80211_mlme_mcgrp.id, gfp);
9442         return;
9443
9444  nla_put_failure:
9445         genlmsg_cancel(msg, hdr);
9446         nlmsg_free(msg);
9447 }
9448
9449 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9450                                     struct net_device *netdev, int index,
9451                                     const u8 *bssid, bool preauth, gfp_t gfp)
9452 {
9453         struct sk_buff *msg;
9454         struct nlattr *attr;
9455         void *hdr;
9456
9457         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9458         if (!msg)
9459                 return;
9460
9461         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9462         if (!hdr) {
9463                 nlmsg_free(msg);
9464                 return;
9465         }
9466
9467         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9468             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9469                 goto nla_put_failure;
9470
9471         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9472         if (!attr)
9473                 goto nla_put_failure;
9474
9475         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9476             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9477             (preauth &&
9478              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9479                 goto nla_put_failure;
9480
9481         nla_nest_end(msg, attr);
9482
9483         genlmsg_end(msg, hdr);
9484
9485         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9486                                 nl80211_mlme_mcgrp.id, gfp);
9487         return;
9488
9489  nla_put_failure:
9490         genlmsg_cancel(msg, hdr);
9491         nlmsg_free(msg);
9492 }
9493
9494 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
9495                               struct net_device *netdev,
9496                               struct cfg80211_chan_def *chandef, gfp_t gfp)
9497 {
9498         struct sk_buff *msg;
9499         void *hdr;
9500
9501         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9502         if (!msg)
9503                 return;
9504
9505         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
9506         if (!hdr) {
9507                 nlmsg_free(msg);
9508                 return;
9509         }
9510
9511         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9512                 goto nla_put_failure;
9513
9514         if (nl80211_send_chandef(msg, chandef))
9515                 goto nla_put_failure;
9516
9517         genlmsg_end(msg, hdr);
9518
9519         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9520                                 nl80211_mlme_mcgrp.id, gfp);
9521         return;
9522
9523  nla_put_failure:
9524         genlmsg_cancel(msg, hdr);
9525         nlmsg_free(msg);
9526 }
9527
9528 void
9529 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
9530                             struct net_device *netdev, const u8 *peer,
9531                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
9532 {
9533         struct sk_buff *msg;
9534         struct nlattr *pinfoattr;
9535         void *hdr;
9536
9537         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9538         if (!msg)
9539                 return;
9540
9541         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9542         if (!hdr) {
9543                 nlmsg_free(msg);
9544                 return;
9545         }
9546
9547         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9548             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9549             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9550                 goto nla_put_failure;
9551
9552         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9553         if (!pinfoattr)
9554                 goto nla_put_failure;
9555
9556         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
9557                 goto nla_put_failure;
9558
9559         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
9560                 goto nla_put_failure;
9561
9562         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
9563                 goto nla_put_failure;
9564
9565         nla_nest_end(msg, pinfoattr);
9566
9567         genlmsg_end(msg, hdr);
9568
9569         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9570                                 nl80211_mlme_mcgrp.id, gfp);
9571         return;
9572
9573  nla_put_failure:
9574         genlmsg_cancel(msg, hdr);
9575         nlmsg_free(msg);
9576 }
9577
9578 void
9579 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
9580                      struct cfg80211_chan_def *chandef,
9581                      enum nl80211_radar_event event,
9582                      struct net_device *netdev, gfp_t gfp)
9583 {
9584         struct sk_buff *msg;
9585         void *hdr;
9586
9587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9588         if (!msg)
9589                 return;
9590
9591         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
9592         if (!hdr) {
9593                 nlmsg_free(msg);
9594                 return;
9595         }
9596
9597         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9598                 goto nla_put_failure;
9599
9600         /* NOP and radar events don't need a netdev parameter */
9601         if (netdev) {
9602                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
9603
9604                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9605                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9606                         goto nla_put_failure;
9607         }
9608
9609         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
9610                 goto nla_put_failure;
9611
9612         if (nl80211_send_chandef(msg, chandef))
9613                 goto nla_put_failure;
9614
9615         if (genlmsg_end(msg, hdr) < 0) {
9616                 nlmsg_free(msg);
9617                 return;
9618         }
9619
9620         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9621                                 nl80211_mlme_mcgrp.id, gfp);
9622         return;
9623
9624  nla_put_failure:
9625         genlmsg_cancel(msg, hdr);
9626         nlmsg_free(msg);
9627 }
9628
9629 void
9630 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
9631                                 struct net_device *netdev, const u8 *peer,
9632                                 u32 num_packets, gfp_t gfp)
9633 {
9634         struct sk_buff *msg;
9635         struct nlattr *pinfoattr;
9636         void *hdr;
9637
9638         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9639         if (!msg)
9640                 return;
9641
9642         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9643         if (!hdr) {
9644                 nlmsg_free(msg);
9645                 return;
9646         }
9647
9648         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9649             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9650             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9651                 goto nla_put_failure;
9652
9653         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9654         if (!pinfoattr)
9655                 goto nla_put_failure;
9656
9657         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
9658                 goto nla_put_failure;
9659
9660         nla_nest_end(msg, pinfoattr);
9661
9662         genlmsg_end(msg, hdr);
9663
9664         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9665                                 nl80211_mlme_mcgrp.id, gfp);
9666         return;
9667
9668  nla_put_failure:
9669         genlmsg_cancel(msg, hdr);
9670         nlmsg_free(msg);
9671 }
9672
9673 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
9674                            u64 cookie, bool acked, gfp_t gfp)
9675 {
9676         struct wireless_dev *wdev = dev->ieee80211_ptr;
9677         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9678         struct sk_buff *msg;
9679         void *hdr;
9680         int err;
9681
9682         trace_cfg80211_probe_status(dev, addr, cookie, acked);
9683
9684         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9685
9686         if (!msg)
9687                 return;
9688
9689         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
9690         if (!hdr) {
9691                 nlmsg_free(msg);
9692                 return;
9693         }
9694
9695         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9696             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9697             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9698             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9699             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
9700                 goto nla_put_failure;
9701
9702         err = genlmsg_end(msg, hdr);
9703         if (err < 0) {
9704                 nlmsg_free(msg);
9705                 return;
9706         }
9707
9708         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9709                                 nl80211_mlme_mcgrp.id, gfp);
9710         return;
9711
9712  nla_put_failure:
9713         genlmsg_cancel(msg, hdr);
9714         nlmsg_free(msg);
9715 }
9716 EXPORT_SYMBOL(cfg80211_probe_status);
9717
9718 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
9719                                  const u8 *frame, size_t len,
9720                                  int freq, int sig_dbm)
9721 {
9722         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9723         struct sk_buff *msg;
9724         void *hdr;
9725         struct cfg80211_beacon_registration *reg;
9726
9727         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
9728
9729         spin_lock_bh(&rdev->beacon_registrations_lock);
9730         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9731                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
9732                 if (!msg) {
9733                         spin_unlock_bh(&rdev->beacon_registrations_lock);
9734                         return;
9735                 }
9736
9737                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9738                 if (!hdr)
9739                         goto nla_put_failure;
9740
9741                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9742                     (freq &&
9743                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9744                     (sig_dbm &&
9745                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9746                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9747                         goto nla_put_failure;
9748
9749                 genlmsg_end(msg, hdr);
9750
9751                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9752         }
9753         spin_unlock_bh(&rdev->beacon_registrations_lock);
9754         return;
9755
9756  nla_put_failure:
9757         spin_unlock_bh(&rdev->beacon_registrations_lock);
9758         if (hdr)
9759                 genlmsg_cancel(msg, hdr);
9760         nlmsg_free(msg);
9761 }
9762 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9763
9764 #ifdef CONFIG_PM
9765 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
9766                                    struct cfg80211_wowlan_wakeup *wakeup,
9767                                    gfp_t gfp)
9768 {
9769         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9770         struct sk_buff *msg;
9771         void *hdr;
9772         int err, size = 200;
9773
9774         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
9775
9776         if (wakeup)
9777                 size += wakeup->packet_present_len;
9778
9779         msg = nlmsg_new(size, gfp);
9780         if (!msg)
9781                 return;
9782
9783         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
9784         if (!hdr)
9785                 goto free_msg;
9786
9787         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9788             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9789                 goto free_msg;
9790
9791         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9792                                         wdev->netdev->ifindex))
9793                 goto free_msg;
9794
9795         if (wakeup) {
9796                 struct nlattr *reasons;
9797
9798                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9799
9800                 if (wakeup->disconnect &&
9801                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
9802                         goto free_msg;
9803                 if (wakeup->magic_pkt &&
9804                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
9805                         goto free_msg;
9806                 if (wakeup->gtk_rekey_failure &&
9807                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
9808                         goto free_msg;
9809                 if (wakeup->eap_identity_req &&
9810                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
9811                         goto free_msg;
9812                 if (wakeup->four_way_handshake &&
9813                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
9814                         goto free_msg;
9815                 if (wakeup->rfkill_release &&
9816                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
9817                         goto free_msg;
9818
9819                 if (wakeup->pattern_idx >= 0 &&
9820                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
9821                                 wakeup->pattern_idx))
9822                         goto free_msg;
9823
9824                 if (wakeup->tcp_match)
9825                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
9826
9827                 if (wakeup->tcp_connlost)
9828                         nla_put_flag(msg,
9829                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
9830
9831                 if (wakeup->tcp_nomoretokens)
9832                         nla_put_flag(msg,
9833                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
9834
9835                 if (wakeup->packet) {
9836                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
9837                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
9838
9839                         if (!wakeup->packet_80211) {
9840                                 pkt_attr =
9841                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
9842                                 len_attr =
9843                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
9844                         }
9845
9846                         if (wakeup->packet_len &&
9847                             nla_put_u32(msg, len_attr, wakeup->packet_len))
9848                                 goto free_msg;
9849
9850                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
9851                                     wakeup->packet))
9852                                 goto free_msg;
9853                 }
9854
9855                 nla_nest_end(msg, reasons);
9856         }
9857
9858         err = genlmsg_end(msg, hdr);
9859         if (err < 0)
9860                 goto free_msg;
9861
9862         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9863                                 nl80211_mlme_mcgrp.id, gfp);
9864         return;
9865
9866  free_msg:
9867         nlmsg_free(msg);
9868 }
9869 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
9870 #endif
9871
9872 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9873                                 enum nl80211_tdls_operation oper,
9874                                 u16 reason_code, gfp_t gfp)
9875 {
9876         struct wireless_dev *wdev = dev->ieee80211_ptr;
9877         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9878         struct sk_buff *msg;
9879         void *hdr;
9880         int err;
9881
9882         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9883                                          reason_code);
9884
9885         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9886         if (!msg)
9887                 return;
9888
9889         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
9890         if (!hdr) {
9891                 nlmsg_free(msg);
9892                 return;
9893         }
9894
9895         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9896             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9897             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
9898             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
9899             (reason_code > 0 &&
9900              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
9901                 goto nla_put_failure;
9902
9903         err = genlmsg_end(msg, hdr);
9904         if (err < 0) {
9905                 nlmsg_free(msg);
9906                 return;
9907         }
9908
9909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9910                                 nl80211_mlme_mcgrp.id, gfp);
9911         return;
9912
9913  nla_put_failure:
9914         genlmsg_cancel(msg, hdr);
9915         nlmsg_free(msg);
9916 }
9917 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
9918
9919 static int nl80211_netlink_notify(struct notifier_block * nb,
9920                                   unsigned long state,
9921                                   void *_notify)
9922 {
9923         struct netlink_notify *notify = _notify;
9924         struct cfg80211_registered_device *rdev;
9925         struct wireless_dev *wdev;
9926         struct cfg80211_beacon_registration *reg, *tmp;
9927
9928         if (state != NETLINK_URELEASE)
9929                 return NOTIFY_DONE;
9930
9931         rcu_read_lock();
9932
9933         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9934                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
9935                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
9936
9937                 spin_lock_bh(&rdev->beacon_registrations_lock);
9938                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
9939                                          list) {
9940                         if (reg->nlportid == notify->portid) {
9941                                 list_del(&reg->list);
9942                                 kfree(reg);
9943                                 break;
9944                         }
9945                 }
9946                 spin_unlock_bh(&rdev->beacon_registrations_lock);
9947         }
9948
9949         rcu_read_unlock();
9950
9951         return NOTIFY_DONE;
9952 }
9953
9954 static struct notifier_block nl80211_netlink_notifier = {
9955         .notifier_call = nl80211_netlink_notify,
9956 };
9957
9958 /* initialisation/exit functions */
9959
9960 int nl80211_init(void)
9961 {
9962         int err;
9963
9964         err = genl_register_family_with_ops(&nl80211_fam,
9965                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
9966         if (err)
9967                 return err;
9968
9969         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9970         if (err)
9971                 goto err_out;
9972
9973         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9974         if (err)
9975                 goto err_out;
9976
9977         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9978         if (err)
9979                 goto err_out;
9980
9981         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9982         if (err)
9983                 goto err_out;
9984
9985 #ifdef CONFIG_NL80211_TESTMODE
9986         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9987         if (err)
9988                 goto err_out;
9989 #endif
9990
9991         err = netlink_register_notifier(&nl80211_netlink_notifier);
9992         if (err)
9993                 goto err_out;
9994
9995         return 0;
9996  err_out:
9997         genl_unregister_family(&nl80211_fam);
9998         return err;
9999 }
10000
10001 void nl80211_exit(void)
10002 {
10003         netlink_unregister_notifier(&nl80211_netlink_notifier);
10004         genl_unregister_family(&nl80211_fam);
10005 }