net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373 };
 374
 375 /* policy for the key attributes */
 376 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 377         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 378         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 379         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 380         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 381         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 382         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 383         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 384         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 385 };
 386
 387 /* policy for the key default flags */
 388 static const struct nla_policy
 389 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 390         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 391         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 392 };
 393
 394 /* policy for WoWLAN attributes */
 395 static const struct nla_policy
 396 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 397         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 398         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 399         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 401         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 402         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 404         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 405         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 406 };
 407
 408 static const struct nla_policy
 409 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 410         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 411         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 412         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 413         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 414         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 415         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 416         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 417                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 418         },
 419         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 420                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 421         },
 422         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 423         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 424         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 425 };
 426
 427 /* policy for GTK rekey offload attributes */
 428 static const struct nla_policy
 429 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 430         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 431         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 432         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 433 };
 434
 435 static const struct nla_policy
 436 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 437         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 438                                                  .len = IEEE80211_MAX_SSID_LEN },
 439         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 440 };
 441
 442 /* ifidx get helper */
 443 static int nl80211_get_ifidx(struct netlink_callback *cb)
 444 {
 445         int res;
 446
 447         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 448                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 449                           nl80211_policy);
 450         if (res)
 451                 return res;
 452
 453         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 454                 return -EINVAL;
 455
 456         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 457         if (!res)
 458                 return -EINVAL;
 459         return res;
 460 }
 461
 462 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 463                                        struct netlink_callback *cb,
 464                                        struct cfg80211_registered_device **rdev,
 465                                        struct net_device **dev)
 466 {
 467         int ifidx = cb->args[0];
 468         int err;
 469
 470         if (!ifidx)
 471                 ifidx = nl80211_get_ifidx(cb);
 472         if (ifidx < 0)
 473                 return ifidx;
 474
 475         cb->args[0] = ifidx;
 476
 477         rtnl_lock();
 478
 479         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 480         if (!*dev) {
 481                 err = -ENODEV;
 482                 goto out_rtnl;
 483         }
 484
 485         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 486         if (IS_ERR(*rdev)) {
 487                 err = PTR_ERR(*rdev);
 488                 goto out_rtnl;
 489         }
 490
 491         return 0;
 492  out_rtnl:
 493         rtnl_unlock();
 494         return err;
 495 }
 496
 497 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 498 {
 499         cfg80211_unlock_rdev(rdev);
 500         rtnl_unlock();
 501 }
 502
 503 /* IE validation */
 504 static bool is_valid_ie_attr(const struct nlattr *attr)
 505 {
 506         const u8 *pos;
 507         int len;
 508
 509         if (!attr)
 510                 return true;
 511
 512         pos = nla_data(attr);
 513         len = nla_len(attr);
 514
 515         while (len) {
 516                 u8 elemlen;
 517
 518                 if (len < 2)
 519                         return false;
 520                 len -= 2;
 521
 522                 elemlen = pos[1];
 523                 if (elemlen > len)
 524                         return false;
 525
 526                 len -= elemlen;
 527                 pos += 2 + elemlen;
 528         }
 529
 530         return true;
 531 }
 532
 533 /* message building helper */
 534 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 535                                    int flags, u8 cmd)
 536 {
 537         /* since there is no private header just add the generic one */
 538         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 539 }
 540
 541 static int nl80211_msg_put_channel(struct sk_buff *msg,
 542                                    struct ieee80211_channel *chan)
 543 {
 544         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 545                         chan->center_freq))
 546                 goto nla_put_failure;
 547
 548         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 549             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 550                 goto nla_put_failure;
 551         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 552             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 553                 goto nla_put_failure;
 554         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 555             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 556                 goto nla_put_failure;
 557         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 558             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 559                 goto nla_put_failure;
 560         if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 561             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 562                 goto nla_put_failure;
 563         if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 564             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 565                 goto nla_put_failure;
 566         if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 567             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 568                 goto nla_put_failure;
 569         if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 570             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 571                 goto nla_put_failure;
 572
 573         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 574                         DBM_TO_MBM(chan->max_power)))
 575                 goto nla_put_failure;
 576
 577         return 0;
 578
 579  nla_put_failure:
 580         return -ENOBUFS;
 581 }
 582
 583 /* netlink command implementations */
 584
 585 struct key_parse {
 586         struct key_params p;
 587         int idx;
 588         int type;
 589         bool def, defmgmt;
 590         bool def_uni, def_multi;
 591 };
 592
 593 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 594 {
 595         struct nlattr *tb[NL80211_KEY_MAX + 1];
 596         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 597                                    nl80211_key_policy);
 598         if (err)
 599                 return err;
 600
 601         k->def = !!tb[NL80211_KEY_DEFAULT];
 602         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 603
 604         if (k->def) {
 605                 k->def_uni = true;
 606                 k->def_multi = true;
 607         }
 608         if (k->defmgmt)
 609                 k->def_multi = true;
 610
 611         if (tb[NL80211_KEY_IDX])
 612                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 613
 614         if (tb[NL80211_KEY_DATA]) {
 615                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 616                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 617         }
 618
 619         if (tb[NL80211_KEY_SEQ]) {
 620                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 621                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 622         }
 623
 624         if (tb[NL80211_KEY_CIPHER])
 625                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 626
 627         if (tb[NL80211_KEY_TYPE]) {
 628                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 629                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 630                         return -EINVAL;
 631         }
 632
 633         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 634                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 635                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 636                                        tb[NL80211_KEY_DEFAULT_TYPES],
 637                                        nl80211_key_default_policy);
 638                 if (err)
 639                         return err;
 640
 641                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 642                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 643         }
 644
 645         return 0;
 646 }
 647
 648 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 649 {
 650         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 651                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 652                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 653         }
 654
 655         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 656                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 657                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 658         }
 659
 660         if (info->attrs[NL80211_ATTR_KEY_IDX])
 661                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 662
 663         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 664                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 665
 666         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 667         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 668
 669         if (k->def) {
 670                 k->def_uni = true;
 671                 k->def_multi = true;
 672         }
 673         if (k->defmgmt)
 674                 k->def_multi = true;
 675
 676         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 677                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 678                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 679                         return -EINVAL;
 680         }
 681
 682         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 683                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 684                 int err = nla_parse_nested(
 685                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 686                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 687                                 nl80211_key_default_policy);
 688                 if (err)
 689                         return err;
 690
 691                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 692                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 693         }
 694
 695         return 0;
 696 }
 697
 698 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 699 {
 700         int err;
 701
 702         memset(k, 0, sizeof(*k));
 703         k->idx = -1;
 704         k->type = -1;
 705
 706         if (info->attrs[NL80211_ATTR_KEY])
 707                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 708         else
 709                 err = nl80211_parse_key_old(info, k);
 710
 711         if (err)
 712                 return err;
 713
 714         if (k->def && k->defmgmt)
 715                 return -EINVAL;
 716
 717         if (k->defmgmt) {
 718                 if (k->def_uni || !k->def_multi)
 719                         return -EINVAL;
 720         }
 721
 722         if (k->idx != -1) {
 723                 if (k->defmgmt) {
 724                         if (k->idx < 4 || k->idx > 5)
 725                                 return -EINVAL;
 726                 } else if (k->def) {
 727                         if (k->idx < 0 || k->idx > 3)
 728                                 return -EINVAL;
 729                 } else {
 730                         if (k->idx < 0 || k->idx > 5)
 731                                 return -EINVAL;
 732                 }
 733         }
 734
 735         return 0;
 736 }
 737
 738 static struct cfg80211_cached_keys *
 739 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 740                        struct nlattr *keys, bool *no_ht)
 741 {
 742         struct key_parse parse;
 743         struct nlattr *key;
 744         struct cfg80211_cached_keys *result;
 745         int rem, err, def = 0;
 746
 747         result = kzalloc(sizeof(*result), GFP_KERNEL);
 748         if (!result)
 749                 return ERR_PTR(-ENOMEM);
 750
 751         result->def = -1;
 752         result->defmgmt = -1;
 753
 754         nla_for_each_nested(key, keys, rem) {
 755                 memset(&parse, 0, sizeof(parse));
 756                 parse.idx = -1;
 757
 758                 err = nl80211_parse_key_new(key, &parse);
 759                 if (err)
 760                         goto error;
 761                 err = -EINVAL;
 762                 if (!parse.p.key)
 763                         goto error;
 764                 if (parse.idx < 0 || parse.idx > 4)
 765                         goto error;
 766                 if (parse.def) {
 767                         if (def)
 768                                 goto error;
 769                         def = 1;
 770                         result->def = parse.idx;
 771                         if (!parse.def_uni || !parse.def_multi)
 772                                 goto error;
 773                 } else if (parse.defmgmt)
 774                         goto error;
 775                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 776                                                      parse.idx, false, NULL);
 777                 if (err)
 778                         goto error;
 779                 result->params[parse.idx].cipher = parse.p.cipher;
 780                 result->params[parse.idx].key_len = parse.p.key_len;
 781                 result->params[parse.idx].key = result->data[parse.idx];
 782                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 783
 784                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 785                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 786                         if (no_ht)
 787                                 *no_ht = true;
 788                 }
 789         }
 790
 791         return result;
 792  error:
 793         kfree(result);
 794         return ERR_PTR(err);
 795 }
 796
 797 static int nl80211_key_allowed(struct wireless_dev *wdev)
 798 {
 799         ASSERT_WDEV_LOCK(wdev);
 800
 801         switch (wdev->iftype) {
 802         case NL80211_IFTYPE_AP:
 803         case NL80211_IFTYPE_AP_VLAN:
 804         case NL80211_IFTYPE_P2P_GO:
 805         case NL80211_IFTYPE_MESH_POINT:
 806                 break;
 807         case NL80211_IFTYPE_ADHOC:
 808                 if (!wdev->current_bss)
 809                         return -ENOLINK;
 810                 break;
 811         case NL80211_IFTYPE_STATION:
 812         case NL80211_IFTYPE_P2P_CLIENT:
 813                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 814                         return -ENOLINK;
 815                 break;
 816         default:
 817                 return -EINVAL;
 818         }
 819
 820         return 0;
 821 }
 822
 823 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 824 {
 825         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 826         int i;
 827
 828         if (!nl_modes)
 829                 goto nla_put_failure;
 830
 831         i = 0;
 832         while (ifmodes) {
 833                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 834                         goto nla_put_failure;
 835                 ifmodes >>= 1;
 836                 i++;
 837         }
 838
 839         nla_nest_end(msg, nl_modes);
 840         return 0;
 841
 842 nla_put_failure:
 843         return -ENOBUFS;
 844 }
 845
 846 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 847                                           struct sk_buff *msg)
 848 {
 849         struct nlattr *nl_combis;
 850         int i, j;
 851
 852         nl_combis = nla_nest_start(msg,
 853                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 854         if (!nl_combis)
 855                 goto nla_put_failure;
 856
 857         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 858                 const struct ieee80211_iface_combination *c;
 859                 struct nlattr *nl_combi, *nl_limits;
 860
 861                 c = &wiphy->iface_combinations[i];
 862
 863                 nl_combi = nla_nest_start(msg, i + 1);
 864                 if (!nl_combi)
 865                         goto nla_put_failure;
 866
 867                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 868                 if (!nl_limits)
 869                         goto nla_put_failure;
 870
 871                 for (j = 0; j < c->n_limits; j++) {
 872                         struct nlattr *nl_limit;
 873
 874                         nl_limit = nla_nest_start(msg, j + 1);
 875                         if (!nl_limit)
 876                                 goto nla_put_failure;
 877                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 878                                         c->limits[j].max))
 879                                 goto nla_put_failure;
 880                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 881                                                 c->limits[j].types))
 882                                 goto nla_put_failure;
 883                         nla_nest_end(msg, nl_limit);
 884                 }
 885
 886                 nla_nest_end(msg, nl_limits);
 887
 888                 if (c->beacon_int_infra_match &&
 889                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 890                         goto nla_put_failure;
 891                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 892                                 c->num_different_channels) ||
 893                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 894                                 c->max_interfaces))
 895                         goto nla_put_failure;
 896
 897                 nla_nest_end(msg, nl_combi);
 898         }
 899
 900         nla_nest_end(msg, nl_combis);
 901
 902         return 0;
 903 nla_put_failure:
 904         return -ENOBUFS;
 905 }
 906
 907 #ifdef CONFIG_PM
 908 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 909                                         struct sk_buff *msg)
 910 {
 911         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 912         struct nlattr *nl_tcp;
 913
 914         if (!tcp)
 915                 return 0;
 916
 917         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 918         if (!nl_tcp)
 919                 return -ENOBUFS;
 920
 921         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 922                         tcp->data_payload_max))
 923                 return -ENOBUFS;
 924
 925         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 926                         tcp->data_payload_max))
 927                 return -ENOBUFS;
 928
 929         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 930                 return -ENOBUFS;
 931
 932         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 933                                 sizeof(*tcp->tok), tcp->tok))
 934                 return -ENOBUFS;
 935
 936         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 937                         tcp->data_interval_max))
 938                 return -ENOBUFS;
 939
 940         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 941                         tcp->wake_payload_max))
 942                 return -ENOBUFS;
 943
 944         nla_nest_end(msg, nl_tcp);
 945         return 0;
 946 }
 947 #endif
 948
 949 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 950                               struct cfg80211_registered_device *dev)
 951 {
 952         void *hdr;
 953         struct nlattr *nl_bands, *nl_band;
 954         struct nlattr *nl_freqs, *nl_freq;
 955         struct nlattr *nl_rates, *nl_rate;
 956         struct nlattr *nl_cmds;
 957         enum ieee80211_band band;
 958         struct ieee80211_channel *chan;
 959         struct ieee80211_rate *rate;
 960         int i;
 961         const struct ieee80211_txrx_stypes *mgmt_stypes =
 962                                 dev->wiphy.mgmt_stypes;
 963
 964         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 965         if (!hdr)
 966                 return -1;
 967
 968         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 969             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 970             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 971                         cfg80211_rdev_list_generation) ||
 972             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 973                        dev->wiphy.retry_short) ||
 974             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 975                        dev->wiphy.retry_long) ||
 976             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 977                         dev->wiphy.frag_threshold) ||
 978             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 979                         dev->wiphy.rts_threshold) ||
 980             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 981                        dev->wiphy.coverage_class) ||
 982             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 983                        dev->wiphy.max_scan_ssids) ||
 984             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 985                        dev->wiphy.max_sched_scan_ssids) ||
 986             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 987                         dev->wiphy.max_scan_ie_len) ||
 988             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 989                         dev->wiphy.max_sched_scan_ie_len) ||
 990             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 991                        dev->wiphy.max_match_sets))
 992                 goto nla_put_failure;
 993
 994         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 995             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 996                 goto nla_put_failure;
 997         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 998             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 999                 goto nla_put_failure;
1000         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1001             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1002                 goto nla_put_failure;
1003         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1004             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1005                 goto nla_put_failure;
1006         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1007             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1008                 goto nla_put_failure;
1009         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1010             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1011                 goto nla_put_failure;
1012
1013         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1014                     sizeof(u32) * dev->wiphy.n_cipher_suites,
1015                     dev->wiphy.cipher_suites))
1016                 goto nla_put_failure;
1017
1018         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1019                        dev->wiphy.max_num_pmkids))
1020                 goto nla_put_failure;
1021
1022         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1023             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1024                 goto nla_put_failure;
1025
1026         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1027                         dev->wiphy.available_antennas_tx) ||
1028             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1029                         dev->wiphy.available_antennas_rx))
1030                 goto nla_put_failure;
1031
1032         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1033             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1034                         dev->wiphy.probe_resp_offload))
1035                 goto nla_put_failure;
1036
1037         if ((dev->wiphy.available_antennas_tx ||
1038              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
1039                 u32 tx_ant = 0, rx_ant = 0;
1040                 int res;
1041                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1042                 if (!res) {
1043                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
1044                                         tx_ant) ||
1045                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
1046                                         rx_ant))
1047                                 goto nla_put_failure;
1048                 }
1049         }
1050
1051         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1052                                 dev->wiphy.interface_modes))
1053                 goto nla_put_failure;
1054
1055         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1056         if (!nl_bands)
1057                 goto nla_put_failure;
1058
1059         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1060                 if (!dev->wiphy.bands[band])
1061                         continue;
1062
1063                 nl_band = nla_nest_start(msg, band);
1064                 if (!nl_band)
1065                         goto nla_put_failure;
1066
1067                 /* add HT info */
1068                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
1069                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1070                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
1071                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
1072                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1073                                  dev->wiphy.bands[band]->ht_cap.cap) ||
1074                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1075                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
1076                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1077                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
1078                         goto nla_put_failure;
1079
1080                 /* add VHT info */
1081                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
1082                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1083                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
1084                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
1085                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1086                                  dev->wiphy.bands[band]->vht_cap.cap)))
1087                         goto nla_put_failure;
1088
1089                 /* add frequencies */
1090                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1091                 if (!nl_freqs)
1092                         goto nla_put_failure;
1093
1094                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1095                         nl_freq = nla_nest_start(msg, i);
1096                         if (!nl_freq)
1097                                 goto nla_put_failure;
1098
1099                         chan = &dev->wiphy.bands[band]->channels[i];
1100
1101                         if (nl80211_msg_put_channel(msg, chan))
1102                                 goto nla_put_failure;
1103
1104                         nla_nest_end(msg, nl_freq);
1105                 }
1106
1107                 nla_nest_end(msg, nl_freqs);
1108
1109                 /* add bitrates */
1110                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1111                 if (!nl_rates)
1112                         goto nla_put_failure;
1113
1114                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1115                         nl_rate = nla_nest_start(msg, i);
1116                         if (!nl_rate)
1117                                 goto nla_put_failure;
1118
1119                         rate = &dev->wiphy.bands[band]->bitrates[i];
1120                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1121                                         rate->bitrate))
1122                                 goto nla_put_failure;
1123                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1124                             nla_put_flag(msg,
1125                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1126                                 goto nla_put_failure;
1127
1128                         nla_nest_end(msg, nl_rate);
1129                 }
1130
1131                 nla_nest_end(msg, nl_rates);
1132
1133                 nla_nest_end(msg, nl_band);
1134         }
1135         nla_nest_end(msg, nl_bands);
1136
1137         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1138         if (!nl_cmds)
1139                 goto nla_put_failure;
1140
1141         i = 0;
1142 #define CMD(op, n)                                              \
1143          do {                                                   \
1144                 if (dev->ops->op) {                             \
1145                         i++;                                    \
1146                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1147                                 goto nla_put_failure;           \
1148                 }                                               \
1149         } while (0)
1150
1151         CMD(add_virtual_intf, NEW_INTERFACE);
1152         CMD(change_virtual_intf, SET_INTERFACE);
1153         CMD(add_key, NEW_KEY);
1154         CMD(start_ap, START_AP);
1155         CMD(add_station, NEW_STATION);
1156         CMD(add_mpath, NEW_MPATH);
1157         CMD(update_mesh_config, SET_MESH_CONFIG);
1158         CMD(change_bss, SET_BSS);
1159         CMD(auth, AUTHENTICATE);
1160         CMD(assoc, ASSOCIATE);
1161         CMD(deauth, DEAUTHENTICATE);
1162         CMD(disassoc, DISASSOCIATE);
1163         CMD(join_ibss, JOIN_IBSS);
1164         CMD(join_mesh, JOIN_MESH);
1165         CMD(set_pmksa, SET_PMKSA);
1166         CMD(del_pmksa, DEL_PMKSA);
1167         CMD(flush_pmksa, FLUSH_PMKSA);
1168         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1169                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1170         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1171         CMD(mgmt_tx, FRAME);
1172         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1173         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1174                 i++;
1175                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1176                         goto nla_put_failure;
1177         }
1178         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1179             dev->ops->join_mesh) {
1180                 i++;
1181                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1182                         goto nla_put_failure;
1183         }
1184         CMD(set_wds_peer, SET_WDS_PEER);
1185         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1186                 CMD(tdls_mgmt, TDLS_MGMT);
1187                 CMD(tdls_oper, TDLS_OPER);
1188         }
1189         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1190                 CMD(sched_scan_start, START_SCHED_SCAN);
1191         CMD(probe_client, PROBE_CLIENT);
1192         CMD(set_noack_map, SET_NOACK_MAP);
1193         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1194                 i++;
1195                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1196                         goto nla_put_failure;
1197         }
1198         CMD(start_p2p_device, START_P2P_DEVICE);
1199         CMD(set_mcast_rate, SET_MCAST_RATE);
1200
1201 #ifdef CONFIG_NL80211_TESTMODE
1202         CMD(testmode_cmd, TESTMODE);
1203 #endif
1204
1205 #undef CMD
1206
1207         if (dev->ops->connect || dev->ops->auth) {
1208                 i++;
1209                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1210                         goto nla_put_failure;
1211         }
1212
1213         if (dev->ops->disconnect || dev->ops->deauth) {
1214                 i++;
1215                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1216                         goto nla_put_failure;
1217         }
1218
1219         nla_nest_end(msg, nl_cmds);
1220
1221         if (dev->ops->remain_on_channel &&
1222             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1223             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1224                         dev->wiphy.max_remain_on_channel_duration))
1225                 goto nla_put_failure;
1226
1227         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1228             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1229                 goto nla_put_failure;
1230
1231         if (mgmt_stypes) {
1232                 u16 stypes;
1233                 struct nlattr *nl_ftypes, *nl_ifs;
1234                 enum nl80211_iftype ift;
1235
1236                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1237                 if (!nl_ifs)
1238                         goto nla_put_failure;
1239
1240                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1241                         nl_ftypes = nla_nest_start(msg, ift);
1242                         if (!nl_ftypes)
1243                                 goto nla_put_failure;
1244                         i = 0;
1245                         stypes = mgmt_stypes[ift].tx;
1246                         while (stypes) {
1247                                 if ((stypes & 1) &&
1248                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1249                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1250                                         goto nla_put_failure;
1251                                 stypes >>= 1;
1252                                 i++;
1253                         }
1254                         nla_nest_end(msg, nl_ftypes);
1255                 }
1256
1257                 nla_nest_end(msg, nl_ifs);
1258
1259                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1260                 if (!nl_ifs)
1261                         goto nla_put_failure;
1262
1263                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1264                         nl_ftypes = nla_nest_start(msg, ift);
1265                         if (!nl_ftypes)
1266                                 goto nla_put_failure;
1267                         i = 0;
1268                         stypes = mgmt_stypes[ift].rx;
1269                         while (stypes) {
1270                                 if ((stypes & 1) &&
1271                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1272                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1273                                         goto nla_put_failure;
1274                                 stypes >>= 1;
1275                                 i++;
1276                         }
1277                         nla_nest_end(msg, nl_ftypes);
1278                 }
1279                 nla_nest_end(msg, nl_ifs);
1280         }
1281
1282 #ifdef CONFIG_PM
1283         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1284                 struct nlattr *nl_wowlan;
1285
1286                 nl_wowlan = nla_nest_start(msg,
1287                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1288                 if (!nl_wowlan)
1289                         goto nla_put_failure;
1290
1291                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1292                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1293                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1294                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1295                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1296                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1297                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1298                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1299                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1301                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1302                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1303                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1304                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1305                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1306                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1307                     goto nla_put_failure;
1308                 if (dev->wiphy.wowlan.n_patterns) {
1309                         struct nl80211_wowlan_pattern_support pat = {
1310                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1311                                 .min_pattern_len =
1312                                         dev->wiphy.wowlan.pattern_min_len,
1313                                 .max_pattern_len =
1314                                         dev->wiphy.wowlan.pattern_max_len,
1315                                 .max_pkt_offset =
1316                                         dev->wiphy.wowlan.max_pkt_offset,
1317                         };
1318                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1319                                     sizeof(pat), &pat))
1320                                 goto nla_put_failure;
1321                 }
1322
1323                 if (nl80211_send_wowlan_tcp_caps(dev, msg))
1324                         goto nla_put_failure;
1325
1326                 nla_nest_end(msg, nl_wowlan);
1327         }
1328 #endif
1329
1330         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1331                                 dev->wiphy.software_iftypes))
1332                 goto nla_put_failure;
1333
1334         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1335                 goto nla_put_failure;
1336
1337         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1338             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1339                         dev->wiphy.ap_sme_capa))
1340                 goto nla_put_failure;
1341
1342         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1343                         dev->wiphy.features))
1344                 goto nla_put_failure;
1345
1346         if (dev->wiphy.ht_capa_mod_mask &&
1347             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1348                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1349                     dev->wiphy.ht_capa_mod_mask))
1350                 goto nla_put_failure;
1351
1352         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1353             dev->wiphy.max_acl_mac_addrs &&
1354             nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1355                         dev->wiphy.max_acl_mac_addrs))
1356                 goto nla_put_failure;
1357
1358         if (dev->wiphy.extended_capabilities &&
1359             (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1360                      dev->wiphy.extended_capabilities_len,
1361                      dev->wiphy.extended_capabilities) ||
1362              nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1363                      dev->wiphy.extended_capabilities_len,
1364                      dev->wiphy.extended_capabilities_mask)))
1365                 goto nla_put_failure;
1366
1367         return genlmsg_end(msg, hdr);
1368
1369  nla_put_failure:
1370         genlmsg_cancel(msg, hdr);
1371         return -EMSGSIZE;
1372 }
1373
1374 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1375 {
1376         int idx = 0;
1377         int start = cb->args[0];
1378         struct cfg80211_registered_device *dev;
1379
1380         mutex_lock(&cfg80211_mutex);
1381         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1382                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1383                         continue;
1384                 if (++idx <= start)
1385                         continue;
1386                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1387                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1388                                        dev) < 0) {
1389                         idx--;
1390                         break;
1391                 }
1392         }
1393         mutex_unlock(&cfg80211_mutex);
1394
1395         cb->args[0] = idx;
1396
1397         return skb->len;
1398 }
1399
1400 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1401 {
1402         struct sk_buff *msg;
1403         struct cfg80211_registered_device *dev = info->user_ptr[0];
1404
1405         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1406         if (!msg)
1407                 return -ENOMEM;
1408
1409         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1410                 nlmsg_free(msg);
1411                 return -ENOBUFS;
1412         }
1413
1414         return genlmsg_reply(msg, info);
1415 }
1416
1417 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1418         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1419         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1420         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1421         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1422         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1423 };
1424
1425 static int parse_txq_params(struct nlattr *tb[],
1426                             struct ieee80211_txq_params *txq_params)
1427 {
1428         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1429             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1430             !tb[NL80211_TXQ_ATTR_AIFS])
1431                 return -EINVAL;
1432
1433         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1434         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1435         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1436         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1437         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1438
1439         if (txq_params->ac >= NL80211_NUM_ACS)
1440                 return -EINVAL;
1441
1442         return 0;
1443 }
1444
1445 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1446 {
1447         /*
1448          * You can only set the channel explicitly for WDS interfaces,
1449          * all others have their channel managed via their respective
1450          * "establish a connection" command (connect, join, ...)
1451          *
1452          * For AP/GO and mesh mode, the channel can be set with the
1453          * channel userspace API, but is only stored and passed to the
1454          * low-level driver when the AP starts or the mesh is joined.
1455          * This is for backward compatibility, userspace can also give
1456          * the channel in the start-ap or join-mesh commands instead.
1457          *
1458          * Monitors are special as they are normally slaved to
1459          * whatever else is going on, so they have their own special
1460          * operation to set the monitor channel if possible.
1461          */
1462         return !wdev ||
1463                 wdev->iftype == NL80211_IFTYPE_AP ||
1464                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1465                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1466                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1467 }
1468
1469 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1470                                  struct genl_info *info,
1471                                  struct cfg80211_chan_def *chandef)
1472 {
1473         u32 control_freq;
1474
1475         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1476                 return -EINVAL;
1477
1478         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1479
1480         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1481         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1482         chandef->center_freq1 = control_freq;
1483         chandef->center_freq2 = 0;
1484
1485         /* Primary channel not allowed */
1486         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1487                 return -EINVAL;
1488
1489         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1490                 enum nl80211_channel_type chantype;
1491
1492                 chantype = nla_get_u32(
1493                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1494
1495                 switch (chantype) {
1496                 case NL80211_CHAN_NO_HT:
1497                 case NL80211_CHAN_HT20:
1498                 case NL80211_CHAN_HT40PLUS:
1499                 case NL80211_CHAN_HT40MINUS:
1500                         cfg80211_chandef_create(chandef, chandef->chan,
1501                                                 chantype);
1502                         break;
1503                 default:
1504                         return -EINVAL;
1505                 }
1506         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1507                 chandef->width =
1508                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1509                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1510                         chandef->center_freq1 =
1511                                 nla_get_u32(
1512                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1513                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1514                         chandef->center_freq2 =
1515                                 nla_get_u32(
1516                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1517         }
1518
1519         if (!cfg80211_chandef_valid(chandef))
1520                 return -EINVAL;
1521
1522         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1523                                      IEEE80211_CHAN_DISABLED))
1524                 return -EINVAL;
1525
1526         return 0;
1527 }
1528
1529 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1530                                  struct wireless_dev *wdev,
1531                                  struct genl_info *info)
1532 {
1533         struct cfg80211_chan_def chandef;
1534         int result;
1535         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1536
1537         if (wdev)
1538                 iftype = wdev->iftype;
1539
1540         if (!nl80211_can_set_dev_channel(wdev))
1541                 return -EOPNOTSUPP;
1542
1543         result = nl80211_parse_chandef(rdev, info, &chandef);
1544         if (result)
1545                 return result;
1546
1547         mutex_lock(&rdev->devlist_mtx);
1548         switch (iftype) {
1549         case NL80211_IFTYPE_AP:
1550         case NL80211_IFTYPE_P2P_GO:
1551                 if (wdev->beacon_interval) {
1552                         result = -EBUSY;
1553                         break;
1554                 }
1555                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1556                         result = -EINVAL;
1557                         break;
1558                 }
1559                 wdev->preset_chandef = chandef;
1560                 result = 0;
1561                 break;
1562         case NL80211_IFTYPE_MESH_POINT:
1563                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1564                 break;
1565         case NL80211_IFTYPE_MONITOR:
1566                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1567                 break;
1568         default:
1569                 result = -EINVAL;
1570         }
1571         mutex_unlock(&rdev->devlist_mtx);
1572
1573         return result;
1574 }
1575
1576 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1577 {
1578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1579         struct net_device *netdev = info->user_ptr[1];
1580
1581         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1582 }
1583
1584 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1585 {
1586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1587         struct net_device *dev = info->user_ptr[1];
1588         struct wireless_dev *wdev = dev->ieee80211_ptr;
1589         const u8 *bssid;
1590
1591         if (!info->attrs[NL80211_ATTR_MAC])
1592                 return -EINVAL;
1593
1594         if (netif_running(dev))
1595                 return -EBUSY;
1596
1597         if (!rdev->ops->set_wds_peer)
1598                 return -EOPNOTSUPP;
1599
1600         if (wdev->iftype != NL80211_IFTYPE_WDS)
1601                 return -EOPNOTSUPP;
1602
1603         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1604         return rdev_set_wds_peer(rdev, dev, bssid);
1605 }
1606
1607
1608 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1609 {
1610         struct cfg80211_registered_device *rdev;
1611         struct net_device *netdev = NULL;
1612         struct wireless_dev *wdev;
1613         int result = 0, rem_txq_params = 0;
1614         struct nlattr *nl_txq_params;
1615         u32 changed;
1616         u8 retry_short = 0, retry_long = 0;
1617         u32 frag_threshold = 0, rts_threshold = 0;
1618         u8 coverage_class = 0;
1619
1620         /*
1621          * Try to find the wiphy and netdev. Normally this
1622          * function shouldn't need the netdev, but this is
1623          * done for backward compatibility -- previously
1624          * setting the channel was done per wiphy, but now
1625          * it is per netdev. Previous userland like hostapd
1626          * also passed a netdev to set_wiphy, so that it is
1627          * possible to let that go to the right netdev!
1628          */
1629         mutex_lock(&cfg80211_mutex);
1630
1631         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1632                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1633
1634                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1635                 if (netdev && netdev->ieee80211_ptr) {
1636                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1637                         mutex_lock(&rdev->mtx);
1638                 } else
1639                         netdev = NULL;
1640         }
1641
1642         if (!netdev) {
1643                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1644                                                   info->attrs);
1645                 if (IS_ERR(rdev)) {
1646                         mutex_unlock(&cfg80211_mutex);
1647                         return PTR_ERR(rdev);
1648                 }
1649                 wdev = NULL;
1650                 netdev = NULL;
1651                 result = 0;
1652
1653                 mutex_lock(&rdev->mtx);
1654         } else
1655                 wdev = netdev->ieee80211_ptr;
1656
1657         /*
1658          * end workaround code, by now the rdev is available
1659          * and locked, and wdev may or may not be NULL.
1660          */
1661
1662         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1663                 result = cfg80211_dev_rename(
1664                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1665
1666         mutex_unlock(&cfg80211_mutex);
1667
1668         if (result)
1669                 goto bad_res;
1670
1671         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1672                 struct ieee80211_txq_params txq_params;
1673                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1674
1675                 if (!rdev->ops->set_txq_params) {
1676                         result = -EOPNOTSUPP;
1677                         goto bad_res;
1678                 }
1679
1680                 if (!netdev) {
1681                         result = -EINVAL;
1682                         goto bad_res;
1683                 }
1684
1685                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1686                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1687                         result = -EINVAL;
1688                         goto bad_res;
1689                 }
1690
1691                 if (!netif_running(netdev)) {
1692                         result = -ENETDOWN;
1693                         goto bad_res;
1694                 }
1695
1696                 nla_for_each_nested(nl_txq_params,
1697                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1698                                     rem_txq_params) {
1699                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1700                                   nla_data(nl_txq_params),
1701                                   nla_len(nl_txq_params),
1702                                   txq_params_policy);
1703                         result = parse_txq_params(tb, &txq_params);
1704                         if (result)
1705                                 goto bad_res;
1706
1707                         result = rdev_set_txq_params(rdev, netdev,
1708                                                      &txq_params);
1709                         if (result)
1710                                 goto bad_res;
1711                 }
1712         }
1713
1714         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1715                 result = __nl80211_set_channel(rdev,
1716                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1717                                 info);
1718                 if (result)
1719                         goto bad_res;
1720         }
1721
1722         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1723                 struct wireless_dev *txp_wdev = wdev;
1724                 enum nl80211_tx_power_setting type;
1725                 int idx, mbm = 0;
1726
1727                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1728                         txp_wdev = NULL;
1729
1730                 if (!rdev->ops->set_tx_power) {
1731                         result = -EOPNOTSUPP;
1732                         goto bad_res;
1733                 }
1734
1735                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1736                 type = nla_get_u32(info->attrs[idx]);
1737
1738                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1739                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1740                         result = -EINVAL;
1741                         goto bad_res;
1742                 }
1743
1744                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1745                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1746                         mbm = nla_get_u32(info->attrs[idx]);
1747                 }
1748
1749                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1750                 if (result)
1751                         goto bad_res;
1752         }
1753
1754         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1755             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1756                 u32 tx_ant, rx_ant;
1757                 if ((!rdev->wiphy.available_antennas_tx &&
1758                      !rdev->wiphy.available_antennas_rx) ||
1759                     !rdev->ops->set_antenna) {
1760                         result = -EOPNOTSUPP;
1761                         goto bad_res;
1762                 }
1763
1764                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1765                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1766
1767                 /* reject antenna configurations which don't match the
1768                  * available antenna masks, except for the "all" mask */
1769                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1770                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1771                         result = -EINVAL;
1772                         goto bad_res;
1773                 }
1774
1775                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1776                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1777
1778                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1779                 if (result)
1780                         goto bad_res;
1781         }
1782
1783         changed = 0;
1784
1785         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1786                 retry_short = nla_get_u8(
1787                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1788                 if (retry_short == 0) {
1789                         result = -EINVAL;
1790                         goto bad_res;
1791                 }
1792                 changed |= WIPHY_PARAM_RETRY_SHORT;
1793         }
1794
1795         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1796                 retry_long = nla_get_u8(
1797                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1798                 if (retry_long == 0) {
1799                         result = -EINVAL;
1800                         goto bad_res;
1801                 }
1802                 changed |= WIPHY_PARAM_RETRY_LONG;
1803         }
1804
1805         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1806                 frag_threshold = nla_get_u32(
1807                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1808                 if (frag_threshold < 256) {
1809                         result = -EINVAL;
1810                         goto bad_res;
1811                 }
1812                 if (frag_threshold != (u32) -1) {
1813                         /*
1814                          * Fragments (apart from the last one) are required to
1815                          * have even length. Make the fragmentation code
1816                          * simpler by stripping LSB should someone try to use
1817                          * odd threshold value.
1818                          */
1819                         frag_threshold &= ~0x1;
1820                 }
1821                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1822         }
1823
1824         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1825                 rts_threshold = nla_get_u32(
1826                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1827                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1828         }
1829
1830         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1831                 coverage_class = nla_get_u8(
1832                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1833                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1834         }
1835
1836         if (changed) {
1837                 u8 old_retry_short, old_retry_long;
1838                 u32 old_frag_threshold, old_rts_threshold;
1839                 u8 old_coverage_class;
1840
1841                 if (!rdev->ops->set_wiphy_params) {
1842                         result = -EOPNOTSUPP;
1843                         goto bad_res;
1844                 }
1845
1846                 old_retry_short = rdev->wiphy.retry_short;
1847                 old_retry_long = rdev->wiphy.retry_long;
1848                 old_frag_threshold = rdev->wiphy.frag_threshold;
1849                 old_rts_threshold = rdev->wiphy.rts_threshold;
1850                 old_coverage_class = rdev->wiphy.coverage_class;
1851
1852                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1853                         rdev->wiphy.retry_short = retry_short;
1854                 if (changed & WIPHY_PARAM_RETRY_LONG)
1855                         rdev->wiphy.retry_long = retry_long;
1856                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1857                         rdev->wiphy.frag_threshold = frag_threshold;
1858                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1859                         rdev->wiphy.rts_threshold = rts_threshold;
1860                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1861                         rdev->wiphy.coverage_class = coverage_class;
1862
1863                 result = rdev_set_wiphy_params(rdev, changed);
1864                 if (result) {
1865                         rdev->wiphy.retry_short = old_retry_short;
1866                         rdev->wiphy.retry_long = old_retry_long;
1867                         rdev->wiphy.frag_threshold = old_frag_threshold;
1868                         rdev->wiphy.rts_threshold = old_rts_threshold;
1869                         rdev->wiphy.coverage_class = old_coverage_class;
1870                 }
1871         }
1872
1873  bad_res:
1874         mutex_unlock(&rdev->mtx);
1875         if (netdev)
1876                 dev_put(netdev);
1877         return result;
1878 }
1879
1880 static inline u64 wdev_id(struct wireless_dev *wdev)
1881 {
1882         return (u64)wdev->identifier |
1883                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1884 }
1885
1886 static int nl80211_send_chandef(struct sk_buff *msg,
1887                                  struct cfg80211_chan_def *chandef)
1888 {
1889         WARN_ON(!cfg80211_chandef_valid(chandef));
1890
1891         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1892                         chandef->chan->center_freq))
1893                 return -ENOBUFS;
1894         switch (chandef->width) {
1895         case NL80211_CHAN_WIDTH_20_NOHT:
1896         case NL80211_CHAN_WIDTH_20:
1897         case NL80211_CHAN_WIDTH_40:
1898                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1899                                 cfg80211_get_chandef_type(chandef)))
1900                         return -ENOBUFS;
1901                 break;
1902         default:
1903                 break;
1904         }
1905         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
1906                 return -ENOBUFS;
1907         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
1908                 return -ENOBUFS;
1909         if (chandef->center_freq2 &&
1910             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
1911                 return -ENOBUFS;
1912         return 0;
1913 }
1914
1915 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1916                               struct cfg80211_registered_device *rdev,
1917                               struct wireless_dev *wdev)
1918 {
1919         struct net_device *dev = wdev->netdev;
1920         void *hdr;
1921
1922         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1923         if (!hdr)
1924                 return -1;
1925
1926         if (dev &&
1927             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1928              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1929                 goto nla_put_failure;
1930
1931         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1932             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1933             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1934             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1935             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1936                         rdev->devlist_generation ^
1937                         (cfg80211_rdev_list_generation << 2)))
1938                 goto nla_put_failure;
1939
1940         if (rdev->ops->get_channel) {
1941                 int ret;
1942                 struct cfg80211_chan_def chandef;
1943
1944                 ret = rdev_get_channel(rdev, wdev, &chandef);
1945                 if (ret == 0) {
1946                         if (nl80211_send_chandef(msg, &chandef))
1947                                 goto nla_put_failure;
1948                 }
1949         }
1950
1951         if (wdev->ssid_len) {
1952                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1953                         goto nla_put_failure;
1954         }
1955
1956         return genlmsg_end(msg, hdr);
1957
1958  nla_put_failure:
1959         genlmsg_cancel(msg, hdr);
1960         return -EMSGSIZE;
1961 }
1962
1963 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1964 {
1965         int wp_idx = 0;
1966         int if_idx = 0;
1967         int wp_start = cb->args[0];
1968         int if_start = cb->args[1];
1969         struct cfg80211_registered_device *rdev;
1970         struct wireless_dev *wdev;
1971
1972         mutex_lock(&cfg80211_mutex);
1973         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1974                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1975                         continue;
1976                 if (wp_idx < wp_start) {
1977                         wp_idx++;
1978                         continue;
1979                 }
1980                 if_idx = 0;
1981
1982                 mutex_lock(&rdev->devlist_mtx);
1983                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1984                         if (if_idx < if_start) {
1985                                 if_idx++;
1986                                 continue;
1987                         }
1988                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1989                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1990                                                rdev, wdev) < 0) {
1991                                 mutex_unlock(&rdev->devlist_mtx);
1992                                 goto out;
1993                         }
1994                         if_idx++;
1995                 }
1996                 mutex_unlock(&rdev->devlist_mtx);
1997
1998                 wp_idx++;
1999         }
2000  out:
2001         mutex_unlock(&cfg80211_mutex);
2002
2003         cb->args[0] = wp_idx;
2004         cb->args[1] = if_idx;
2005
2006         return skb->len;
2007 }
2008
2009 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2010 {
2011         struct sk_buff *msg;
2012         struct cfg80211_registered_device *dev = info->user_ptr[0];
2013         struct wireless_dev *wdev = info->user_ptr[1];
2014
2015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2016         if (!msg)
2017                 return -ENOMEM;
2018
2019         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2020                                dev, wdev) < 0) {
2021                 nlmsg_free(msg);
2022                 return -ENOBUFS;
2023         }
2024
2025         return genlmsg_reply(msg, info);
2026 }
2027
2028 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2029         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2030         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2031         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2032         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2033         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2034 };
2035
2036 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2037 {
2038         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2039         int flag;
2040
2041         *mntrflags = 0;
2042
2043         if (!nla)
2044                 return -EINVAL;
2045
2046         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2047                              nla, mntr_flags_policy))
2048                 return -EINVAL;
2049
2050         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2051                 if (flags[flag])
2052                         *mntrflags |= (1<<flag);
2053
2054         return 0;
2055 }
2056
2057 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2058                                struct net_device *netdev, u8 use_4addr,
2059                                enum nl80211_iftype iftype)
2060 {
2061         if (!use_4addr) {
2062                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2063                         return -EBUSY;
2064                 return 0;
2065         }
2066
2067         switch (iftype) {
2068         case NL80211_IFTYPE_AP_VLAN:
2069                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2070                         return 0;
2071                 break;
2072         case NL80211_IFTYPE_STATION:
2073                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2074                         return 0;
2075                 break;
2076         default:
2077                 break;
2078         }
2079
2080         return -EOPNOTSUPP;
2081 }
2082
2083 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2084 {
2085         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2086         struct vif_params params;
2087         int err;
2088         enum nl80211_iftype otype, ntype;
2089         struct net_device *dev = info->user_ptr[1];
2090         u32 _flags, *flags = NULL;
2091         bool change = false;
2092
2093         memset(&params, 0, sizeof(params));
2094
2095         otype = ntype = dev->ieee80211_ptr->iftype;
2096
2097         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2098                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2099                 if (otype != ntype)
2100                         change = true;
2101                 if (ntype > NL80211_IFTYPE_MAX)
2102                         return -EINVAL;
2103         }
2104
2105         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2106                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2107
2108                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2109                         return -EINVAL;
2110                 if (netif_running(dev))
2111                         return -EBUSY;
2112
2113                 wdev_lock(wdev);
2114                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2115                              IEEE80211_MAX_MESH_ID_LEN);
2116                 wdev->mesh_id_up_len =
2117                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2118                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2119                        wdev->mesh_id_up_len);
2120                 wdev_unlock(wdev);
2121         }
2122
2123         if (info->attrs[NL80211_ATTR_4ADDR]) {
2124                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2125                 change = true;
2126                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2127                 if (err)
2128                         return err;
2129         } else {
2130                 params.use_4addr = -1;
2131         }
2132
2133         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2134                 if (ntype != NL80211_IFTYPE_MONITOR)
2135                         return -EINVAL;
2136                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2137                                           &_flags);
2138                 if (err)
2139                         return err;
2140
2141                 flags = &_flags;
2142                 change = true;
2143         }
2144
2145         if (change)
2146                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2147         else
2148                 err = 0;
2149
2150         if (!err && params.use_4addr != -1)
2151                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2152
2153         return err;
2154 }
2155
2156 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2157 {
2158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2159         struct vif_params params;
2160         struct wireless_dev *wdev;
2161         struct sk_buff *msg;
2162         int err;
2163         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2164         u32 flags;
2165
2166         memset(&params, 0, sizeof(params));
2167
2168         if (!info->attrs[NL80211_ATTR_IFNAME])
2169                 return -EINVAL;
2170
2171         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2172                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2173                 if (type > NL80211_IFTYPE_MAX)
2174                         return -EINVAL;
2175         }
2176
2177         if (!rdev->ops->add_virtual_intf ||
2178             !(rdev->wiphy.interface_modes & (1 << type)))
2179                 return -EOPNOTSUPP;
2180
2181         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2182                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2183                            ETH_ALEN);
2184                 if (!is_valid_ether_addr(params.macaddr))
2185                         return -EADDRNOTAVAIL;
2186         }
2187
2188         if (info->attrs[NL80211_ATTR_4ADDR]) {
2189                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2190                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2191                 if (err)
2192                         return err;
2193         }
2194
2195         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2196         if (!msg)
2197                 return -ENOMEM;
2198
2199         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2200                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2201                                   &flags);
2202         wdev = rdev_add_virtual_intf(rdev,
2203                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2204                                 type, err ? NULL : &flags, &params);
2205         if (IS_ERR(wdev)) {
2206                 nlmsg_free(msg);
2207                 return PTR_ERR(wdev);
2208         }
2209
2210         switch (type) {
2211         case NL80211_IFTYPE_MESH_POINT:
2212                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2213                         break;
2214                 wdev_lock(wdev);
2215                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2216                              IEEE80211_MAX_MESH_ID_LEN);
2217                 wdev->mesh_id_up_len =
2218                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2219                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2220                        wdev->mesh_id_up_len);
2221                 wdev_unlock(wdev);
2222                 break;
2223         case NL80211_IFTYPE_P2P_DEVICE:
2224                 /*
2225                  * P2P Device doesn't have a netdev, so doesn't go
2226                  * through the netdev notifier and must be added here
2227                  */
2228                 mutex_init(&wdev->mtx);
2229                 INIT_LIST_HEAD(&wdev->event_list);
2230                 spin_lock_init(&wdev->event_lock);
2231                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2232                 spin_lock_init(&wdev->mgmt_registrations_lock);
2233
2234                 mutex_lock(&rdev->devlist_mtx);
2235                 wdev->identifier = ++rdev->wdev_id;
2236                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2237                 rdev->devlist_generation++;
2238                 mutex_unlock(&rdev->devlist_mtx);
2239                 break;
2240         default:
2241                 break;
2242         }
2243
2244         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2245                                rdev, wdev) < 0) {
2246                 nlmsg_free(msg);
2247                 return -ENOBUFS;
2248         }
2249
2250         return genlmsg_reply(msg, info);
2251 }
2252
2253 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2254 {
2255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2256         struct wireless_dev *wdev = info->user_ptr[1];
2257
2258         if (!rdev->ops->del_virtual_intf)
2259                 return -EOPNOTSUPP;
2260
2261         /*
2262          * If we remove a wireless device without a netdev then clear
2263          * user_ptr[1] so that nl80211_post_doit won't dereference it
2264          * to check if it needs to do dev_put(). Otherwise it crashes
2265          * since the wdev has been freed, unlike with a netdev where
2266          * we need the dev_put() for the netdev to really be freed.
2267          */
2268         if (!wdev->netdev)
2269                 info->user_ptr[1] = NULL;
2270
2271         return rdev_del_virtual_intf(rdev, wdev);
2272 }
2273
2274 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2275 {
2276         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2277         struct net_device *dev = info->user_ptr[1];
2278         u16 noack_map;
2279
2280         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2281                 return -EINVAL;
2282
2283         if (!rdev->ops->set_noack_map)
2284                 return -EOPNOTSUPP;
2285
2286         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2287
2288         return rdev_set_noack_map(rdev, dev, noack_map);
2289 }
2290
2291 struct get_key_cookie {
2292         struct sk_buff *msg;
2293         int error;
2294         int idx;
2295 };
2296
2297 static void get_key_callback(void *c, struct key_params *params)
2298 {
2299         struct nlattr *key;
2300         struct get_key_cookie *cookie = c;
2301
2302         if ((params->key &&
2303              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2304                      params->key_len, params->key)) ||
2305             (params->seq &&
2306              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2307                      params->seq_len, params->seq)) ||
2308             (params->cipher &&
2309              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2310                          params->cipher)))
2311                 goto nla_put_failure;
2312
2313         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2314         if (!key)
2315                 goto nla_put_failure;
2316
2317         if ((params->key &&
2318              nla_put(cookie->msg, NL80211_KEY_DATA,
2319                      params->key_len, params->key)) ||
2320             (params->seq &&
2321              nla_put(cookie->msg, NL80211_KEY_SEQ,
2322                      params->seq_len, params->seq)) ||
2323             (params->cipher &&
2324              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2325                          params->cipher)))
2326                 goto nla_put_failure;
2327
2328         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2329                 goto nla_put_failure;
2330
2331         nla_nest_end(cookie->msg, key);
2332
2333         return;
2334  nla_put_failure:
2335         cookie->error = 1;
2336 }
2337
2338 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2339 {
2340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2341         int err;
2342         struct net_device *dev = info->user_ptr[1];
2343         u8 key_idx = 0;
2344         const u8 *mac_addr = NULL;
2345         bool pairwise;
2346         struct get_key_cookie cookie = {
2347                 .error = 0,
2348         };
2349         void *hdr;
2350         struct sk_buff *msg;
2351
2352         if (info->attrs[NL80211_ATTR_KEY_IDX])
2353                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2354
2355         if (key_idx > 5)
2356                 return -EINVAL;
2357
2358         if (info->attrs[NL80211_ATTR_MAC])
2359                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2360
2361         pairwise = !!mac_addr;
2362         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2363                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2364                 if (kt >= NUM_NL80211_KEYTYPES)
2365                         return -EINVAL;
2366                 if (kt != NL80211_KEYTYPE_GROUP &&
2367                     kt != NL80211_KEYTYPE_PAIRWISE)
2368                         return -EINVAL;
2369                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2370         }
2371
2372         if (!rdev->ops->get_key)
2373                 return -EOPNOTSUPP;
2374
2375         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2376         if (!msg)
2377                 return -ENOMEM;
2378
2379         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2380                              NL80211_CMD_NEW_KEY);
2381         if (IS_ERR(hdr))
2382                 return PTR_ERR(hdr);
2383
2384         cookie.msg = msg;
2385         cookie.idx = key_idx;
2386
2387         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2388             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2389                 goto nla_put_failure;
2390         if (mac_addr &&
2391             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2392                 goto nla_put_failure;
2393
2394         if (pairwise && mac_addr &&
2395             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2396                 return -ENOENT;
2397
2398         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2399                            get_key_callback);
2400
2401         if (err)
2402                 goto free_msg;
2403
2404         if (cookie.error)
2405                 goto nla_put_failure;
2406
2407         genlmsg_end(msg, hdr);
2408         return genlmsg_reply(msg, info);
2409
2410  nla_put_failure:
2411         err = -ENOBUFS;
2412  free_msg:
2413         nlmsg_free(msg);
2414         return err;
2415 }
2416
2417 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2418 {
2419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2420         struct key_parse key;
2421         int err;
2422         struct net_device *dev = info->user_ptr[1];
2423
2424         err = nl80211_parse_key(info, &key);
2425         if (err)
2426                 return err;
2427
2428         if (key.idx < 0)
2429                 return -EINVAL;
2430
2431         /* only support setting default key */
2432         if (!key.def && !key.defmgmt)
2433                 return -EINVAL;
2434
2435         wdev_lock(dev->ieee80211_ptr);
2436
2437         if (key.def) {
2438                 if (!rdev->ops->set_default_key) {
2439                         err = -EOPNOTSUPP;
2440                         goto out;
2441                 }
2442
2443                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2444                 if (err)
2445                         goto out;
2446
2447                 err = rdev_set_default_key(rdev, dev, key.idx,
2448                                                  key.def_uni, key.def_multi);
2449
2450                 if (err)
2451                         goto out;
2452
2453 #ifdef CONFIG_CFG80211_WEXT
2454                 dev->ieee80211_ptr->wext.default_key = key.idx;
2455 #endif
2456         } else {
2457                 if (key.def_uni || !key.def_multi) {
2458                         err = -EINVAL;
2459                         goto out;
2460                 }
2461
2462                 if (!rdev->ops->set_default_mgmt_key) {
2463                         err = -EOPNOTSUPP;
2464                         goto out;
2465                 }
2466
2467                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2468                 if (err)
2469                         goto out;
2470
2471                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2472                 if (err)
2473                         goto out;
2474
2475 #ifdef CONFIG_CFG80211_WEXT
2476                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2477 #endif
2478         }
2479
2480  out:
2481         wdev_unlock(dev->ieee80211_ptr);
2482
2483         return err;
2484 }
2485
2486 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2487 {
2488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2489         int err;
2490         struct net_device *dev = info->user_ptr[1];
2491         struct key_parse key;
2492         const u8 *mac_addr = NULL;
2493
2494         err = nl80211_parse_key(info, &key);
2495         if (err)
2496                 return err;
2497
2498         if (!key.p.key)
2499                 return -EINVAL;
2500
2501         if (info->attrs[NL80211_ATTR_MAC])
2502                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2503
2504         if (key.type == -1) {
2505                 if (mac_addr)
2506                         key.type = NL80211_KEYTYPE_PAIRWISE;
2507                 else
2508                         key.type = NL80211_KEYTYPE_GROUP;
2509         }
2510
2511         /* for now */
2512         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2513             key.type != NL80211_KEYTYPE_GROUP)
2514                 return -EINVAL;
2515
2516         if (!rdev->ops->add_key)
2517                 return -EOPNOTSUPP;
2518
2519         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2520                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2521                                            mac_addr))
2522                 return -EINVAL;
2523
2524         wdev_lock(dev->ieee80211_ptr);
2525         err = nl80211_key_allowed(dev->ieee80211_ptr);
2526         if (!err)
2527                 err = rdev_add_key(rdev, dev, key.idx,
2528                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2529                                     mac_addr, &key.p);
2530         wdev_unlock(dev->ieee80211_ptr);
2531
2532         return err;
2533 }
2534
2535 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2536 {
2537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2538         int err;
2539         struct net_device *dev = info->user_ptr[1];
2540         u8 *mac_addr = NULL;
2541         struct key_parse key;
2542
2543         err = nl80211_parse_key(info, &key);
2544         if (err)
2545                 return err;
2546
2547         if (info->attrs[NL80211_ATTR_MAC])
2548                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2549
2550         if (key.type == -1) {
2551                 if (mac_addr)
2552                         key.type = NL80211_KEYTYPE_PAIRWISE;
2553                 else
2554                         key.type = NL80211_KEYTYPE_GROUP;
2555         }
2556
2557         /* for now */
2558         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2559             key.type != NL80211_KEYTYPE_GROUP)
2560                 return -EINVAL;
2561
2562         if (!rdev->ops->del_key)
2563                 return -EOPNOTSUPP;
2564
2565         wdev_lock(dev->ieee80211_ptr);
2566         err = nl80211_key_allowed(dev->ieee80211_ptr);
2567
2568         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2569             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2570                 err = -ENOENT;
2571
2572         if (!err)
2573                 err = rdev_del_key(rdev, dev, key.idx,
2574                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2575                                    mac_addr);
2576
2577 #ifdef CONFIG_CFG80211_WEXT
2578         if (!err) {
2579                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2580                         dev->ieee80211_ptr->wext.default_key = -1;
2581                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2582                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2583         }
2584 #endif
2585         wdev_unlock(dev->ieee80211_ptr);
2586
2587         return err;
2588 }
2589
2590 /* This function returns an error or the number of nested attributes */
2591 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2592 {
2593         struct nlattr *attr;
2594         int n_entries = 0, tmp;
2595
2596         nla_for_each_nested(attr, nl_attr, tmp) {
2597                 if (nla_len(attr) != ETH_ALEN)
2598                         return -EINVAL;
2599
2600                 n_entries++;
2601         }
2602
2603         return n_entries;
2604 }
2605
2606 /*
2607  * This function parses ACL information and allocates memory for ACL data.
2608  * On successful return, the calling function is responsible to free the
2609  * ACL buffer returned by this function.
2610  */
2611 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2612                                                 struct genl_info *info)
2613 {
2614         enum nl80211_acl_policy acl_policy;
2615         struct nlattr *attr;
2616         struct cfg80211_acl_data *acl;
2617         int i = 0, n_entries, tmp;
2618
2619         if (!wiphy->max_acl_mac_addrs)
2620                 return ERR_PTR(-EOPNOTSUPP);
2621
2622         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2623                 return ERR_PTR(-EINVAL);
2624
2625         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2626         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2627             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2628                 return ERR_PTR(-EINVAL);
2629
2630         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2631                 return ERR_PTR(-EINVAL);
2632
2633         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2634         if (n_entries < 0)
2635                 return ERR_PTR(n_entries);
2636
2637         if (n_entries > wiphy->max_acl_mac_addrs)
2638                 return ERR_PTR(-ENOTSUPP);
2639
2640         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2641                       GFP_KERNEL);
2642         if (!acl)
2643                 return ERR_PTR(-ENOMEM);
2644
2645         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2646                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2647                 i++;
2648         }
2649
2650         acl->n_acl_entries = n_entries;
2651         acl->acl_policy = acl_policy;
2652
2653         return acl;
2654 }
2655
2656 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2657 {
2658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2659         struct net_device *dev = info->user_ptr[1];
2660         struct cfg80211_acl_data *acl;
2661         int err;
2662
2663         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2664             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2665                 return -EOPNOTSUPP;
2666
2667         if (!dev->ieee80211_ptr->beacon_interval)
2668                 return -EINVAL;
2669
2670         acl = parse_acl_data(&rdev->wiphy, info);
2671         if (IS_ERR(acl))
2672                 return PTR_ERR(acl);
2673
2674         err = rdev_set_mac_acl(rdev, dev, acl);
2675
2676         kfree(acl);
2677
2678         return err;
2679 }
2680
2681 static int nl80211_parse_beacon(struct genl_info *info,
2682                                 struct cfg80211_beacon_data *bcn)
2683 {
2684         bool haveinfo = false;
2685
2686         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2687             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2688             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2689             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2690                 return -EINVAL;
2691
2692         memset(bcn, 0, sizeof(*bcn));
2693
2694         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2695                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2696                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2697                 if (!bcn->head_len)
2698                         return -EINVAL;
2699                 haveinfo = true;
2700         }
2701
2702         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2703                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2704                 bcn->tail_len =
2705                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2706                 haveinfo = true;
2707         }
2708
2709         if (!haveinfo)
2710                 return -EINVAL;
2711
2712         if (info->attrs[NL80211_ATTR_IE]) {
2713                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2714                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2715         }
2716
2717         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2718                 bcn->proberesp_ies =
2719                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2720                 bcn->proberesp_ies_len =
2721                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2722         }
2723
2724         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2725                 bcn->assocresp_ies =
2726                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2727                 bcn->assocresp_ies_len =
2728                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2729         }
2730
2731         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2732                 bcn->probe_resp =
2733                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2734                 bcn->probe_resp_len =
2735                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2736         }
2737
2738         return 0;
2739 }
2740
2741 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2742                                    struct cfg80211_ap_settings *params)
2743 {
2744         struct wireless_dev *wdev;
2745         bool ret = false;
2746
2747         mutex_lock(&rdev->devlist_mtx);
2748
2749         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2750                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2751                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2752                         continue;
2753
2754                 if (!wdev->preset_chandef.chan)
2755                         continue;
2756
2757                 params->chandef = wdev->preset_chandef;
2758                 ret = true;
2759                 break;
2760         }
2761
2762         mutex_unlock(&rdev->devlist_mtx);
2763
2764         return ret;
2765 }
2766
2767 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2768                                     enum nl80211_auth_type auth_type,
2769                                     enum nl80211_commands cmd)
2770 {
2771         if (auth_type > NL80211_AUTHTYPE_MAX)
2772                 return false;
2773
2774         switch (cmd) {
2775         case NL80211_CMD_AUTHENTICATE:
2776                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2777                     auth_type == NL80211_AUTHTYPE_SAE)
2778                         return false;
2779                 return true;
2780         case NL80211_CMD_CONNECT:
2781         case NL80211_CMD_START_AP:
2782                 /* SAE not supported yet */
2783                 if (auth_type == NL80211_AUTHTYPE_SAE)
2784                         return false;
2785                 return true;
2786         default:
2787                 return false;
2788         }
2789 }
2790
2791 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2792 {
2793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2794         struct net_device *dev = info->user_ptr[1];
2795         struct wireless_dev *wdev = dev->ieee80211_ptr;
2796         struct cfg80211_ap_settings params;
2797         int err;
2798         u8 radar_detect_width = 0;
2799
2800         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2801             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2802                 return -EOPNOTSUPP;
2803
2804         if (!rdev->ops->start_ap)
2805                 return -EOPNOTSUPP;
2806
2807         if (wdev->beacon_interval)
2808                 return -EALREADY;
2809
2810         memset(&params, 0, sizeof(params));
2811
2812         /* these are required for START_AP */
2813         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2814             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2815             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2816                 return -EINVAL;
2817
2818         err = nl80211_parse_beacon(info, &params.beacon);
2819         if (err)
2820                 return err;
2821
2822         params.beacon_interval =
2823                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2824         params.dtim_period =
2825                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2826
2827         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2828         if (err)
2829                 return err;
2830
2831         /*
2832          * In theory, some of these attributes should be required here
2833          * but since they were not used when the command was originally
2834          * added, keep them optional for old user space programs to let
2835          * them continue to work with drivers that do not need the
2836          * additional information -- drivers must check!
2837          */
2838         if (info->attrs[NL80211_ATTR_SSID]) {
2839                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2840                 params.ssid_len =
2841                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2842                 if (params.ssid_len == 0 ||
2843                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2844                         return -EINVAL;
2845         }
2846
2847         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2848                 params.hidden_ssid = nla_get_u32(
2849                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2850                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2851                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2852                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2853                         return -EINVAL;
2854         }
2855
2856         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2857
2858         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2859                 params.auth_type = nla_get_u32(
2860                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2861                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2862                                              NL80211_CMD_START_AP))
2863                         return -EINVAL;
2864         } else
2865                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2866
2867         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2868                                       NL80211_MAX_NR_CIPHER_SUITES);
2869         if (err)
2870                 return err;
2871
2872         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2873                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2874                         return -EOPNOTSUPP;
2875                 params.inactivity_timeout = nla_get_u16(
2876                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2877         }
2878
2879         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
2880                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2881                         return -EINVAL;
2882                 params.p2p_ctwindow =
2883                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
2884                 if (params.p2p_ctwindow > 127)
2885                         return -EINVAL;
2886                 if (params.p2p_ctwindow != 0 &&
2887                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
2888                         return -EINVAL;
2889         }
2890
2891         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
2892                 u8 tmp;
2893
2894                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2895                         return -EINVAL;
2896                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
2897                 if (tmp > 1)
2898                         return -EINVAL;
2899                 params.p2p_opp_ps = tmp;
2900                 if (params.p2p_opp_ps != 0 &&
2901                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
2902                         return -EINVAL;
2903         }
2904
2905         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2906                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
2907                 if (err)
2908                         return err;
2909         } else if (wdev->preset_chandef.chan) {
2910                 params.chandef = wdev->preset_chandef;
2911         } else if (!nl80211_get_ap_channel(rdev, &params))
2912                 return -EINVAL;
2913
2914         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2915                 return -EINVAL;
2916
2917         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
2918         if (err < 0)
2919                 return err;
2920         if (err) {
2921                 radar_detect_width = BIT(params.chandef.width);
2922                 params.radar_required = true;
2923         }
2924
2925         mutex_lock(&rdev->devlist_mtx);
2926         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
2927                                            params.chandef.chan,
2928                                            CHAN_MODE_SHARED,
2929                                            radar_detect_width);
2930         mutex_unlock(&rdev->devlist_mtx);
2931
2932         if (err)
2933                 return err;
2934
2935         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
2936                 params.acl = parse_acl_data(&rdev->wiphy, info);
2937                 if (IS_ERR(params.acl))
2938                         return PTR_ERR(params.acl);
2939         }
2940
2941         err = rdev_start_ap(rdev, dev, &params);
2942         if (!err) {
2943                 wdev->preset_chandef = params.chandef;
2944                 wdev->beacon_interval = params.beacon_interval;
2945                 wdev->channel = params.chandef.chan;
2946                 wdev->ssid_len = params.ssid_len;
2947                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2948         }
2949
2950         kfree(params.acl);
2951
2952         return err;
2953 }
2954
2955 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2956 {
2957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2958         struct net_device *dev = info->user_ptr[1];
2959         struct wireless_dev *wdev = dev->ieee80211_ptr;
2960         struct cfg80211_beacon_data params;
2961         int err;
2962
2963         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2964             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2965                 return -EOPNOTSUPP;
2966
2967         if (!rdev->ops->change_beacon)
2968                 return -EOPNOTSUPP;
2969
2970         if (!wdev->beacon_interval)
2971                 return -EINVAL;
2972
2973         err = nl80211_parse_beacon(info, &params);
2974         if (err)
2975                 return err;
2976
2977         return rdev_change_beacon(rdev, dev, &params);
2978 }
2979
2980 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2981 {
2982         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2983         struct net_device *dev = info->user_ptr[1];
2984
2985         return cfg80211_stop_ap(rdev, dev);
2986 }
2987
2988 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2989         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2990         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2991         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2992         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2993         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2994         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2995 };
2996
2997 static int parse_station_flags(struct genl_info *info,
2998                                enum nl80211_iftype iftype,
2999                                struct station_parameters *params)
3000 {
3001         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3002         struct nlattr *nla;
3003         int flag;
3004
3005         /*
3006          * Try parsing the new attribute first so userspace
3007          * can specify both for older kernels.
3008          */
3009         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3010         if (nla) {
3011                 struct nl80211_sta_flag_update *sta_flags;
3012
3013                 sta_flags = nla_data(nla);
3014                 params->sta_flags_mask = sta_flags->mask;
3015                 params->sta_flags_set = sta_flags->set;
3016                 if ((params->sta_flags_mask |
3017                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3018                         return -EINVAL;
3019                 return 0;
3020         }
3021
3022         /* if present, parse the old attribute */
3023
3024         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3025         if (!nla)
3026                 return 0;
3027
3028         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3029                              nla, sta_flags_policy))
3030                 return -EINVAL;
3031
3032         /*
3033          * Only allow certain flags for interface types so that
3034          * other attributes are silently ignored. Remember that
3035          * this is backward compatibility code with old userspace
3036          * and shouldn't be hit in other cases anyway.
3037          */
3038         switch (iftype) {
3039         case NL80211_IFTYPE_AP:
3040         case NL80211_IFTYPE_AP_VLAN:
3041         case NL80211_IFTYPE_P2P_GO:
3042                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3043                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3044                                          BIT(NL80211_STA_FLAG_WME) |
3045                                          BIT(NL80211_STA_FLAG_MFP);
3046                 break;
3047         case NL80211_IFTYPE_P2P_CLIENT:
3048         case NL80211_IFTYPE_STATION:
3049                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3050                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3051                 break;
3052         case NL80211_IFTYPE_MESH_POINT:
3053                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3054                                          BIT(NL80211_STA_FLAG_MFP) |
3055                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3056         default:
3057                 return -EINVAL;
3058         }
3059
3060         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3061                 if (flags[flag]) {
3062                         params->sta_flags_set |= (1<<flag);
3063
3064                         /* no longer support new API additions in old API */
3065                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3066                                 return -EINVAL;
3067                 }
3068         }
3069
3070         return 0;
3071 }
3072
3073 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3074                                  int attr)
3075 {
3076         struct nlattr *rate;
3077         u32 bitrate;
3078         u16 bitrate_compat;
3079
3080         rate = nla_nest_start(msg, attr);
3081         if (!rate)
3082                 return false;
3083
3084         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3085         bitrate = cfg80211_calculate_bitrate(info);
3086         /* report 16-bit bitrate only if we can */
3087         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3088         if (bitrate > 0 &&
3089             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3090                 return false;
3091         if (bitrate_compat > 0 &&
3092             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3093                 return false;
3094
3095         if (info->flags & RATE_INFO_FLAGS_MCS) {
3096                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3097                         return false;
3098                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3099                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3100                         return false;
3101                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3102                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3103                         return false;
3104         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3105                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3106                         return false;
3107                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3108                         return false;
3109                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3110                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3111                         return false;
3112                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3113                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3114                         return false;
3115                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3116                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3117                         return false;
3118                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3119                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3120                         return false;
3121                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3122                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3123                         return false;
3124         }
3125
3126         nla_nest_end(msg, rate);
3127         return true;
3128 }
3129
3130 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3131                                 int flags,
3132                                 struct cfg80211_registered_device *rdev,
3133                                 struct net_device *dev,
3134                                 const u8 *mac_addr, struct station_info *sinfo)
3135 {
3136         void *hdr;
3137         struct nlattr *sinfoattr, *bss_param;
3138
3139         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3140         if (!hdr)
3141                 return -1;
3142
3143         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3144             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3145             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3146                 goto nla_put_failure;
3147
3148         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3149         if (!sinfoattr)
3150                 goto nla_put_failure;
3151         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3152             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3153                         sinfo->connected_time))
3154                 goto nla_put_failure;
3155         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3156             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3157                         sinfo->inactive_time))
3158                 goto nla_put_failure;
3159         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3160                               STATION_INFO_RX_BYTES64)) &&
3161             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3162                         (u32)sinfo->rx_bytes))
3163                 goto nla_put_failure;
3164         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3165                               NL80211_STA_INFO_TX_BYTES64)) &&
3166             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3167                         (u32)sinfo->tx_bytes))
3168                 goto nla_put_failure;
3169         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3170             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3171                         sinfo->rx_bytes))
3172                 goto nla_put_failure;
3173         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3174             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3175                         sinfo->tx_bytes))
3176                 goto nla_put_failure;
3177         if ((sinfo->filled & STATION_INFO_LLID) &&
3178             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3179                 goto nla_put_failure;
3180         if ((sinfo->filled & STATION_INFO_PLID) &&
3181             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3182                 goto nla_put_failure;
3183         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3184             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3185                        sinfo->plink_state))
3186                 goto nla_put_failure;
3187         switch (rdev->wiphy.signal_type) {
3188         case CFG80211_SIGNAL_TYPE_MBM:
3189                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3190                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3191                                sinfo->signal))
3192                         goto nla_put_failure;
3193                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3194                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3195                                sinfo->signal_avg))
3196                         goto nla_put_failure;
3197                 break;
3198         default:
3199                 break;
3200         }
3201         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3202                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3203                                           NL80211_STA_INFO_TX_BITRATE))
3204                         goto nla_put_failure;
3205         }
3206         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3207                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3208                                           NL80211_STA_INFO_RX_BITRATE))
3209                         goto nla_put_failure;
3210         }
3211         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3212             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3213                         sinfo->rx_packets))
3214                 goto nla_put_failure;
3215         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3216             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3217                         sinfo->tx_packets))
3218                 goto nla_put_failure;
3219         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3220             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3221                         sinfo->tx_retries))
3222                 goto nla_put_failure;
3223         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3224             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3225                         sinfo->tx_failed))
3226                 goto nla_put_failure;
3227         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3228             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3229                         sinfo->beacon_loss_count))
3230                 goto nla_put_failure;
3231         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3232             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3233                         sinfo->local_pm))
3234                 goto nla_put_failure;
3235         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3236             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3237                         sinfo->peer_pm))
3238                 goto nla_put_failure;
3239         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3240             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3241                         sinfo->nonpeer_pm))
3242                 goto nla_put_failure;
3243         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3244                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3245                 if (!bss_param)
3246                         goto nla_put_failure;
3247
3248                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3249                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3250                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3251                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3252                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3253                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3254                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3255                                sinfo->bss_param.dtim_period) ||
3256                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3257                                 sinfo->bss_param.beacon_interval))
3258                         goto nla_put_failure;
3259
3260                 nla_nest_end(msg, bss_param);
3261         }
3262         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3263             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3264                     sizeof(struct nl80211_sta_flag_update),
3265                     &sinfo->sta_flags))
3266                 goto nla_put_failure;
3267         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3268                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3269                             sinfo->t_offset))
3270                 goto nla_put_failure;
3271         nla_nest_end(msg, sinfoattr);
3272
3273         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3274             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3275                     sinfo->assoc_req_ies))
3276                 goto nla_put_failure;
3277
3278         return genlmsg_end(msg, hdr);
3279
3280  nla_put_failure:
3281         genlmsg_cancel(msg, hdr);
3282         return -EMSGSIZE;
3283 }
3284
3285 static int nl80211_dump_station(struct sk_buff *skb,
3286                                 struct netlink_callback *cb)
3287 {
3288         struct station_info sinfo;
3289         struct cfg80211_registered_device *dev;
3290         struct net_device *netdev;
3291         u8 mac_addr[ETH_ALEN];
3292         int sta_idx = cb->args[1];
3293         int err;
3294
3295         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3296         if (err)
3297                 return err;
3298
3299         if (!dev->ops->dump_station) {
3300                 err = -EOPNOTSUPP;
3301                 goto out_err;
3302         }
3303
3304         while (1) {
3305                 memset(&sinfo, 0, sizeof(sinfo));
3306                 err = rdev_dump_station(dev, netdev, sta_idx,
3307                                         mac_addr, &sinfo);
3308                 if (err == -ENOENT)
3309                         break;
3310                 if (err)
3311                         goto out_err;
3312
3313                 if (nl80211_send_station(skb,
3314                                 NETLINK_CB(cb->skb).portid,
3315                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3316                                 dev, netdev, mac_addr,
3317                                 &sinfo) < 0)
3318                         goto out;
3319
3320                 sta_idx++;
3321         }
3322
3323
3324  out:
3325         cb->args[1] = sta_idx;
3326         err = skb->len;
3327  out_err:
3328         nl80211_finish_netdev_dump(dev);
3329
3330         return err;
3331 }
3332
3333 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3334 {
3335         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3336         struct net_device *dev = info->user_ptr[1];
3337         struct station_info sinfo;
3338         struct sk_buff *msg;
3339         u8 *mac_addr = NULL;
3340         int err;
3341
3342         memset(&sinfo, 0, sizeof(sinfo));
3343
3344         if (!info->attrs[NL80211_ATTR_MAC])
3345                 return -EINVAL;
3346
3347         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3348
3349         if (!rdev->ops->get_station)
3350                 return -EOPNOTSUPP;
3351
3352         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3353         if (err)
3354                 return err;
3355
3356         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3357         if (!msg)
3358                 return -ENOMEM;
3359
3360         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3361                                  rdev, dev, mac_addr, &sinfo) < 0) {
3362                 nlmsg_free(msg);
3363                 return -ENOBUFS;
3364         }
3365
3366         return genlmsg_reply(msg, info);
3367 }
3368
3369 /*
3370  * Get vlan interface making sure it is running and on the right wiphy.
3371  */
3372 static struct net_device *get_vlan(struct genl_info *info,
3373                                    struct cfg80211_registered_device *rdev)
3374 {
3375         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3376         struct net_device *v;
3377         int ret;
3378
3379         if (!vlanattr)
3380                 return NULL;
3381
3382         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3383         if (!v)
3384                 return ERR_PTR(-ENODEV);
3385
3386         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3387                 ret = -EINVAL;
3388                 goto error;
3389         }
3390
3391         if (!netif_running(v)) {
3392                 ret = -ENETDOWN;
3393                 goto error;
3394         }
3395
3396         return v;
3397  error:
3398         dev_put(v);
3399         return ERR_PTR(ret);
3400 }
3401
3402 static struct nla_policy
3403 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3404         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3405         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3406 };
3407
3408 static int nl80211_set_station_tdls(struct genl_info *info,
3409                                     struct station_parameters *params)
3410 {
3411         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3412         struct nlattr *nla;
3413         int err;
3414
3415         /* Dummy STA entry gets updated once the peer capabilities are known */
3416         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3417                 params->ht_capa =
3418                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3419         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3420                 params->vht_capa =
3421                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3422
3423         /* parse WME attributes if present */
3424         if (!info->attrs[NL80211_ATTR_STA_WME])
3425                 return 0;
3426
3427         nla = info->attrs[NL80211_ATTR_STA_WME];
3428         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3429                                nl80211_sta_wme_policy);
3430         if (err)
3431                 return err;
3432
3433         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3434                 params->uapsd_queues = nla_get_u8(
3435                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3436         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3437                 return -EINVAL;
3438
3439         if (tb[NL80211_STA_WME_MAX_SP])
3440                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3441
3442         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3443                 return -EINVAL;
3444
3445         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3446
3447         return 0;
3448 }
3449
3450 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3451 {
3452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3453         int err;
3454         struct net_device *dev = info->user_ptr[1];
3455         struct station_parameters params;
3456         u8 *mac_addr = NULL;
3457
3458         memset(&params, 0, sizeof(params));
3459
3460         params.listen_interval = -1;
3461         params.plink_state = -1;
3462
3463         if (info->attrs[NL80211_ATTR_STA_AID])
3464                 return -EINVAL;
3465
3466         if (!info->attrs[NL80211_ATTR_MAC])
3467                 return -EINVAL;
3468
3469         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3470
3471         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3472                 params.supported_rates =
3473                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3474                 params.supported_rates_len =
3475                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3476         }
3477
3478         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3479                 params.capability =
3480                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3481                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3482         }
3483
3484         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3485                 params.ext_capab =
3486                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3487                 params.ext_capab_len =
3488                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3489         }
3490
3491         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3492                 return -EINVAL;
3493
3494         if (!rdev->ops->change_station)
3495                 return -EOPNOTSUPP;
3496
3497         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3498                 return -EINVAL;
3499
3500         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3501                 params.plink_action =
3502                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3503
3504         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3505                 params.plink_state =
3506                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3507
3508         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3509                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3510                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3511
3512                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3513                     pm > NL80211_MESH_POWER_MAX)
3514                         return -EINVAL;
3515
3516                 params.local_pm = pm;
3517         }
3518
3519         switch (dev->ieee80211_ptr->iftype) {
3520         case NL80211_IFTYPE_AP:
3521         case NL80211_IFTYPE_AP_VLAN:
3522         case NL80211_IFTYPE_P2P_GO:
3523                 /* disallow mesh-specific things */
3524                 if (params.plink_action)
3525                         return -EINVAL;
3526                 if (params.local_pm)
3527                         return -EINVAL;
3528
3529                 /* TDLS can't be set, ... */
3530                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3531                         return -EINVAL;
3532                 /*
3533                  * ... but don't bother the driver with it. This works around
3534                  * a hostapd/wpa_supplicant issue -- it always includes the
3535                  * TLDS_PEER flag in the mask even for AP mode.
3536                  */
3537                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3538
3539                 /* accept only the listed bits */
3540                 if (params.sta_flags_mask &
3541                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3542                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3543                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3544                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3545                                   BIT(NL80211_STA_FLAG_WME) |
3546                                   BIT(NL80211_STA_FLAG_MFP)))
3547                         return -EINVAL;
3548
3549                 /* but authenticated/associated only if driver handles it */
3550                 if (!(rdev->wiphy.features &
3551                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3552                     params.sta_flags_mask &
3553                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3554                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3555                         return -EINVAL;
3556
3557                 /* reject other things that can't change */
3558                 if (params.supported_rates)
3559                         return -EINVAL;
3560                 if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
3561                         return -EINVAL;
3562                 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
3563                         return -EINVAL;
3564                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3565                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3566                         return -EINVAL;
3567
3568                 /* must be last in here for error handling */
3569                 params.vlan = get_vlan(info, rdev);
3570                 if (IS_ERR(params.vlan))
3571                         return PTR_ERR(params.vlan);
3572                 break;
3573         case NL80211_IFTYPE_P2P_CLIENT:
3574         case NL80211_IFTYPE_STATION:
3575                 /*
3576                  * Don't allow userspace to change the TDLS_PEER flag,
3577                  * but silently ignore attempts to change it since we
3578                  * don't have state here to verify that it doesn't try
3579                  * to change the flag.
3580                  */
3581                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3582                 /* Include parameters for TDLS peer (driver will check) */
3583                 err = nl80211_set_station_tdls(info, &params);
3584                 if (err)
3585                         return err;
3586                 /* disallow things sta doesn't support */
3587                 if (params.plink_action)
3588                         return -EINVAL;
3589                 if (params.local_pm)
3590                         return -EINVAL;
3591                 /* reject any changes other than AUTHORIZED or WME (for TDLS) */
3592                 if (params.sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3593                                               BIT(NL80211_STA_FLAG_WME)))
3594                         return -EINVAL;
3595                 break;
3596         case NL80211_IFTYPE_ADHOC:
3597                 /* disallow things sta doesn't support */
3598                 if (params.plink_action)
3599                         return -EINVAL;
3600                 if (params.local_pm)
3601                         return -EINVAL;
3602                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3603                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3604                         return -EINVAL;
3605                 /* reject any changes other than AUTHORIZED */
3606                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3607                         return -EINVAL;
3608                 break;
3609         case NL80211_IFTYPE_MESH_POINT:
3610                 /* disallow things mesh doesn't support */
3611                 if (params.vlan)
3612                         return -EINVAL;
3613                 if (params.supported_rates)
3614                         return -EINVAL;
3615                 if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
3616                         return -EINVAL;
3617                 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
3618                         return -EINVAL;
3619                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3620                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3621                         return -EINVAL;
3622                 /*
3623                  * No special handling for TDLS here -- the userspace
3624                  * mesh code doesn't have this bug.
3625                  */
3626                 if (params.sta_flags_mask &
3627                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3628                                   BIT(NL80211_STA_FLAG_MFP) |
3629                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3630                         return -EINVAL;
3631                 break;
3632         default:
3633                 return -EOPNOTSUPP;
3634         }
3635
3636         /* be aware of params.vlan when changing code here */
3637
3638         err = rdev_change_station(rdev, dev, mac_addr, &params);
3639
3640         if (params.vlan)
3641                 dev_put(params.vlan);
3642
3643         return err;
3644 }
3645
3646 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3647 {
3648         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3649         int err;
3650         struct net_device *dev = info->user_ptr[1];
3651         struct station_parameters params;
3652         u8 *mac_addr = NULL;
3653
3654         memset(&params, 0, sizeof(params));
3655
3656         if (!info->attrs[NL80211_ATTR_MAC])
3657                 return -EINVAL;
3658
3659         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3660                 return -EINVAL;
3661
3662         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3663                 return -EINVAL;
3664
3665         if (!info->attrs[NL80211_ATTR_STA_AID])
3666                 return -EINVAL;
3667
3668         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3669         params.supported_rates =
3670                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3671         params.supported_rates_len =
3672                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3673         params.listen_interval =
3674                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3675
3676         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3677         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3678                 return -EINVAL;
3679
3680         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3681                 params.capability =
3682                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3683                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3684         }
3685
3686         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3687                 params.ext_capab =
3688                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3689                 params.ext_capab_len =
3690                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3691         }
3692
3693         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3694                 params.ht_capa =
3695                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3696
3697         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3698                 params.vht_capa =
3699                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3700
3701         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3702                 params.plink_action =
3703                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3704
3705         if (!rdev->ops->add_station)
3706                 return -EOPNOTSUPP;
3707
3708         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3709                 return -EINVAL;
3710
3711         switch (dev->ieee80211_ptr->iftype) {
3712         case NL80211_IFTYPE_AP:
3713         case NL80211_IFTYPE_AP_VLAN:
3714         case NL80211_IFTYPE_P2P_GO:
3715                 /* parse WME attributes if sta is WME capable */
3716                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3717                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3718                     info->attrs[NL80211_ATTR_STA_WME]) {
3719                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3720                         struct nlattr *nla;
3721
3722                         nla = info->attrs[NL80211_ATTR_STA_WME];
3723                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3724                                                nl80211_sta_wme_policy);
3725                         if (err)
3726                                 return err;
3727
3728                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3729                                 params.uapsd_queues =
3730                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3731                         if (params.uapsd_queues &
3732                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3733                                 return -EINVAL;
3734
3735                         if (tb[NL80211_STA_WME_MAX_SP])
3736                                 params.max_sp =
3737                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3738
3739                         if (params.max_sp &
3740                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3741                                 return -EINVAL;
3742
3743                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3744                 }
3745                 /* TDLS peers cannot be added */
3746                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3747                         return -EINVAL;
3748                 /* but don't bother the driver with it */
3749                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3750
3751                 /* allow authenticated/associated only if driver handles it */
3752                 if (!(rdev->wiphy.features &
3753                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3754                     params.sta_flags_mask &
3755                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3756                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3757                         return -EINVAL;
3758
3759                 /* must be last in here for error handling */
3760                 params.vlan = get_vlan(info, rdev);
3761                 if (IS_ERR(params.vlan))
3762                         return PTR_ERR(params.vlan);
3763                 break;
3764         case NL80211_IFTYPE_MESH_POINT:
3765                 /* associated is disallowed */
3766                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3767                         return -EINVAL;
3768                 /* TDLS peers cannot be added */
3769                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3770                         return -EINVAL;
3771                 break;
3772         case NL80211_IFTYPE_STATION:
3773                 /* associated is disallowed */
3774                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3775                         return -EINVAL;
3776                 /* Only TDLS peers can be added */
3777                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3778                         return -EINVAL;
3779                 /* Can only add if TDLS ... */
3780                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3781                         return -EOPNOTSUPP;
3782                 /* ... with external setup is supported */
3783                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3784                         return -EOPNOTSUPP;
3785                 break;
3786         default:
3787                 return -EOPNOTSUPP;
3788         }
3789
3790         /* be aware of params.vlan when changing code here */
3791
3792         err = rdev_add_station(rdev, dev, mac_addr, &params);
3793
3794         if (params.vlan)
3795                 dev_put(params.vlan);
3796         return err;
3797 }
3798
3799 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3800 {
3801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3802         struct net_device *dev = info->user_ptr[1];
3803         u8 *mac_addr = NULL;
3804
3805         if (info->attrs[NL80211_ATTR_MAC])
3806                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3807
3808         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3809             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3810             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3811             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3812                 return -EINVAL;
3813
3814         if (!rdev->ops->del_station)
3815                 return -EOPNOTSUPP;
3816
3817         return rdev_del_station(rdev, dev, mac_addr);
3818 }
3819
3820 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3821                                 int flags, struct net_device *dev,
3822                                 u8 *dst, u8 *next_hop,
3823                                 struct mpath_info *pinfo)
3824 {
3825         void *hdr;
3826         struct nlattr *pinfoattr;
3827
3828         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3829         if (!hdr)
3830                 return -1;
3831
3832         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3833             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3834             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3835             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3836                 goto nla_put_failure;
3837
3838         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3839         if (!pinfoattr)
3840                 goto nla_put_failure;
3841         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3842             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3843                         pinfo->frame_qlen))
3844                 goto nla_put_failure;
3845         if (((pinfo->filled & MPATH_INFO_SN) &&
3846              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3847             ((pinfo->filled & MPATH_INFO_METRIC) &&
3848              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3849                          pinfo->metric)) ||
3850             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3851              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3852                          pinfo->exptime)) ||
3853             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3854              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3855                         pinfo->flags)) ||
3856             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3857              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3858                          pinfo->discovery_timeout)) ||
3859             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3860              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3861                         pinfo->discovery_retries)))
3862                 goto nla_put_failure;
3863
3864         nla_nest_end(msg, pinfoattr);
3865
3866         return genlmsg_end(msg, hdr);
3867
3868  nla_put_failure:
3869         genlmsg_cancel(msg, hdr);
3870         return -EMSGSIZE;
3871 }
3872
3873 static int nl80211_dump_mpath(struct sk_buff *skb,
3874                               struct netlink_callback *cb)
3875 {
3876         struct mpath_info pinfo;
3877         struct cfg80211_registered_device *dev;
3878         struct net_device *netdev;
3879         u8 dst[ETH_ALEN];
3880         u8 next_hop[ETH_ALEN];
3881         int path_idx = cb->args[1];
3882         int err;
3883
3884         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3885         if (err)
3886                 return err;
3887
3888         if (!dev->ops->dump_mpath) {
3889                 err = -EOPNOTSUPP;
3890                 goto out_err;
3891         }
3892
3893         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3894                 err = -EOPNOTSUPP;
3895                 goto out_err;
3896         }
3897
3898         while (1) {
3899                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3900                                       &pinfo);
3901                 if (err == -ENOENT)
3902                         break;
3903                 if (err)
3904                         goto out_err;
3905
3906                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3907                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3908                                        netdev, dst, next_hop,
3909                                        &pinfo) < 0)
3910                         goto out;
3911
3912                 path_idx++;
3913         }
3914
3915
3916  out:
3917         cb->args[1] = path_idx;
3918         err = skb->len;
3919  out_err:
3920         nl80211_finish_netdev_dump(dev);
3921         return err;
3922 }
3923
3924 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3925 {
3926         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3927         int err;
3928         struct net_device *dev = info->user_ptr[1];
3929         struct mpath_info pinfo;
3930         struct sk_buff *msg;
3931         u8 *dst = NULL;
3932         u8 next_hop[ETH_ALEN];
3933
3934         memset(&pinfo, 0, sizeof(pinfo));
3935
3936         if (!info->attrs[NL80211_ATTR_MAC])
3937                 return -EINVAL;
3938
3939         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3940
3941         if (!rdev->ops->get_mpath)
3942                 return -EOPNOTSUPP;
3943
3944         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3945                 return -EOPNOTSUPP;
3946
3947         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3948         if (err)
3949                 return err;
3950
3951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3952         if (!msg)
3953                 return -ENOMEM;
3954
3955         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3956                                  dev, dst, next_hop, &pinfo) < 0) {
3957                 nlmsg_free(msg);
3958                 return -ENOBUFS;
3959         }
3960
3961         return genlmsg_reply(msg, info);
3962 }
3963
3964 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3965 {
3966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3967         struct net_device *dev = info->user_ptr[1];
3968         u8 *dst = NULL;
3969         u8 *next_hop = NULL;
3970
3971         if (!info->attrs[NL80211_ATTR_MAC])
3972                 return -EINVAL;
3973
3974         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3975                 return -EINVAL;
3976
3977         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3978         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3979
3980         if (!rdev->ops->change_mpath)
3981                 return -EOPNOTSUPP;
3982
3983         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3984                 return -EOPNOTSUPP;
3985
3986         return rdev_change_mpath(rdev, dev, dst, next_hop);
3987 }
3988
3989 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3990 {
3991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3992         struct net_device *dev = info->user_ptr[1];
3993         u8 *dst = NULL;
3994         u8 *next_hop = NULL;
3995
3996         if (!info->attrs[NL80211_ATTR_MAC])
3997                 return -EINVAL;
3998
3999         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4000                 return -EINVAL;
4001
4002         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4003         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4004
4005         if (!rdev->ops->add_mpath)
4006                 return -EOPNOTSUPP;
4007
4008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4009                 return -EOPNOTSUPP;
4010
4011         return rdev_add_mpath(rdev, dev, dst, next_hop);
4012 }
4013
4014 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4015 {
4016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4017         struct net_device *dev = info->user_ptr[1];
4018         u8 *dst = NULL;
4019
4020         if (info->attrs[NL80211_ATTR_MAC])
4021                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4022
4023         if (!rdev->ops->del_mpath)
4024                 return -EOPNOTSUPP;
4025
4026         return rdev_del_mpath(rdev, dev, dst);
4027 }
4028
4029 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4030 {
4031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4032         struct net_device *dev = info->user_ptr[1];
4033         struct bss_parameters params;
4034
4035         memset(&params, 0, sizeof(params));
4036         /* default to not changing parameters */
4037         params.use_cts_prot = -1;
4038         params.use_short_preamble = -1;
4039         params.use_short_slot_time = -1;
4040         params.ap_isolate = -1;
4041         params.ht_opmode = -1;
4042         params.p2p_ctwindow = -1;
4043         params.p2p_opp_ps = -1;
4044
4045         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4046                 params.use_cts_prot =
4047                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4048         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4049                 params.use_short_preamble =
4050                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4051         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4052                 params.use_short_slot_time =
4053                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4054         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4055                 params.basic_rates =
4056                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4057                 params.basic_rates_len =
4058                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4059         }
4060         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4061                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4062         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4063                 params.ht_opmode =
4064                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4065
4066         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4067                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4068                         return -EINVAL;
4069                 params.p2p_ctwindow =
4070                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4071                 if (params.p2p_ctwindow < 0)
4072                         return -EINVAL;
4073                 if (params.p2p_ctwindow != 0 &&
4074                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4075                         return -EINVAL;
4076         }
4077
4078         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4079                 u8 tmp;
4080
4081                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4082                         return -EINVAL;
4083                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4084                 if (tmp > 1)
4085                         return -EINVAL;
4086                 params.p2p_opp_ps = tmp;
4087                 if (params.p2p_opp_ps &&
4088                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4089                         return -EINVAL;
4090         }
4091
4092         if (!rdev->ops->change_bss)
4093                 return -EOPNOTSUPP;
4094
4095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4097                 return -EOPNOTSUPP;
4098
4099         return rdev_change_bss(rdev, dev, &params);
4100 }
4101
4102 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4103         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4104         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4105         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4106         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4107         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4108         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4109 };
4110
4111 static int parse_reg_rule(struct nlattr *tb[],
4112         struct ieee80211_reg_rule *reg_rule)
4113 {
4114         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4115         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4116
4117         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4118                 return -EINVAL;
4119         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4120                 return -EINVAL;
4121         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4122                 return -EINVAL;
4123         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4124                 return -EINVAL;
4125         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4126                 return -EINVAL;
4127
4128         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4129
4130         freq_range->start_freq_khz =
4131                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4132         freq_range->end_freq_khz =
4133                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4134         freq_range->max_bandwidth_khz =
4135                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4136
4137         power_rule->max_eirp =
4138                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4139
4140         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4141                 power_rule->max_antenna_gain =
4142                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4143
4144         return 0;
4145 }
4146
4147 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4148 {
4149         int r;
4150         char *data = NULL;
4151         enum nl80211_user_reg_hint_type user_reg_hint_type;
4152
4153         /*
4154          * You should only get this when cfg80211 hasn't yet initialized
4155          * completely when built-in to the kernel right between the time
4156          * window between nl80211_init() and regulatory_init(), if that is
4157          * even possible.
4158          */
4159         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4160                 return -EINPROGRESS;
4161
4162         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4163                 return -EINVAL;
4164
4165         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4166
4167         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4168                 user_reg_hint_type =
4169                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4170         else
4171                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4172
4173         switch (user_reg_hint_type) {
4174         case NL80211_USER_REG_HINT_USER:
4175         case NL80211_USER_REG_HINT_CELL_BASE:
4176                 break;
4177         default:
4178                 return -EINVAL;
4179         }
4180
4181         r = regulatory_hint_user(data, user_reg_hint_type);
4182
4183         return r;
4184 }
4185
4186 static int nl80211_get_mesh_config(struct sk_buff *skb,
4187                                    struct genl_info *info)
4188 {
4189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4190         struct net_device *dev = info->user_ptr[1];
4191         struct wireless_dev *wdev = dev->ieee80211_ptr;
4192         struct mesh_config cur_params;
4193         int err = 0;
4194         void *hdr;
4195         struct nlattr *pinfoattr;
4196         struct sk_buff *msg;
4197
4198         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4199                 return -EOPNOTSUPP;
4200
4201         if (!rdev->ops->get_mesh_config)
4202                 return -EOPNOTSUPP;
4203
4204         wdev_lock(wdev);
4205         /* If not connected, get default parameters */
4206         if (!wdev->mesh_id_len)
4207                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4208         else
4209                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4210         wdev_unlock(wdev);
4211
4212         if (err)
4213                 return err;
4214
4215         /* Draw up a netlink message to send back */
4216         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4217         if (!msg)
4218                 return -ENOMEM;
4219         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4220                              NL80211_CMD_GET_MESH_CONFIG);
4221         if (!hdr)
4222                 goto out;
4223         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4224         if (!pinfoattr)
4225                 goto nla_put_failure;
4226         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4227             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4228                         cur_params.dot11MeshRetryTimeout) ||
4229             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4230                         cur_params.dot11MeshConfirmTimeout) ||
4231             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4232                         cur_params.dot11MeshHoldingTimeout) ||
4233             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4234                         cur_params.dot11MeshMaxPeerLinks) ||
4235             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4236                        cur_params.dot11MeshMaxRetries) ||
4237             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4238                        cur_params.dot11MeshTTL) ||
4239             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4240                        cur_params.element_ttl) ||
4241             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4242                        cur_params.auto_open_plinks) ||
4243             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4244                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4245             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4246                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4247             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4248                         cur_params.path_refresh_time) ||
4249             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4250                         cur_params.min_discovery_timeout) ||
4251             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4252                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4253             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4254                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4255             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4256                         cur_params.dot11MeshHWMPperrMinInterval) ||
4257             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4258                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4259             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4260                        cur_params.dot11MeshHWMPRootMode) ||
4261             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4262                         cur_params.dot11MeshHWMPRannInterval) ||
4263             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4264                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4265             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4266                        cur_params.dot11MeshForwarding) ||
4267             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4268                         cur_params.rssi_threshold) ||
4269             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4270                         cur_params.ht_opmode) ||
4271             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4272                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4273             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4274                         cur_params.dot11MeshHWMProotInterval) ||
4275             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4276                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4277             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4278                         cur_params.power_mode) ||
4279             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4280                         cur_params.dot11MeshAwakeWindowDuration))
4281                 goto nla_put_failure;
4282         nla_nest_end(msg, pinfoattr);
4283         genlmsg_end(msg, hdr);
4284         return genlmsg_reply(msg, info);
4285
4286  nla_put_failure:
4287         genlmsg_cancel(msg, hdr);
4288  out:
4289         nlmsg_free(msg);
4290         return -ENOBUFS;
4291 }
4292
4293 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4294         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4295         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4296         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4297         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4298         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4299         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4300         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4301         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4302         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4303         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4304         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4305         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4306         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4307         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4308         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4309         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4310         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4311         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4312         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4313         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4314         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4315         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4316         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4317         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4318         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4319         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4320         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4321 };
4322
4323 static const struct nla_policy
4324         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4325         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4326         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4327         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4328         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4329         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4330                                     .len = IEEE80211_MAX_DATA_LEN },
4331         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4332 };
4333
4334 static int nl80211_parse_mesh_config(struct genl_info *info,
4335                                      struct mesh_config *cfg,
4336                                      u32 *mask_out)
4337 {
4338         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4339         u32 mask = 0;
4340
4341 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4342 do {                                                                        \
4343         if (tb[attr]) {                                                     \
4344                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4345                         return -EINVAL;                                     \
4346                 cfg->param = fn(tb[attr]);                                  \
4347                 mask |= (1 << (attr - 1));                                  \
4348         }                                                                   \
4349 } while (0)
4350
4351
4352         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4353                 return -EINVAL;
4354         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4355                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4356                              nl80211_meshconf_params_policy))
4357                 return -EINVAL;
4358
4359         /* This makes sure that there aren't more than 32 mesh config
4360          * parameters (otherwise our bitfield scheme would not work.) */
4361         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4362
4363         /* Fill in the params struct */
4364         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4365                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4366                                   nla_get_u16);
4367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4368                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4369                                   nla_get_u16);
4370         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4371                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4372                                   nla_get_u16);
4373         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4374                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4375                                   nla_get_u16);
4376         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4377                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4378                                   nla_get_u8);
4379         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4380                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4381         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4382                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4383                                   nla_get_u8);
4384         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4385                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4386                                   nla_get_u8);
4387         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4388                                   1, 255, mask,
4389                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4390                                   nla_get_u32);
4391         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4392                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4393                                   nla_get_u8);
4394         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4395                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4396                                   nla_get_u32);
4397         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4398                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4399                                   nla_get_u16);
4400         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4401                                   1, 65535, mask,
4402                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4403                                   nla_get_u32);
4404         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4405                                   1, 65535, mask,
4406                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4407                                   nla_get_u16);
4408         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4409                                   1, 65535, mask,
4410                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4411                                   nla_get_u16);
4412         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4413                                   dot11MeshHWMPnetDiameterTraversalTime,
4414                                   1, 65535, mask,
4415                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4416                                   nla_get_u16);
4417         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4418                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4419                                   nla_get_u8);
4420         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4421                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4422                                   nla_get_u16);
4423         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4424                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4425                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4426                                   nla_get_u8);
4427         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4428                                   mask, NL80211_MESHCONF_FORWARDING,
4429                                   nla_get_u8);
4430         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4431                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4432                                   nla_get_u32);
4433         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4434                                   mask, NL80211_MESHCONF_HT_OPMODE,
4435                                   nla_get_u16);
4436         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4437                                   1, 65535, mask,
4438                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4439                                   nla_get_u32);
4440         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4441                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4442                                   nla_get_u16);
4443         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4444                                   dot11MeshHWMPconfirmationInterval,
4445                                   1, 65535, mask,
4446                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4447                                   nla_get_u16);
4448         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4449                                   NL80211_MESH_POWER_ACTIVE,
4450                                   NL80211_MESH_POWER_MAX,
4451                                   mask, NL80211_MESHCONF_POWER_MODE,
4452                                   nla_get_u32);
4453         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4454                                   0, 65535, mask,
4455                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4456         if (mask_out)
4457                 *mask_out = mask;
4458
4459         return 0;
4460
4461 #undef FILL_IN_MESH_PARAM_IF_SET
4462 }
4463
4464 static int nl80211_parse_mesh_setup(struct genl_info *info,
4465                                      struct mesh_setup *setup)
4466 {
4467         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4468
4469         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4470                 return -EINVAL;
4471         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4472                              info->attrs[NL80211_ATTR_MESH_SETUP],
4473                              nl80211_mesh_setup_params_policy))
4474                 return -EINVAL;
4475
4476         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4477                 setup->sync_method =
4478                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4479                  IEEE80211_SYNC_METHOD_VENDOR :
4480                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4481
4482         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4483                 setup->path_sel_proto =
4484                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4485                  IEEE80211_PATH_PROTOCOL_VENDOR :
4486                  IEEE80211_PATH_PROTOCOL_HWMP;
4487
4488         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4489                 setup->path_metric =
4490                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4491                  IEEE80211_PATH_METRIC_VENDOR :
4492                  IEEE80211_PATH_METRIC_AIRTIME;
4493
4494
4495         if (tb[NL80211_MESH_SETUP_IE]) {
4496                 struct nlattr *ieattr =
4497                         tb[NL80211_MESH_SETUP_IE];
4498                 if (!is_valid_ie_attr(ieattr))
4499                         return -EINVAL;
4500                 setup->ie = nla_data(ieattr);
4501                 setup->ie_len = nla_len(ieattr);
4502         }
4503         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4504         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4505
4506         return 0;
4507 }
4508
4509 static int nl80211_update_mesh_config(struct sk_buff *skb,
4510                                       struct genl_info *info)
4511 {
4512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4513         struct net_device *dev = info->user_ptr[1];
4514         struct wireless_dev *wdev = dev->ieee80211_ptr;
4515         struct mesh_config cfg;
4516         u32 mask;
4517         int err;
4518
4519         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4520                 return -EOPNOTSUPP;
4521
4522         if (!rdev->ops->update_mesh_config)
4523                 return -EOPNOTSUPP;
4524
4525         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4526         if (err)
4527                 return err;
4528
4529         wdev_lock(wdev);
4530         if (!wdev->mesh_id_len)
4531                 err = -ENOLINK;
4532
4533         if (!err)
4534                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4535
4536         wdev_unlock(wdev);
4537
4538         return err;
4539 }
4540
4541 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4542 {
4543         const struct ieee80211_regdomain *regdom;
4544         struct sk_buff *msg;
4545         void *hdr = NULL;
4546         struct nlattr *nl_reg_rules;
4547         unsigned int i;
4548         int err = -EINVAL;
4549
4550         mutex_lock(&cfg80211_mutex);
4551
4552         if (!cfg80211_regdomain)
4553                 goto out;
4554
4555         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4556         if (!msg) {
4557                 err = -ENOBUFS;
4558                 goto out;
4559         }
4560
4561         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4562                              NL80211_CMD_GET_REG);
4563         if (!hdr)
4564                 goto put_failure;
4565
4566         if (reg_last_request_cell_base() &&
4567             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4568                         NL80211_USER_REG_HINT_CELL_BASE))
4569                 goto nla_put_failure;
4570
4571         rcu_read_lock();
4572         regdom = rcu_dereference(cfg80211_regdomain);
4573
4574         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4575             (regdom->dfs_region &&
4576              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4577                 goto nla_put_failure_rcu;
4578
4579         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4580         if (!nl_reg_rules)
4581                 goto nla_put_failure_rcu;
4582
4583         for (i = 0; i < regdom->n_reg_rules; i++) {
4584                 struct nlattr *nl_reg_rule;
4585                 const struct ieee80211_reg_rule *reg_rule;
4586                 const struct ieee80211_freq_range *freq_range;
4587                 const struct ieee80211_power_rule *power_rule;
4588
4589                 reg_rule = &regdom->reg_rules[i];
4590                 freq_range = &reg_rule->freq_range;
4591                 power_rule = &reg_rule->power_rule;
4592
4593                 nl_reg_rule = nla_nest_start(msg, i);
4594                 if (!nl_reg_rule)
4595                         goto nla_put_failure_rcu;
4596
4597                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4598                                 reg_rule->flags) ||
4599                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4600                                 freq_range->start_freq_khz) ||
4601                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4602                                 freq_range->end_freq_khz) ||
4603                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4604                                 freq_range->max_bandwidth_khz) ||
4605                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4606                                 power_rule->max_antenna_gain) ||
4607                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4608                                 power_rule->max_eirp))
4609                         goto nla_put_failure_rcu;
4610
4611                 nla_nest_end(msg, nl_reg_rule);
4612         }
4613         rcu_read_unlock();
4614
4615         nla_nest_end(msg, nl_reg_rules);
4616
4617         genlmsg_end(msg, hdr);
4618         err = genlmsg_reply(msg, info);
4619         goto out;
4620
4621 nla_put_failure_rcu:
4622         rcu_read_unlock();
4623 nla_put_failure:
4624         genlmsg_cancel(msg, hdr);
4625 put_failure:
4626         nlmsg_free(msg);
4627         err = -EMSGSIZE;
4628 out:
4629         mutex_unlock(&cfg80211_mutex);
4630         return err;
4631 }
4632
4633 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4634 {
4635         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4636         struct nlattr *nl_reg_rule;
4637         char *alpha2 = NULL;
4638         int rem_reg_rules = 0, r = 0;
4639         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4640         u8 dfs_region = 0;
4641         struct ieee80211_regdomain *rd = NULL;
4642
4643         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4644                 return -EINVAL;
4645
4646         if (!info->attrs[NL80211_ATTR_REG_RULES])
4647                 return -EINVAL;
4648
4649         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4650
4651         if (info->attrs[NL80211_ATTR_DFS_REGION])
4652                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4653
4654         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4655                             rem_reg_rules) {
4656                 num_rules++;
4657                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4658                         return -EINVAL;
4659         }
4660
4661         size_of_regd = sizeof(struct ieee80211_regdomain) +
4662                        num_rules * sizeof(struct ieee80211_reg_rule);
4663
4664         rd = kzalloc(size_of_regd, GFP_KERNEL);
4665         if (!rd)
4666                 return -ENOMEM;
4667
4668         rd->n_reg_rules = num_rules;
4669         rd->alpha2[0] = alpha2[0];
4670         rd->alpha2[1] = alpha2[1];
4671
4672         /*
4673          * Disable DFS master mode if the DFS region was
4674          * not supported or known on this kernel.
4675          */
4676         if (reg_supported_dfs_region(dfs_region))
4677                 rd->dfs_region = dfs_region;
4678
4679         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4680                             rem_reg_rules) {
4681                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4682                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4683                           reg_rule_policy);
4684                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4685                 if (r)
4686                         goto bad_reg;
4687
4688                 rule_idx++;
4689
4690                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4691                         r = -EINVAL;
4692                         goto bad_reg;
4693                 }
4694         }
4695
4696         mutex_lock(&cfg80211_mutex);
4697
4698         r = set_regdom(rd);
4699         /* set_regdom took ownership */
4700         rd = NULL;
4701         mutex_unlock(&cfg80211_mutex);
4702
4703  bad_reg:
4704         kfree(rd);
4705         return r;
4706 }
4707
4708 static int validate_scan_freqs(struct nlattr *freqs)
4709 {
4710         struct nlattr *attr1, *attr2;
4711         int n_channels = 0, tmp1, tmp2;
4712
4713         nla_for_each_nested(attr1, freqs, tmp1) {
4714                 n_channels++;
4715                 /*
4716                  * Some hardware has a limited channel list for
4717                  * scanning, and it is pretty much nonsensical
4718                  * to scan for a channel twice, so disallow that
4719                  * and don't require drivers to check that the
4720                  * channel list they get isn't longer than what
4721                  * they can scan, as long as they can scan all
4722                  * the channels they registered at once.
4723                  */
4724                 nla_for_each_nested(attr2, freqs, tmp2)
4725                         if (attr1 != attr2 &&
4726                             nla_get_u32(attr1) == nla_get_u32(attr2))
4727                                 return 0;
4728         }
4729
4730         return n_channels;
4731 }
4732
4733 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4734 {
4735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4736         struct wireless_dev *wdev = info->user_ptr[1];
4737         struct cfg80211_scan_request *request;
4738         struct nlattr *attr;
4739         struct wiphy *wiphy;
4740         int err, tmp, n_ssids = 0, n_channels, i;
4741         size_t ie_len;
4742
4743         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4744                 return -EINVAL;
4745
4746         wiphy = &rdev->wiphy;
4747
4748         if (!rdev->ops->scan)
4749                 return -EOPNOTSUPP;
4750
4751         if (rdev->scan_req)
4752                 return -EBUSY;
4753
4754         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4755                 n_channels = validate_scan_freqs(
4756                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4757                 if (!n_channels)
4758                         return -EINVAL;
4759         } else {
4760                 enum ieee80211_band band;
4761                 n_channels = 0;
4762
4763                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4764                         if (wiphy->bands[band])
4765                                 n_channels += wiphy->bands[band]->n_channels;
4766         }
4767
4768         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4769                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4770                         n_ssids++;
4771
4772         if (n_ssids > wiphy->max_scan_ssids)
4773                 return -EINVAL;
4774
4775         if (info->attrs[NL80211_ATTR_IE])
4776                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4777         else
4778                 ie_len = 0;
4779
4780         if (ie_len > wiphy->max_scan_ie_len)
4781                 return -EINVAL;
4782
4783         request = kzalloc(sizeof(*request)
4784                         + sizeof(*request->ssids) * n_ssids
4785                         + sizeof(*request->channels) * n_channels
4786                         + ie_len, GFP_KERNEL);
4787         if (!request)
4788                 return -ENOMEM;
4789
4790         if (n_ssids)
4791                 request->ssids = (void *)&request->channels[n_channels];
4792         request->n_ssids = n_ssids;
4793         if (ie_len) {
4794                 if (request->ssids)
4795                         request->ie = (void *)(request->ssids + n_ssids);
4796                 else
4797                         request->ie = (void *)(request->channels + n_channels);
4798         }
4799
4800         i = 0;
4801         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4802                 /* user specified, bail out if channel not found */
4803                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4804                         struct ieee80211_channel *chan;
4805
4806                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4807
4808                         if (!chan) {
4809                                 err = -EINVAL;
4810                                 goto out_free;
4811                         }
4812
4813                         /* ignore disabled channels */
4814                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4815                                 continue;
4816
4817                         request->channels[i] = chan;
4818                         i++;
4819                 }
4820         } else {
4821                 enum ieee80211_band band;
4822
4823                 /* all channels */
4824                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4825                         int j;
4826                         if (!wiphy->bands[band])
4827                                 continue;
4828                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4829                                 struct ieee80211_channel *chan;
4830
4831                                 chan = &wiphy->bands[band]->channels[j];
4832
4833                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4834                                         continue;
4835
4836                                 request->channels[i] = chan;
4837                                 i++;
4838                         }
4839                 }
4840         }
4841
4842         if (!i) {
4843                 err = -EINVAL;
4844                 goto out_free;
4845         }
4846
4847         request->n_channels = i;
4848
4849         i = 0;
4850         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4851                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4852                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4853                                 err = -EINVAL;
4854                                 goto out_free;
4855                         }
4856                         request->ssids[i].ssid_len = nla_len(attr);
4857                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4858                         i++;
4859                 }
4860         }
4861
4862         if (info->attrs[NL80211_ATTR_IE]) {
4863                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4864                 memcpy((void *)request->ie,
4865                        nla_data(info->attrs[NL80211_ATTR_IE]),
4866                        request->ie_len);
4867         }
4868
4869         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4870                 if (wiphy->bands[i])
4871                         request->rates[i] =
4872                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4873
4874         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4875                 nla_for_each_nested(attr,
4876                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4877                                     tmp) {
4878                         enum ieee80211_band band = nla_type(attr);
4879
4880                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4881                                 err = -EINVAL;
4882                                 goto out_free;
4883                         }
4884                         err = ieee80211_get_ratemask(wiphy->bands[band],
4885                                                      nla_data(attr),
4886                                                      nla_len(attr),
4887                                                      &request->rates[band]);
4888                         if (err)
4889                                 goto out_free;
4890                 }
4891         }
4892
4893         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4894                 request->flags = nla_get_u32(
4895                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4896                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4897                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4898                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4899                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4900                         err = -EOPNOTSUPP;
4901                         goto out_free;
4902                 }
4903         }
4904
4905         request->no_cck =
4906                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4907
4908         request->wdev = wdev;
4909         request->wiphy = &rdev->wiphy;
4910         request->scan_start = jiffies;
4911
4912         rdev->scan_req = request;
4913         err = rdev_scan(rdev, request);
4914
4915         if (!err) {
4916                 nl80211_send_scan_start(rdev, wdev);
4917                 if (wdev->netdev)
4918                         dev_hold(wdev->netdev);
4919         } else {
4920  out_free:
4921                 rdev->scan_req = NULL;
4922                 kfree(request);
4923         }
4924
4925         return err;
4926 }
4927
4928 static int nl80211_start_sched_scan(struct sk_buff *skb,
4929                                     struct genl_info *info)
4930 {
4931         struct cfg80211_sched_scan_request *request;
4932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4933         struct net_device *dev = info->user_ptr[1];
4934         struct nlattr *attr;
4935         struct wiphy *wiphy;
4936         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4937         u32 interval;
4938         enum ieee80211_band band;
4939         size_t ie_len;
4940         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4941
4942         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4943             !rdev->ops->sched_scan_start)
4944                 return -EOPNOTSUPP;
4945
4946         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4947                 return -EINVAL;
4948
4949         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4950                 return -EINVAL;
4951
4952         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4953         if (interval == 0)
4954                 return -EINVAL;
4955
4956         wiphy = &rdev->wiphy;
4957
4958         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4959                 n_channels = validate_scan_freqs(
4960                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4961                 if (!n_channels)
4962                         return -EINVAL;
4963         } else {
4964                 n_channels = 0;
4965
4966                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4967                         if (wiphy->bands[band])
4968                                 n_channels += wiphy->bands[band]->n_channels;
4969         }
4970
4971         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4972                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4973                                     tmp)
4974                         n_ssids++;
4975
4976         if (n_ssids > wiphy->max_sched_scan_ssids)
4977                 return -EINVAL;
4978
4979         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4980                 nla_for_each_nested(attr,
4981                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4982                                     tmp)
4983                         n_match_sets++;
4984
4985         if (n_match_sets > wiphy->max_match_sets)
4986                 return -EINVAL;
4987
4988         if (info->attrs[NL80211_ATTR_IE])
4989                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4990         else
4991                 ie_len = 0;
4992
4993         if (ie_len > wiphy->max_sched_scan_ie_len)
4994                 return -EINVAL;
4995
4996         mutex_lock(&rdev->sched_scan_mtx);
4997
4998         if (rdev->sched_scan_req) {
4999                 err = -EINPROGRESS;
5000                 goto out;
5001         }
5002
5003         request = kzalloc(sizeof(*request)
5004                         + sizeof(*request->ssids) * n_ssids
5005                         + sizeof(*request->match_sets) * n_match_sets
5006                         + sizeof(*request->channels) * n_channels
5007                         + ie_len, GFP_KERNEL);
5008         if (!request) {
5009                 err = -ENOMEM;
5010                 goto out;
5011         }
5012
5013         if (n_ssids)
5014                 request->ssids = (void *)&request->channels[n_channels];
5015         request->n_ssids = n_ssids;
5016         if (ie_len) {
5017                 if (request->ssids)
5018                         request->ie = (void *)(request->ssids + n_ssids);
5019                 else
5020                         request->ie = (void *)(request->channels + n_channels);
5021         }
5022
5023         if (n_match_sets) {
5024                 if (request->ie)
5025                         request->match_sets = (void *)(request->ie + ie_len);
5026                 else if (request->ssids)
5027                         request->match_sets =
5028                                 (void *)(request->ssids + n_ssids);
5029                 else
5030                         request->match_sets =
5031                                 (void *)(request->channels + n_channels);
5032         }
5033         request->n_match_sets = n_match_sets;
5034
5035         i = 0;
5036         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5037                 /* user specified, bail out if channel not found */
5038                 nla_for_each_nested(attr,
5039                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5040                                     tmp) {
5041                         struct ieee80211_channel *chan;
5042
5043                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5044
5045                         if (!chan) {
5046                                 err = -EINVAL;
5047                                 goto out_free;
5048                         }
5049
5050                         /* ignore disabled channels */
5051                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5052                                 continue;
5053
5054                         request->channels[i] = chan;
5055                         i++;
5056                 }
5057         } else {
5058                 /* all channels */
5059                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5060                         int j;
5061                         if (!wiphy->bands[band])
5062                                 continue;
5063                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5064                                 struct ieee80211_channel *chan;
5065
5066                                 chan = &wiphy->bands[band]->channels[j];
5067
5068                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5069                                         continue;
5070
5071                                 request->channels[i] = chan;
5072                                 i++;
5073                         }
5074                 }
5075         }
5076
5077         if (!i) {
5078                 err = -EINVAL;
5079                 goto out_free;
5080         }
5081
5082         request->n_channels = i;
5083
5084         i = 0;
5085         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5086                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5087                                     tmp) {
5088                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5089                                 err = -EINVAL;
5090                                 goto out_free;
5091                         }
5092                         request->ssids[i].ssid_len = nla_len(attr);
5093                         memcpy(request->ssids[i].ssid, nla_data(attr),
5094                                nla_len(attr));
5095                         i++;
5096                 }
5097         }
5098
5099         i = 0;
5100         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5101                 nla_for_each_nested(attr,
5102                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5103                                     tmp) {
5104                         struct nlattr *ssid, *rssi;
5105
5106                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5107                                   nla_data(attr), nla_len(attr),
5108                                   nl80211_match_policy);
5109                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5110                         if (ssid) {
5111                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5112                                         err = -EINVAL;
5113                                         goto out_free;
5114                                 }
5115                                 memcpy(request->match_sets[i].ssid.ssid,
5116                                        nla_data(ssid), nla_len(ssid));
5117                                 request->match_sets[i].ssid.ssid_len =
5118                                         nla_len(ssid);
5119                         }
5120                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5121                         if (rssi)
5122                                 request->rssi_thold = nla_get_u32(rssi);
5123                         else
5124                                 request->rssi_thold =
5125                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5126                         i++;
5127                 }
5128         }
5129
5130         if (info->attrs[NL80211_ATTR_IE]) {
5131                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5132                 memcpy((void *)request->ie,
5133                        nla_data(info->attrs[NL80211_ATTR_IE]),
5134                        request->ie_len);
5135         }
5136
5137         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5138                 request->flags = nla_get_u32(
5139                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5140                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5141                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5142                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5143                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5144                         err = -EOPNOTSUPP;
5145                         goto out_free;
5146                 }
5147         }
5148
5149         request->dev = dev;
5150         request->wiphy = &rdev->wiphy;
5151         request->interval = interval;
5152         request->scan_start = jiffies;
5153
5154         err = rdev_sched_scan_start(rdev, dev, request);
5155         if (!err) {
5156                 rdev->sched_scan_req = request;
5157                 nl80211_send_sched_scan(rdev, dev,
5158                                         NL80211_CMD_START_SCHED_SCAN);
5159                 goto out;
5160         }
5161
5162 out_free:
5163         kfree(request);
5164 out:
5165         mutex_unlock(&rdev->sched_scan_mtx);
5166         return err;
5167 }
5168
5169 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5170                                    struct genl_info *info)
5171 {
5172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5173         int err;
5174
5175         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5176             !rdev->ops->sched_scan_stop)
5177                 return -EOPNOTSUPP;
5178
5179         mutex_lock(&rdev->sched_scan_mtx);
5180         err = __cfg80211_stop_sched_scan(rdev, false);
5181         mutex_unlock(&rdev->sched_scan_mtx);
5182
5183         return err;
5184 }
5185
5186 static int nl80211_start_radar_detection(struct sk_buff *skb,
5187                                          struct genl_info *info)
5188 {
5189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5190         struct net_device *dev = info->user_ptr[1];
5191         struct wireless_dev *wdev = dev->ieee80211_ptr;
5192         struct cfg80211_chan_def chandef;
5193         int err;
5194
5195         err = nl80211_parse_chandef(rdev, info, &chandef);
5196         if (err)
5197                 return err;
5198
5199         if (wdev->cac_started)
5200                 return -EBUSY;
5201
5202         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5203         if (err < 0)
5204                 return err;
5205
5206         if (err == 0)
5207                 return -EINVAL;
5208
5209         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5210                 return -EINVAL;
5211
5212         if (!rdev->ops->start_radar_detection)
5213                 return -EOPNOTSUPP;
5214
5215         mutex_lock(&rdev->devlist_mtx);
5216         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5217                                            chandef.chan, CHAN_MODE_SHARED,
5218                                            BIT(chandef.width));
5219         if (err)
5220                 goto err_locked;
5221
5222         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5223         if (!err) {
5224                 wdev->channel = chandef.chan;
5225                 wdev->cac_started = true;
5226                 wdev->cac_start_time = jiffies;
5227         }
5228 err_locked:
5229         mutex_unlock(&rdev->devlist_mtx);
5230
5231         return err;
5232 }
5233
5234 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5235                             u32 seq, int flags,
5236                             struct cfg80211_registered_device *rdev,
5237                             struct wireless_dev *wdev,
5238                             struct cfg80211_internal_bss *intbss)
5239 {
5240         struct cfg80211_bss *res = &intbss->pub;
5241         const struct cfg80211_bss_ies *ies;
5242         void *hdr;
5243         struct nlattr *bss;
5244         bool tsf = false;
5245
5246         ASSERT_WDEV_LOCK(wdev);
5247
5248         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5249                              NL80211_CMD_NEW_SCAN_RESULTS);
5250         if (!hdr)
5251                 return -1;
5252
5253         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5254
5255         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5256             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5257                 goto nla_put_failure;
5258
5259         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5260         if (!bss)
5261                 goto nla_put_failure;
5262         if ((!is_zero_ether_addr(res->bssid) &&
5263              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5264                 goto nla_put_failure;
5265
5266         rcu_read_lock();
5267         ies = rcu_dereference(res->ies);
5268         if (ies) {
5269                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5270                         goto fail_unlock_rcu;
5271                 tsf = true;
5272                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5273                                         ies->len, ies->data))
5274                         goto fail_unlock_rcu;
5275         }
5276         ies = rcu_dereference(res->beacon_ies);
5277         if (ies) {
5278                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5279                         goto fail_unlock_rcu;
5280                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5281                                         ies->len, ies->data))
5282                         goto fail_unlock_rcu;
5283         }
5284         rcu_read_unlock();
5285
5286         if (res->beacon_interval &&
5287             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5288                 goto nla_put_failure;
5289         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5290             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5291             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5292                         jiffies_to_msecs(jiffies - intbss->ts)))
5293                 goto nla_put_failure;
5294
5295         switch (rdev->wiphy.signal_type) {
5296         case CFG80211_SIGNAL_TYPE_MBM:
5297                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5298                         goto nla_put_failure;
5299                 break;
5300         case CFG80211_SIGNAL_TYPE_UNSPEC:
5301                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5302                         goto nla_put_failure;
5303                 break;
5304         default:
5305                 break;
5306         }
5307
5308         switch (wdev->iftype) {
5309         case NL80211_IFTYPE_P2P_CLIENT:
5310         case NL80211_IFTYPE_STATION:
5311                 if (intbss == wdev->current_bss &&
5312                     nla_put_u32(msg, NL80211_BSS_STATUS,
5313                                 NL80211_BSS_STATUS_ASSOCIATED))
5314                         goto nla_put_failure;
5315                 break;
5316         case NL80211_IFTYPE_ADHOC:
5317                 if (intbss == wdev->current_bss &&
5318                     nla_put_u32(msg, NL80211_BSS_STATUS,
5319                                 NL80211_BSS_STATUS_IBSS_JOINED))
5320                         goto nla_put_failure;
5321                 break;
5322         default:
5323                 break;
5324         }
5325
5326         nla_nest_end(msg, bss);
5327
5328         return genlmsg_end(msg, hdr);
5329
5330  fail_unlock_rcu:
5331         rcu_read_unlock();
5332  nla_put_failure:
5333         genlmsg_cancel(msg, hdr);
5334         return -EMSGSIZE;
5335 }
5336
5337 static int nl80211_dump_scan(struct sk_buff *skb,
5338                              struct netlink_callback *cb)
5339 {
5340         struct cfg80211_registered_device *rdev;
5341         struct net_device *dev;
5342         struct cfg80211_internal_bss *scan;
5343         struct wireless_dev *wdev;
5344         int start = cb->args[1], idx = 0;
5345         int err;
5346
5347         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5348         if (err)
5349                 return err;
5350
5351         wdev = dev->ieee80211_ptr;
5352
5353         wdev_lock(wdev);
5354         spin_lock_bh(&rdev->bss_lock);
5355         cfg80211_bss_expire(rdev);
5356
5357         cb->seq = rdev->bss_generation;
5358
5359         list_for_each_entry(scan, &rdev->bss_list, list) {
5360                 if (++idx <= start)
5361                         continue;
5362                 if (nl80211_send_bss(skb, cb,
5363                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5364                                 rdev, wdev, scan) < 0) {
5365                         idx--;
5366                         break;
5367                 }
5368         }
5369
5370         spin_unlock_bh(&rdev->bss_lock);
5371         wdev_unlock(wdev);
5372
5373         cb->args[1] = idx;
5374         nl80211_finish_netdev_dump(rdev);
5375
5376         return skb->len;
5377 }
5378
5379 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5380                                 int flags, struct net_device *dev,
5381                                 struct survey_info *survey)
5382 {
5383         void *hdr;
5384         struct nlattr *infoattr;
5385
5386         hdr = nl80211hdr_put(msg, portid, seq, flags,
5387                              NL80211_CMD_NEW_SURVEY_RESULTS);
5388         if (!hdr)
5389                 return -ENOMEM;
5390
5391         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5392                 goto nla_put_failure;
5393
5394         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5395         if (!infoattr)
5396                 goto nla_put_failure;
5397
5398         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5399                         survey->channel->center_freq))
5400                 goto nla_put_failure;
5401
5402         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5403             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5404                 goto nla_put_failure;
5405         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5406             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5407                 goto nla_put_failure;
5408         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5409             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5410                         survey->channel_time))
5411                 goto nla_put_failure;
5412         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5413             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5414                         survey->channel_time_busy))
5415                 goto nla_put_failure;
5416         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5417             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5418                         survey->channel_time_ext_busy))
5419                 goto nla_put_failure;
5420         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5421             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5422                         survey->channel_time_rx))
5423                 goto nla_put_failure;
5424         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5425             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5426                         survey->channel_time_tx))
5427                 goto nla_put_failure;
5428
5429         nla_nest_end(msg, infoattr);
5430
5431         return genlmsg_end(msg, hdr);
5432
5433  nla_put_failure:
5434         genlmsg_cancel(msg, hdr);
5435         return -EMSGSIZE;
5436 }
5437
5438 static int nl80211_dump_survey(struct sk_buff *skb,
5439                         struct netlink_callback *cb)
5440 {
5441         struct survey_info survey;
5442         struct cfg80211_registered_device *dev;
5443         struct net_device *netdev;
5444         int survey_idx = cb->args[1];
5445         int res;
5446
5447         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5448         if (res)
5449                 return res;
5450
5451         if (!dev->ops->dump_survey) {
5452                 res = -EOPNOTSUPP;
5453                 goto out_err;
5454         }
5455
5456         while (1) {
5457                 struct ieee80211_channel *chan;
5458
5459                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5460                 if (res == -ENOENT)
5461                         break;
5462                 if (res)
5463                         goto out_err;
5464
5465                 /* Survey without a channel doesn't make sense */
5466                 if (!survey.channel) {
5467                         res = -EINVAL;
5468                         goto out;
5469                 }
5470
5471                 chan = ieee80211_get_channel(&dev->wiphy,
5472                                              survey.channel->center_freq);
5473                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5474                         survey_idx++;
5475                         continue;
5476                 }
5477
5478                 if (nl80211_send_survey(skb,
5479                                 NETLINK_CB(cb->skb).portid,
5480                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5481                                 netdev,
5482                                 &survey) < 0)
5483                         goto out;
5484                 survey_idx++;
5485         }
5486
5487  out:
5488         cb->args[1] = survey_idx;
5489         res = skb->len;
5490  out_err:
5491         nl80211_finish_netdev_dump(dev);
5492         return res;
5493 }
5494
5495 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5496 {
5497         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5498                                   NL80211_WPA_VERSION_2));
5499 }
5500
5501 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5502 {
5503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5504         struct net_device *dev = info->user_ptr[1];
5505         struct ieee80211_channel *chan;
5506         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5507         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5508         enum nl80211_auth_type auth_type;
5509         struct key_parse key;
5510         bool local_state_change;
5511
5512         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5513                 return -EINVAL;
5514
5515         if (!info->attrs[NL80211_ATTR_MAC])
5516                 return -EINVAL;
5517
5518         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5519                 return -EINVAL;
5520
5521         if (!info->attrs[NL80211_ATTR_SSID])
5522                 return -EINVAL;
5523
5524         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5525                 return -EINVAL;
5526
5527         err = nl80211_parse_key(info, &key);
5528         if (err)
5529                 return err;
5530
5531         if (key.idx >= 0) {
5532                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5533                         return -EINVAL;
5534                 if (!key.p.key || !key.p.key_len)
5535                         return -EINVAL;
5536                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5537                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5538                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5539                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5540                         return -EINVAL;
5541                 if (key.idx > 4)
5542                         return -EINVAL;
5543         } else {
5544                 key.p.key_len = 0;
5545                 key.p.key = NULL;
5546         }
5547
5548         if (key.idx >= 0) {
5549                 int i;
5550                 bool ok = false;
5551                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5552                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5553                                 ok = true;
5554                                 break;
5555                         }
5556                 }
5557                 if (!ok)
5558                         return -EINVAL;
5559         }
5560
5561         if (!rdev->ops->auth)
5562                 return -EOPNOTSUPP;
5563
5564         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5565             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5566                 return -EOPNOTSUPP;
5567
5568         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5569         chan = ieee80211_get_channel(&rdev->wiphy,
5570                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5571         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5572                 return -EINVAL;
5573
5574         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5575         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5576
5577         if (info->attrs[NL80211_ATTR_IE]) {
5578                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5579                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5580         }
5581
5582         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5583         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5584                 return -EINVAL;
5585
5586         if (auth_type == NL80211_AUTHTYPE_SAE &&
5587             !info->attrs[NL80211_ATTR_SAE_DATA])
5588                 return -EINVAL;
5589
5590         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5591                 if (auth_type != NL80211_AUTHTYPE_SAE)
5592                         return -EINVAL;
5593                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5594                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5595                 /* need to include at least Auth Transaction and Status Code */
5596                 if (sae_data_len < 4)
5597                         return -EINVAL;
5598         }
5599
5600         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5601
5602         /*
5603          * Since we no longer track auth state, ignore
5604          * requests to only change local state.
5605          */
5606         if (local_state_change)
5607                 return 0;
5608
5609         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5610                                   ssid, ssid_len, ie, ie_len,
5611                                   key.p.key, key.p.key_len, key.idx,
5612                                   sae_data, sae_data_len);
5613 }
5614
5615 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5616                                    struct genl_info *info,
5617                                    struct cfg80211_crypto_settings *settings,
5618                                    int cipher_limit)
5619 {
5620         memset(settings, 0, sizeof(*settings));
5621
5622         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5623
5624         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5625                 u16 proto;
5626                 proto = nla_get_u16(
5627                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5628                 settings->control_port_ethertype = cpu_to_be16(proto);
5629                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5630                     proto != ETH_P_PAE)
5631                         return -EINVAL;
5632                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5633                         settings->control_port_no_encrypt = true;
5634         } else
5635                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5636
5637         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5638                 void *data;
5639                 int len, i;
5640
5641                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5642                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5643                 settings->n_ciphers_pairwise = len / sizeof(u32);
5644
5645                 if (len % sizeof(u32))
5646                         return -EINVAL;
5647
5648                 if (settings->n_ciphers_pairwise > cipher_limit)
5649                         return -EINVAL;
5650
5651                 memcpy(settings->ciphers_pairwise, data, len);
5652
5653                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5654                         if (!cfg80211_supported_cipher_suite(
5655                                         &rdev->wiphy,
5656                                         settings->ciphers_pairwise[i]))
5657                                 return -EINVAL;
5658         }
5659
5660         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5661                 settings->cipher_group =
5662                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5663                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5664                                                      settings->cipher_group))
5665                         return -EINVAL;
5666         }
5667
5668         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5669                 settings->wpa_versions =
5670                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5671                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5672                         return -EINVAL;
5673         }
5674
5675         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5676                 void *data;
5677                 int len;
5678
5679                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5680                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5681                 settings->n_akm_suites = len / sizeof(u32);
5682
5683                 if (len % sizeof(u32))
5684                         return -EINVAL;
5685
5686                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5687                         return -EINVAL;
5688
5689                 memcpy(settings->akm_suites, data, len);
5690         }
5691
5692         return 0;
5693 }
5694
5695 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5696 {
5697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5698         struct net_device *dev = info->user_ptr[1];
5699         struct cfg80211_crypto_settings crypto;
5700         struct ieee80211_channel *chan;
5701         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5702         int err, ssid_len, ie_len = 0;
5703         bool use_mfp = false;
5704         u32 flags = 0;
5705         struct ieee80211_ht_cap *ht_capa = NULL;
5706         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5707
5708         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5709                 return -EINVAL;
5710
5711         if (!info->attrs[NL80211_ATTR_MAC] ||
5712             !info->attrs[NL80211_ATTR_SSID] ||
5713             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5714                 return -EINVAL;
5715
5716         if (!rdev->ops->assoc)
5717                 return -EOPNOTSUPP;
5718
5719         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5720             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5721                 return -EOPNOTSUPP;
5722
5723         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5724
5725         chan = ieee80211_get_channel(&rdev->wiphy,
5726                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5727         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5728                 return -EINVAL;
5729
5730         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5731         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5732
5733         if (info->attrs[NL80211_ATTR_IE]) {
5734                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5735                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5736         }
5737
5738         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5739                 enum nl80211_mfp mfp =
5740                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5741                 if (mfp == NL80211_MFP_REQUIRED)
5742                         use_mfp = true;
5743                 else if (mfp != NL80211_MFP_NO)
5744                         return -EINVAL;
5745         }
5746
5747         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5748                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5749
5750         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5751                 flags |= ASSOC_REQ_DISABLE_HT;
5752
5753         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5754                 ht_capa_mask =
5755                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5756
5757         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5758                 if (!ht_capa_mask)
5759                         return -EINVAL;
5760                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5761         }
5762
5763         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5764         if (!err)
5765                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5766                                           ssid, ssid_len, ie, ie_len, use_mfp,
5767                                           &crypto, flags, ht_capa,
5768                                           ht_capa_mask);
5769
5770         return err;
5771 }
5772
5773 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5774 {
5775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5776         struct net_device *dev = info->user_ptr[1];
5777         const u8 *ie = NULL, *bssid;
5778         int ie_len = 0;
5779         u16 reason_code;
5780         bool local_state_change;
5781
5782         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5783                 return -EINVAL;
5784
5785         if (!info->attrs[NL80211_ATTR_MAC])
5786                 return -EINVAL;
5787
5788         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5789                 return -EINVAL;
5790
5791         if (!rdev->ops->deauth)
5792                 return -EOPNOTSUPP;
5793
5794         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5795             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5796                 return -EOPNOTSUPP;
5797
5798         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5799
5800         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5801         if (reason_code == 0) {
5802                 /* Reason Code 0 is reserved */
5803                 return -EINVAL;
5804         }
5805
5806         if (info->attrs[NL80211_ATTR_IE]) {
5807                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5808                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5809         }
5810
5811         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5812
5813         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5814                                     local_state_change);
5815 }
5816
5817 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5818 {
5819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5820         struct net_device *dev = info->user_ptr[1];
5821         const u8 *ie = NULL, *bssid;
5822         int ie_len = 0;
5823         u16 reason_code;
5824         bool local_state_change;
5825
5826         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5827                 return -EINVAL;
5828
5829         if (!info->attrs[NL80211_ATTR_MAC])
5830                 return -EINVAL;
5831
5832         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5833                 return -EINVAL;
5834
5835         if (!rdev->ops->disassoc)
5836                 return -EOPNOTSUPP;
5837
5838         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5839             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5840                 return -EOPNOTSUPP;
5841
5842         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5843
5844         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5845         if (reason_code == 0) {
5846                 /* Reason Code 0 is reserved */
5847                 return -EINVAL;
5848         }
5849
5850         if (info->attrs[NL80211_ATTR_IE]) {
5851                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5852                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5853         }
5854
5855         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5856
5857         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5858                                       local_state_change);
5859 }
5860
5861 static bool
5862 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5863                          int mcast_rate[IEEE80211_NUM_BANDS],
5864                          int rateval)
5865 {
5866         struct wiphy *wiphy = &rdev->wiphy;
5867         bool found = false;
5868         int band, i;
5869
5870         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5871                 struct ieee80211_supported_band *sband;
5872
5873                 sband = wiphy->bands[band];
5874                 if (!sband)
5875                         continue;
5876
5877                 for (i = 0; i < sband->n_bitrates; i++) {
5878                         if (sband->bitrates[i].bitrate == rateval) {
5879                                 mcast_rate[band] = i + 1;
5880                                 found = true;
5881                                 break;
5882                         }
5883                 }
5884         }
5885
5886         return found;
5887 }
5888
5889 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5890 {
5891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5892         struct net_device *dev = info->user_ptr[1];
5893         struct cfg80211_ibss_params ibss;
5894         struct wiphy *wiphy;
5895         struct cfg80211_cached_keys *connkeys = NULL;
5896         int err;
5897
5898         memset(&ibss, 0, sizeof(ibss));
5899
5900         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5901                 return -EINVAL;
5902
5903         if (!info->attrs[NL80211_ATTR_SSID] ||
5904             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5905                 return -EINVAL;
5906
5907         ibss.beacon_interval = 100;
5908
5909         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5910                 ibss.beacon_interval =
5911                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5912                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5913                         return -EINVAL;
5914         }
5915
5916         if (!rdev->ops->join_ibss)
5917                 return -EOPNOTSUPP;
5918
5919         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5920                 return -EOPNOTSUPP;
5921
5922         wiphy = &rdev->wiphy;
5923
5924         if (info->attrs[NL80211_ATTR_MAC]) {
5925                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5926
5927                 if (!is_valid_ether_addr(ibss.bssid))
5928                         return -EINVAL;
5929         }
5930         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5931         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5932
5933         if (info->attrs[NL80211_ATTR_IE]) {
5934                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5935                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5936         }
5937
5938         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
5939         if (err)
5940                 return err;
5941
5942         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
5943                 return -EINVAL;
5944
5945         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
5946                 return -EINVAL;
5947         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
5948             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
5949                 return -EINVAL;
5950
5951         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5952         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5953
5954         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5955                 u8 *rates =
5956                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5957                 int n_rates =
5958                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5959                 struct ieee80211_supported_band *sband =
5960                         wiphy->bands[ibss.chandef.chan->band];
5961
5962                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5963                                              &ibss.basic_rates);
5964                 if (err)
5965                         return err;
5966         }
5967
5968         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5969             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5970                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5971                 return -EINVAL;
5972
5973         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5974                 bool no_ht = false;
5975
5976                 connkeys = nl80211_parse_connkeys(rdev,
5977                                           info->attrs[NL80211_ATTR_KEYS],
5978                                           &no_ht);
5979                 if (IS_ERR(connkeys))
5980                         return PTR_ERR(connkeys);
5981
5982                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
5983                     no_ht) {
5984                         kfree(connkeys);
5985                         return -EINVAL;
5986                 }
5987         }
5988
5989         ibss.control_port =
5990                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5991
5992         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5993         if (err)
5994                 kfree(connkeys);
5995         return err;
5996 }
5997
5998 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5999 {
6000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6001         struct net_device *dev = info->user_ptr[1];
6002
6003         if (!rdev->ops->leave_ibss)
6004                 return -EOPNOTSUPP;
6005
6006         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6007                 return -EOPNOTSUPP;
6008
6009         return cfg80211_leave_ibss(rdev, dev, false);
6010 }
6011
6012 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6013 {
6014         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6015         struct net_device *dev = info->user_ptr[1];
6016         int mcast_rate[IEEE80211_NUM_BANDS];
6017         u32 nla_rate;
6018         int err;
6019
6020         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6021             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6022                 return -EOPNOTSUPP;
6023
6024         if (!rdev->ops->set_mcast_rate)
6025                 return -EOPNOTSUPP;
6026
6027         memset(mcast_rate, 0, sizeof(mcast_rate));
6028
6029         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6030                 return -EINVAL;
6031
6032         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6033         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6034                 return -EINVAL;
6035
6036         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6037
6038         return err;
6039 }
6040
6041
6042 #ifdef CONFIG_NL80211_TESTMODE
6043 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6044         .name = "testmode",
6045 };
6046
6047 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6048 {
6049         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6050         int err;
6051
6052         if (!info->attrs[NL80211_ATTR_TESTDATA])
6053                 return -EINVAL;
6054
6055         err = -EOPNOTSUPP;
6056         if (rdev->ops->testmode_cmd) {
6057                 rdev->testmode_info = info;
6058                 err = rdev_testmode_cmd(rdev,
6059                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6060                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6061                 rdev->testmode_info = NULL;
6062         }
6063
6064         return err;
6065 }
6066
6067 static int nl80211_testmode_dump(struct sk_buff *skb,
6068                                  struct netlink_callback *cb)
6069 {
6070         struct cfg80211_registered_device *rdev;
6071         int err;
6072         long phy_idx;
6073         void *data = NULL;
6074         int data_len = 0;
6075
6076         if (cb->args[0]) {
6077                 /*
6078                  * 0 is a valid index, but not valid for args[0],
6079                  * so we need to offset by 1.
6080                  */
6081                 phy_idx = cb->args[0] - 1;
6082         } else {
6083                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6084                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6085                                   nl80211_policy);
6086                 if (err)
6087                         return err;
6088
6089                 mutex_lock(&cfg80211_mutex);
6090                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6091                                                   nl80211_fam.attrbuf);
6092                 if (IS_ERR(rdev)) {
6093                         mutex_unlock(&cfg80211_mutex);
6094                         return PTR_ERR(rdev);
6095                 }
6096                 phy_idx = rdev->wiphy_idx;
6097                 rdev = NULL;
6098                 mutex_unlock(&cfg80211_mutex);
6099
6100                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6101                         cb->args[1] =
6102                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6103         }
6104
6105         if (cb->args[1]) {
6106                 data = nla_data((void *)cb->args[1]);
6107                 data_len = nla_len((void *)cb->args[1]);
6108         }
6109
6110         mutex_lock(&cfg80211_mutex);
6111         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6112         if (!rdev) {
6113                 mutex_unlock(&cfg80211_mutex);
6114                 return -ENOENT;
6115         }
6116         cfg80211_lock_rdev(rdev);
6117         mutex_unlock(&cfg80211_mutex);
6118
6119         if (!rdev->ops->testmode_dump) {
6120                 err = -EOPNOTSUPP;
6121                 goto out_err;
6122         }
6123
6124         while (1) {
6125                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6126                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6127                                            NL80211_CMD_TESTMODE);
6128                 struct nlattr *tmdata;
6129
6130                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6131                         genlmsg_cancel(skb, hdr);
6132                         break;
6133                 }
6134
6135                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6136                 if (!tmdata) {
6137                         genlmsg_cancel(skb, hdr);
6138                         break;
6139                 }
6140                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6141                 nla_nest_end(skb, tmdata);
6142
6143                 if (err == -ENOBUFS || err == -ENOENT) {
6144                         genlmsg_cancel(skb, hdr);
6145                         break;
6146                 } else if (err) {
6147                         genlmsg_cancel(skb, hdr);
6148                         goto out_err;
6149                 }
6150
6151                 genlmsg_end(skb, hdr);
6152         }
6153
6154         err = skb->len;
6155         /* see above */
6156         cb->args[0] = phy_idx + 1;
6157  out_err:
6158         cfg80211_unlock_rdev(rdev);
6159         return err;
6160 }
6161
6162 static struct sk_buff *
6163 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6164                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6165 {
6166         struct sk_buff *skb;
6167         void *hdr;
6168         struct nlattr *data;
6169
6170         skb = nlmsg_new(approxlen + 100, gfp);
6171         if (!skb)
6172                 return NULL;
6173
6174         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6175         if (!hdr) {
6176                 kfree_skb(skb);
6177                 return NULL;
6178         }
6179
6180         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6181                 goto nla_put_failure;
6182         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6183
6184         ((void **)skb->cb)[0] = rdev;
6185         ((void **)skb->cb)[1] = hdr;
6186         ((void **)skb->cb)[2] = data;
6187
6188         return skb;
6189
6190  nla_put_failure:
6191         kfree_skb(skb);
6192         return NULL;
6193 }
6194
6195 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6196                                                   int approxlen)
6197 {
6198         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6199
6200         if (WARN_ON(!rdev->testmode_info))
6201                 return NULL;
6202
6203         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6204                                 rdev->testmode_info->snd_portid,
6205                                 rdev->testmode_info->snd_seq,
6206                                 GFP_KERNEL);
6207 }
6208 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6209
6210 int cfg80211_testmode_reply(struct sk_buff *skb)
6211 {
6212         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6213         void *hdr = ((void **)skb->cb)[1];
6214         struct nlattr *data = ((void **)skb->cb)[2];
6215
6216         if (WARN_ON(!rdev->testmode_info)) {
6217                 kfree_skb(skb);
6218                 return -EINVAL;
6219         }
6220
6221         nla_nest_end(skb, data);
6222         genlmsg_end(skb, hdr);
6223         return genlmsg_reply(skb, rdev->testmode_info);
6224 }
6225 EXPORT_SYMBOL(cfg80211_testmode_reply);
6226
6227 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6228                                                   int approxlen, gfp_t gfp)
6229 {
6230         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6231
6232         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6233 }
6234 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6235
6236 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6237 {
6238         void *hdr = ((void **)skb->cb)[1];
6239         struct nlattr *data = ((void **)skb->cb)[2];
6240
6241         nla_nest_end(skb, data);
6242         genlmsg_end(skb, hdr);
6243         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6244 }
6245 EXPORT_SYMBOL(cfg80211_testmode_event);
6246 #endif
6247
6248 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6249 {
6250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6251         struct net_device *dev = info->user_ptr[1];
6252         struct cfg80211_connect_params connect;
6253         struct wiphy *wiphy;
6254         struct cfg80211_cached_keys *connkeys = NULL;
6255         int err;
6256
6257         memset(&connect, 0, sizeof(connect));
6258
6259         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6260                 return -EINVAL;
6261
6262         if (!info->attrs[NL80211_ATTR_SSID] ||
6263             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6264                 return -EINVAL;
6265
6266         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6267                 connect.auth_type =
6268                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6269                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6270                                              NL80211_CMD_CONNECT))
6271                         return -EINVAL;
6272         } else
6273                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6274
6275         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6276
6277         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6278                                       NL80211_MAX_NR_CIPHER_SUITES);
6279         if (err)
6280                 return err;
6281
6282         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6283             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6284                 return -EOPNOTSUPP;
6285
6286         wiphy = &rdev->wiphy;
6287
6288         connect.bg_scan_period = -1;
6289         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6290                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6291                 connect.bg_scan_period =
6292                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6293         }
6294
6295         if (info->attrs[NL80211_ATTR_MAC])
6296                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6297         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6298         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6299
6300         if (info->attrs[NL80211_ATTR_IE]) {
6301                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6302                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6303         }
6304
6305         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6306                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6307                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6308                     connect.mfp != NL80211_MFP_NO)
6309                         return -EINVAL;
6310         } else {
6311                 connect.mfp = NL80211_MFP_NO;
6312         }
6313
6314         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6315                 connect.channel =
6316                         ieee80211_get_channel(wiphy,
6317                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6318                 if (!connect.channel ||
6319                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6320                         return -EINVAL;
6321         }
6322
6323         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6324                 connkeys = nl80211_parse_connkeys(rdev,
6325                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6326                 if (IS_ERR(connkeys))
6327                         return PTR_ERR(connkeys);
6328         }
6329
6330         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6331                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6332
6333         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6334                 memcpy(&connect.ht_capa_mask,
6335                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6336                        sizeof(connect.ht_capa_mask));
6337
6338         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6339                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6340                         kfree(connkeys);
6341                         return -EINVAL;
6342                 }
6343                 memcpy(&connect.ht_capa,
6344                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6345                        sizeof(connect.ht_capa));
6346         }
6347
6348         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6349         if (err)
6350                 kfree(connkeys);
6351         return err;
6352 }
6353
6354 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6355 {
6356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6357         struct net_device *dev = info->user_ptr[1];
6358         u16 reason;
6359
6360         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6361                 reason = WLAN_REASON_DEAUTH_LEAVING;
6362         else
6363                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6364
6365         if (reason == 0)
6366                 return -EINVAL;
6367
6368         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6369             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6370                 return -EOPNOTSUPP;
6371
6372         return cfg80211_disconnect(rdev, dev, reason, true);
6373 }
6374
6375 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6376 {
6377         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6378         struct net *net;
6379         int err;
6380         u32 pid;
6381
6382         if (!info->attrs[NL80211_ATTR_PID])
6383                 return -EINVAL;
6384
6385         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6386
6387         net = get_net_ns_by_pid(pid);
6388         if (IS_ERR(net))
6389                 return PTR_ERR(net);
6390
6391         err = 0;
6392
6393         /* check if anything to do */
6394         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6395                 err = cfg80211_switch_netns(rdev, net);
6396
6397         put_net(net);
6398         return err;
6399 }
6400
6401 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6402 {
6403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6404         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6405                         struct cfg80211_pmksa *pmksa) = NULL;
6406         struct net_device *dev = info->user_ptr[1];
6407         struct cfg80211_pmksa pmksa;
6408
6409         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6410
6411         if (!info->attrs[NL80211_ATTR_MAC])
6412                 return -EINVAL;
6413
6414         if (!info->attrs[NL80211_ATTR_PMKID])
6415                 return -EINVAL;
6416
6417         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6418         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6419
6420         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6421             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6422                 return -EOPNOTSUPP;
6423
6424         switch (info->genlhdr->cmd) {
6425         case NL80211_CMD_SET_PMKSA:
6426                 rdev_ops = rdev->ops->set_pmksa;
6427                 break;
6428         case NL80211_CMD_DEL_PMKSA:
6429                 rdev_ops = rdev->ops->del_pmksa;
6430                 break;
6431         default:
6432                 WARN_ON(1);
6433                 break;
6434         }
6435
6436         if (!rdev_ops)
6437                 return -EOPNOTSUPP;
6438
6439         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6440 }
6441
6442 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6443 {
6444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6445         struct net_device *dev = info->user_ptr[1];
6446
6447         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6448             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6449                 return -EOPNOTSUPP;
6450
6451         if (!rdev->ops->flush_pmksa)
6452                 return -EOPNOTSUPP;
6453
6454         return rdev_flush_pmksa(rdev, dev);
6455 }
6456
6457 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6458 {
6459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6460         struct net_device *dev = info->user_ptr[1];
6461         u8 action_code, dialog_token;
6462         u16 status_code;
6463         u8 *peer;
6464
6465         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6466             !rdev->ops->tdls_mgmt)
6467                 return -EOPNOTSUPP;
6468
6469         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6470             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6471             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6472             !info->attrs[NL80211_ATTR_IE] ||
6473             !info->attrs[NL80211_ATTR_MAC])
6474                 return -EINVAL;
6475
6476         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6477         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6478         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6479         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6480
6481         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6482                               dialog_token, status_code,
6483                               nla_data(info->attrs[NL80211_ATTR_IE]),
6484                               nla_len(info->attrs[NL80211_ATTR_IE]));
6485 }
6486
6487 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6488 {
6489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6490         struct net_device *dev = info->user_ptr[1];
6491         enum nl80211_tdls_operation operation;
6492         u8 *peer;
6493
6494         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6495             !rdev->ops->tdls_oper)
6496                 return -EOPNOTSUPP;
6497
6498         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6499             !info->attrs[NL80211_ATTR_MAC])
6500                 return -EINVAL;
6501
6502         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6503         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6504
6505         return rdev_tdls_oper(rdev, dev, peer, operation);
6506 }
6507
6508 static int nl80211_remain_on_channel(struct sk_buff *skb,
6509                                      struct genl_info *info)
6510 {
6511         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6512         struct wireless_dev *wdev = info->user_ptr[1];
6513         struct cfg80211_chan_def chandef;
6514         struct sk_buff *msg;
6515         void *hdr;
6516         u64 cookie;
6517         u32 duration;
6518         int err;
6519
6520         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6521             !info->attrs[NL80211_ATTR_DURATION])
6522                 return -EINVAL;
6523
6524         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6525
6526         if (!rdev->ops->remain_on_channel ||
6527             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6528                 return -EOPNOTSUPP;
6529
6530         /*
6531          * We should be on that channel for at least a minimum amount of
6532          * time (10ms) but no longer than the driver supports.
6533          */
6534         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6535             duration > rdev->wiphy.max_remain_on_channel_duration)
6536                 return -EINVAL;
6537
6538         err = nl80211_parse_chandef(rdev, info, &chandef);
6539         if (err)
6540                 return err;
6541
6542         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6543         if (!msg)
6544                 return -ENOMEM;
6545
6546         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6547                              NL80211_CMD_REMAIN_ON_CHANNEL);
6548
6549         if (IS_ERR(hdr)) {
6550                 err = PTR_ERR(hdr);
6551                 goto free_msg;
6552         }
6553
6554         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6555                                      duration, &cookie);
6556
6557         if (err)
6558                 goto free_msg;
6559
6560         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6561                 goto nla_put_failure;
6562
6563         genlmsg_end(msg, hdr);
6564
6565         return genlmsg_reply(msg, info);
6566
6567  nla_put_failure:
6568         err = -ENOBUFS;
6569  free_msg:
6570         nlmsg_free(msg);
6571         return err;
6572 }
6573
6574 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6575                                             struct genl_info *info)
6576 {
6577         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6578         struct wireless_dev *wdev = info->user_ptr[1];
6579         u64 cookie;
6580
6581         if (!info->attrs[NL80211_ATTR_COOKIE])
6582                 return -EINVAL;
6583
6584         if (!rdev->ops->cancel_remain_on_channel)
6585                 return -EOPNOTSUPP;
6586
6587         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6588
6589         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6590 }
6591
6592 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6593                            u8 *rates, u8 rates_len)
6594 {
6595         u8 i;
6596         u32 mask = 0;
6597
6598         for (i = 0; i < rates_len; i++) {
6599                 int rate = (rates[i] & 0x7f) * 5;
6600                 int ridx;
6601                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6602                         struct ieee80211_rate *srate =
6603                                 &sband->bitrates[ridx];
6604                         if (rate == srate->bitrate) {
6605                                 mask |= 1 << ridx;
6606                                 break;
6607                         }
6608                 }
6609                 if (ridx == sband->n_bitrates)
6610                         return 0; /* rate not found */
6611         }
6612
6613         return mask;
6614 }
6615
6616 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6617                                u8 *rates, u8 rates_len,
6618                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6619 {
6620         u8 i;
6621
6622         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6623
6624         for (i = 0; i < rates_len; i++) {
6625                 int ridx, rbit;
6626
6627                 ridx = rates[i] / 8;
6628                 rbit = BIT(rates[i] % 8);
6629
6630                 /* check validity */
6631                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6632                         return false;
6633
6634                 /* check availability */
6635                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6636                         mcs[ridx] |= rbit;
6637                 else
6638                         return false;
6639         }
6640
6641         return true;
6642 }
6643
6644 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6645         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6646                                     .len = NL80211_MAX_SUPP_RATES },
6647         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6648                                  .len = NL80211_MAX_SUPP_HT_RATES },
6649 };
6650
6651 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6652                                        struct genl_info *info)
6653 {
6654         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6656         struct cfg80211_bitrate_mask mask;
6657         int rem, i;
6658         struct net_device *dev = info->user_ptr[1];
6659         struct nlattr *tx_rates;
6660         struct ieee80211_supported_band *sband;
6661
6662         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6663                 return -EINVAL;
6664
6665         if (!rdev->ops->set_bitrate_mask)
6666                 return -EOPNOTSUPP;
6667
6668         memset(&mask, 0, sizeof(mask));
6669         /* Default to all rates enabled */
6670         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6671                 sband = rdev->wiphy.bands[i];
6672                 mask.control[i].legacy =
6673                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6674                 if (sband)
6675                         memcpy(mask.control[i].mcs,
6676                                sband->ht_cap.mcs.rx_mask,
6677                                sizeof(mask.control[i].mcs));
6678                 else
6679                         memset(mask.control[i].mcs, 0,
6680                                sizeof(mask.control[i].mcs));
6681         }
6682
6683         /*
6684          * The nested attribute uses enum nl80211_band as the index. This maps
6685          * directly to the enum ieee80211_band values used in cfg80211.
6686          */
6687         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6688         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6689         {
6690                 enum ieee80211_band band = nla_type(tx_rates);
6691                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6692                         return -EINVAL;
6693                 sband = rdev->wiphy.bands[band];
6694                 if (sband == NULL)
6695                         return -EINVAL;
6696                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6697                           nla_len(tx_rates), nl80211_txattr_policy);
6698                 if (tb[NL80211_TXRATE_LEGACY]) {
6699                         mask.control[band].legacy = rateset_to_mask(
6700                                 sband,
6701                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6702                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6703                         if ((mask.control[band].legacy == 0) &&
6704                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6705                                 return -EINVAL;
6706                 }
6707                 if (tb[NL80211_TXRATE_MCS]) {
6708                         if (!ht_rateset_to_mask(
6709                                         sband,
6710                                         nla_data(tb[NL80211_TXRATE_MCS]),
6711                                         nla_len(tb[NL80211_TXRATE_MCS]),
6712                                         mask.control[band].mcs))
6713                                 return -EINVAL;
6714                 }
6715
6716                 if (mask.control[band].legacy == 0) {
6717                         /* don't allow empty legacy rates if HT
6718                          * is not even supported. */
6719                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6720                                 return -EINVAL;
6721
6722                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6723                                 if (mask.control[band].mcs[i])
6724                                         break;
6725
6726                         /* legacy and mcs rates may not be both empty */
6727                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6728                                 return -EINVAL;
6729                 }
6730         }
6731
6732         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6733 }
6734
6735 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6736 {
6737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6738         struct wireless_dev *wdev = info->user_ptr[1];
6739         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6740
6741         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6742                 return -EINVAL;
6743
6744         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6745                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6746
6747         switch (wdev->iftype) {
6748         case NL80211_IFTYPE_STATION:
6749         case NL80211_IFTYPE_ADHOC:
6750         case NL80211_IFTYPE_P2P_CLIENT:
6751         case NL80211_IFTYPE_AP:
6752         case NL80211_IFTYPE_AP_VLAN:
6753         case NL80211_IFTYPE_MESH_POINT:
6754         case NL80211_IFTYPE_P2P_GO:
6755         case NL80211_IFTYPE_P2P_DEVICE:
6756                 break;
6757         default:
6758                 return -EOPNOTSUPP;
6759         }
6760
6761         /* not much point in registering if we can't reply */
6762         if (!rdev->ops->mgmt_tx)
6763                 return -EOPNOTSUPP;
6764
6765         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6766                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6767                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6768 }
6769
6770 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6771 {
6772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6773         struct wireless_dev *wdev = info->user_ptr[1];
6774         struct cfg80211_chan_def chandef;
6775         int err;
6776         void *hdr = NULL;
6777         u64 cookie;
6778         struct sk_buff *msg = NULL;
6779         unsigned int wait = 0;
6780         bool offchan, no_cck, dont_wait_for_ack;
6781
6782         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6783
6784         if (!info->attrs[NL80211_ATTR_FRAME])
6785                 return -EINVAL;
6786
6787         if (!rdev->ops->mgmt_tx)
6788                 return -EOPNOTSUPP;
6789
6790         switch (wdev->iftype) {
6791         case NL80211_IFTYPE_STATION:
6792         case NL80211_IFTYPE_ADHOC:
6793         case NL80211_IFTYPE_P2P_CLIENT:
6794         case NL80211_IFTYPE_AP:
6795         case NL80211_IFTYPE_AP_VLAN:
6796         case NL80211_IFTYPE_MESH_POINT:
6797         case NL80211_IFTYPE_P2P_GO:
6798         case NL80211_IFTYPE_P2P_DEVICE:
6799                 break;
6800         default:
6801                 return -EOPNOTSUPP;
6802         }
6803
6804         if (info->attrs[NL80211_ATTR_DURATION]) {
6805                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6806                         return -EINVAL;
6807                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6808
6809                 /*
6810                  * We should wait on the channel for at least a minimum amount
6811                  * of time (10ms) but no longer than the driver supports.
6812                  */
6813                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6814                     wait > rdev->wiphy.max_remain_on_channel_duration)
6815                         return -EINVAL;
6816
6817         }
6818
6819         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6820
6821         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6822                 return -EINVAL;
6823
6824         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6825
6826         err = nl80211_parse_chandef(rdev, info, &chandef);
6827         if (err)
6828                 return err;
6829
6830         if (!dont_wait_for_ack) {
6831                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6832                 if (!msg)
6833                         return -ENOMEM;
6834
6835                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6836                                      NL80211_CMD_FRAME);
6837
6838                 if (IS_ERR(hdr)) {
6839                         err = PTR_ERR(hdr);
6840                         goto free_msg;
6841                 }
6842         }
6843
6844         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
6845                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6846                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6847                                     no_cck, dont_wait_for_ack, &cookie);
6848         if (err)
6849                 goto free_msg;
6850
6851         if (msg) {
6852                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6853                         goto nla_put_failure;
6854
6855                 genlmsg_end(msg, hdr);
6856                 return genlmsg_reply(msg, info);
6857         }
6858
6859         return 0;
6860
6861  nla_put_failure:
6862         err = -ENOBUFS;
6863  free_msg:
6864         nlmsg_free(msg);
6865         return err;
6866 }
6867
6868 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6869 {
6870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6871         struct wireless_dev *wdev = info->user_ptr[1];
6872         u64 cookie;
6873
6874         if (!info->attrs[NL80211_ATTR_COOKIE])
6875                 return -EINVAL;
6876
6877         if (!rdev->ops->mgmt_tx_cancel_wait)
6878                 return -EOPNOTSUPP;
6879
6880         switch (wdev->iftype) {
6881         case NL80211_IFTYPE_STATION:
6882         case NL80211_IFTYPE_ADHOC:
6883         case NL80211_IFTYPE_P2P_CLIENT:
6884         case NL80211_IFTYPE_AP:
6885         case NL80211_IFTYPE_AP_VLAN:
6886         case NL80211_IFTYPE_P2P_GO:
6887         case NL80211_IFTYPE_P2P_DEVICE:
6888                 break;
6889         default:
6890                 return -EOPNOTSUPP;
6891         }
6892
6893         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6894
6895         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6896 }
6897
6898 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6899 {
6900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6901         struct wireless_dev *wdev;
6902         struct net_device *dev = info->user_ptr[1];
6903         u8 ps_state;
6904         bool state;
6905         int err;
6906
6907         if (!info->attrs[NL80211_ATTR_PS_STATE])
6908                 return -EINVAL;
6909
6910         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6911
6912         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6913                 return -EINVAL;
6914
6915         wdev = dev->ieee80211_ptr;
6916
6917         if (!rdev->ops->set_power_mgmt)
6918                 return -EOPNOTSUPP;
6919
6920         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6921
6922         if (state == wdev->ps)
6923                 return 0;
6924
6925         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6926         if (!err)
6927                 wdev->ps = state;
6928         return err;
6929 }
6930
6931 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6932 {
6933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6934         enum nl80211_ps_state ps_state;
6935         struct wireless_dev *wdev;
6936         struct net_device *dev = info->user_ptr[1];
6937         struct sk_buff *msg;
6938         void *hdr;
6939         int err;
6940
6941         wdev = dev->ieee80211_ptr;
6942
6943         if (!rdev->ops->set_power_mgmt)
6944                 return -EOPNOTSUPP;
6945
6946         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6947         if (!msg)
6948                 return -ENOMEM;
6949
6950         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6951                              NL80211_CMD_GET_POWER_SAVE);
6952         if (!hdr) {
6953                 err = -ENOBUFS;
6954                 goto free_msg;
6955         }
6956
6957         if (wdev->ps)
6958                 ps_state = NL80211_PS_ENABLED;
6959         else
6960                 ps_state = NL80211_PS_DISABLED;
6961
6962         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6963                 goto nla_put_failure;
6964
6965         genlmsg_end(msg, hdr);
6966         return genlmsg_reply(msg, info);
6967
6968  nla_put_failure:
6969         err = -ENOBUFS;
6970  free_msg:
6971         nlmsg_free(msg);
6972         return err;
6973 }
6974
6975 static struct nla_policy
6976 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6977         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6978         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6979         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6980         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6981         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6982         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6983 };
6984
6985 static int nl80211_set_cqm_txe(struct genl_info *info,
6986                                u32 rate, u32 pkts, u32 intvl)
6987 {
6988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6989         struct wireless_dev *wdev;
6990         struct net_device *dev = info->user_ptr[1];
6991
6992         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
6993                 return -EINVAL;
6994
6995         wdev = dev->ieee80211_ptr;
6996
6997         if (!rdev->ops->set_cqm_txe_config)
6998                 return -EOPNOTSUPP;
6999
7000         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7001             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7002                 return -EOPNOTSUPP;
7003
7004         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7005 }
7006
7007 static int nl80211_set_cqm_rssi(struct genl_info *info,
7008                                 s32 threshold, u32 hysteresis)
7009 {
7010         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7011         struct wireless_dev *wdev;
7012         struct net_device *dev = info->user_ptr[1];
7013
7014         if (threshold > 0)
7015                 return -EINVAL;
7016
7017         wdev = dev->ieee80211_ptr;
7018
7019         if (!rdev->ops->set_cqm_rssi_config)
7020                 return -EOPNOTSUPP;
7021
7022         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7023             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7024                 return -EOPNOTSUPP;
7025
7026         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7027 }
7028
7029 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7030 {
7031         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7032         struct nlattr *cqm;
7033         int err;
7034
7035         cqm = info->attrs[NL80211_ATTR_CQM];
7036         if (!cqm) {
7037                 err = -EINVAL;
7038                 goto out;
7039         }
7040
7041         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7042                                nl80211_attr_cqm_policy);
7043         if (err)
7044                 goto out;
7045
7046         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7047             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7048                 s32 threshold;
7049                 u32 hysteresis;
7050                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7051                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7052                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7053         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7054                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7055                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7056                 u32 rate, pkts, intvl;
7057                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7058                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7059                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7060                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7061         } else
7062                 err = -EINVAL;
7063
7064 out:
7065         return err;
7066 }
7067
7068 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7069 {
7070         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7071         struct net_device *dev = info->user_ptr[1];
7072         struct mesh_config cfg;
7073         struct mesh_setup setup;
7074         int err;
7075
7076         /* start with default */
7077         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7078         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7079
7080         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7081                 /* and parse parameters if given */
7082                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7083                 if (err)
7084                         return err;
7085         }
7086
7087         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7088             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7089                 return -EINVAL;
7090
7091         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7092         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7093
7094         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7095             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7096                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7097                         return -EINVAL;
7098
7099         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7100                 setup.beacon_interval =
7101                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7102                 if (setup.beacon_interval < 10 ||
7103                     setup.beacon_interval > 10000)
7104                         return -EINVAL;
7105         }
7106
7107         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7108                 setup.dtim_period =
7109                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7110                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7111                         return -EINVAL;
7112         }
7113
7114         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7115                 /* parse additional setup parameters if given */
7116                 err = nl80211_parse_mesh_setup(info, &setup);
7117                 if (err)
7118                         return err;
7119         }
7120
7121         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7122                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7123                 if (err)
7124                         return err;
7125         } else {
7126                 /* cfg80211_join_mesh() will sort it out */
7127                 setup.chandef.chan = NULL;
7128         }
7129
7130         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7131 }
7132
7133 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7134 {
7135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7136         struct net_device *dev = info->user_ptr[1];
7137
7138         return cfg80211_leave_mesh(rdev, dev);
7139 }
7140
7141 #ifdef CONFIG_PM
7142 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7143                                         struct cfg80211_registered_device *rdev)
7144 {
7145         struct nlattr *nl_pats, *nl_pat;
7146         int i, pat_len;
7147
7148         if (!rdev->wowlan->n_patterns)
7149                 return 0;
7150
7151         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7152         if (!nl_pats)
7153                 return -ENOBUFS;
7154
7155         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7156                 nl_pat = nla_nest_start(msg, i + 1);
7157                 if (!nl_pat)
7158                         return -ENOBUFS;
7159                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7160                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7161                             DIV_ROUND_UP(pat_len, 8),
7162                             rdev->wowlan->patterns[i].mask) ||
7163                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7164                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7165                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7166                                 rdev->wowlan->patterns[i].pkt_offset))
7167                         return -ENOBUFS;
7168                 nla_nest_end(msg, nl_pat);
7169         }
7170         nla_nest_end(msg, nl_pats);
7171
7172         return 0;
7173 }
7174
7175 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7176                                    struct cfg80211_wowlan_tcp *tcp)
7177 {
7178         struct nlattr *nl_tcp;
7179
7180         if (!tcp)
7181                 return 0;
7182
7183         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7184         if (!nl_tcp)
7185                 return -ENOBUFS;
7186
7187         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7188             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7189             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7190             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7191             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7192             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7193                     tcp->payload_len, tcp->payload) ||
7194             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7195                         tcp->data_interval) ||
7196             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7197                     tcp->wake_len, tcp->wake_data) ||
7198             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7199                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7200                 return -ENOBUFS;
7201
7202         if (tcp->payload_seq.len &&
7203             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7204                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7205                 return -ENOBUFS;
7206
7207         if (tcp->payload_tok.len &&
7208             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7209                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7210                     &tcp->payload_tok))
7211                 return -ENOBUFS;
7212
7213         return 0;
7214 }
7215
7216 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7217 {
7218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7219         struct sk_buff *msg;
7220         void *hdr;
7221         u32 size = NLMSG_DEFAULT_SIZE;
7222
7223         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7224             !rdev->wiphy.wowlan.tcp)
7225                 return -EOPNOTSUPP;
7226
7227         if (rdev->wowlan && rdev->wowlan->tcp) {
7228                 /* adjust size to have room for all the data */
7229                 size += rdev->wowlan->tcp->tokens_size +
7230                         rdev->wowlan->tcp->payload_len +
7231                         rdev->wowlan->tcp->wake_len +
7232                         rdev->wowlan->tcp->wake_len / 8;
7233         }
7234
7235         msg = nlmsg_new(size, GFP_KERNEL);
7236         if (!msg)
7237                 return -ENOMEM;
7238
7239         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7240                              NL80211_CMD_GET_WOWLAN);
7241         if (!hdr)
7242                 goto nla_put_failure;
7243
7244         if (rdev->wowlan) {
7245                 struct nlattr *nl_wowlan;
7246
7247                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7248                 if (!nl_wowlan)
7249                         goto nla_put_failure;
7250
7251                 if ((rdev->wowlan->any &&
7252                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7253                     (rdev->wowlan->disconnect &&
7254                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7255                     (rdev->wowlan->magic_pkt &&
7256                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7257                     (rdev->wowlan->gtk_rekey_failure &&
7258                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7259                     (rdev->wowlan->eap_identity_req &&
7260                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7261                     (rdev->wowlan->four_way_handshake &&
7262                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7263                     (rdev->wowlan->rfkill_release &&
7264                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7265                         goto nla_put_failure;
7266
7267                 if (nl80211_send_wowlan_patterns(msg, rdev))
7268                         goto nla_put_failure;
7269
7270                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7271                         goto nla_put_failure;
7272
7273                 nla_nest_end(msg, nl_wowlan);
7274         }
7275
7276         genlmsg_end(msg, hdr);
7277         return genlmsg_reply(msg, info);
7278
7279 nla_put_failure:
7280         nlmsg_free(msg);
7281         return -ENOBUFS;
7282 }
7283
7284 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7285                                     struct nlattr *attr,
7286                                     struct cfg80211_wowlan *trig)
7287 {
7288         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7289         struct cfg80211_wowlan_tcp *cfg;
7290         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7291         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7292         u32 size;
7293         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7294         int err, port;
7295
7296         if (!rdev->wiphy.wowlan.tcp)
7297                 return -EINVAL;
7298
7299         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7300                         nla_data(attr), nla_len(attr),
7301                         nl80211_wowlan_tcp_policy);
7302         if (err)
7303                 return err;
7304
7305         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7306             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7307             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7308             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7309             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7310             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7311             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7312             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7313                 return -EINVAL;
7314
7315         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7316         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7317                 return -EINVAL;
7318
7319         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7320                         rdev->wiphy.wowlan.tcp->data_interval_max)
7321                 return -EINVAL;
7322
7323         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7324         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7325                 return -EINVAL;
7326
7327         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7328         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7329                 return -EINVAL;
7330
7331         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7332                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7333
7334                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7335                 tokens_size = tokln - sizeof(*tok);
7336
7337                 if (!tok->len || tokens_size % tok->len)
7338                         return -EINVAL;
7339                 if (!rdev->wiphy.wowlan.tcp->tok)
7340                         return -EINVAL;
7341                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7342                         return -EINVAL;
7343                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7344                         return -EINVAL;
7345                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7346                         return -EINVAL;
7347                 if (tok->offset + tok->len > data_size)
7348                         return -EINVAL;
7349         }
7350
7351         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7352                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7353                 if (!rdev->wiphy.wowlan.tcp->seq)
7354                         return -EINVAL;
7355                 if (seq->len == 0 || seq->len > 4)
7356                         return -EINVAL;
7357                 if (seq->len + seq->offset > data_size)
7358                         return -EINVAL;
7359         }
7360
7361         size = sizeof(*cfg);
7362         size += data_size;
7363         size += wake_size + wake_mask_size;
7364         size += tokens_size;
7365
7366         cfg = kzalloc(size, GFP_KERNEL);
7367         if (!cfg)
7368                 return -ENOMEM;
7369         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7370         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7371         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7372                ETH_ALEN);
7373         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7374                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7375         else
7376                 port = 0;
7377 #ifdef CONFIG_INET
7378         /* allocate a socket and port for it and use it */
7379         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7380                             IPPROTO_TCP, &cfg->sock, 1);
7381         if (err) {
7382                 kfree(cfg);
7383                 return err;
7384         }
7385         if (inet_csk_get_port(cfg->sock->sk, port)) {
7386                 sock_release(cfg->sock);
7387                 kfree(cfg);
7388                 return -EADDRINUSE;
7389         }
7390         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7391 #else
7392         if (!port) {
7393                 kfree(cfg);
7394                 return -EINVAL;
7395         }
7396         cfg->src_port = port;
7397 #endif
7398
7399         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7400         cfg->payload_len = data_size;
7401         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7402         memcpy((void *)cfg->payload,
7403                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7404                data_size);
7405         if (seq)
7406                 cfg->payload_seq = *seq;
7407         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7408         cfg->wake_len = wake_size;
7409         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7410         memcpy((void *)cfg->wake_data,
7411                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7412                wake_size);
7413         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7414                          data_size + wake_size;
7415         memcpy((void *)cfg->wake_mask,
7416                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7417                wake_mask_size);
7418         if (tok) {
7419                 cfg->tokens_size = tokens_size;
7420                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7421         }
7422
7423         trig->tcp = cfg;
7424
7425         return 0;
7426 }
7427
7428 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7429 {
7430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7431         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7432         struct cfg80211_wowlan new_triggers = {};
7433         struct cfg80211_wowlan *ntrig;
7434         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7435         int err, i;
7436         bool prev_enabled = rdev->wowlan;
7437
7438         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7439             !rdev->wiphy.wowlan.tcp)
7440                 return -EOPNOTSUPP;
7441
7442         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7443                 cfg80211_rdev_free_wowlan(rdev);
7444                 rdev->wowlan = NULL;
7445                 goto set_wakeup;
7446         }
7447
7448         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7449                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7450                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7451                         nl80211_wowlan_policy);
7452         if (err)
7453                 return err;
7454
7455         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7456                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7457                         return -EINVAL;
7458                 new_triggers.any = true;
7459         }
7460
7461         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7462                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7463                         return -EINVAL;
7464                 new_triggers.disconnect = true;
7465         }
7466
7467         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7468                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7469                         return -EINVAL;
7470                 new_triggers.magic_pkt = true;
7471         }
7472
7473         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7474                 return -EINVAL;
7475
7476         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7477                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7478                         return -EINVAL;
7479                 new_triggers.gtk_rekey_failure = true;
7480         }
7481
7482         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7483                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7484                         return -EINVAL;
7485                 new_triggers.eap_identity_req = true;
7486         }
7487
7488         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7489                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7490                         return -EINVAL;
7491                 new_triggers.four_way_handshake = true;
7492         }
7493
7494         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7495                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7496                         return -EINVAL;
7497                 new_triggers.rfkill_release = true;
7498         }
7499
7500         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7501                 struct nlattr *pat;
7502                 int n_patterns = 0;
7503                 int rem, pat_len, mask_len, pkt_offset;
7504                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7505
7506                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7507                                     rem)
7508                         n_patterns++;
7509                 if (n_patterns > wowlan->n_patterns)
7510                         return -EINVAL;
7511
7512                 new_triggers.patterns = kcalloc(n_patterns,
7513                                                 sizeof(new_triggers.patterns[0]),
7514                                                 GFP_KERNEL);
7515                 if (!new_triggers.patterns)
7516                         return -ENOMEM;
7517
7518                 new_triggers.n_patterns = n_patterns;
7519                 i = 0;
7520
7521                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7522                                     rem) {
7523                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7524                                   nla_data(pat), nla_len(pat), NULL);
7525                         err = -EINVAL;
7526                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7527                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7528                                 goto error;
7529                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7530                         mask_len = DIV_ROUND_UP(pat_len, 8);
7531                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7532                             mask_len)
7533                                 goto error;
7534                         if (pat_len > wowlan->pattern_max_len ||
7535                             pat_len < wowlan->pattern_min_len)
7536                                 goto error;
7537
7538                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7539                                 pkt_offset = 0;
7540                         else
7541                                 pkt_offset = nla_get_u32(
7542                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7543                         if (pkt_offset > wowlan->max_pkt_offset)
7544                                 goto error;
7545                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7546
7547                         new_triggers.patterns[i].mask =
7548                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7549                         if (!new_triggers.patterns[i].mask) {
7550                                 err = -ENOMEM;
7551                                 goto error;
7552                         }
7553                         new_triggers.patterns[i].pattern =
7554                                 new_triggers.patterns[i].mask + mask_len;
7555                         memcpy(new_triggers.patterns[i].mask,
7556                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7557                                mask_len);
7558                         new_triggers.patterns[i].pattern_len = pat_len;
7559                         memcpy(new_triggers.patterns[i].pattern,
7560                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7561                                pat_len);
7562                         i++;
7563                 }
7564         }
7565
7566         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7567                 err = nl80211_parse_wowlan_tcp(
7568                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7569                         &new_triggers);
7570                 if (err)
7571                         goto error;
7572         }
7573
7574         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7575         if (!ntrig) {
7576                 err = -ENOMEM;
7577                 goto error;
7578         }
7579         cfg80211_rdev_free_wowlan(rdev);
7580         rdev->wowlan = ntrig;
7581
7582  set_wakeup:
7583         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7584                 rdev_set_wakeup(rdev, rdev->wowlan);
7585
7586         return 0;
7587  error:
7588         for (i = 0; i < new_triggers.n_patterns; i++)
7589                 kfree(new_triggers.patterns[i].mask);
7590         kfree(new_triggers.patterns);
7591         if (new_triggers.tcp && new_triggers.tcp->sock)
7592                 sock_release(new_triggers.tcp->sock);
7593         kfree(new_triggers.tcp);
7594         return err;
7595 }
7596 #endif
7597
7598 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7599 {
7600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7601         struct net_device *dev = info->user_ptr[1];
7602         struct wireless_dev *wdev = dev->ieee80211_ptr;
7603         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7604         struct cfg80211_gtk_rekey_data rekey_data;
7605         int err;
7606
7607         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7608                 return -EINVAL;
7609
7610         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7611                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7612                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7613                         nl80211_rekey_policy);
7614         if (err)
7615                 return err;
7616
7617         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7618                 return -ERANGE;
7619         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7620                 return -ERANGE;
7621         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7622                 return -ERANGE;
7623
7624         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7625                NL80211_KEK_LEN);
7626         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7627                NL80211_KCK_LEN);
7628         memcpy(rekey_data.replay_ctr,
7629                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7630                NL80211_REPLAY_CTR_LEN);
7631
7632         wdev_lock(wdev);
7633         if (!wdev->current_bss) {
7634                 err = -ENOTCONN;
7635                 goto out;
7636         }
7637
7638         if (!rdev->ops->set_rekey_data) {
7639                 err = -EOPNOTSUPP;
7640                 goto out;
7641         }
7642
7643         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7644  out:
7645         wdev_unlock(wdev);
7646         return err;
7647 }
7648
7649 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7650                                              struct genl_info *info)
7651 {
7652         struct net_device *dev = info->user_ptr[1];
7653         struct wireless_dev *wdev = dev->ieee80211_ptr;
7654
7655         if (wdev->iftype != NL80211_IFTYPE_AP &&
7656             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7657                 return -EINVAL;
7658
7659         if (wdev->ap_unexpected_nlportid)
7660                 return -EBUSY;
7661
7662         wdev->ap_unexpected_nlportid = info->snd_portid;
7663         return 0;
7664 }
7665
7666 static int nl80211_probe_client(struct sk_buff *skb,
7667                                 struct genl_info *info)
7668 {
7669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7670         struct net_device *dev = info->user_ptr[1];
7671         struct wireless_dev *wdev = dev->ieee80211_ptr;
7672         struct sk_buff *msg;
7673         void *hdr;
7674         const u8 *addr;
7675         u64 cookie;
7676         int err;
7677
7678         if (wdev->iftype != NL80211_IFTYPE_AP &&
7679             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7680                 return -EOPNOTSUPP;
7681
7682         if (!info->attrs[NL80211_ATTR_MAC])
7683                 return -EINVAL;
7684
7685         if (!rdev->ops->probe_client)
7686                 return -EOPNOTSUPP;
7687
7688         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7689         if (!msg)
7690                 return -ENOMEM;
7691
7692         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7693                              NL80211_CMD_PROBE_CLIENT);
7694
7695         if (IS_ERR(hdr)) {
7696                 err = PTR_ERR(hdr);
7697                 goto free_msg;
7698         }
7699
7700         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7701
7702         err = rdev_probe_client(rdev, dev, addr, &cookie);
7703         if (err)
7704                 goto free_msg;
7705
7706         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7707                 goto nla_put_failure;
7708
7709         genlmsg_end(msg, hdr);
7710
7711         return genlmsg_reply(msg, info);
7712
7713  nla_put_failure:
7714         err = -ENOBUFS;
7715  free_msg:
7716         nlmsg_free(msg);
7717         return err;
7718 }
7719
7720 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7721 {
7722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7723         struct cfg80211_beacon_registration *reg, *nreg;
7724         int rv;
7725
7726         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
7727                 return -EOPNOTSUPP;
7728
7729         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
7730         if (!nreg)
7731                 return -ENOMEM;
7732
7733         /* First, check if already registered. */
7734         spin_lock_bh(&rdev->beacon_registrations_lock);
7735         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
7736                 if (reg->nlportid == info->snd_portid) {
7737                         rv = -EALREADY;
7738                         goto out_err;
7739                 }
7740         }
7741         /* Add it to the list */
7742         nreg->nlportid = info->snd_portid;
7743         list_add(&nreg->list, &rdev->beacon_registrations);
7744
7745         spin_unlock_bh(&rdev->beacon_registrations_lock);
7746
7747         return 0;
7748 out_err:
7749         spin_unlock_bh(&rdev->beacon_registrations_lock);
7750         kfree(nreg);
7751         return rv;
7752 }
7753
7754 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
7755 {
7756         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7757         struct wireless_dev *wdev = info->user_ptr[1];
7758         int err;
7759
7760         if (!rdev->ops->start_p2p_device)
7761                 return -EOPNOTSUPP;
7762
7763         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7764                 return -EOPNOTSUPP;
7765
7766         if (wdev->p2p_started)
7767                 return 0;
7768
7769         mutex_lock(&rdev->devlist_mtx);
7770         err = cfg80211_can_add_interface(rdev, wdev->iftype);
7771         mutex_unlock(&rdev->devlist_mtx);
7772         if (err)
7773                 return err;
7774
7775         err = rdev_start_p2p_device(rdev, wdev);
7776         if (err)
7777                 return err;
7778
7779         wdev->p2p_started = true;
7780         mutex_lock(&rdev->devlist_mtx);
7781         rdev->opencount++;
7782         mutex_unlock(&rdev->devlist_mtx);
7783
7784         return 0;
7785 }
7786
7787 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7788 {
7789         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7790         struct wireless_dev *wdev = info->user_ptr[1];
7791
7792         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7793                 return -EOPNOTSUPP;
7794
7795         if (!rdev->ops->stop_p2p_device)
7796                 return -EOPNOTSUPP;
7797
7798         if (!wdev->p2p_started)
7799                 return 0;
7800
7801         rdev_stop_p2p_device(rdev, wdev);
7802         wdev->p2p_started = false;
7803
7804         mutex_lock(&rdev->devlist_mtx);
7805         rdev->opencount--;
7806         mutex_unlock(&rdev->devlist_mtx);
7807
7808         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7809                 rdev->scan_req->aborted = true;
7810                 ___cfg80211_scan_done(rdev, true);
7811         }
7812
7813         return 0;
7814 }
7815
7816 #define NL80211_FLAG_NEED_WIPHY         0x01
7817 #define NL80211_FLAG_NEED_NETDEV        0x02
7818 #define NL80211_FLAG_NEED_RTNL          0x04
7819 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7820 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7821                                          NL80211_FLAG_CHECK_NETDEV_UP)
7822 #define NL80211_FLAG_NEED_WDEV          0x10
7823 /* If a netdev is associated, it must be UP, P2P must be started */
7824 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7825                                          NL80211_FLAG_CHECK_NETDEV_UP)
7826
7827 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7828                             struct genl_info *info)
7829 {
7830         struct cfg80211_registered_device *rdev;
7831         struct wireless_dev *wdev;
7832         struct net_device *dev;
7833         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7834
7835         if (rtnl)
7836                 rtnl_lock();
7837
7838         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7839                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7840                 if (IS_ERR(rdev)) {
7841                         if (rtnl)
7842                                 rtnl_unlock();
7843                         return PTR_ERR(rdev);
7844                 }
7845                 info->user_ptr[0] = rdev;
7846         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7847                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7848                 mutex_lock(&cfg80211_mutex);
7849                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7850                                                   info->attrs);
7851                 if (IS_ERR(wdev)) {
7852                         mutex_unlock(&cfg80211_mutex);
7853                         if (rtnl)
7854                                 rtnl_unlock();
7855                         return PTR_ERR(wdev);
7856                 }
7857
7858                 dev = wdev->netdev;
7859                 rdev = wiphy_to_dev(wdev->wiphy);
7860
7861                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7862                         if (!dev) {
7863                                 mutex_unlock(&cfg80211_mutex);
7864                                 if (rtnl)
7865                                         rtnl_unlock();
7866                                 return -EINVAL;
7867                         }
7868
7869                         info->user_ptr[1] = dev;
7870                 } else {
7871                         info->user_ptr[1] = wdev;
7872                 }
7873
7874                 if (dev) {
7875                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7876                             !netif_running(dev)) {
7877                                 mutex_unlock(&cfg80211_mutex);
7878                                 if (rtnl)
7879                                         rtnl_unlock();
7880                                 return -ENETDOWN;
7881                         }
7882
7883                         dev_hold(dev);
7884                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7885                         if (!wdev->p2p_started) {
7886                                 mutex_unlock(&cfg80211_mutex);
7887                                 if (rtnl)
7888                                         rtnl_unlock();
7889                                 return -ENETDOWN;
7890                         }
7891                 }
7892
7893                 cfg80211_lock_rdev(rdev);
7894
7895                 mutex_unlock(&cfg80211_mutex);
7896
7897                 info->user_ptr[0] = rdev;
7898         }
7899
7900         return 0;
7901 }
7902
7903 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7904                               struct genl_info *info)
7905 {
7906         if (info->user_ptr[0])
7907                 cfg80211_unlock_rdev(info->user_ptr[0]);
7908         if (info->user_ptr[1]) {
7909                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7910                         struct wireless_dev *wdev = info->user_ptr[1];
7911
7912                         if (wdev->netdev)
7913                                 dev_put(wdev->netdev);
7914                 } else {
7915                         dev_put(info->user_ptr[1]);
7916                 }
7917         }
7918         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7919                 rtnl_unlock();
7920 }
7921
7922 static struct genl_ops nl80211_ops[] = {
7923         {
7924                 .cmd = NL80211_CMD_GET_WIPHY,
7925                 .doit = nl80211_get_wiphy,
7926                 .dumpit = nl80211_dump_wiphy,
7927                 .policy = nl80211_policy,
7928                 /* can be retrieved by unprivileged users */
7929                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7930         },
7931         {
7932                 .cmd = NL80211_CMD_SET_WIPHY,
7933                 .doit = nl80211_set_wiphy,
7934                 .policy = nl80211_policy,
7935                 .flags = GENL_ADMIN_PERM,
7936                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7937         },
7938         {
7939                 .cmd = NL80211_CMD_GET_INTERFACE,
7940                 .doit = nl80211_get_interface,
7941                 .dumpit = nl80211_dump_interface,
7942                 .policy = nl80211_policy,
7943                 /* can be retrieved by unprivileged users */
7944                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7945         },
7946         {
7947                 .cmd = NL80211_CMD_SET_INTERFACE,
7948                 .doit = nl80211_set_interface,
7949                 .policy = nl80211_policy,
7950                 .flags = GENL_ADMIN_PERM,
7951                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7952                                   NL80211_FLAG_NEED_RTNL,
7953         },
7954         {
7955                 .cmd = NL80211_CMD_NEW_INTERFACE,
7956                 .doit = nl80211_new_interface,
7957                 .policy = nl80211_policy,
7958                 .flags = GENL_ADMIN_PERM,
7959                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7960                                   NL80211_FLAG_NEED_RTNL,
7961         },
7962         {
7963                 .cmd = NL80211_CMD_DEL_INTERFACE,
7964                 .doit = nl80211_del_interface,
7965                 .policy = nl80211_policy,
7966                 .flags = GENL_ADMIN_PERM,
7967                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7968                                   NL80211_FLAG_NEED_RTNL,
7969         },
7970         {
7971                 .cmd = NL80211_CMD_GET_KEY,
7972                 .doit = nl80211_get_key,
7973                 .policy = nl80211_policy,
7974                 .flags = GENL_ADMIN_PERM,
7975                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7976                                   NL80211_FLAG_NEED_RTNL,
7977         },
7978         {
7979                 .cmd = NL80211_CMD_SET_KEY,
7980                 .doit = nl80211_set_key,
7981                 .policy = nl80211_policy,
7982                 .flags = GENL_ADMIN_PERM,
7983                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7984                                   NL80211_FLAG_NEED_RTNL,
7985         },
7986         {
7987                 .cmd = NL80211_CMD_NEW_KEY,
7988                 .doit = nl80211_new_key,
7989                 .policy = nl80211_policy,
7990                 .flags = GENL_ADMIN_PERM,
7991                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7992                                   NL80211_FLAG_NEED_RTNL,
7993         },
7994         {
7995                 .cmd = NL80211_CMD_DEL_KEY,
7996                 .doit = nl80211_del_key,
7997                 .policy = nl80211_policy,
7998                 .flags = GENL_ADMIN_PERM,
7999                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8000                                   NL80211_FLAG_NEED_RTNL,
8001         },
8002         {
8003                 .cmd = NL80211_CMD_SET_BEACON,
8004                 .policy = nl80211_policy,
8005                 .flags = GENL_ADMIN_PERM,
8006                 .doit = nl80211_set_beacon,
8007                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8008                                   NL80211_FLAG_NEED_RTNL,
8009         },
8010         {
8011                 .cmd = NL80211_CMD_START_AP,
8012                 .policy = nl80211_policy,
8013                 .flags = GENL_ADMIN_PERM,
8014                 .doit = nl80211_start_ap,
8015                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8016                                   NL80211_FLAG_NEED_RTNL,
8017         },
8018         {
8019                 .cmd = NL80211_CMD_STOP_AP,
8020                 .policy = nl80211_policy,
8021                 .flags = GENL_ADMIN_PERM,
8022                 .doit = nl80211_stop_ap,
8023                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8024                                   NL80211_FLAG_NEED_RTNL,
8025         },
8026         {
8027                 .cmd = NL80211_CMD_GET_STATION,
8028                 .doit = nl80211_get_station,
8029                 .dumpit = nl80211_dump_station,
8030                 .policy = nl80211_policy,
8031                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8032                                   NL80211_FLAG_NEED_RTNL,
8033         },
8034         {
8035                 .cmd = NL80211_CMD_SET_STATION,
8036                 .doit = nl80211_set_station,
8037                 .policy = nl80211_policy,
8038                 .flags = GENL_ADMIN_PERM,
8039                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8040                                   NL80211_FLAG_NEED_RTNL,
8041         },
8042         {
8043                 .cmd = NL80211_CMD_NEW_STATION,
8044                 .doit = nl80211_new_station,
8045                 .policy = nl80211_policy,
8046                 .flags = GENL_ADMIN_PERM,
8047                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8048                                   NL80211_FLAG_NEED_RTNL,
8049         },
8050         {
8051                 .cmd = NL80211_CMD_DEL_STATION,
8052                 .doit = nl80211_del_station,
8053                 .policy = nl80211_policy,
8054                 .flags = GENL_ADMIN_PERM,
8055                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8056                                   NL80211_FLAG_NEED_RTNL,
8057         },
8058         {
8059                 .cmd = NL80211_CMD_GET_MPATH,
8060                 .doit = nl80211_get_mpath,
8061                 .dumpit = nl80211_dump_mpath,
8062                 .policy = nl80211_policy,
8063                 .flags = GENL_ADMIN_PERM,
8064                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8065                                   NL80211_FLAG_NEED_RTNL,
8066         },
8067         {
8068                 .cmd = NL80211_CMD_SET_MPATH,
8069                 .doit = nl80211_set_mpath,
8070                 .policy = nl80211_policy,
8071                 .flags = GENL_ADMIN_PERM,
8072                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8073                                   NL80211_FLAG_NEED_RTNL,
8074         },
8075         {
8076                 .cmd = NL80211_CMD_NEW_MPATH,
8077                 .doit = nl80211_new_mpath,
8078                 .policy = nl80211_policy,
8079                 .flags = GENL_ADMIN_PERM,
8080                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8081                                   NL80211_FLAG_NEED_RTNL,
8082         },
8083         {
8084                 .cmd = NL80211_CMD_DEL_MPATH,
8085                 .doit = nl80211_del_mpath,
8086                 .policy = nl80211_policy,
8087                 .flags = GENL_ADMIN_PERM,
8088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8089                                   NL80211_FLAG_NEED_RTNL,
8090         },
8091         {
8092                 .cmd = NL80211_CMD_SET_BSS,
8093                 .doit = nl80211_set_bss,
8094                 .policy = nl80211_policy,
8095                 .flags = GENL_ADMIN_PERM,
8096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8097                                   NL80211_FLAG_NEED_RTNL,
8098         },
8099         {
8100                 .cmd = NL80211_CMD_GET_REG,
8101                 .doit = nl80211_get_reg,
8102                 .policy = nl80211_policy,
8103                 /* can be retrieved by unprivileged users */
8104         },
8105         {
8106                 .cmd = NL80211_CMD_SET_REG,
8107                 .doit = nl80211_set_reg,
8108                 .policy = nl80211_policy,
8109                 .flags = GENL_ADMIN_PERM,
8110         },
8111         {
8112                 .cmd = NL80211_CMD_REQ_SET_REG,
8113                 .doit = nl80211_req_set_reg,
8114                 .policy = nl80211_policy,
8115                 .flags = GENL_ADMIN_PERM,
8116         },
8117         {
8118                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8119                 .doit = nl80211_get_mesh_config,
8120                 .policy = nl80211_policy,
8121                 /* can be retrieved by unprivileged users */
8122                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8123                                   NL80211_FLAG_NEED_RTNL,
8124         },
8125         {
8126                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8127                 .doit = nl80211_update_mesh_config,
8128                 .policy = nl80211_policy,
8129                 .flags = GENL_ADMIN_PERM,
8130                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8131                                   NL80211_FLAG_NEED_RTNL,
8132         },
8133         {
8134                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8135                 .doit = nl80211_trigger_scan,
8136                 .policy = nl80211_policy,
8137                 .flags = GENL_ADMIN_PERM,
8138                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8139                                   NL80211_FLAG_NEED_RTNL,
8140         },
8141         {
8142                 .cmd = NL80211_CMD_GET_SCAN,
8143                 .policy = nl80211_policy,
8144                 .dumpit = nl80211_dump_scan,
8145         },
8146         {
8147                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8148                 .doit = nl80211_start_sched_scan,
8149                 .policy = nl80211_policy,
8150                 .flags = GENL_ADMIN_PERM,
8151                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8152                                   NL80211_FLAG_NEED_RTNL,
8153         },
8154         {
8155                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8156                 .doit = nl80211_stop_sched_scan,
8157                 .policy = nl80211_policy,
8158                 .flags = GENL_ADMIN_PERM,
8159                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8160                                   NL80211_FLAG_NEED_RTNL,
8161         },
8162         {
8163                 .cmd = NL80211_CMD_AUTHENTICATE,
8164                 .doit = nl80211_authenticate,
8165                 .policy = nl80211_policy,
8166                 .flags = GENL_ADMIN_PERM,
8167                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8168                                   NL80211_FLAG_NEED_RTNL,
8169         },
8170         {
8171                 .cmd = NL80211_CMD_ASSOCIATE,
8172                 .doit = nl80211_associate,
8173                 .policy = nl80211_policy,
8174                 .flags = GENL_ADMIN_PERM,
8175                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8176                                   NL80211_FLAG_NEED_RTNL,
8177         },
8178         {
8179                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8180                 .doit = nl80211_deauthenticate,
8181                 .policy = nl80211_policy,
8182                 .flags = GENL_ADMIN_PERM,
8183                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8184                                   NL80211_FLAG_NEED_RTNL,
8185         },
8186         {
8187                 .cmd = NL80211_CMD_DISASSOCIATE,
8188                 .doit = nl80211_disassociate,
8189                 .policy = nl80211_policy,
8190                 .flags = GENL_ADMIN_PERM,
8191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8192                                   NL80211_FLAG_NEED_RTNL,
8193         },
8194         {
8195                 .cmd = NL80211_CMD_JOIN_IBSS,
8196                 .doit = nl80211_join_ibss,
8197                 .policy = nl80211_policy,
8198                 .flags = GENL_ADMIN_PERM,
8199                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8200                                   NL80211_FLAG_NEED_RTNL,
8201         },
8202         {
8203                 .cmd = NL80211_CMD_LEAVE_IBSS,
8204                 .doit = nl80211_leave_ibss,
8205                 .policy = nl80211_policy,
8206                 .flags = GENL_ADMIN_PERM,
8207                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8208                                   NL80211_FLAG_NEED_RTNL,
8209         },
8210 #ifdef CONFIG_NL80211_TESTMODE
8211         {
8212                 .cmd = NL80211_CMD_TESTMODE,
8213                 .doit = nl80211_testmode_do,
8214                 .dumpit = nl80211_testmode_dump,
8215                 .policy = nl80211_policy,
8216                 .flags = GENL_ADMIN_PERM,
8217                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8218                                   NL80211_FLAG_NEED_RTNL,
8219         },
8220 #endif
8221         {
8222                 .cmd = NL80211_CMD_CONNECT,
8223                 .doit = nl80211_connect,
8224                 .policy = nl80211_policy,
8225                 .flags = GENL_ADMIN_PERM,
8226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8227                                   NL80211_FLAG_NEED_RTNL,
8228         },
8229         {
8230                 .cmd = NL80211_CMD_DISCONNECT,
8231                 .doit = nl80211_disconnect,
8232                 .policy = nl80211_policy,
8233                 .flags = GENL_ADMIN_PERM,
8234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8235                                   NL80211_FLAG_NEED_RTNL,
8236         },
8237         {
8238                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8239                 .doit = nl80211_wiphy_netns,
8240                 .policy = nl80211_policy,
8241                 .flags = GENL_ADMIN_PERM,
8242                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8243                                   NL80211_FLAG_NEED_RTNL,
8244         },
8245         {
8246                 .cmd = NL80211_CMD_GET_SURVEY,
8247                 .policy = nl80211_policy,
8248                 .dumpit = nl80211_dump_survey,
8249         },
8250         {
8251                 .cmd = NL80211_CMD_SET_PMKSA,
8252                 .doit = nl80211_setdel_pmksa,
8253                 .policy = nl80211_policy,
8254                 .flags = GENL_ADMIN_PERM,
8255                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8256                                   NL80211_FLAG_NEED_RTNL,
8257         },
8258         {
8259                 .cmd = NL80211_CMD_DEL_PMKSA,
8260                 .doit = nl80211_setdel_pmksa,
8261                 .policy = nl80211_policy,
8262                 .flags = GENL_ADMIN_PERM,
8263                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8264                                   NL80211_FLAG_NEED_RTNL,
8265         },
8266         {
8267                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8268                 .doit = nl80211_flush_pmksa,
8269                 .policy = nl80211_policy,
8270                 .flags = GENL_ADMIN_PERM,
8271                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8272                                   NL80211_FLAG_NEED_RTNL,
8273         },
8274         {
8275                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8276                 .doit = nl80211_remain_on_channel,
8277                 .policy = nl80211_policy,
8278                 .flags = GENL_ADMIN_PERM,
8279                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8280                                   NL80211_FLAG_NEED_RTNL,
8281         },
8282         {
8283                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8284                 .doit = nl80211_cancel_remain_on_channel,
8285                 .policy = nl80211_policy,
8286                 .flags = GENL_ADMIN_PERM,
8287                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8288                                   NL80211_FLAG_NEED_RTNL,
8289         },
8290         {
8291                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8292                 .doit = nl80211_set_tx_bitrate_mask,
8293                 .policy = nl80211_policy,
8294                 .flags = GENL_ADMIN_PERM,
8295                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8296                                   NL80211_FLAG_NEED_RTNL,
8297         },
8298         {
8299                 .cmd = NL80211_CMD_REGISTER_FRAME,
8300                 .doit = nl80211_register_mgmt,
8301                 .policy = nl80211_policy,
8302                 .flags = GENL_ADMIN_PERM,
8303                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8304                                   NL80211_FLAG_NEED_RTNL,
8305         },
8306         {
8307                 .cmd = NL80211_CMD_FRAME,
8308                 .doit = nl80211_tx_mgmt,
8309                 .policy = nl80211_policy,
8310                 .flags = GENL_ADMIN_PERM,
8311                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8312                                   NL80211_FLAG_NEED_RTNL,
8313         },
8314         {
8315                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8316                 .doit = nl80211_tx_mgmt_cancel_wait,
8317                 .policy = nl80211_policy,
8318                 .flags = GENL_ADMIN_PERM,
8319                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8320                                   NL80211_FLAG_NEED_RTNL,
8321         },
8322         {
8323                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8324                 .doit = nl80211_set_power_save,
8325                 .policy = nl80211_policy,
8326                 .flags = GENL_ADMIN_PERM,
8327                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8328                                   NL80211_FLAG_NEED_RTNL,
8329         },
8330         {
8331                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8332                 .doit = nl80211_get_power_save,
8333                 .policy = nl80211_policy,
8334                 /* can be retrieved by unprivileged users */
8335                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8336                                   NL80211_FLAG_NEED_RTNL,
8337         },
8338         {
8339                 .cmd = NL80211_CMD_SET_CQM,
8340                 .doit = nl80211_set_cqm,
8341                 .policy = nl80211_policy,
8342                 .flags = GENL_ADMIN_PERM,
8343                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8344                                   NL80211_FLAG_NEED_RTNL,
8345         },
8346         {
8347                 .cmd = NL80211_CMD_SET_CHANNEL,
8348                 .doit = nl80211_set_channel,
8349                 .policy = nl80211_policy,
8350                 .flags = GENL_ADMIN_PERM,
8351                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8352                                   NL80211_FLAG_NEED_RTNL,
8353         },
8354         {
8355                 .cmd = NL80211_CMD_SET_WDS_PEER,
8356                 .doit = nl80211_set_wds_peer,
8357                 .policy = nl80211_policy,
8358                 .flags = GENL_ADMIN_PERM,
8359                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8360                                   NL80211_FLAG_NEED_RTNL,
8361         },
8362         {
8363                 .cmd = NL80211_CMD_JOIN_MESH,
8364                 .doit = nl80211_join_mesh,
8365                 .policy = nl80211_policy,
8366                 .flags = GENL_ADMIN_PERM,
8367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8368                                   NL80211_FLAG_NEED_RTNL,
8369         },
8370         {
8371                 .cmd = NL80211_CMD_LEAVE_MESH,
8372                 .doit = nl80211_leave_mesh,
8373                 .policy = nl80211_policy,
8374                 .flags = GENL_ADMIN_PERM,
8375                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8376                                   NL80211_FLAG_NEED_RTNL,
8377         },
8378 #ifdef CONFIG_PM
8379         {
8380                 .cmd = NL80211_CMD_GET_WOWLAN,
8381                 .doit = nl80211_get_wowlan,
8382                 .policy = nl80211_policy,
8383                 /* can be retrieved by unprivileged users */
8384                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8385                                   NL80211_FLAG_NEED_RTNL,
8386         },
8387         {
8388                 .cmd = NL80211_CMD_SET_WOWLAN,
8389                 .doit = nl80211_set_wowlan,
8390                 .policy = nl80211_policy,
8391                 .flags = GENL_ADMIN_PERM,
8392                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8393                                   NL80211_FLAG_NEED_RTNL,
8394         },
8395 #endif
8396         {
8397                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8398                 .doit = nl80211_set_rekey_data,
8399                 .policy = nl80211_policy,
8400                 .flags = GENL_ADMIN_PERM,
8401                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8402                                   NL80211_FLAG_NEED_RTNL,
8403         },
8404         {
8405                 .cmd = NL80211_CMD_TDLS_MGMT,
8406                 .doit = nl80211_tdls_mgmt,
8407                 .policy = nl80211_policy,
8408                 .flags = GENL_ADMIN_PERM,
8409                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8410                                   NL80211_FLAG_NEED_RTNL,
8411         },
8412         {
8413                 .cmd = NL80211_CMD_TDLS_OPER,
8414                 .doit = nl80211_tdls_oper,
8415                 .policy = nl80211_policy,
8416                 .flags = GENL_ADMIN_PERM,
8417                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8418                                   NL80211_FLAG_NEED_RTNL,
8419         },
8420         {
8421                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8422                 .doit = nl80211_register_unexpected_frame,
8423                 .policy = nl80211_policy,
8424                 .flags = GENL_ADMIN_PERM,
8425                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8426                                   NL80211_FLAG_NEED_RTNL,
8427         },
8428         {
8429                 .cmd = NL80211_CMD_PROBE_CLIENT,
8430                 .doit = nl80211_probe_client,
8431                 .policy = nl80211_policy,
8432                 .flags = GENL_ADMIN_PERM,
8433                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8434                                   NL80211_FLAG_NEED_RTNL,
8435         },
8436         {
8437                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8438                 .doit = nl80211_register_beacons,
8439                 .policy = nl80211_policy,
8440                 .flags = GENL_ADMIN_PERM,
8441                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8442                                   NL80211_FLAG_NEED_RTNL,
8443         },
8444         {
8445                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8446                 .doit = nl80211_set_noack_map,
8447                 .policy = nl80211_policy,
8448                 .flags = GENL_ADMIN_PERM,
8449                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8450                                   NL80211_FLAG_NEED_RTNL,
8451         },
8452         {
8453                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8454                 .doit = nl80211_start_p2p_device,
8455                 .policy = nl80211_policy,
8456                 .flags = GENL_ADMIN_PERM,
8457                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8458                                   NL80211_FLAG_NEED_RTNL,
8459         },
8460         {
8461                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8462                 .doit = nl80211_stop_p2p_device,
8463                 .policy = nl80211_policy,
8464                 .flags = GENL_ADMIN_PERM,
8465                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8466                                   NL80211_FLAG_NEED_RTNL,
8467         },
8468         {
8469                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8470                 .doit = nl80211_set_mcast_rate,
8471                 .policy = nl80211_policy,
8472                 .flags = GENL_ADMIN_PERM,
8473                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8474                                   NL80211_FLAG_NEED_RTNL,
8475         },
8476         {
8477                 .cmd = NL80211_CMD_SET_MAC_ACL,
8478                 .doit = nl80211_set_mac_acl,
8479                 .policy = nl80211_policy,
8480                 .flags = GENL_ADMIN_PERM,
8481                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8482                                   NL80211_FLAG_NEED_RTNL,
8483         },
8484         {
8485                 .cmd = NL80211_CMD_RADAR_DETECT,
8486                 .doit = nl80211_start_radar_detection,
8487                 .policy = nl80211_policy,
8488                 .flags = GENL_ADMIN_PERM,
8489                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8490                                   NL80211_FLAG_NEED_RTNL,
8491         },
8492 };
8493
8494 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8495         .name = "mlme",
8496 };
8497
8498 /* multicast groups */
8499 static struct genl_multicast_group nl80211_config_mcgrp = {
8500         .name = "config",
8501 };
8502 static struct genl_multicast_group nl80211_scan_mcgrp = {
8503         .name = "scan",
8504 };
8505 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8506         .name = "regulatory",
8507 };
8508
8509 /* notification functions */
8510
8511 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8512 {
8513         struct sk_buff *msg;
8514
8515         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8516         if (!msg)
8517                 return;
8518
8519         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
8520                 nlmsg_free(msg);
8521                 return;
8522         }
8523
8524         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8525                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8526 }
8527
8528 static int nl80211_add_scan_req(struct sk_buff *msg,
8529                                 struct cfg80211_registered_device *rdev)
8530 {
8531         struct cfg80211_scan_request *req = rdev->scan_req;
8532         struct nlattr *nest;
8533         int i;
8534
8535         ASSERT_RDEV_LOCK(rdev);
8536
8537         if (WARN_ON(!req))
8538                 return 0;
8539
8540         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8541         if (!nest)
8542                 goto nla_put_failure;
8543         for (i = 0; i < req->n_ssids; i++) {
8544                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8545                         goto nla_put_failure;
8546         }
8547         nla_nest_end(msg, nest);
8548
8549         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8550         if (!nest)
8551                 goto nla_put_failure;
8552         for (i = 0; i < req->n_channels; i++) {
8553                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8554                         goto nla_put_failure;
8555         }
8556         nla_nest_end(msg, nest);
8557
8558         if (req->ie &&
8559             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8560                 goto nla_put_failure;
8561
8562         if (req->flags)
8563                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8564
8565         return 0;
8566  nla_put_failure:
8567         return -ENOBUFS;
8568 }
8569
8570 static int nl80211_send_scan_msg(struct sk_buff *msg,
8571                                  struct cfg80211_registered_device *rdev,
8572                                  struct wireless_dev *wdev,
8573                                  u32 portid, u32 seq, int flags,
8574                                  u32 cmd)
8575 {
8576         void *hdr;
8577
8578         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8579         if (!hdr)
8580                 return -1;
8581
8582         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8583             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8584                                          wdev->netdev->ifindex)) ||
8585             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8586                 goto nla_put_failure;
8587
8588         /* ignore errors and send incomplete event anyway */
8589         nl80211_add_scan_req(msg, rdev);
8590
8591         return genlmsg_end(msg, hdr);
8592
8593  nla_put_failure:
8594         genlmsg_cancel(msg, hdr);
8595         return -EMSGSIZE;
8596 }
8597
8598 static int
8599 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8600                             struct cfg80211_registered_device *rdev,
8601                             struct net_device *netdev,
8602                             u32 portid, u32 seq, int flags, u32 cmd)
8603 {
8604         void *hdr;
8605
8606         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8607         if (!hdr)
8608                 return -1;
8609
8610         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8611             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8612                 goto nla_put_failure;
8613
8614         return genlmsg_end(msg, hdr);
8615
8616  nla_put_failure:
8617         genlmsg_cancel(msg, hdr);
8618         return -EMSGSIZE;
8619 }
8620
8621 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8622                              struct wireless_dev *wdev)
8623 {
8624         struct sk_buff *msg;
8625
8626         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8627         if (!msg)
8628                 return;
8629
8630         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8631                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8632                 nlmsg_free(msg);
8633                 return;
8634         }
8635
8636         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8637                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8638 }
8639
8640 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8641                             struct wireless_dev *wdev)
8642 {
8643         struct sk_buff *msg;
8644
8645         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8646         if (!msg)
8647                 return;
8648
8649         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8650                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8651                 nlmsg_free(msg);
8652                 return;
8653         }
8654
8655         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8656                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8657 }
8658
8659 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8660                                struct wireless_dev *wdev)
8661 {
8662         struct sk_buff *msg;
8663
8664         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8665         if (!msg)
8666                 return;
8667
8668         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8669                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8670                 nlmsg_free(msg);
8671                 return;
8672         }
8673
8674         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8675                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8676 }
8677
8678 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8679                                      struct net_device *netdev)
8680 {
8681         struct sk_buff *msg;
8682
8683         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8684         if (!msg)
8685                 return;
8686
8687         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8688                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
8689                 nlmsg_free(msg);
8690                 return;
8691         }
8692
8693         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8694                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8695 }
8696
8697 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
8698                              struct net_device *netdev, u32 cmd)
8699 {
8700         struct sk_buff *msg;
8701
8702         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8703         if (!msg)
8704                 return;
8705
8706         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
8707                 nlmsg_free(msg);
8708                 return;
8709         }
8710
8711         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8712                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8713 }
8714
8715 /*
8716  * This can happen on global regulatory changes or device specific settings
8717  * based on custom world regulatory domains.
8718  */
8719 void nl80211_send_reg_change_event(struct regulatory_request *request)
8720 {
8721         struct sk_buff *msg;
8722         void *hdr;
8723
8724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8725         if (!msg)
8726                 return;
8727
8728         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
8729         if (!hdr) {
8730                 nlmsg_free(msg);
8731                 return;
8732         }
8733
8734         /* Userspace can always count this one always being set */
8735         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
8736                 goto nla_put_failure;
8737
8738         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
8739                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8740                                NL80211_REGDOM_TYPE_WORLD))
8741                         goto nla_put_failure;
8742         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
8743                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8744                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
8745                         goto nla_put_failure;
8746         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
8747                    request->intersect) {
8748                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8749                                NL80211_REGDOM_TYPE_INTERSECTION))
8750                         goto nla_put_failure;
8751         } else {
8752                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8753                                NL80211_REGDOM_TYPE_COUNTRY) ||
8754                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
8755                                    request->alpha2))
8756                         goto nla_put_failure;
8757         }
8758
8759         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
8760             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
8761                 goto nla_put_failure;
8762
8763         genlmsg_end(msg, hdr);
8764
8765         rcu_read_lock();
8766         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8767                                 GFP_ATOMIC);
8768         rcu_read_unlock();
8769
8770         return;
8771
8772 nla_put_failure:
8773         genlmsg_cancel(msg, hdr);
8774         nlmsg_free(msg);
8775 }
8776
8777 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
8778                                     struct net_device *netdev,
8779                                     const u8 *buf, size_t len,
8780                                     enum nl80211_commands cmd, gfp_t gfp)
8781 {
8782         struct sk_buff *msg;
8783         void *hdr;
8784
8785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8786         if (!msg)
8787                 return;
8788
8789         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8790         if (!hdr) {
8791                 nlmsg_free(msg);
8792                 return;
8793         }
8794
8795         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8796             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8797             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8798                 goto nla_put_failure;
8799
8800         genlmsg_end(msg, hdr);
8801
8802         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8803                                 nl80211_mlme_mcgrp.id, gfp);
8804         return;
8805
8806  nla_put_failure:
8807         genlmsg_cancel(msg, hdr);
8808         nlmsg_free(msg);
8809 }
8810
8811 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8812                           struct net_device *netdev, const u8 *buf,
8813                           size_t len, gfp_t gfp)
8814 {
8815         nl80211_send_mlme_event(rdev, netdev, buf, len,
8816                                 NL80211_CMD_AUTHENTICATE, gfp);
8817 }
8818
8819 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8820                            struct net_device *netdev, const u8 *buf,
8821                            size_t len, gfp_t gfp)
8822 {
8823         nl80211_send_mlme_event(rdev, netdev, buf, len,
8824                                 NL80211_CMD_ASSOCIATE, gfp);
8825 }
8826
8827 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8828                          struct net_device *netdev, const u8 *buf,
8829                          size_t len, gfp_t gfp)
8830 {
8831         nl80211_send_mlme_event(rdev, netdev, buf, len,
8832                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8833 }
8834
8835 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8836                            struct net_device *netdev, const u8 *buf,
8837                            size_t len, gfp_t gfp)
8838 {
8839         nl80211_send_mlme_event(rdev, netdev, buf, len,
8840                                 NL80211_CMD_DISASSOCIATE, gfp);
8841 }
8842
8843 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8844                                 struct net_device *netdev, const u8 *buf,
8845                                 size_t len, gfp_t gfp)
8846 {
8847         nl80211_send_mlme_event(rdev, netdev, buf, len,
8848                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8849 }
8850
8851 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8852                                   struct net_device *netdev, const u8 *buf,
8853                                   size_t len, gfp_t gfp)
8854 {
8855         nl80211_send_mlme_event(rdev, netdev, buf, len,
8856                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8857 }
8858
8859 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8860                                       struct net_device *netdev, int cmd,
8861                                       const u8 *addr, gfp_t gfp)
8862 {
8863         struct sk_buff *msg;
8864         void *hdr;
8865
8866         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8867         if (!msg)
8868                 return;
8869
8870         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8871         if (!hdr) {
8872                 nlmsg_free(msg);
8873                 return;
8874         }
8875
8876         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8877             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8878             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8879             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8880                 goto nla_put_failure;
8881
8882         genlmsg_end(msg, hdr);
8883
8884         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8885                                 nl80211_mlme_mcgrp.id, gfp);
8886         return;
8887
8888  nla_put_failure:
8889         genlmsg_cancel(msg, hdr);
8890         nlmsg_free(msg);
8891 }
8892
8893 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8894                                struct net_device *netdev, const u8 *addr,
8895                                gfp_t gfp)
8896 {
8897         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8898                                   addr, gfp);
8899 }
8900
8901 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8902                                 struct net_device *netdev, const u8 *addr,
8903                                 gfp_t gfp)
8904 {
8905         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8906                                   addr, gfp);
8907 }
8908
8909 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8910                                  struct net_device *netdev, const u8 *bssid,
8911                                  const u8 *req_ie, size_t req_ie_len,
8912                                  const u8 *resp_ie, size_t resp_ie_len,
8913                                  u16 status, gfp_t gfp)
8914 {
8915         struct sk_buff *msg;
8916         void *hdr;
8917
8918         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8919         if (!msg)
8920                 return;
8921
8922         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8923         if (!hdr) {
8924                 nlmsg_free(msg);
8925                 return;
8926         }
8927
8928         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8929             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8930             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8931             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8932             (req_ie &&
8933              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8934             (resp_ie &&
8935              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8936                 goto nla_put_failure;
8937
8938         genlmsg_end(msg, hdr);
8939
8940         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8941                                 nl80211_mlme_mcgrp.id, gfp);
8942         return;
8943
8944  nla_put_failure:
8945         genlmsg_cancel(msg, hdr);
8946         nlmsg_free(msg);
8947
8948 }
8949
8950 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8951                          struct net_device *netdev, const u8 *bssid,
8952                          const u8 *req_ie, size_t req_ie_len,
8953                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8954 {
8955         struct sk_buff *msg;
8956         void *hdr;
8957
8958         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8959         if (!msg)
8960                 return;
8961
8962         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8963         if (!hdr) {
8964                 nlmsg_free(msg);
8965                 return;
8966         }
8967
8968         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8969             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8970             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8971             (req_ie &&
8972              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8973             (resp_ie &&
8974              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8975                 goto nla_put_failure;
8976
8977         genlmsg_end(msg, hdr);
8978
8979         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8980                                 nl80211_mlme_mcgrp.id, gfp);
8981         return;
8982
8983  nla_put_failure:
8984         genlmsg_cancel(msg, hdr);
8985         nlmsg_free(msg);
8986
8987 }
8988
8989 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8990                                struct net_device *netdev, u16 reason,
8991                                const u8 *ie, size_t ie_len, bool from_ap)
8992 {
8993         struct sk_buff *msg;
8994         void *hdr;
8995
8996         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8997         if (!msg)
8998                 return;
8999
9000         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9001         if (!hdr) {
9002                 nlmsg_free(msg);
9003                 return;
9004         }
9005
9006         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9007             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9008             (from_ap && reason &&
9009              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9010             (from_ap &&
9011              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9012             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9013                 goto nla_put_failure;
9014
9015         genlmsg_end(msg, hdr);
9016
9017         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9018                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9019         return;
9020
9021  nla_put_failure:
9022         genlmsg_cancel(msg, hdr);
9023         nlmsg_free(msg);
9024
9025 }
9026
9027 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9028                              struct net_device *netdev, const u8 *bssid,
9029                              gfp_t gfp)
9030 {
9031         struct sk_buff *msg;
9032         void *hdr;
9033
9034         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9035         if (!msg)
9036                 return;
9037
9038         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9039         if (!hdr) {
9040                 nlmsg_free(msg);
9041                 return;
9042         }
9043
9044         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9045             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9046             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9047                 goto nla_put_failure;
9048
9049         genlmsg_end(msg, hdr);
9050
9051         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9052                                 nl80211_mlme_mcgrp.id, gfp);
9053         return;
9054
9055  nla_put_failure:
9056         genlmsg_cancel(msg, hdr);
9057         nlmsg_free(msg);
9058 }
9059
9060 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
9061                 struct net_device *netdev,
9062                 const u8 *macaddr, const u8* ie, u8 ie_len,
9063                 gfp_t gfp)
9064 {
9065         struct sk_buff *msg;
9066         void *hdr;
9067
9068         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9069         if (!msg)
9070                 return;
9071
9072         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9073         if (!hdr) {
9074                 nlmsg_free(msg);
9075                 return;
9076         }
9077
9078         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9079             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9080             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
9081             (ie_len && ie &&
9082              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9083                 goto nla_put_failure;
9084
9085         genlmsg_end(msg, hdr);
9086
9087         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9088                                 nl80211_mlme_mcgrp.id, gfp);
9089         return;
9090
9091  nla_put_failure:
9092         genlmsg_cancel(msg, hdr);
9093         nlmsg_free(msg);
9094 }
9095
9096 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9097                                  struct net_device *netdev, const u8 *addr,
9098                                  enum nl80211_key_type key_type, int key_id,
9099                                  const u8 *tsc, gfp_t gfp)
9100 {
9101         struct sk_buff *msg;
9102         void *hdr;
9103
9104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9105         if (!msg)
9106                 return;
9107
9108         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9109         if (!hdr) {
9110                 nlmsg_free(msg);
9111                 return;
9112         }
9113
9114         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9115             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9116             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9117             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9118             (key_id != -1 &&
9119              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9120             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9121                 goto nla_put_failure;
9122
9123         genlmsg_end(msg, hdr);
9124
9125         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9126                                 nl80211_mlme_mcgrp.id, gfp);
9127         return;
9128
9129  nla_put_failure:
9130         genlmsg_cancel(msg, hdr);
9131         nlmsg_free(msg);
9132 }
9133
9134 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9135                                     struct ieee80211_channel *channel_before,
9136                                     struct ieee80211_channel *channel_after)
9137 {
9138         struct sk_buff *msg;
9139         void *hdr;
9140         struct nlattr *nl_freq;
9141
9142         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9143         if (!msg)
9144                 return;
9145
9146         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9147         if (!hdr) {
9148                 nlmsg_free(msg);
9149                 return;
9150         }
9151
9152         /*
9153          * Since we are applying the beacon hint to a wiphy we know its
9154          * wiphy_idx is valid
9155          */
9156         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9157                 goto nla_put_failure;
9158
9159         /* Before */
9160         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9161         if (!nl_freq)
9162                 goto nla_put_failure;
9163         if (nl80211_msg_put_channel(msg, channel_before))
9164                 goto nla_put_failure;
9165         nla_nest_end(msg, nl_freq);
9166
9167         /* After */
9168         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9169         if (!nl_freq)
9170                 goto nla_put_failure;
9171         if (nl80211_msg_put_channel(msg, channel_after))
9172                 goto nla_put_failure;
9173         nla_nest_end(msg, nl_freq);
9174
9175         genlmsg_end(msg, hdr);
9176
9177         rcu_read_lock();
9178         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9179                                 GFP_ATOMIC);
9180         rcu_read_unlock();
9181
9182         return;
9183
9184 nla_put_failure:
9185         genlmsg_cancel(msg, hdr);
9186         nlmsg_free(msg);
9187 }
9188
9189 static void nl80211_send_remain_on_chan_event(
9190         int cmd, struct cfg80211_registered_device *rdev,
9191         struct wireless_dev *wdev, u64 cookie,
9192         struct ieee80211_channel *chan,
9193         unsigned int duration, gfp_t gfp)
9194 {
9195         struct sk_buff *msg;
9196         void *hdr;
9197
9198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9199         if (!msg)
9200                 return;
9201
9202         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9203         if (!hdr) {
9204                 nlmsg_free(msg);
9205                 return;
9206         }
9207
9208         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9209             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9210                                          wdev->netdev->ifindex)) ||
9211             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9212             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9213             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9214                         NL80211_CHAN_NO_HT) ||
9215             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9216                 goto nla_put_failure;
9217
9218         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9219             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9220                 goto nla_put_failure;
9221
9222         genlmsg_end(msg, hdr);
9223
9224         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9225                                 nl80211_mlme_mcgrp.id, gfp);
9226         return;
9227
9228  nla_put_failure:
9229         genlmsg_cancel(msg, hdr);
9230         nlmsg_free(msg);
9231 }
9232
9233 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
9234                                     struct wireless_dev *wdev, u64 cookie,
9235                                     struct ieee80211_channel *chan,
9236                                     unsigned int duration, gfp_t gfp)
9237 {
9238         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9239                                           rdev, wdev, cookie, chan,
9240                                           duration, gfp);
9241 }
9242
9243 void nl80211_send_remain_on_channel_cancel(
9244         struct cfg80211_registered_device *rdev,
9245         struct wireless_dev *wdev,
9246         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
9247 {
9248         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9249                                           rdev, wdev, cookie, chan, 0, gfp);
9250 }
9251
9252 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
9253                             struct net_device *dev, const u8 *mac_addr,
9254                             struct station_info *sinfo, gfp_t gfp)
9255 {
9256         struct sk_buff *msg;
9257
9258         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9259         if (!msg)
9260                 return;
9261
9262         if (nl80211_send_station(msg, 0, 0, 0,
9263                                  rdev, dev, mac_addr, sinfo) < 0) {
9264                 nlmsg_free(msg);
9265                 return;
9266         }
9267
9268         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9269                                 nl80211_mlme_mcgrp.id, gfp);
9270 }
9271
9272 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
9273                                 struct net_device *dev, const u8 *mac_addr,
9274                                 gfp_t gfp)
9275 {
9276         struct sk_buff *msg;
9277         void *hdr;
9278
9279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9280         if (!msg)
9281                 return;
9282
9283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9284         if (!hdr) {
9285                 nlmsg_free(msg);
9286                 return;
9287         }
9288
9289         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9290             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9291                 goto nla_put_failure;
9292
9293         genlmsg_end(msg, hdr);
9294
9295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9296                                 nl80211_mlme_mcgrp.id, gfp);
9297         return;
9298
9299  nla_put_failure:
9300         genlmsg_cancel(msg, hdr);
9301         nlmsg_free(msg);
9302 }
9303
9304 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
9305                                     struct net_device *dev, const u8 *mac_addr,
9306                                     enum nl80211_connect_failed_reason reason,
9307                                     gfp_t gfp)
9308 {
9309         struct sk_buff *msg;
9310         void *hdr;
9311
9312         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9313         if (!msg)
9314                 return;
9315
9316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9317         if (!hdr) {
9318                 nlmsg_free(msg);
9319                 return;
9320         }
9321
9322         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9323             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9324             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9325                 goto nla_put_failure;
9326
9327         genlmsg_end(msg, hdr);
9328
9329         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9330                                 nl80211_mlme_mcgrp.id, gfp);
9331         return;
9332
9333  nla_put_failure:
9334         genlmsg_cancel(msg, hdr);
9335         nlmsg_free(msg);
9336 }
9337
9338 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9339                                        const u8 *addr, gfp_t gfp)
9340 {
9341         struct wireless_dev *wdev = dev->ieee80211_ptr;
9342         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9343         struct sk_buff *msg;
9344         void *hdr;
9345         int err;
9346         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9347
9348         if (!nlportid)
9349                 return false;
9350
9351         msg = nlmsg_new(100, gfp);
9352         if (!msg)
9353                 return true;
9354
9355         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9356         if (!hdr) {
9357                 nlmsg_free(msg);
9358                 return true;
9359         }
9360
9361         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9362             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9363             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9364                 goto nla_put_failure;
9365
9366         err = genlmsg_end(msg, hdr);
9367         if (err < 0) {
9368                 nlmsg_free(msg);
9369                 return true;
9370         }
9371
9372         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9373         return true;
9374
9375  nla_put_failure:
9376         genlmsg_cancel(msg, hdr);
9377         nlmsg_free(msg);
9378         return true;
9379 }
9380
9381 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
9382 {
9383         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9384                                           addr, gfp);
9385 }
9386
9387 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
9388                                     const u8 *addr, gfp_t gfp)
9389 {
9390         return __nl80211_unexpected_frame(dev,
9391                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9392                                           addr, gfp);
9393 }
9394
9395 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9396                       struct wireless_dev *wdev, u32 nlportid,
9397                       int freq, int sig_dbm,
9398                       const u8 *buf, size_t len, gfp_t gfp)
9399 {
9400         struct net_device *netdev = wdev->netdev;
9401         struct sk_buff *msg;
9402         void *hdr;
9403
9404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9405         if (!msg)
9406                 return -ENOMEM;
9407
9408         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9409         if (!hdr) {
9410                 nlmsg_free(msg);
9411                 return -ENOMEM;
9412         }
9413
9414         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9415             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9416                                         netdev->ifindex)) ||
9417             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9418             (sig_dbm &&
9419              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9420             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9421                 goto nla_put_failure;
9422
9423         genlmsg_end(msg, hdr);
9424
9425         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9426
9427  nla_put_failure:
9428         genlmsg_cancel(msg, hdr);
9429         nlmsg_free(msg);
9430         return -ENOBUFS;
9431 }
9432
9433 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
9434                                  struct wireless_dev *wdev, u64 cookie,
9435                                  const u8 *buf, size_t len, bool ack,
9436                                  gfp_t gfp)
9437 {
9438         struct net_device *netdev = wdev->netdev;
9439         struct sk_buff *msg;
9440         void *hdr;
9441
9442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9443         if (!msg)
9444                 return;
9445
9446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9447         if (!hdr) {
9448                 nlmsg_free(msg);
9449                 return;
9450         }
9451
9452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9453             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9454                                    netdev->ifindex)) ||
9455             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9456             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9457             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9458                 goto nla_put_failure;
9459
9460         genlmsg_end(msg, hdr);
9461
9462         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9463         return;
9464
9465  nla_put_failure:
9466         genlmsg_cancel(msg, hdr);
9467         nlmsg_free(msg);
9468 }
9469
9470 void
9471 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
9472                              struct net_device *netdev,
9473                              enum nl80211_cqm_rssi_threshold_event rssi_event,
9474                              gfp_t gfp)
9475 {
9476         struct sk_buff *msg;
9477         struct nlattr *pinfoattr;
9478         void *hdr;
9479
9480         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9481         if (!msg)
9482                 return;
9483
9484         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9485         if (!hdr) {
9486                 nlmsg_free(msg);
9487                 return;
9488         }
9489
9490         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9491             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9492                 goto nla_put_failure;
9493
9494         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9495         if (!pinfoattr)
9496                 goto nla_put_failure;
9497
9498         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9499                         rssi_event))
9500                 goto nla_put_failure;
9501
9502         nla_nest_end(msg, pinfoattr);
9503
9504         genlmsg_end(msg, hdr);
9505
9506         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9507                                 nl80211_mlme_mcgrp.id, gfp);
9508         return;
9509
9510  nla_put_failure:
9511         genlmsg_cancel(msg, hdr);
9512         nlmsg_free(msg);
9513 }
9514
9515 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9516                               struct net_device *netdev, const u8 *bssid,
9517                               const u8 *replay_ctr, gfp_t gfp)
9518 {
9519         struct sk_buff *msg;
9520         struct nlattr *rekey_attr;
9521         void *hdr;
9522
9523         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9524         if (!msg)
9525                 return;
9526
9527         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9528         if (!hdr) {
9529                 nlmsg_free(msg);
9530                 return;
9531         }
9532
9533         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9534             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9535             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9536                 goto nla_put_failure;
9537
9538         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9539         if (!rekey_attr)
9540                 goto nla_put_failure;
9541
9542         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9543                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9544                 goto nla_put_failure;
9545
9546         nla_nest_end(msg, rekey_attr);
9547
9548         genlmsg_end(msg, hdr);
9549
9550         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9551                                 nl80211_mlme_mcgrp.id, gfp);
9552         return;
9553
9554  nla_put_failure:
9555         genlmsg_cancel(msg, hdr);
9556         nlmsg_free(msg);
9557 }
9558
9559 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9560                                     struct net_device *netdev, int index,
9561                                     const u8 *bssid, bool preauth, gfp_t gfp)
9562 {
9563         struct sk_buff *msg;
9564         struct nlattr *attr;
9565         void *hdr;
9566
9567         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9568         if (!msg)
9569                 return;
9570
9571         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9572         if (!hdr) {
9573                 nlmsg_free(msg);
9574                 return;
9575         }
9576
9577         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9578             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9579                 goto nla_put_failure;
9580
9581         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9582         if (!attr)
9583                 goto nla_put_failure;
9584
9585         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9586             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9587             (preauth &&
9588              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9589                 goto nla_put_failure;
9590
9591         nla_nest_end(msg, attr);
9592
9593         genlmsg_end(msg, hdr);
9594
9595         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9596                                 nl80211_mlme_mcgrp.id, gfp);
9597         return;
9598
9599  nla_put_failure:
9600         genlmsg_cancel(msg, hdr);
9601         nlmsg_free(msg);
9602 }
9603
9604 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
9605                               struct net_device *netdev,
9606                               struct cfg80211_chan_def *chandef, gfp_t gfp)
9607 {
9608         struct sk_buff *msg;
9609         void *hdr;
9610
9611         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9612         if (!msg)
9613                 return;
9614
9615         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
9616         if (!hdr) {
9617                 nlmsg_free(msg);
9618                 return;
9619         }
9620
9621         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9622                 goto nla_put_failure;
9623
9624         if (nl80211_send_chandef(msg, chandef))
9625                 goto nla_put_failure;
9626
9627         genlmsg_end(msg, hdr);
9628
9629         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9630                                 nl80211_mlme_mcgrp.id, gfp);
9631         return;
9632
9633  nla_put_failure:
9634         genlmsg_cancel(msg, hdr);
9635         nlmsg_free(msg);
9636 }
9637
9638 void
9639 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
9640                             struct net_device *netdev, const u8 *peer,
9641                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
9642 {
9643         struct sk_buff *msg;
9644         struct nlattr *pinfoattr;
9645         void *hdr;
9646
9647         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9648         if (!msg)
9649                 return;
9650
9651         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9652         if (!hdr) {
9653                 nlmsg_free(msg);
9654                 return;
9655         }
9656
9657         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9658             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9659             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9660                 goto nla_put_failure;
9661
9662         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9663         if (!pinfoattr)
9664                 goto nla_put_failure;
9665
9666         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
9667                 goto nla_put_failure;
9668
9669         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
9670                 goto nla_put_failure;
9671
9672         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
9673                 goto nla_put_failure;
9674
9675         nla_nest_end(msg, pinfoattr);
9676
9677         genlmsg_end(msg, hdr);
9678
9679         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9680                                 nl80211_mlme_mcgrp.id, gfp);
9681         return;
9682
9683  nla_put_failure:
9684         genlmsg_cancel(msg, hdr);
9685         nlmsg_free(msg);
9686 }
9687
9688 void
9689 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
9690                      struct cfg80211_chan_def *chandef,
9691                      enum nl80211_radar_event event,
9692                      struct net_device *netdev, gfp_t gfp)
9693 {
9694         struct sk_buff *msg;
9695         void *hdr;
9696
9697         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9698         if (!msg)
9699                 return;
9700
9701         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
9702         if (!hdr) {
9703                 nlmsg_free(msg);
9704                 return;
9705         }
9706
9707         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9708                 goto nla_put_failure;
9709
9710         /* NOP and radar events don't need a netdev parameter */
9711         if (netdev) {
9712                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
9713
9714                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9715                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9716                         goto nla_put_failure;
9717         }
9718
9719         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
9720                 goto nla_put_failure;
9721
9722         if (nl80211_send_chandef(msg, chandef))
9723                 goto nla_put_failure;
9724
9725         if (genlmsg_end(msg, hdr) < 0) {
9726                 nlmsg_free(msg);
9727                 return;
9728         }
9729
9730         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9731                                 nl80211_mlme_mcgrp.id, gfp);
9732         return;
9733
9734  nla_put_failure:
9735         genlmsg_cancel(msg, hdr);
9736         nlmsg_free(msg);
9737 }
9738
9739 void
9740 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
9741                                 struct net_device *netdev, const u8 *peer,
9742                                 u32 num_packets, gfp_t gfp)
9743 {
9744         struct sk_buff *msg;
9745         struct nlattr *pinfoattr;
9746         void *hdr;
9747
9748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9749         if (!msg)
9750                 return;
9751
9752         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9753         if (!hdr) {
9754                 nlmsg_free(msg);
9755                 return;
9756         }
9757
9758         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9759             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9760             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9761                 goto nla_put_failure;
9762
9763         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9764         if (!pinfoattr)
9765                 goto nla_put_failure;
9766
9767         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
9768                 goto nla_put_failure;
9769
9770         nla_nest_end(msg, pinfoattr);
9771
9772         genlmsg_end(msg, hdr);
9773
9774         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9775                                 nl80211_mlme_mcgrp.id, gfp);
9776         return;
9777
9778  nla_put_failure:
9779         genlmsg_cancel(msg, hdr);
9780         nlmsg_free(msg);
9781 }
9782
9783 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
9784                            u64 cookie, bool acked, gfp_t gfp)
9785 {
9786         struct wireless_dev *wdev = dev->ieee80211_ptr;
9787         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9788         struct sk_buff *msg;
9789         void *hdr;
9790         int err;
9791
9792         trace_cfg80211_probe_status(dev, addr, cookie, acked);
9793
9794         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9795
9796         if (!msg)
9797                 return;
9798
9799         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
9800         if (!hdr) {
9801                 nlmsg_free(msg);
9802                 return;
9803         }
9804
9805         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9806             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9807             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9808             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9809             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
9810                 goto nla_put_failure;
9811
9812         err = genlmsg_end(msg, hdr);
9813         if (err < 0) {
9814                 nlmsg_free(msg);
9815                 return;
9816         }
9817
9818         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9819                                 nl80211_mlme_mcgrp.id, gfp);
9820         return;
9821
9822  nla_put_failure:
9823         genlmsg_cancel(msg, hdr);
9824         nlmsg_free(msg);
9825 }
9826 EXPORT_SYMBOL(cfg80211_probe_status);
9827
9828 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
9829                                  const u8 *frame, size_t len,
9830                                  int freq, int sig_dbm)
9831 {
9832         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9833         struct sk_buff *msg;
9834         void *hdr;
9835         struct cfg80211_beacon_registration *reg;
9836
9837         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
9838
9839         spin_lock_bh(&rdev->beacon_registrations_lock);
9840         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9841                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
9842                 if (!msg) {
9843                         spin_unlock_bh(&rdev->beacon_registrations_lock);
9844                         return;
9845                 }
9846
9847                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9848                 if (!hdr)
9849                         goto nla_put_failure;
9850
9851                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9852                     (freq &&
9853                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9854                     (sig_dbm &&
9855                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9856                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9857                         goto nla_put_failure;
9858
9859                 genlmsg_end(msg, hdr);
9860
9861                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9862         }
9863         spin_unlock_bh(&rdev->beacon_registrations_lock);
9864         return;
9865
9866  nla_put_failure:
9867         spin_unlock_bh(&rdev->beacon_registrations_lock);
9868         if (hdr)
9869                 genlmsg_cancel(msg, hdr);
9870         nlmsg_free(msg);
9871 }
9872 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9873
9874 #ifdef CONFIG_PM
9875 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
9876                                    struct cfg80211_wowlan_wakeup *wakeup,
9877                                    gfp_t gfp)
9878 {
9879         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9880         struct sk_buff *msg;
9881         void *hdr;
9882         int err, size = 200;
9883
9884         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
9885
9886         if (wakeup)
9887                 size += wakeup->packet_present_len;
9888
9889         msg = nlmsg_new(size, gfp);
9890         if (!msg)
9891                 return;
9892
9893         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
9894         if (!hdr)
9895                 goto free_msg;
9896
9897         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9898             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9899                 goto free_msg;
9900
9901         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9902                                         wdev->netdev->ifindex))
9903                 goto free_msg;
9904
9905         if (wakeup) {
9906                 struct nlattr *reasons;
9907
9908                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9909
9910                 if (wakeup->disconnect &&
9911                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
9912                         goto free_msg;
9913                 if (wakeup->magic_pkt &&
9914                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
9915                         goto free_msg;
9916                 if (wakeup->gtk_rekey_failure &&
9917                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
9918                         goto free_msg;
9919                 if (wakeup->eap_identity_req &&
9920                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
9921                         goto free_msg;
9922                 if (wakeup->four_way_handshake &&
9923                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
9924                         goto free_msg;
9925                 if (wakeup->rfkill_release &&
9926                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
9927                         goto free_msg;
9928
9929                 if (wakeup->pattern_idx >= 0 &&
9930                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
9931                                 wakeup->pattern_idx))
9932                         goto free_msg;
9933
9934                 if (wakeup->tcp_match)
9935                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
9936
9937                 if (wakeup->tcp_connlost)
9938                         nla_put_flag(msg,
9939                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
9940
9941                 if (wakeup->tcp_nomoretokens)
9942                         nla_put_flag(msg,
9943                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
9944
9945                 if (wakeup->packet) {
9946                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
9947                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
9948
9949                         if (!wakeup->packet_80211) {
9950                                 pkt_attr =
9951                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
9952                                 len_attr =
9953                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
9954                         }
9955
9956                         if (wakeup->packet_len &&
9957                             nla_put_u32(msg, len_attr, wakeup->packet_len))
9958                                 goto free_msg;
9959
9960                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
9961                                     wakeup->packet))
9962                                 goto free_msg;
9963                 }
9964
9965                 nla_nest_end(msg, reasons);
9966         }
9967
9968         err = genlmsg_end(msg, hdr);
9969         if (err < 0)
9970                 goto free_msg;
9971
9972         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9973                                 nl80211_mlme_mcgrp.id, gfp);
9974         return;
9975
9976  free_msg:
9977         nlmsg_free(msg);
9978 }
9979 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
9980 #endif
9981
9982 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9983                                 enum nl80211_tdls_operation oper,
9984                                 u16 reason_code, gfp_t gfp)
9985 {
9986         struct wireless_dev *wdev = dev->ieee80211_ptr;
9987         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9988         struct sk_buff *msg;
9989         void *hdr;
9990         int err;
9991
9992         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9993                                          reason_code);
9994
9995         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9996         if (!msg)
9997                 return;
9998
9999         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10000         if (!hdr) {
10001                 nlmsg_free(msg);
10002                 return;
10003         }
10004
10005         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10006             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10007             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10008             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10009             (reason_code > 0 &&
10010              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10011                 goto nla_put_failure;
10012
10013         err = genlmsg_end(msg, hdr);
10014         if (err < 0) {
10015                 nlmsg_free(msg);
10016                 return;
10017         }
10018
10019         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10020                                 nl80211_mlme_mcgrp.id, gfp);
10021         return;
10022
10023  nla_put_failure:
10024         genlmsg_cancel(msg, hdr);
10025         nlmsg_free(msg);
10026 }
10027 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10028
10029 static int nl80211_netlink_notify(struct notifier_block * nb,
10030                                   unsigned long state,
10031                                   void *_notify)
10032 {
10033         struct netlink_notify *notify = _notify;
10034         struct cfg80211_registered_device *rdev;
10035         struct wireless_dev *wdev;
10036         struct cfg80211_beacon_registration *reg, *tmp;
10037
10038         if (state != NETLINK_URELEASE)
10039                 return NOTIFY_DONE;
10040
10041         rcu_read_lock();
10042
10043         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10044                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10045                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10046
10047                 spin_lock_bh(&rdev->beacon_registrations_lock);
10048                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10049                                          list) {
10050                         if (reg->nlportid == notify->portid) {
10051                                 list_del(&reg->list);
10052                                 kfree(reg);
10053                                 break;
10054                         }
10055                 }
10056                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10057         }
10058
10059         rcu_read_unlock();
10060
10061         return NOTIFY_DONE;
10062 }
10063
10064 static struct notifier_block nl80211_netlink_notifier = {
10065         .notifier_call = nl80211_netlink_notify,
10066 };
10067
10068 /* initialisation/exit functions */
10069
10070 int nl80211_init(void)
10071 {
10072         int err;
10073
10074         err = genl_register_family_with_ops(&nl80211_fam,
10075                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10076         if (err)
10077                 return err;
10078
10079         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10080         if (err)
10081                 goto err_out;
10082
10083         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10084         if (err)
10085                 goto err_out;
10086
10087         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10088         if (err)
10089                 goto err_out;
10090
10091         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10092         if (err)
10093                 goto err_out;
10094
10095 #ifdef CONFIG_NL80211_TESTMODE
10096         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10097         if (err)
10098                 goto err_out;
10099 #endif
10100
10101         err = netlink_register_notifier(&nl80211_netlink_notifier);
10102         if (err)
10103                 goto err_out;
10104
10105         return 0;
10106  err_out:
10107         genl_unregister_family(&nl80211_fam);
10108         return err;
10109 }
10110
10111 void nl80211_exit(void)
10112 {
10113         netlink_unregister_notifier(&nl80211_netlink_notifier);
10114         genl_unregister_family(&nl80211_fam);
10115 }