net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2016  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170                 netdev = __dev_get_by_index(netns, ifindex);
 171                 if (netdev) {
 172                         if (netdev->ieee80211_ptr)
 173                                 tmp = wiphy_to_rdev(
 174                                         netdev->ieee80211_ptr->wiphy);
 175                         else
 176                                 tmp = NULL;
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 231
 232         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 235
 236         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 237         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 238
 239         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 240         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 241                                     .len = WLAN_MAX_KEY_LEN },
 242         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 243         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 244         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 245         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 246         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 249         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 250         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 251                                        .len = IEEE80211_MAX_DATA_LEN },
 252         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 255         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 256         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 258                                                .len = NL80211_MAX_SUPP_RATES },
 259         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 260         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 261         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 262         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 263                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 264         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 265
 266         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 267         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 268
 269         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 273                                            .len = NL80211_MAX_SUPP_RATES },
 274         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 275
 276         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 277         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 278
 279         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 280
 281         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 282         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 283                               .len = IEEE80211_MAX_DATA_LEN },
 284         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 286
 287         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 288                                 .len = IEEE80211_MAX_SSID_LEN },
 289         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 290         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 291         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_STA_FLAGS2] = {
 295                 .len = sizeof(struct nl80211_sta_flag_update),
 296         },
 297         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 303         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 304         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 305         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 306                                  .len = WLAN_PMKID_LEN },
 307         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 308         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 309         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 310         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 311                                  .len = IEEE80211_MAX_DATA_LEN },
 312         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 313         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 315         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 323         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 327         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 328         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 331         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 332                                          .len = IEEE80211_MAX_DATA_LEN },
 333         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 361         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 362         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 363         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 365         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 366         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 367         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 369                 .len = NL80211_VHT_CAPABILITY_LEN,
 370         },
 371         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 372         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 373                                   .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 376         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 378         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 384         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 387         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 388                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 389         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 390         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 391         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 394         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 396         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 397         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 398         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 401         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 402         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 403         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 404         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 405         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 407 };
 408
 409 /* policy for the key attributes */
 410 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 411         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 412         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 413         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 414         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 415         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 416         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 417         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 418         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 419 };
 420
 421 /* policy for the key default flags */
 422 static const struct nla_policy
 423 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 424         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 425         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 426 };
 427
 428 /* policy for WoWLAN attributes */
 429 static const struct nla_policy
 430 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 431         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 432         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 435         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 436         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 437         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 438         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 439         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 440         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 441 };
 442
 443 static const struct nla_policy
 444 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 445         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 446         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 447         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 448         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 449         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 450         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 451         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 452                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 453         },
 454         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 455                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 456         },
 457         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 458         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 459         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 460 };
 461
 462 /* policy for coalesce rule attributes */
 463 static const struct nla_policy
 464 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 465         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 466         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 467         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 468 };
 469
 470 /* policy for GTK rekey offload attributes */
 471 static const struct nla_policy
 472 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 473         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 474         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 475         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 476 };
 477
 478 static const struct nla_policy
 479 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 480         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 481                                                  .len = IEEE80211_MAX_SSID_LEN },
 482         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 483 };
 484
 485 static const struct nla_policy
 486 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 487         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 488         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 489 };
 490
 491 static const struct nla_policy
 492 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 493         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 494         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 495         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 496                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 497         },
 498 };
 499
 500 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 501                                      struct netlink_callback *cb,
 502                                      struct cfg80211_registered_device **rdev,
 503                                      struct wireless_dev **wdev)
 504 {
 505         int err;
 506
 507         rtnl_lock();
 508
 509         if (!cb->args[0]) {
 510                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 511                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 512                                   nl80211_policy);
 513                 if (err)
 514                         goto out_unlock;
 515
 516                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 517                                                    nl80211_fam.attrbuf);
 518                 if (IS_ERR(*wdev)) {
 519                         err = PTR_ERR(*wdev);
 520                         goto out_unlock;
 521                 }
 522                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 523                 /* 0 is the first index - add 1 to parse only once */
 524                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 525                 cb->args[1] = (*wdev)->identifier;
 526         } else {
 527                 /* subtract the 1 again here */
 528                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 529                 struct wireless_dev *tmp;
 530
 531                 if (!wiphy) {
 532                         err = -ENODEV;
 533                         goto out_unlock;
 534                 }
 535                 *rdev = wiphy_to_rdev(wiphy);
 536                 *wdev = NULL;
 537
 538                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 539                         if (tmp->identifier == cb->args[1]) {
 540                                 *wdev = tmp;
 541                                 break;
 542                         }
 543                 }
 544
 545                 if (!*wdev) {
 546                         err = -ENODEV;
 547                         goto out_unlock;
 548                 }
 549         }
 550
 551         return 0;
 552  out_unlock:
 553         rtnl_unlock();
 554         return err;
 555 }
 556
 557 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 558 {
 559         rtnl_unlock();
 560 }
 561
 562 /* IE validation */
 563 static bool is_valid_ie_attr(const struct nlattr *attr)
 564 {
 565         const u8 *pos;
 566         int len;
 567
 568         if (!attr)
 569                 return true;
 570
 571         pos = nla_data(attr);
 572         len = nla_len(attr);
 573
 574         while (len) {
 575                 u8 elemlen;
 576
 577                 if (len < 2)
 578                         return false;
 579                 len -= 2;
 580
 581                 elemlen = pos[1];
 582                 if (elemlen > len)
 583                         return false;
 584
 585                 len -= elemlen;
 586                 pos += 2 + elemlen;
 587         }
 588
 589         return true;
 590 }
 591
 592 /* message building helper */
 593 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 594                                    int flags, u8 cmd)
 595 {
 596         /* since there is no private header just add the generic one */
 597         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 598 }
 599
 600 static int nl80211_msg_put_channel(struct sk_buff *msg,
 601                                    struct ieee80211_channel *chan,
 602                                    bool large)
 603 {
 604         /* Some channels must be completely excluded from the
 605          * list to protect old user-space tools from breaking
 606          */
 607         if (!large && chan->flags &
 608             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 609                 return 0;
 610
 611         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 612                         chan->center_freq))
 613                 goto nla_put_failure;
 614
 615         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 616             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 617                 goto nla_put_failure;
 618         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 619                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 620                         goto nla_put_failure;
 621                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 622                         goto nla_put_failure;
 623         }
 624         if (chan->flags & IEEE80211_CHAN_RADAR) {
 625                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 626                         goto nla_put_failure;
 627                 if (large) {
 628                         u32 time;
 629
 630                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 631
 632                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 633                                         chan->dfs_state))
 634                                 goto nla_put_failure;
 635                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 636                                         time))
 637                                 goto nla_put_failure;
 638                         if (nla_put_u32(msg,
 639                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 640                                         chan->dfs_cac_ms))
 641                                 goto nla_put_failure;
 642                 }
 643         }
 644
 645         if (large) {
 646                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 651                         goto nla_put_failure;
 652                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 653                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 654                         goto nla_put_failure;
 655                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 656                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 657                         goto nla_put_failure;
 658                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 659                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 660                         goto nla_put_failure;
 661                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 662                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 663                         goto nla_put_failure;
 664                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 665                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 666                         goto nla_put_failure;
 667                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 668                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 669                         goto nla_put_failure;
 670         }
 671
 672         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 673                         DBM_TO_MBM(chan->max_power)))
 674                 goto nla_put_failure;
 675
 676         return 0;
 677
 678  nla_put_failure:
 679         return -ENOBUFS;
 680 }
 681
 682 /* netlink command implementations */
 683
 684 struct key_parse {
 685         struct key_params p;
 686         int idx;
 687         int type;
 688         bool def, defmgmt;
 689         bool def_uni, def_multi;
 690 };
 691
 692 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 693 {
 694         struct nlattr *tb[NL80211_KEY_MAX + 1];
 695         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 696                                    nl80211_key_policy);
 697         if (err)
 698                 return err;
 699
 700         k->def = !!tb[NL80211_KEY_DEFAULT];
 701         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 702
 703         if (k->def) {
 704                 k->def_uni = true;
 705                 k->def_multi = true;
 706         }
 707         if (k->defmgmt)
 708                 k->def_multi = true;
 709
 710         if (tb[NL80211_KEY_IDX])
 711                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 712
 713         if (tb[NL80211_KEY_DATA]) {
 714                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 715                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 716         }
 717
 718         if (tb[NL80211_KEY_SEQ]) {
 719                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 720                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 721         }
 722
 723         if (tb[NL80211_KEY_CIPHER])
 724                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 725
 726         if (tb[NL80211_KEY_TYPE]) {
 727                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 728                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 729                         return -EINVAL;
 730         }
 731
 732         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 733                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 734                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 735                                        tb[NL80211_KEY_DEFAULT_TYPES],
 736                                        nl80211_key_default_policy);
 737                 if (err)
 738                         return err;
 739
 740                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 741                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 742         }
 743
 744         return 0;
 745 }
 746
 747 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 748 {
 749         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 750                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 751                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 752         }
 753
 754         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 755                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 756                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 757         }
 758
 759         if (info->attrs[NL80211_ATTR_KEY_IDX])
 760                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 761
 762         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 763                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 764
 765         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 766         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 767
 768         if (k->def) {
 769                 k->def_uni = true;
 770                 k->def_multi = true;
 771         }
 772         if (k->defmgmt)
 773                 k->def_multi = true;
 774
 775         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 776                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 777                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 778                         return -EINVAL;
 779         }
 780
 781         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 782                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 783                 int err = nla_parse_nested(
 784                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 785                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 786                                 nl80211_key_default_policy);
 787                 if (err)
 788                         return err;
 789
 790                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 791                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 792         }
 793
 794         return 0;
 795 }
 796
 797 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 798 {
 799         int err;
 800
 801         memset(k, 0, sizeof(*k));
 802         k->idx = -1;
 803         k->type = -1;
 804
 805         if (info->attrs[NL80211_ATTR_KEY])
 806                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 807         else
 808                 err = nl80211_parse_key_old(info, k);
 809
 810         if (err)
 811                 return err;
 812
 813         if (k->def && k->defmgmt)
 814                 return -EINVAL;
 815
 816         if (k->defmgmt) {
 817                 if (k->def_uni || !k->def_multi)
 818                         return -EINVAL;
 819         }
 820
 821         if (k->idx != -1) {
 822                 if (k->defmgmt) {
 823                         if (k->idx < 4 || k->idx > 5)
 824                                 return -EINVAL;
 825                 } else if (k->def) {
 826                         if (k->idx < 0 || k->idx > 3)
 827                                 return -EINVAL;
 828                 } else {
 829                         if (k->idx < 0 || k->idx > 5)
 830                                 return -EINVAL;
 831                 }
 832         }
 833
 834         return 0;
 835 }
 836
 837 static struct cfg80211_cached_keys *
 838 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 839                        struct nlattr *keys, bool *no_ht)
 840 {
 841         struct key_parse parse;
 842         struct nlattr *key;
 843         struct cfg80211_cached_keys *result;
 844         int rem, err, def = 0;
 845
 846         result = kzalloc(sizeof(*result), GFP_KERNEL);
 847         if (!result)
 848                 return ERR_PTR(-ENOMEM);
 849
 850         result->def = -1;
 851         result->defmgmt = -1;
 852
 853         nla_for_each_nested(key, keys, rem) {
 854                 memset(&parse, 0, sizeof(parse));
 855                 parse.idx = -1;
 856
 857                 err = nl80211_parse_key_new(key, &parse);
 858                 if (err)
 859                         goto error;
 860                 err = -EINVAL;
 861                 if (!parse.p.key)
 862                         goto error;
 863                 if (parse.idx < 0 || parse.idx > 4)
 864                         goto error;
 865                 if (parse.def) {
 866                         if (def)
 867                                 goto error;
 868                         def = 1;
 869                         result->def = parse.idx;
 870                         if (!parse.def_uni || !parse.def_multi)
 871                                 goto error;
 872                 } else if (parse.defmgmt)
 873                         goto error;
 874                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 875                                                      parse.idx, false, NULL);
 876                 if (err)
 877                         goto error;
 878                 result->params[parse.idx].cipher = parse.p.cipher;
 879                 result->params[parse.idx].key_len = parse.p.key_len;
 880                 result->params[parse.idx].key = result->data[parse.idx];
 881                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 882
 883                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 884                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 885                         if (no_ht)
 886                                 *no_ht = true;
 887                 }
 888         }
 889
 890         return result;
 891  error:
 892         kfree(result);
 893         return ERR_PTR(err);
 894 }
 895
 896 static int nl80211_key_allowed(struct wireless_dev *wdev)
 897 {
 898         ASSERT_WDEV_LOCK(wdev);
 899
 900         switch (wdev->iftype) {
 901         case NL80211_IFTYPE_AP:
 902         case NL80211_IFTYPE_AP_VLAN:
 903         case NL80211_IFTYPE_P2P_GO:
 904         case NL80211_IFTYPE_MESH_POINT:
 905                 break;
 906         case NL80211_IFTYPE_ADHOC:
 907         case NL80211_IFTYPE_STATION:
 908         case NL80211_IFTYPE_P2P_CLIENT:
 909                 if (!wdev->current_bss)
 910                         return -ENOLINK;
 911                 break;
 912         case NL80211_IFTYPE_UNSPECIFIED:
 913         case NL80211_IFTYPE_OCB:
 914         case NL80211_IFTYPE_MONITOR:
 915         case NL80211_IFTYPE_P2P_DEVICE:
 916         case NL80211_IFTYPE_WDS:
 917         case NUM_NL80211_IFTYPES:
 918                 return -EINVAL;
 919         }
 920
 921         return 0;
 922 }
 923
 924 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 925                                                         struct nlattr *tb)
 926 {
 927         struct ieee80211_channel *chan;
 928
 929         if (tb == NULL)
 930                 return NULL;
 931         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 932         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 933                 return NULL;
 934         return chan;
 935 }
 936
 937 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 938 {
 939         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 940         int i;
 941
 942         if (!nl_modes)
 943                 goto nla_put_failure;
 944
 945         i = 0;
 946         while (ifmodes) {
 947                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 948                         goto nla_put_failure;
 949                 ifmodes >>= 1;
 950                 i++;
 951         }
 952
 953         nla_nest_end(msg, nl_modes);
 954         return 0;
 955
 956 nla_put_failure:
 957         return -ENOBUFS;
 958 }
 959
 960 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 961                                           struct sk_buff *msg,
 962                                           bool large)
 963 {
 964         struct nlattr *nl_combis;
 965         int i, j;
 966
 967         nl_combis = nla_nest_start(msg,
 968                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 969         if (!nl_combis)
 970                 goto nla_put_failure;
 971
 972         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 973                 const struct ieee80211_iface_combination *c;
 974                 struct nlattr *nl_combi, *nl_limits;
 975
 976                 c = &wiphy->iface_combinations[i];
 977
 978                 nl_combi = nla_nest_start(msg, i + 1);
 979                 if (!nl_combi)
 980                         goto nla_put_failure;
 981
 982                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 983                 if (!nl_limits)
 984                         goto nla_put_failure;
 985
 986                 for (j = 0; j < c->n_limits; j++) {
 987                         struct nlattr *nl_limit;
 988
 989                         nl_limit = nla_nest_start(msg, j + 1);
 990                         if (!nl_limit)
 991                                 goto nla_put_failure;
 992                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 993                                         c->limits[j].max))
 994                                 goto nla_put_failure;
 995                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 996                                                 c->limits[j].types))
 997                                 goto nla_put_failure;
 998                         nla_nest_end(msg, nl_limit);
 999                 }
1000
1001                 nla_nest_end(msg, nl_limits);
1002
1003                 if (c->beacon_int_infra_match &&
1004                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1005                         goto nla_put_failure;
1006                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1007                                 c->num_different_channels) ||
1008                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1009                                 c->max_interfaces))
1010                         goto nla_put_failure;
1011                 if (large &&
1012                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1013                                 c->radar_detect_widths) ||
1014                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1015                                 c->radar_detect_regions)))
1016                         goto nla_put_failure;
1017
1018                 nla_nest_end(msg, nl_combi);
1019         }
1020
1021         nla_nest_end(msg, nl_combis);
1022
1023         return 0;
1024 nla_put_failure:
1025         return -ENOBUFS;
1026 }
1027
1028 #ifdef CONFIG_PM
1029 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1030                                         struct sk_buff *msg)
1031 {
1032         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1033         struct nlattr *nl_tcp;
1034
1035         if (!tcp)
1036                 return 0;
1037
1038         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1039         if (!nl_tcp)
1040                 return -ENOBUFS;
1041
1042         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1043                         tcp->data_payload_max))
1044                 return -ENOBUFS;
1045
1046         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1047                         tcp->data_payload_max))
1048                 return -ENOBUFS;
1049
1050         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1051                 return -ENOBUFS;
1052
1053         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1054                                 sizeof(*tcp->tok), tcp->tok))
1055                 return -ENOBUFS;
1056
1057         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1058                         tcp->data_interval_max))
1059                 return -ENOBUFS;
1060
1061         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1062                         tcp->wake_payload_max))
1063                 return -ENOBUFS;
1064
1065         nla_nest_end(msg, nl_tcp);
1066         return 0;
1067 }
1068
1069 static int nl80211_send_wowlan(struct sk_buff *msg,
1070                                struct cfg80211_registered_device *rdev,
1071                                bool large)
1072 {
1073         struct nlattr *nl_wowlan;
1074
1075         if (!rdev->wiphy.wowlan)
1076                 return 0;
1077
1078         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1079         if (!nl_wowlan)
1080                 return -ENOBUFS;
1081
1082         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1083              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1084             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1085              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1086             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1087              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1088             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1089              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1090             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1091              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1092             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1093              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1094             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1095              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1096             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1097              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1098                 return -ENOBUFS;
1099
1100         if (rdev->wiphy.wowlan->n_patterns) {
1101                 struct nl80211_pattern_support pat = {
1102                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1103                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1104                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1105                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1106                 };
1107
1108                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1109                             sizeof(pat), &pat))
1110                         return -ENOBUFS;
1111         }
1112
1113         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1114             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1115                         rdev->wiphy.wowlan->max_nd_match_sets))
1116                 return -ENOBUFS;
1117
1118         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1119                 return -ENOBUFS;
1120
1121         nla_nest_end(msg, nl_wowlan);
1122
1123         return 0;
1124 }
1125 #endif
1126
1127 static int nl80211_send_coalesce(struct sk_buff *msg,
1128                                  struct cfg80211_registered_device *rdev)
1129 {
1130         struct nl80211_coalesce_rule_support rule;
1131
1132         if (!rdev->wiphy.coalesce)
1133                 return 0;
1134
1135         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1136         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1137         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1138         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1139         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1140         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1141
1142         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1143                 return -ENOBUFS;
1144
1145         return 0;
1146 }
1147
1148 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1149                                       struct ieee80211_supported_band *sband)
1150 {
1151         struct nlattr *nl_rates, *nl_rate;
1152         struct ieee80211_rate *rate;
1153         int i;
1154
1155         /* add HT info */
1156         if (sband->ht_cap.ht_supported &&
1157             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1158                      sizeof(sband->ht_cap.mcs),
1159                      &sband->ht_cap.mcs) ||
1160              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1161                          sband->ht_cap.cap) ||
1162              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1163                         sband->ht_cap.ampdu_factor) ||
1164              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1165                         sband->ht_cap.ampdu_density)))
1166                 return -ENOBUFS;
1167
1168         /* add VHT info */
1169         if (sband->vht_cap.vht_supported &&
1170             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1171                      sizeof(sband->vht_cap.vht_mcs),
1172                      &sband->vht_cap.vht_mcs) ||
1173              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1174                          sband->vht_cap.cap)))
1175                 return -ENOBUFS;
1176
1177         /* add bitrates */
1178         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1179         if (!nl_rates)
1180                 return -ENOBUFS;
1181
1182         for (i = 0; i < sband->n_bitrates; i++) {
1183                 nl_rate = nla_nest_start(msg, i);
1184                 if (!nl_rate)
1185                         return -ENOBUFS;
1186
1187                 rate = &sband->bitrates[i];
1188                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1189                                 rate->bitrate))
1190                         return -ENOBUFS;
1191                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1192                     nla_put_flag(msg,
1193                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1194                         return -ENOBUFS;
1195
1196                 nla_nest_end(msg, nl_rate);
1197         }
1198
1199         nla_nest_end(msg, nl_rates);
1200
1201         return 0;
1202 }
1203
1204 static int
1205 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1206                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1207 {
1208         u16 stypes;
1209         struct nlattr *nl_ftypes, *nl_ifs;
1210         enum nl80211_iftype ift;
1211         int i;
1212
1213         if (!mgmt_stypes)
1214                 return 0;
1215
1216         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1217         if (!nl_ifs)
1218                 return -ENOBUFS;
1219
1220         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1221                 nl_ftypes = nla_nest_start(msg, ift);
1222                 if (!nl_ftypes)
1223                         return -ENOBUFS;
1224                 i = 0;
1225                 stypes = mgmt_stypes[ift].tx;
1226                 while (stypes) {
1227                         if ((stypes & 1) &&
1228                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1229                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1230                                 return -ENOBUFS;
1231                         stypes >>= 1;
1232                         i++;
1233                 }
1234                 nla_nest_end(msg, nl_ftypes);
1235         }
1236
1237         nla_nest_end(msg, nl_ifs);
1238
1239         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1240         if (!nl_ifs)
1241                 return -ENOBUFS;
1242
1243         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1244                 nl_ftypes = nla_nest_start(msg, ift);
1245                 if (!nl_ftypes)
1246                         return -ENOBUFS;
1247                 i = 0;
1248                 stypes = mgmt_stypes[ift].rx;
1249                 while (stypes) {
1250                         if ((stypes & 1) &&
1251                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1252                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1253                                 return -ENOBUFS;
1254                         stypes >>= 1;
1255                         i++;
1256                 }
1257                 nla_nest_end(msg, nl_ftypes);
1258         }
1259         nla_nest_end(msg, nl_ifs);
1260
1261         return 0;
1262 }
1263
1264 struct nl80211_dump_wiphy_state {
1265         s64 filter_wiphy;
1266         long start;
1267         long split_start, band_start, chan_start;
1268         bool split;
1269 };
1270
1271 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1272                               enum nl80211_commands cmd,
1273                               struct sk_buff *msg, u32 portid, u32 seq,
1274                               int flags, struct nl80211_dump_wiphy_state *state)
1275 {
1276         void *hdr;
1277         struct nlattr *nl_bands, *nl_band;
1278         struct nlattr *nl_freqs, *nl_freq;
1279         struct nlattr *nl_cmds;
1280         enum nl80211_band band;
1281         struct ieee80211_channel *chan;
1282         int i;
1283         const struct ieee80211_txrx_stypes *mgmt_stypes =
1284                                 rdev->wiphy.mgmt_stypes;
1285         u32 features;
1286
1287         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1288         if (!hdr)
1289                 return -ENOBUFS;
1290
1291         if (WARN_ON(!state))
1292                 return -EINVAL;
1293
1294         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1295             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1296                            wiphy_name(&rdev->wiphy)) ||
1297             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1298                         cfg80211_rdev_list_generation))
1299                 goto nla_put_failure;
1300
1301         if (cmd != NL80211_CMD_NEW_WIPHY)
1302                 goto finish;
1303
1304         switch (state->split_start) {
1305         case 0:
1306                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1307                                rdev->wiphy.retry_short) ||
1308                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1309                                rdev->wiphy.retry_long) ||
1310                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1311                                 rdev->wiphy.frag_threshold) ||
1312                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1313                                 rdev->wiphy.rts_threshold) ||
1314                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1315                                rdev->wiphy.coverage_class) ||
1316                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1317                                rdev->wiphy.max_scan_ssids) ||
1318                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1319                                rdev->wiphy.max_sched_scan_ssids) ||
1320                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1321                                 rdev->wiphy.max_scan_ie_len) ||
1322                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1323                                 rdev->wiphy.max_sched_scan_ie_len) ||
1324                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1325                                rdev->wiphy.max_match_sets) ||
1326                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1327                                 rdev->wiphy.max_sched_scan_plans) ||
1328                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1329                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1330                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1331                                 rdev->wiphy.max_sched_scan_plan_iterations))
1332                         goto nla_put_failure;
1333
1334                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1335                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1336                         goto nla_put_failure;
1337                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1338                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1339                         goto nla_put_failure;
1340                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1341                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1342                         goto nla_put_failure;
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1344                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1345                         goto nla_put_failure;
1346                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1347                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1348                         goto nla_put_failure;
1349                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1350                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1351                         goto nla_put_failure;
1352                 state->split_start++;
1353                 if (state->split)
1354                         break;
1355         case 1:
1356                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1357                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1358                             rdev->wiphy.cipher_suites))
1359                         goto nla_put_failure;
1360
1361                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1362                                rdev->wiphy.max_num_pmkids))
1363                         goto nla_put_failure;
1364
1365                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1366                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1367                         goto nla_put_failure;
1368
1369                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1370                                 rdev->wiphy.available_antennas_tx) ||
1371                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1372                                 rdev->wiphy.available_antennas_rx))
1373                         goto nla_put_failure;
1374
1375                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1376                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1377                                 rdev->wiphy.probe_resp_offload))
1378                         goto nla_put_failure;
1379
1380                 if ((rdev->wiphy.available_antennas_tx ||
1381                      rdev->wiphy.available_antennas_rx) &&
1382                     rdev->ops->get_antenna) {
1383                         u32 tx_ant = 0, rx_ant = 0;
1384                         int res;
1385                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1386                         if (!res) {
1387                                 if (nla_put_u32(msg,
1388                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1389                                                 tx_ant) ||
1390                                     nla_put_u32(msg,
1391                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1392                                                 rx_ant))
1393                                         goto nla_put_failure;
1394                         }
1395                 }
1396
1397                 state->split_start++;
1398                 if (state->split)
1399                         break;
1400         case 2:
1401                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1402                                         rdev->wiphy.interface_modes))
1403                                 goto nla_put_failure;
1404                 state->split_start++;
1405                 if (state->split)
1406                         break;
1407         case 3:
1408                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1409                 if (!nl_bands)
1410                         goto nla_put_failure;
1411
1412                 for (band = state->band_start;
1413                      band < NUM_NL80211_BANDS; band++) {
1414                         struct ieee80211_supported_band *sband;
1415
1416                         sband = rdev->wiphy.bands[band];
1417
1418                         if (!sband)
1419                                 continue;
1420
1421                         nl_band = nla_nest_start(msg, band);
1422                         if (!nl_band)
1423                                 goto nla_put_failure;
1424
1425                         switch (state->chan_start) {
1426                         case 0:
1427                                 if (nl80211_send_band_rateinfo(msg, sband))
1428                                         goto nla_put_failure;
1429                                 state->chan_start++;
1430                                 if (state->split)
1431                                         break;
1432                         default:
1433                                 /* add frequencies */
1434                                 nl_freqs = nla_nest_start(
1435                                         msg, NL80211_BAND_ATTR_FREQS);
1436                                 if (!nl_freqs)
1437                                         goto nla_put_failure;
1438
1439                                 for (i = state->chan_start - 1;
1440                                      i < sband->n_channels;
1441                                      i++) {
1442                                         nl_freq = nla_nest_start(msg, i);
1443                                         if (!nl_freq)
1444                                                 goto nla_put_failure;
1445
1446                                         chan = &sband->channels[i];
1447
1448                                         if (nl80211_msg_put_channel(
1449                                                         msg, chan,
1450                                                         state->split))
1451                                                 goto nla_put_failure;
1452
1453                                         nla_nest_end(msg, nl_freq);
1454                                         if (state->split)
1455                                                 break;
1456                                 }
1457                                 if (i < sband->n_channels)
1458                                         state->chan_start = i + 2;
1459                                 else
1460                                         state->chan_start = 0;
1461                                 nla_nest_end(msg, nl_freqs);
1462                         }
1463
1464                         nla_nest_end(msg, nl_band);
1465
1466                         if (state->split) {
1467                                 /* start again here */
1468                                 if (state->chan_start)
1469                                         band--;
1470                                 break;
1471                         }
1472                 }
1473                 nla_nest_end(msg, nl_bands);
1474
1475                 if (band < NUM_NL80211_BANDS)
1476                         state->band_start = band + 1;
1477                 else
1478                         state->band_start = 0;
1479
1480                 /* if bands & channels are done, continue outside */
1481                 if (state->band_start == 0 && state->chan_start == 0)
1482                         state->split_start++;
1483                 if (state->split)
1484                         break;
1485         case 4:
1486                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1487                 if (!nl_cmds)
1488                         goto nla_put_failure;
1489
1490                 i = 0;
1491 #define CMD(op, n)                                                      \
1492                  do {                                                   \
1493                         if (rdev->ops->op) {                            \
1494                                 i++;                                    \
1495                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1496                                         goto nla_put_failure;           \
1497                         }                                               \
1498                 } while (0)
1499
1500                 CMD(add_virtual_intf, NEW_INTERFACE);
1501                 CMD(change_virtual_intf, SET_INTERFACE);
1502                 CMD(add_key, NEW_KEY);
1503                 CMD(start_ap, START_AP);
1504                 CMD(add_station, NEW_STATION);
1505                 CMD(add_mpath, NEW_MPATH);
1506                 CMD(update_mesh_config, SET_MESH_CONFIG);
1507                 CMD(change_bss, SET_BSS);
1508                 CMD(auth, AUTHENTICATE);
1509                 CMD(assoc, ASSOCIATE);
1510                 CMD(deauth, DEAUTHENTICATE);
1511                 CMD(disassoc, DISASSOCIATE);
1512                 CMD(join_ibss, JOIN_IBSS);
1513                 CMD(join_mesh, JOIN_MESH);
1514                 CMD(set_pmksa, SET_PMKSA);
1515                 CMD(del_pmksa, DEL_PMKSA);
1516                 CMD(flush_pmksa, FLUSH_PMKSA);
1517                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1518                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1519                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1520                 CMD(mgmt_tx, FRAME);
1521                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1522                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1523                         i++;
1524                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1525                                 goto nla_put_failure;
1526                 }
1527                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1528                     rdev->ops->join_mesh) {
1529                         i++;
1530                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1531                                 goto nla_put_failure;
1532                 }
1533                 CMD(set_wds_peer, SET_WDS_PEER);
1534                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1535                         CMD(tdls_mgmt, TDLS_MGMT);
1536                         CMD(tdls_oper, TDLS_OPER);
1537                 }
1538                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1539                         CMD(sched_scan_start, START_SCHED_SCAN);
1540                 CMD(probe_client, PROBE_CLIENT);
1541                 CMD(set_noack_map, SET_NOACK_MAP);
1542                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1543                         i++;
1544                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1545                                 goto nla_put_failure;
1546                 }
1547                 CMD(start_p2p_device, START_P2P_DEVICE);
1548                 CMD(set_mcast_rate, SET_MCAST_RATE);
1549 #ifdef CONFIG_NL80211_TESTMODE
1550                 CMD(testmode_cmd, TESTMODE);
1551 #endif
1552                 if (state->split) {
1553                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1554                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1555                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1556                                 CMD(channel_switch, CHANNEL_SWITCH);
1557                         CMD(set_qos_map, SET_QOS_MAP);
1558                         if (rdev->wiphy.features &
1559                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1560                                 CMD(add_tx_ts, ADD_TX_TS);
1561                 }
1562                 /* add into the if now */
1563 #undef CMD
1564
1565                 if (rdev->ops->connect || rdev->ops->auth) {
1566                         i++;
1567                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1568                                 goto nla_put_failure;
1569                 }
1570
1571                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1572                         i++;
1573                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1574                                 goto nla_put_failure;
1575                 }
1576
1577                 nla_nest_end(msg, nl_cmds);
1578                 state->split_start++;
1579                 if (state->split)
1580                         break;
1581         case 5:
1582                 if (rdev->ops->remain_on_channel &&
1583                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1584                     nla_put_u32(msg,
1585                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1586                                 rdev->wiphy.max_remain_on_channel_duration))
1587                         goto nla_put_failure;
1588
1589                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1590                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1591                         goto nla_put_failure;
1592
1593                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1594                         goto nla_put_failure;
1595                 state->split_start++;
1596                 if (state->split)
1597                         break;
1598         case 6:
1599 #ifdef CONFIG_PM
1600                 if (nl80211_send_wowlan(msg, rdev, state->split))
1601                         goto nla_put_failure;
1602                 state->split_start++;
1603                 if (state->split)
1604                         break;
1605 #else
1606                 state->split_start++;
1607 #endif
1608         case 7:
1609                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1610                                         rdev->wiphy.software_iftypes))
1611                         goto nla_put_failure;
1612
1613                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1614                                                    state->split))
1615                         goto nla_put_failure;
1616
1617                 state->split_start++;
1618                 if (state->split)
1619                         break;
1620         case 8:
1621                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1622                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1623                                 rdev->wiphy.ap_sme_capa))
1624                         goto nla_put_failure;
1625
1626                 features = rdev->wiphy.features;
1627                 /*
1628                  * We can only add the per-channel limit information if the
1629                  * dump is split, otherwise it makes it too big. Therefore
1630                  * only advertise it in that case.
1631                  */
1632                 if (state->split)
1633                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1634                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1635                         goto nla_put_failure;
1636
1637                 if (rdev->wiphy.ht_capa_mod_mask &&
1638                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1639                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1640                             rdev->wiphy.ht_capa_mod_mask))
1641                         goto nla_put_failure;
1642
1643                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1644                     rdev->wiphy.max_acl_mac_addrs &&
1645                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1646                                 rdev->wiphy.max_acl_mac_addrs))
1647                         goto nla_put_failure;
1648
1649                 /*
1650                  * Any information below this point is only available to
1651                  * applications that can deal with it being split. This
1652                  * helps ensure that newly added capabilities don't break
1653                  * older tools by overrunning their buffers.
1654                  *
1655                  * We still increment split_start so that in the split
1656                  * case we'll continue with more data in the next round,
1657                  * but break unconditionally so unsplit data stops here.
1658                  */
1659                 state->split_start++;
1660                 break;
1661         case 9:
1662                 if (rdev->wiphy.extended_capabilities &&
1663                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1664                              rdev->wiphy.extended_capabilities_len,
1665                              rdev->wiphy.extended_capabilities) ||
1666                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1667                              rdev->wiphy.extended_capabilities_len,
1668                              rdev->wiphy.extended_capabilities_mask)))
1669                         goto nla_put_failure;
1670
1671                 if (rdev->wiphy.vht_capa_mod_mask &&
1672                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1673                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1674                             rdev->wiphy.vht_capa_mod_mask))
1675                         goto nla_put_failure;
1676
1677                 state->split_start++;
1678                 break;
1679         case 10:
1680                 if (nl80211_send_coalesce(msg, rdev))
1681                         goto nla_put_failure;
1682
1683                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1684                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1685                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1686                         goto nla_put_failure;
1687
1688                 if (rdev->wiphy.max_ap_assoc_sta &&
1689                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1690                                 rdev->wiphy.max_ap_assoc_sta))
1691                         goto nla_put_failure;
1692
1693                 state->split_start++;
1694                 break;
1695         case 11:
1696                 if (rdev->wiphy.n_vendor_commands) {
1697                         const struct nl80211_vendor_cmd_info *info;
1698                         struct nlattr *nested;
1699
1700                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1701                         if (!nested)
1702                                 goto nla_put_failure;
1703
1704                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1705                                 info = &rdev->wiphy.vendor_commands[i].info;
1706                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1707                                         goto nla_put_failure;
1708                         }
1709                         nla_nest_end(msg, nested);
1710                 }
1711
1712                 if (rdev->wiphy.n_vendor_events) {
1713                         const struct nl80211_vendor_cmd_info *info;
1714                         struct nlattr *nested;
1715
1716                         nested = nla_nest_start(msg,
1717                                                 NL80211_ATTR_VENDOR_EVENTS);
1718                         if (!nested)
1719                                 goto nla_put_failure;
1720
1721                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1722                                 info = &rdev->wiphy.vendor_events[i];
1723                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1724                                         goto nla_put_failure;
1725                         }
1726                         nla_nest_end(msg, nested);
1727                 }
1728                 state->split_start++;
1729                 break;
1730         case 12:
1731                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1732                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1733                                rdev->wiphy.max_num_csa_counters))
1734                         goto nla_put_failure;
1735
1736                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1737                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1738                         goto nla_put_failure;
1739
1740                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1741                             sizeof(rdev->wiphy.ext_features),
1742                             rdev->wiphy.ext_features))
1743                         goto nla_put_failure;
1744
1745                 if (rdev->wiphy.bss_select_support) {
1746                         struct nlattr *nested;
1747                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1748
1749                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1750                         if (!nested)
1751                                 goto nla_put_failure;
1752
1753                         i = 0;
1754                         while (bss_select_support) {
1755                                 if ((bss_select_support & 1) &&
1756                                     nla_put_flag(msg, i))
1757                                         goto nla_put_failure;
1758                                 i++;
1759                                 bss_select_support >>= 1;
1760                         }
1761                         nla_nest_end(msg, nested);
1762                 }
1763
1764                 /* done */
1765                 state->split_start = 0;
1766                 break;
1767         }
1768  finish:
1769         genlmsg_end(msg, hdr);
1770         return 0;
1771
1772  nla_put_failure:
1773         genlmsg_cancel(msg, hdr);
1774         return -EMSGSIZE;
1775 }
1776
1777 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1778                                     struct netlink_callback *cb,
1779                                     struct nl80211_dump_wiphy_state *state)
1780 {
1781         struct nlattr **tb = nl80211_fam.attrbuf;
1782         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1783                               tb, nl80211_fam.maxattr, nl80211_policy);
1784         /* ignore parse errors for backward compatibility */
1785         if (ret)
1786                 return 0;
1787
1788         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1789         if (tb[NL80211_ATTR_WIPHY])
1790                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1791         if (tb[NL80211_ATTR_WDEV])
1792                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1793         if (tb[NL80211_ATTR_IFINDEX]) {
1794                 struct net_device *netdev;
1795                 struct cfg80211_registered_device *rdev;
1796                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1797
1798                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1799                 if (!netdev)
1800                         return -ENODEV;
1801                 if (netdev->ieee80211_ptr) {
1802                         rdev = wiphy_to_rdev(
1803                                 netdev->ieee80211_ptr->wiphy);
1804                         state->filter_wiphy = rdev->wiphy_idx;
1805                 }
1806         }
1807
1808         return 0;
1809 }
1810
1811 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1812 {
1813         int idx = 0, ret;
1814         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1815         struct cfg80211_registered_device *rdev;
1816
1817         rtnl_lock();
1818         if (!state) {
1819                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1820                 if (!state) {
1821                         rtnl_unlock();
1822                         return -ENOMEM;
1823                 }
1824                 state->filter_wiphy = -1;
1825                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1826                 if (ret) {
1827                         kfree(state);
1828                         rtnl_unlock();
1829                         return ret;
1830                 }
1831                 cb->args[0] = (long)state;
1832         }
1833
1834         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1835                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1836                         continue;
1837                 if (++idx <= state->start)
1838                         continue;
1839                 if (state->filter_wiphy != -1 &&
1840                     state->filter_wiphy != rdev->wiphy_idx)
1841                         continue;
1842                 /* attempt to fit multiple wiphy data chunks into the skb */
1843                 do {
1844                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1845                                                  skb,
1846                                                  NETLINK_CB(cb->skb).portid,
1847                                                  cb->nlh->nlmsg_seq,
1848                                                  NLM_F_MULTI, state);
1849                         if (ret < 0) {
1850                                 /*
1851                                  * If sending the wiphy data didn't fit (ENOBUFS
1852                                  * or EMSGSIZE returned), this SKB is still
1853                                  * empty (so it's not too big because another
1854                                  * wiphy dataset is already in the skb) and
1855                                  * we've not tried to adjust the dump allocation
1856                                  * yet ... then adjust the alloc size to be
1857                                  * bigger, and return 1 but with the empty skb.
1858                                  * This results in an empty message being RX'ed
1859                                  * in userspace, but that is ignored.
1860                                  *
1861                                  * We can then retry with the larger buffer.
1862                                  */
1863                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1864                                     !skb->len && !state->split &&
1865                                     cb->min_dump_alloc < 4096) {
1866                                         cb->min_dump_alloc = 4096;
1867                                         state->split_start = 0;
1868                                         rtnl_unlock();
1869                                         return 1;
1870                                 }
1871                                 idx--;
1872                                 break;
1873                         }
1874                 } while (state->split_start > 0);
1875                 break;
1876         }
1877         rtnl_unlock();
1878
1879         state->start = idx;
1880
1881         return skb->len;
1882 }
1883
1884 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1885 {
1886         kfree((void *)cb->args[0]);
1887         return 0;
1888 }
1889
1890 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1891 {
1892         struct sk_buff *msg;
1893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1894         struct nl80211_dump_wiphy_state state = {};
1895
1896         msg = nlmsg_new(4096, GFP_KERNEL);
1897         if (!msg)
1898                 return -ENOMEM;
1899
1900         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1901                                info->snd_portid, info->snd_seq, 0,
1902                                &state) < 0) {
1903                 nlmsg_free(msg);
1904                 return -ENOBUFS;
1905         }
1906
1907         return genlmsg_reply(msg, info);
1908 }
1909
1910 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1911         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1912         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1913         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1914         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1915         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1916 };
1917
1918 static int parse_txq_params(struct nlattr *tb[],
1919                             struct ieee80211_txq_params *txq_params)
1920 {
1921         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1922             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1923             !tb[NL80211_TXQ_ATTR_AIFS])
1924                 return -EINVAL;
1925
1926         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1927         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1928         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1929         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1930         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1931
1932         if (txq_params->ac >= NL80211_NUM_ACS)
1933                 return -EINVAL;
1934
1935         return 0;
1936 }
1937
1938 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1939 {
1940         /*
1941          * You can only set the channel explicitly for WDS interfaces,
1942          * all others have their channel managed via their respective
1943          * "establish a connection" command (connect, join, ...)
1944          *
1945          * For AP/GO and mesh mode, the channel can be set with the
1946          * channel userspace API, but is only stored and passed to the
1947          * low-level driver when the AP starts or the mesh is joined.
1948          * This is for backward compatibility, userspace can also give
1949          * the channel in the start-ap or join-mesh commands instead.
1950          *
1951          * Monitors are special as they are normally slaved to
1952          * whatever else is going on, so they have their own special
1953          * operation to set the monitor channel if possible.
1954          */
1955         return !wdev ||
1956                 wdev->iftype == NL80211_IFTYPE_AP ||
1957                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1958                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1959                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1960 }
1961
1962 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1963                                  struct genl_info *info,
1964                                  struct cfg80211_chan_def *chandef)
1965 {
1966         u32 control_freq;
1967
1968         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1969                 return -EINVAL;
1970
1971         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1972
1973         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1974         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1975         chandef->center_freq1 = control_freq;
1976         chandef->center_freq2 = 0;
1977
1978         /* Primary channel not allowed */
1979         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1980                 return -EINVAL;
1981
1982         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1983                 enum nl80211_channel_type chantype;
1984
1985                 chantype = nla_get_u32(
1986                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1987
1988                 switch (chantype) {
1989                 case NL80211_CHAN_NO_HT:
1990                 case NL80211_CHAN_HT20:
1991                 case NL80211_CHAN_HT40PLUS:
1992                 case NL80211_CHAN_HT40MINUS:
1993                         cfg80211_chandef_create(chandef, chandef->chan,
1994                                                 chantype);
1995                         break;
1996                 default:
1997                         return -EINVAL;
1998                 }
1999         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2000                 chandef->width =
2001                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2002                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2003                         chandef->center_freq1 =
2004                                 nla_get_u32(
2005                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2006                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2007                         chandef->center_freq2 =
2008                                 nla_get_u32(
2009                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2010         }
2011
2012         if (!cfg80211_chandef_valid(chandef))
2013                 return -EINVAL;
2014
2015         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2016                                      IEEE80211_CHAN_DISABLED))
2017                 return -EINVAL;
2018
2019         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2020              chandef->width == NL80211_CHAN_WIDTH_10) &&
2021             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2022                 return -EINVAL;
2023
2024         return 0;
2025 }
2026
2027 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2028                                  struct net_device *dev,
2029                                  struct genl_info *info)
2030 {
2031         struct cfg80211_chan_def chandef;
2032         int result;
2033         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2034         struct wireless_dev *wdev = NULL;
2035
2036         if (dev)
2037                 wdev = dev->ieee80211_ptr;
2038         if (!nl80211_can_set_dev_channel(wdev))
2039                 return -EOPNOTSUPP;
2040         if (wdev)
2041                 iftype = wdev->iftype;
2042
2043         result = nl80211_parse_chandef(rdev, info, &chandef);
2044         if (result)
2045                 return result;
2046
2047         switch (iftype) {
2048         case NL80211_IFTYPE_AP:
2049         case NL80211_IFTYPE_P2P_GO:
2050                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2051                                                    iftype)) {
2052                         result = -EINVAL;
2053                         break;
2054                 }
2055                 if (wdev->beacon_interval) {
2056                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2057                             !(rdev->wiphy.features &
2058                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2059                                 result = -EBUSY;
2060                                 break;
2061                         }
2062
2063                         /* Only allow dynamic channel width changes */
2064                         if (chandef.chan != wdev->preset_chandef.chan) {
2065                                 result = -EBUSY;
2066                                 break;
2067                         }
2068                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2069                         if (result)
2070                                 break;
2071                 }
2072                 wdev->preset_chandef = chandef;
2073                 result = 0;
2074                 break;
2075         case NL80211_IFTYPE_MESH_POINT:
2076                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2077                 break;
2078         case NL80211_IFTYPE_MONITOR:
2079                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2080                 break;
2081         default:
2082                 result = -EINVAL;
2083         }
2084
2085         return result;
2086 }
2087
2088 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2089 {
2090         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2091         struct net_device *netdev = info->user_ptr[1];
2092
2093         return __nl80211_set_channel(rdev, netdev, info);
2094 }
2095
2096 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2097 {
2098         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2099         struct net_device *dev = info->user_ptr[1];
2100         struct wireless_dev *wdev = dev->ieee80211_ptr;
2101         const u8 *bssid;
2102
2103         if (!info->attrs[NL80211_ATTR_MAC])
2104                 return -EINVAL;
2105
2106         if (netif_running(dev))
2107                 return -EBUSY;
2108
2109         if (!rdev->ops->set_wds_peer)
2110                 return -EOPNOTSUPP;
2111
2112         if (wdev->iftype != NL80211_IFTYPE_WDS)
2113                 return -EOPNOTSUPP;
2114
2115         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2116         return rdev_set_wds_peer(rdev, dev, bssid);
2117 }
2118
2119
2120 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2121 {
2122         struct cfg80211_registered_device *rdev;
2123         struct net_device *netdev = NULL;
2124         struct wireless_dev *wdev;
2125         int result = 0, rem_txq_params = 0;
2126         struct nlattr *nl_txq_params;
2127         u32 changed;
2128         u8 retry_short = 0, retry_long = 0;
2129         u32 frag_threshold = 0, rts_threshold = 0;
2130         u8 coverage_class = 0;
2131
2132         ASSERT_RTNL();
2133
2134         /*
2135          * Try to find the wiphy and netdev. Normally this
2136          * function shouldn't need the netdev, but this is
2137          * done for backward compatibility -- previously
2138          * setting the channel was done per wiphy, but now
2139          * it is per netdev. Previous userland like hostapd
2140          * also passed a netdev to set_wiphy, so that it is
2141          * possible to let that go to the right netdev!
2142          */
2143
2144         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2145                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2146
2147                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2148                 if (netdev && netdev->ieee80211_ptr)
2149                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2150                 else
2151                         netdev = NULL;
2152         }
2153
2154         if (!netdev) {
2155                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2156                                                   info->attrs);
2157                 if (IS_ERR(rdev))
2158                         return PTR_ERR(rdev);
2159                 wdev = NULL;
2160                 netdev = NULL;
2161                 result = 0;
2162         } else
2163                 wdev = netdev->ieee80211_ptr;
2164
2165         /*
2166          * end workaround code, by now the rdev is available
2167          * and locked, and wdev may or may not be NULL.
2168          */
2169
2170         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2171                 result = cfg80211_dev_rename(
2172                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2173
2174         if (result)
2175                 return result;
2176
2177         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2178                 struct ieee80211_txq_params txq_params;
2179                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2180
2181                 if (!rdev->ops->set_txq_params)
2182                         return -EOPNOTSUPP;
2183
2184                 if (!netdev)
2185                         return -EINVAL;
2186
2187                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2188                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2189                         return -EINVAL;
2190
2191                 if (!netif_running(netdev))
2192                         return -ENETDOWN;
2193
2194                 nla_for_each_nested(nl_txq_params,
2195                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2196                                     rem_txq_params) {
2197                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2198                                            nla_data(nl_txq_params),
2199                                            nla_len(nl_txq_params),
2200                                            txq_params_policy);
2201                         if (result)
2202                                 return result;
2203                         result = parse_txq_params(tb, &txq_params);
2204                         if (result)
2205                                 return result;
2206
2207                         result = rdev_set_txq_params(rdev, netdev,
2208                                                      &txq_params);
2209                         if (result)
2210                                 return result;
2211                 }
2212         }
2213
2214         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2215                 result = __nl80211_set_channel(
2216                         rdev,
2217                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2218                         info);
2219                 if (result)
2220                         return result;
2221         }
2222
2223         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2224                 struct wireless_dev *txp_wdev = wdev;
2225                 enum nl80211_tx_power_setting type;
2226                 int idx, mbm = 0;
2227
2228                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2229                         txp_wdev = NULL;
2230
2231                 if (!rdev->ops->set_tx_power)
2232                         return -EOPNOTSUPP;
2233
2234                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2235                 type = nla_get_u32(info->attrs[idx]);
2236
2237                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2238                     (type != NL80211_TX_POWER_AUTOMATIC))
2239                         return -EINVAL;
2240
2241                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2242                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2243                         mbm = nla_get_u32(info->attrs[idx]);
2244                 }
2245
2246                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2247                 if (result)
2248                         return result;
2249         }
2250
2251         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2252             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2253                 u32 tx_ant, rx_ant;
2254                 if ((!rdev->wiphy.available_antennas_tx &&
2255                      !rdev->wiphy.available_antennas_rx) ||
2256                     !rdev->ops->set_antenna)
2257                         return -EOPNOTSUPP;
2258
2259                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2260                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2261
2262                 /* reject antenna configurations which don't match the
2263                  * available antenna masks, except for the "all" mask */
2264                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2265                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2266                         return -EINVAL;
2267
2268                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2269                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2270
2271                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2272                 if (result)
2273                         return result;
2274         }
2275
2276         changed = 0;
2277
2278         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2279                 retry_short = nla_get_u8(
2280                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2281                 if (retry_short == 0)
2282                         return -EINVAL;
2283
2284                 changed |= WIPHY_PARAM_RETRY_SHORT;
2285         }
2286
2287         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2288                 retry_long = nla_get_u8(
2289                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2290                 if (retry_long == 0)
2291                         return -EINVAL;
2292
2293                 changed |= WIPHY_PARAM_RETRY_LONG;
2294         }
2295
2296         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2297                 frag_threshold = nla_get_u32(
2298                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2299                 if (frag_threshold < 256)
2300                         return -EINVAL;
2301
2302                 if (frag_threshold != (u32) -1) {
2303                         /*
2304                          * Fragments (apart from the last one) are required to
2305                          * have even length. Make the fragmentation code
2306                          * simpler by stripping LSB should someone try to use
2307                          * odd threshold value.
2308                          */
2309                         frag_threshold &= ~0x1;
2310                 }
2311                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2312         }
2313
2314         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2315                 rts_threshold = nla_get_u32(
2316                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2317                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2318         }
2319
2320         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2321                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2322                         return -EINVAL;
2323
2324                 coverage_class = nla_get_u8(
2325                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2326                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2327         }
2328
2329         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2330                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2331                         return -EOPNOTSUPP;
2332
2333                 changed |= WIPHY_PARAM_DYN_ACK;
2334         }
2335
2336         if (changed) {
2337                 u8 old_retry_short, old_retry_long;
2338                 u32 old_frag_threshold, old_rts_threshold;
2339                 u8 old_coverage_class;
2340
2341                 if (!rdev->ops->set_wiphy_params)
2342                         return -EOPNOTSUPP;
2343
2344                 old_retry_short = rdev->wiphy.retry_short;
2345                 old_retry_long = rdev->wiphy.retry_long;
2346                 old_frag_threshold = rdev->wiphy.frag_threshold;
2347                 old_rts_threshold = rdev->wiphy.rts_threshold;
2348                 old_coverage_class = rdev->wiphy.coverage_class;
2349
2350                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2351                         rdev->wiphy.retry_short = retry_short;
2352                 if (changed & WIPHY_PARAM_RETRY_LONG)
2353                         rdev->wiphy.retry_long = retry_long;
2354                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2355                         rdev->wiphy.frag_threshold = frag_threshold;
2356                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2357                         rdev->wiphy.rts_threshold = rts_threshold;
2358                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2359                         rdev->wiphy.coverage_class = coverage_class;
2360
2361                 result = rdev_set_wiphy_params(rdev, changed);
2362                 if (result) {
2363                         rdev->wiphy.retry_short = old_retry_short;
2364                         rdev->wiphy.retry_long = old_retry_long;
2365                         rdev->wiphy.frag_threshold = old_frag_threshold;
2366                         rdev->wiphy.rts_threshold = old_rts_threshold;
2367                         rdev->wiphy.coverage_class = old_coverage_class;
2368                         return result;
2369                 }
2370         }
2371         return 0;
2372 }
2373
2374 static inline u64 wdev_id(struct wireless_dev *wdev)
2375 {
2376         return (u64)wdev->identifier |
2377                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2378 }
2379
2380 static int nl80211_send_chandef(struct sk_buff *msg,
2381                                 const struct cfg80211_chan_def *chandef)
2382 {
2383         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2384                 return -EINVAL;
2385
2386         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2387                         chandef->chan->center_freq))
2388                 return -ENOBUFS;
2389         switch (chandef->width) {
2390         case NL80211_CHAN_WIDTH_20_NOHT:
2391         case NL80211_CHAN_WIDTH_20:
2392         case NL80211_CHAN_WIDTH_40:
2393                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2394                                 cfg80211_get_chandef_type(chandef)))
2395                         return -ENOBUFS;
2396                 break;
2397         default:
2398                 break;
2399         }
2400         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2401                 return -ENOBUFS;
2402         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2403                 return -ENOBUFS;
2404         if (chandef->center_freq2 &&
2405             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2406                 return -ENOBUFS;
2407         return 0;
2408 }
2409
2410 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2411                               struct cfg80211_registered_device *rdev,
2412                               struct wireless_dev *wdev, bool removal)
2413 {
2414         struct net_device *dev = wdev->netdev;
2415         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2416         void *hdr;
2417
2418         if (removal)
2419                 cmd = NL80211_CMD_DEL_INTERFACE;
2420
2421         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2422         if (!hdr)
2423                 return -1;
2424
2425         if (dev &&
2426             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2427              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2428                 goto nla_put_failure;
2429
2430         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2431             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2432             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2433             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2434             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2435                         rdev->devlist_generation ^
2436                         (cfg80211_rdev_list_generation << 2)))
2437                 goto nla_put_failure;
2438
2439         if (rdev->ops->get_channel) {
2440                 int ret;
2441                 struct cfg80211_chan_def chandef;
2442
2443                 ret = rdev_get_channel(rdev, wdev, &chandef);
2444                 if (ret == 0) {
2445                         if (nl80211_send_chandef(msg, &chandef))
2446                                 goto nla_put_failure;
2447                 }
2448         }
2449
2450         if (rdev->ops->get_tx_power) {
2451                 int dbm, ret;
2452
2453                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2454                 if (ret == 0 &&
2455                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2456                                 DBM_TO_MBM(dbm)))
2457                         goto nla_put_failure;
2458         }
2459
2460         if (wdev->ssid_len) {
2461                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2462                         goto nla_put_failure;
2463         }
2464
2465         genlmsg_end(msg, hdr);
2466         return 0;
2467
2468  nla_put_failure:
2469         genlmsg_cancel(msg, hdr);
2470         return -EMSGSIZE;
2471 }
2472
2473 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2474 {
2475         int wp_idx = 0;
2476         int if_idx = 0;
2477         int wp_start = cb->args[0];
2478         int if_start = cb->args[1];
2479         struct cfg80211_registered_device *rdev;
2480         struct wireless_dev *wdev;
2481
2482         rtnl_lock();
2483         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2484                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2485                         continue;
2486                 if (wp_idx < wp_start) {
2487                         wp_idx++;
2488                         continue;
2489                 }
2490                 if_idx = 0;
2491
2492                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2493                         if (if_idx < if_start) {
2494                                 if_idx++;
2495                                 continue;
2496                         }
2497                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2498                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2499                                                rdev, wdev, false) < 0) {
2500                                 goto out;
2501                         }
2502                         if_idx++;
2503                 }
2504
2505                 wp_idx++;
2506         }
2507  out:
2508         rtnl_unlock();
2509
2510         cb->args[0] = wp_idx;
2511         cb->args[1] = if_idx;
2512
2513         return skb->len;
2514 }
2515
2516 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2517 {
2518         struct sk_buff *msg;
2519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2520         struct wireless_dev *wdev = info->user_ptr[1];
2521
2522         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2523         if (!msg)
2524                 return -ENOMEM;
2525
2526         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2527                                rdev, wdev, false) < 0) {
2528                 nlmsg_free(msg);
2529                 return -ENOBUFS;
2530         }
2531
2532         return genlmsg_reply(msg, info);
2533 }
2534
2535 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2536         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2537         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2538         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2539         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2540         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2541         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2542 };
2543
2544 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2545 {
2546         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2547         int flag;
2548
2549         *mntrflags = 0;
2550
2551         if (!nla)
2552                 return -EINVAL;
2553
2554         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2555                              nla, mntr_flags_policy))
2556                 return -EINVAL;
2557
2558         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2559                 if (flags[flag])
2560                         *mntrflags |= (1<<flag);
2561
2562         return 0;
2563 }
2564
2565 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2566                                struct net_device *netdev, u8 use_4addr,
2567                                enum nl80211_iftype iftype)
2568 {
2569         if (!use_4addr) {
2570                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2571                         return -EBUSY;
2572                 return 0;
2573         }
2574
2575         switch (iftype) {
2576         case NL80211_IFTYPE_AP_VLAN:
2577                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2578                         return 0;
2579                 break;
2580         case NL80211_IFTYPE_STATION:
2581                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2582                         return 0;
2583                 break;
2584         default:
2585                 break;
2586         }
2587
2588         return -EOPNOTSUPP;
2589 }
2590
2591 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2592 {
2593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2594         struct vif_params params;
2595         int err;
2596         enum nl80211_iftype otype, ntype;
2597         struct net_device *dev = info->user_ptr[1];
2598         u32 _flags, *flags = NULL;
2599         bool change = false;
2600
2601         memset(&params, 0, sizeof(params));
2602
2603         otype = ntype = dev->ieee80211_ptr->iftype;
2604
2605         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2606                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2607                 if (otype != ntype)
2608                         change = true;
2609                 if (ntype > NL80211_IFTYPE_MAX)
2610                         return -EINVAL;
2611         }
2612
2613         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2614                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2615
2616                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2617                         return -EINVAL;
2618                 if (netif_running(dev))
2619                         return -EBUSY;
2620
2621                 wdev_lock(wdev);
2622                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2623                              IEEE80211_MAX_MESH_ID_LEN);
2624                 wdev->mesh_id_up_len =
2625                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2626                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2627                        wdev->mesh_id_up_len);
2628                 wdev_unlock(wdev);
2629         }
2630
2631         if (info->attrs[NL80211_ATTR_4ADDR]) {
2632                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2633                 change = true;
2634                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2635                 if (err)
2636                         return err;
2637         } else {
2638                 params.use_4addr = -1;
2639         }
2640
2641         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2642                 if (ntype != NL80211_IFTYPE_MONITOR)
2643                         return -EINVAL;
2644                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2645                                           &_flags);
2646                 if (err)
2647                         return err;
2648
2649                 flags = &_flags;
2650                 change = true;
2651         }
2652
2653         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2654             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2655                 return -EOPNOTSUPP;
2656
2657         if (change)
2658                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2659         else
2660                 err = 0;
2661
2662         if (!err && params.use_4addr != -1)
2663                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2664
2665         return err;
2666 }
2667
2668 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2669 {
2670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2671         struct vif_params params;
2672         struct wireless_dev *wdev;
2673         struct sk_buff *msg, *event;
2674         int err;
2675         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2676         u32 flags;
2677
2678         /* to avoid failing a new interface creation due to pending removal */
2679         cfg80211_destroy_ifaces(rdev);
2680
2681         memset(&params, 0, sizeof(params));
2682
2683         if (!info->attrs[NL80211_ATTR_IFNAME])
2684                 return -EINVAL;
2685
2686         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2687                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2688                 if (type > NL80211_IFTYPE_MAX)
2689                         return -EINVAL;
2690         }
2691
2692         if (!rdev->ops->add_virtual_intf ||
2693             !(rdev->wiphy.interface_modes & (1 << type)))
2694                 return -EOPNOTSUPP;
2695
2696         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2697              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2698             info->attrs[NL80211_ATTR_MAC]) {
2699                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2700                            ETH_ALEN);
2701                 if (!is_valid_ether_addr(params.macaddr))
2702                         return -EADDRNOTAVAIL;
2703         }
2704
2705         if (info->attrs[NL80211_ATTR_4ADDR]) {
2706                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2707                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2708                 if (err)
2709                         return err;
2710         }
2711
2712         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2713                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2714                                   &flags);
2715
2716         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2717             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2718                 return -EOPNOTSUPP;
2719
2720         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2721         if (!msg)
2722                 return -ENOMEM;
2723
2724         wdev = rdev_add_virtual_intf(rdev,
2725                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2726                                 NET_NAME_USER, type, err ? NULL : &flags,
2727                                 &params);
2728         if (WARN_ON(!wdev)) {
2729                 nlmsg_free(msg);
2730                 return -EPROTO;
2731         } else if (IS_ERR(wdev)) {
2732                 nlmsg_free(msg);
2733                 return PTR_ERR(wdev);
2734         }
2735
2736         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2737                 wdev->owner_nlportid = info->snd_portid;
2738
2739         switch (type) {
2740         case NL80211_IFTYPE_MESH_POINT:
2741                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2742                         break;
2743                 wdev_lock(wdev);
2744                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2745                              IEEE80211_MAX_MESH_ID_LEN);
2746                 wdev->mesh_id_up_len =
2747                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2748                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2749                        wdev->mesh_id_up_len);
2750                 wdev_unlock(wdev);
2751                 break;
2752         case NL80211_IFTYPE_P2P_DEVICE:
2753                 /*
2754                  * P2P Device doesn't have a netdev, so doesn't go
2755                  * through the netdev notifier and must be added here
2756                  */
2757                 mutex_init(&wdev->mtx);
2758                 INIT_LIST_HEAD(&wdev->event_list);
2759                 spin_lock_init(&wdev->event_lock);
2760                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2761                 spin_lock_init(&wdev->mgmt_registrations_lock);
2762
2763                 wdev->identifier = ++rdev->wdev_id;
2764                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2765                 rdev->devlist_generation++;
2766                 break;
2767         default:
2768                 break;
2769         }
2770
2771         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2772                                rdev, wdev, false) < 0) {
2773                 nlmsg_free(msg);
2774                 return -ENOBUFS;
2775         }
2776
2777         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2778         if (event) {
2779                 if (nl80211_send_iface(event, 0, 0, 0,
2780                                        rdev, wdev, false) < 0) {
2781                         nlmsg_free(event);
2782                         goto out;
2783                 }
2784
2785                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2786                                         event, 0, NL80211_MCGRP_CONFIG,
2787                                         GFP_KERNEL);
2788         }
2789
2790 out:
2791         return genlmsg_reply(msg, info);
2792 }
2793
2794 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2795 {
2796         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2797         struct wireless_dev *wdev = info->user_ptr[1];
2798         struct sk_buff *msg;
2799         int status;
2800
2801         if (!rdev->ops->del_virtual_intf)
2802                 return -EOPNOTSUPP;
2803
2804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2805         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2806                 nlmsg_free(msg);
2807                 msg = NULL;
2808         }
2809
2810         /*
2811          * If we remove a wireless device without a netdev then clear
2812          * user_ptr[1] so that nl80211_post_doit won't dereference it
2813          * to check if it needs to do dev_put(). Otherwise it crashes
2814          * since the wdev has been freed, unlike with a netdev where
2815          * we need the dev_put() for the netdev to really be freed.
2816          */
2817         if (!wdev->netdev)
2818                 info->user_ptr[1] = NULL;
2819
2820         status = rdev_del_virtual_intf(rdev, wdev);
2821         if (status >= 0 && msg)
2822                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2823                                         msg, 0, NL80211_MCGRP_CONFIG,
2824                                         GFP_KERNEL);
2825         else
2826                 nlmsg_free(msg);
2827
2828         return status;
2829 }
2830
2831 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2832 {
2833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2834         struct net_device *dev = info->user_ptr[1];
2835         u16 noack_map;
2836
2837         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2838                 return -EINVAL;
2839
2840         if (!rdev->ops->set_noack_map)
2841                 return -EOPNOTSUPP;
2842
2843         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2844
2845         return rdev_set_noack_map(rdev, dev, noack_map);
2846 }
2847
2848 struct get_key_cookie {
2849         struct sk_buff *msg;
2850         int error;
2851         int idx;
2852 };
2853
2854 static void get_key_callback(void *c, struct key_params *params)
2855 {
2856         struct nlattr *key;
2857         struct get_key_cookie *cookie = c;
2858
2859         if ((params->key &&
2860              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2861                      params->key_len, params->key)) ||
2862             (params->seq &&
2863              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2864                      params->seq_len, params->seq)) ||
2865             (params->cipher &&
2866              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2867                          params->cipher)))
2868                 goto nla_put_failure;
2869
2870         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2871         if (!key)
2872                 goto nla_put_failure;
2873
2874         if ((params->key &&
2875              nla_put(cookie->msg, NL80211_KEY_DATA,
2876                      params->key_len, params->key)) ||
2877             (params->seq &&
2878              nla_put(cookie->msg, NL80211_KEY_SEQ,
2879                      params->seq_len, params->seq)) ||
2880             (params->cipher &&
2881              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2882                          params->cipher)))
2883                 goto nla_put_failure;
2884
2885         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2886                 goto nla_put_failure;
2887
2888         nla_nest_end(cookie->msg, key);
2889
2890         return;
2891  nla_put_failure:
2892         cookie->error = 1;
2893 }
2894
2895 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2896 {
2897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2898         int err;
2899         struct net_device *dev = info->user_ptr[1];
2900         u8 key_idx = 0;
2901         const u8 *mac_addr = NULL;
2902         bool pairwise;
2903         struct get_key_cookie cookie = {
2904                 .error = 0,
2905         };
2906         void *hdr;
2907         struct sk_buff *msg;
2908
2909         if (info->attrs[NL80211_ATTR_KEY_IDX])
2910                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2911
2912         if (key_idx > 5)
2913                 return -EINVAL;
2914
2915         if (info->attrs[NL80211_ATTR_MAC])
2916                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2917
2918         pairwise = !!mac_addr;
2919         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2920                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2921                 if (kt >= NUM_NL80211_KEYTYPES)
2922                         return -EINVAL;
2923                 if (kt != NL80211_KEYTYPE_GROUP &&
2924                     kt != NL80211_KEYTYPE_PAIRWISE)
2925                         return -EINVAL;
2926                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2927         }
2928
2929         if (!rdev->ops->get_key)
2930                 return -EOPNOTSUPP;
2931
2932         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2933                 return -ENOENT;
2934
2935         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2936         if (!msg)
2937                 return -ENOMEM;
2938
2939         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2940                              NL80211_CMD_NEW_KEY);
2941         if (!hdr)
2942                 goto nla_put_failure;
2943
2944         cookie.msg = msg;
2945         cookie.idx = key_idx;
2946
2947         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2948             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2949                 goto nla_put_failure;
2950         if (mac_addr &&
2951             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2952                 goto nla_put_failure;
2953
2954         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2955                            get_key_callback);
2956
2957         if (err)
2958                 goto free_msg;
2959
2960         if (cookie.error)
2961                 goto nla_put_failure;
2962
2963         genlmsg_end(msg, hdr);
2964         return genlmsg_reply(msg, info);
2965
2966  nla_put_failure:
2967         err = -ENOBUFS;
2968  free_msg:
2969         nlmsg_free(msg);
2970         return err;
2971 }
2972
2973 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2974 {
2975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2976         struct key_parse key;
2977         int err;
2978         struct net_device *dev = info->user_ptr[1];
2979
2980         err = nl80211_parse_key(info, &key);
2981         if (err)
2982                 return err;
2983
2984         if (key.idx < 0)
2985                 return -EINVAL;
2986
2987         /* only support setting default key */
2988         if (!key.def && !key.defmgmt)
2989                 return -EINVAL;
2990
2991         wdev_lock(dev->ieee80211_ptr);
2992
2993         if (key.def) {
2994                 if (!rdev->ops->set_default_key) {
2995                         err = -EOPNOTSUPP;
2996                         goto out;
2997                 }
2998
2999                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3000                 if (err)
3001                         goto out;
3002
3003                 err = rdev_set_default_key(rdev, dev, key.idx,
3004                                                  key.def_uni, key.def_multi);
3005
3006                 if (err)
3007                         goto out;
3008
3009 #ifdef CONFIG_CFG80211_WEXT
3010                 dev->ieee80211_ptr->wext.default_key = key.idx;
3011 #endif
3012         } else {
3013                 if (key.def_uni || !key.def_multi) {
3014                         err = -EINVAL;
3015                         goto out;
3016                 }
3017
3018                 if (!rdev->ops->set_default_mgmt_key) {
3019                         err = -EOPNOTSUPP;
3020                         goto out;
3021                 }
3022
3023                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3024                 if (err)
3025                         goto out;
3026
3027                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3028                 if (err)
3029                         goto out;
3030
3031 #ifdef CONFIG_CFG80211_WEXT
3032                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3033 #endif
3034         }
3035
3036  out:
3037         wdev_unlock(dev->ieee80211_ptr);
3038
3039         return err;
3040 }
3041
3042 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3043 {
3044         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3045         int err;
3046         struct net_device *dev = info->user_ptr[1];
3047         struct key_parse key;
3048         const u8 *mac_addr = NULL;
3049
3050         err = nl80211_parse_key(info, &key);
3051         if (err)
3052                 return err;
3053
3054         if (!key.p.key)
3055                 return -EINVAL;
3056
3057         if (info->attrs[NL80211_ATTR_MAC])
3058                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3059
3060         if (key.type == -1) {
3061                 if (mac_addr)
3062                         key.type = NL80211_KEYTYPE_PAIRWISE;
3063                 else
3064                         key.type = NL80211_KEYTYPE_GROUP;
3065         }
3066
3067         /* for now */
3068         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3069             key.type != NL80211_KEYTYPE_GROUP)
3070                 return -EINVAL;
3071
3072         if (!rdev->ops->add_key)
3073                 return -EOPNOTSUPP;
3074
3075         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3076                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3077                                            mac_addr))
3078                 return -EINVAL;
3079
3080         wdev_lock(dev->ieee80211_ptr);
3081         err = nl80211_key_allowed(dev->ieee80211_ptr);
3082         if (!err)
3083                 err = rdev_add_key(rdev, dev, key.idx,
3084                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3085                                     mac_addr, &key.p);
3086         wdev_unlock(dev->ieee80211_ptr);
3087
3088         return err;
3089 }
3090
3091 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3092 {
3093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3094         int err;
3095         struct net_device *dev = info->user_ptr[1];
3096         u8 *mac_addr = NULL;
3097         struct key_parse key;
3098
3099         err = nl80211_parse_key(info, &key);
3100         if (err)
3101                 return err;
3102
3103         if (info->attrs[NL80211_ATTR_MAC])
3104                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3105
3106         if (key.type == -1) {
3107                 if (mac_addr)
3108                         key.type = NL80211_KEYTYPE_PAIRWISE;
3109                 else
3110                         key.type = NL80211_KEYTYPE_GROUP;
3111         }
3112
3113         /* for now */
3114         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3115             key.type != NL80211_KEYTYPE_GROUP)
3116                 return -EINVAL;
3117
3118         if (!rdev->ops->del_key)
3119                 return -EOPNOTSUPP;
3120
3121         wdev_lock(dev->ieee80211_ptr);
3122         err = nl80211_key_allowed(dev->ieee80211_ptr);
3123
3124         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3125             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3126                 err = -ENOENT;
3127
3128         if (!err)
3129                 err = rdev_del_key(rdev, dev, key.idx,
3130                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3131                                    mac_addr);
3132
3133 #ifdef CONFIG_CFG80211_WEXT
3134         if (!err) {
3135                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3136                         dev->ieee80211_ptr->wext.default_key = -1;
3137                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3138                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3139         }
3140 #endif
3141         wdev_unlock(dev->ieee80211_ptr);
3142
3143         return err;
3144 }
3145
3146 /* This function returns an error or the number of nested attributes */
3147 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3148 {
3149         struct nlattr *attr;
3150         int n_entries = 0, tmp;
3151
3152         nla_for_each_nested(attr, nl_attr, tmp) {
3153                 if (nla_len(attr) != ETH_ALEN)
3154                         return -EINVAL;
3155
3156                 n_entries++;
3157         }
3158
3159         return n_entries;
3160 }
3161
3162 /*
3163  * This function parses ACL information and allocates memory for ACL data.
3164  * On successful return, the calling function is responsible to free the
3165  * ACL buffer returned by this function.
3166  */
3167 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3168                                                 struct genl_info *info)
3169 {
3170         enum nl80211_acl_policy acl_policy;
3171         struct nlattr *attr;
3172         struct cfg80211_acl_data *acl;
3173         int i = 0, n_entries, tmp;
3174
3175         if (!wiphy->max_acl_mac_addrs)
3176                 return ERR_PTR(-EOPNOTSUPP);
3177
3178         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3179                 return ERR_PTR(-EINVAL);
3180
3181         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3182         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3183             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3184                 return ERR_PTR(-EINVAL);
3185
3186         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3187                 return ERR_PTR(-EINVAL);
3188
3189         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3190         if (n_entries < 0)
3191                 return ERR_PTR(n_entries);
3192
3193         if (n_entries > wiphy->max_acl_mac_addrs)
3194                 return ERR_PTR(-ENOTSUPP);
3195
3196         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3197                       GFP_KERNEL);
3198         if (!acl)
3199                 return ERR_PTR(-ENOMEM);
3200
3201         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3202                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3203                 i++;
3204         }
3205
3206         acl->n_acl_entries = n_entries;
3207         acl->acl_policy = acl_policy;
3208
3209         return acl;
3210 }
3211
3212 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3213 {
3214         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3215         struct net_device *dev = info->user_ptr[1];
3216         struct cfg80211_acl_data *acl;
3217         int err;
3218
3219         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3220             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3221                 return -EOPNOTSUPP;
3222
3223         if (!dev->ieee80211_ptr->beacon_interval)
3224                 return -EINVAL;
3225
3226         acl = parse_acl_data(&rdev->wiphy, info);
3227         if (IS_ERR(acl))
3228                 return PTR_ERR(acl);
3229
3230         err = rdev_set_mac_acl(rdev, dev, acl);
3231
3232         kfree(acl);
3233
3234         return err;
3235 }
3236
3237 static int nl80211_parse_beacon(struct nlattr *attrs[],
3238                                 struct cfg80211_beacon_data *bcn)
3239 {
3240         bool haveinfo = false;
3241
3242         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3243             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3244             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3245             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3246                 return -EINVAL;
3247
3248         memset(bcn, 0, sizeof(*bcn));
3249
3250         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3251                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3252                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3253                 if (!bcn->head_len)
3254                         return -EINVAL;
3255                 haveinfo = true;
3256         }
3257
3258         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3259                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3260                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3261                 haveinfo = true;
3262         }
3263
3264         if (!haveinfo)
3265                 return -EINVAL;
3266
3267         if (attrs[NL80211_ATTR_IE]) {
3268                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3269                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3270         }
3271
3272         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3273                 bcn->proberesp_ies =
3274                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3275                 bcn->proberesp_ies_len =
3276                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3277         }
3278
3279         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3280                 bcn->assocresp_ies =
3281                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3282                 bcn->assocresp_ies_len =
3283                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3284         }
3285
3286         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3287                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3288                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3289         }
3290
3291         return 0;
3292 }
3293
3294 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3295                                    struct cfg80211_ap_settings *params)
3296 {
3297         struct wireless_dev *wdev;
3298         bool ret = false;
3299
3300         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3301                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3302                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3303                         continue;
3304
3305                 if (!wdev->preset_chandef.chan)
3306                         continue;
3307
3308                 params->chandef = wdev->preset_chandef;
3309                 ret = true;
3310                 break;
3311         }
3312
3313         return ret;
3314 }
3315
3316 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3317                                     enum nl80211_auth_type auth_type,
3318                                     enum nl80211_commands cmd)
3319 {
3320         if (auth_type > NL80211_AUTHTYPE_MAX)
3321                 return false;
3322
3323         switch (cmd) {
3324         case NL80211_CMD_AUTHENTICATE:
3325                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3326                     auth_type == NL80211_AUTHTYPE_SAE)
3327                         return false;
3328                 return true;
3329         case NL80211_CMD_CONNECT:
3330         case NL80211_CMD_START_AP:
3331                 /* SAE not supported yet */
3332                 if (auth_type == NL80211_AUTHTYPE_SAE)
3333                         return false;
3334                 return true;
3335         default:
3336                 return false;
3337         }
3338 }
3339
3340 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3341 {
3342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3343         struct net_device *dev = info->user_ptr[1];
3344         struct wireless_dev *wdev = dev->ieee80211_ptr;
3345         struct cfg80211_ap_settings params;
3346         int err;
3347
3348         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3349             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3350                 return -EOPNOTSUPP;
3351
3352         if (!rdev->ops->start_ap)
3353                 return -EOPNOTSUPP;
3354
3355         if (wdev->beacon_interval)
3356                 return -EALREADY;
3357
3358         memset(&params, 0, sizeof(params));
3359
3360         /* these are required for START_AP */
3361         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3362             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3363             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3364                 return -EINVAL;
3365
3366         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3367         if (err)
3368                 return err;
3369
3370         params.beacon_interval =
3371                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3372         params.dtim_period =
3373                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3374
3375         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3376         if (err)
3377                 return err;
3378
3379         /*
3380          * In theory, some of these attributes should be required here
3381          * but since they were not used when the command was originally
3382          * added, keep them optional for old user space programs to let
3383          * them continue to work with drivers that do not need the
3384          * additional information -- drivers must check!
3385          */
3386         if (info->attrs[NL80211_ATTR_SSID]) {
3387                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3388                 params.ssid_len =
3389                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3390                 if (params.ssid_len == 0 ||
3391                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3392                         return -EINVAL;
3393         }
3394
3395         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3396                 params.hidden_ssid = nla_get_u32(
3397                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3398                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3399                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3400                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3401                         return -EINVAL;
3402         }
3403
3404         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3405
3406         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3407                 params.auth_type = nla_get_u32(
3408                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3409                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3410                                              NL80211_CMD_START_AP))
3411                         return -EINVAL;
3412         } else
3413                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3414
3415         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3416                                       NL80211_MAX_NR_CIPHER_SUITES);
3417         if (err)
3418                 return err;
3419
3420         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3421                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3422                         return -EOPNOTSUPP;
3423                 params.inactivity_timeout = nla_get_u16(
3424                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3425         }
3426
3427         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3428                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3429                         return -EINVAL;
3430                 params.p2p_ctwindow =
3431                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3432                 if (params.p2p_ctwindow > 127)
3433                         return -EINVAL;
3434                 if (params.p2p_ctwindow != 0 &&
3435                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3436                         return -EINVAL;
3437         }
3438
3439         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3440                 u8 tmp;
3441
3442                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3443                         return -EINVAL;
3444                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3445                 if (tmp > 1)
3446                         return -EINVAL;
3447                 params.p2p_opp_ps = tmp;
3448                 if (params.p2p_opp_ps != 0 &&
3449                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3450                         return -EINVAL;
3451         }
3452
3453         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3454                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3455                 if (err)
3456                         return err;
3457         } else if (wdev->preset_chandef.chan) {
3458                 params.chandef = wdev->preset_chandef;
3459         } else if (!nl80211_get_ap_channel(rdev, &params))
3460                 return -EINVAL;
3461
3462         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3463                                            wdev->iftype))
3464                 return -EINVAL;
3465
3466         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3467                 params.smps_mode =
3468                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3469                 switch (params.smps_mode) {
3470                 case NL80211_SMPS_OFF:
3471                         break;
3472                 case NL80211_SMPS_STATIC:
3473                         if (!(rdev->wiphy.features &
3474                               NL80211_FEATURE_STATIC_SMPS))
3475                                 return -EINVAL;
3476                         break;
3477                 case NL80211_SMPS_DYNAMIC:
3478                         if (!(rdev->wiphy.features &
3479                               NL80211_FEATURE_DYNAMIC_SMPS))
3480                                 return -EINVAL;
3481                         break;
3482                 default:
3483                         return -EINVAL;
3484                 }
3485         } else {
3486                 params.smps_mode = NL80211_SMPS_OFF;
3487         }
3488
3489         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3490                 params.acl = parse_acl_data(&rdev->wiphy, info);
3491                 if (IS_ERR(params.acl))
3492                         return PTR_ERR(params.acl);
3493         }
3494
3495         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3496         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3497                 return -EOPNOTSUPP;
3498
3499         wdev_lock(wdev);
3500         err = rdev_start_ap(rdev, dev, &params);
3501         if (!err) {
3502                 wdev->preset_chandef = params.chandef;
3503                 wdev->beacon_interval = params.beacon_interval;
3504                 wdev->chandef = params.chandef;
3505                 wdev->ssid_len = params.ssid_len;
3506                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3507         }
3508         wdev_unlock(wdev);
3509
3510         kfree(params.acl);
3511
3512         return err;
3513 }
3514
3515 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3516 {
3517         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3518         struct net_device *dev = info->user_ptr[1];
3519         struct wireless_dev *wdev = dev->ieee80211_ptr;
3520         struct cfg80211_beacon_data params;
3521         int err;
3522
3523         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3524             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3525                 return -EOPNOTSUPP;
3526
3527         if (!rdev->ops->change_beacon)
3528                 return -EOPNOTSUPP;
3529
3530         if (!wdev->beacon_interval)
3531                 return -EINVAL;
3532
3533         err = nl80211_parse_beacon(info->attrs, &params);
3534         if (err)
3535                 return err;
3536
3537         wdev_lock(wdev);
3538         err = rdev_change_beacon(rdev, dev, &params);
3539         wdev_unlock(wdev);
3540
3541         return err;
3542 }
3543
3544 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3545 {
3546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3547         struct net_device *dev = info->user_ptr[1];
3548
3549         return cfg80211_stop_ap(rdev, dev, false);
3550 }
3551
3552 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3553         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3554         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3555         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3556         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3557         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3558         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3559 };
3560
3561 static int parse_station_flags(struct genl_info *info,
3562                                enum nl80211_iftype iftype,
3563                                struct station_parameters *params)
3564 {
3565         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3566         struct nlattr *nla;
3567         int flag;
3568
3569         /*
3570          * Try parsing the new attribute first so userspace
3571          * can specify both for older kernels.
3572          */
3573         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3574         if (nla) {
3575                 struct nl80211_sta_flag_update *sta_flags;
3576
3577                 sta_flags = nla_data(nla);
3578                 params->sta_flags_mask = sta_flags->mask;
3579                 params->sta_flags_set = sta_flags->set;
3580                 params->sta_flags_set &= params->sta_flags_mask;
3581                 if ((params->sta_flags_mask |
3582                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3583                         return -EINVAL;
3584                 return 0;
3585         }
3586
3587         /* if present, parse the old attribute */
3588
3589         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3590         if (!nla)
3591                 return 0;
3592
3593         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3594                              nla, sta_flags_policy))
3595                 return -EINVAL;
3596
3597         /*
3598          * Only allow certain flags for interface types so that
3599          * other attributes are silently ignored. Remember that
3600          * this is backward compatibility code with old userspace
3601          * and shouldn't be hit in other cases anyway.
3602          */
3603         switch (iftype) {
3604         case NL80211_IFTYPE_AP:
3605         case NL80211_IFTYPE_AP_VLAN:
3606         case NL80211_IFTYPE_P2P_GO:
3607                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3608                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3609                                          BIT(NL80211_STA_FLAG_WME) |
3610                                          BIT(NL80211_STA_FLAG_MFP);
3611                 break;
3612         case NL80211_IFTYPE_P2P_CLIENT:
3613         case NL80211_IFTYPE_STATION:
3614                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3615                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3616                 break;
3617         case NL80211_IFTYPE_MESH_POINT:
3618                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3619                                          BIT(NL80211_STA_FLAG_MFP) |
3620                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3621         default:
3622                 return -EINVAL;
3623         }
3624
3625         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3626                 if (flags[flag]) {
3627                         params->sta_flags_set |= (1<<flag);
3628
3629                         /* no longer support new API additions in old API */
3630                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3631                                 return -EINVAL;
3632                 }
3633         }
3634
3635         return 0;
3636 }
3637
3638 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3639                                  int attr)
3640 {
3641         struct nlattr *rate;
3642         u32 bitrate;
3643         u16 bitrate_compat;
3644         enum nl80211_attrs rate_flg;
3645
3646         rate = nla_nest_start(msg, attr);
3647         if (!rate)
3648                 return false;
3649
3650         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3651         bitrate = cfg80211_calculate_bitrate(info);
3652         /* report 16-bit bitrate only if we can */
3653         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3654         if (bitrate > 0 &&
3655             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3656                 return false;
3657         if (bitrate_compat > 0 &&
3658             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3659                 return false;
3660
3661         switch (info->bw) {
3662         case RATE_INFO_BW_5:
3663                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3664                 break;
3665         case RATE_INFO_BW_10:
3666                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3667                 break;
3668         default:
3669                 WARN_ON(1);
3670                 /* fall through */
3671         case RATE_INFO_BW_20:
3672                 rate_flg = 0;
3673                 break;
3674         case RATE_INFO_BW_40:
3675                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3676                 break;
3677         case RATE_INFO_BW_80:
3678                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3679                 break;
3680         case RATE_INFO_BW_160:
3681                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3682                 break;
3683         }
3684
3685         if (rate_flg && nla_put_flag(msg, rate_flg))
3686                 return false;
3687
3688         if (info->flags & RATE_INFO_FLAGS_MCS) {
3689                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3690                         return false;
3691                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3692                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3693                         return false;
3694         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3695                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3696                         return false;
3697                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3698                         return false;
3699                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3700                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3701                         return false;
3702         }
3703
3704         nla_nest_end(msg, rate);
3705         return true;
3706 }
3707
3708 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3709                                int id)
3710 {
3711         void *attr;
3712         int i = 0;
3713
3714         if (!mask)
3715                 return true;
3716
3717         attr = nla_nest_start(msg, id);
3718         if (!attr)
3719                 return false;
3720
3721         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3722                 if (!(mask & BIT(i)))
3723                         continue;
3724
3725                 if (nla_put_u8(msg, i, signal[i]))
3726                         return false;
3727         }
3728
3729         nla_nest_end(msg, attr);
3730
3731         return true;
3732 }
3733
3734 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3735                                 u32 seq, int flags,
3736                                 struct cfg80211_registered_device *rdev,
3737                                 struct net_device *dev,
3738                                 const u8 *mac_addr, struct station_info *sinfo)
3739 {
3740         void *hdr;
3741         struct nlattr *sinfoattr, *bss_param;
3742
3743         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3744         if (!hdr)
3745                 return -1;
3746
3747         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3748             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3749             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3750                 goto nla_put_failure;
3751
3752         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3753         if (!sinfoattr)
3754                 goto nla_put_failure;
3755
3756 #define PUT_SINFO(attr, memb, type) do {                                \
3757         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3758             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3759                              sinfo->memb))                              \
3760                 goto nla_put_failure;                                   \
3761         } while (0)
3762
3763         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3764         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3765
3766         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3767                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3768             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3769                         (u32)sinfo->rx_bytes))
3770                 goto nla_put_failure;
3771
3772         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3773                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3774             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3775                         (u32)sinfo->tx_bytes))
3776                 goto nla_put_failure;
3777
3778         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3779         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3780         PUT_SINFO(LLID, llid, u16);
3781         PUT_SINFO(PLID, plid, u16);
3782         PUT_SINFO(PLINK_STATE, plink_state, u8);
3783
3784         switch (rdev->wiphy.signal_type) {
3785         case CFG80211_SIGNAL_TYPE_MBM:
3786                 PUT_SINFO(SIGNAL, signal, u8);
3787                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3788                 break;
3789         default:
3790                 break;
3791         }
3792         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3793                 if (!nl80211_put_signal(msg, sinfo->chains,
3794                                         sinfo->chain_signal,
3795                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3796                         goto nla_put_failure;
3797         }
3798         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3799                 if (!nl80211_put_signal(msg, sinfo->chains,
3800                                         sinfo->chain_signal_avg,
3801                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3802                         goto nla_put_failure;
3803         }
3804         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3805                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3806                                           NL80211_STA_INFO_TX_BITRATE))
3807                         goto nla_put_failure;
3808         }
3809         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3810                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3811                                           NL80211_STA_INFO_RX_BITRATE))
3812                         goto nla_put_failure;
3813         }
3814
3815         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3816         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3817         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3818         PUT_SINFO(TX_FAILED, tx_failed, u32);
3819         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3820         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3821         PUT_SINFO(LOCAL_PM, local_pm, u32);
3822         PUT_SINFO(PEER_PM, peer_pm, u32);
3823         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3824
3825         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3826                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3827                 if (!bss_param)
3828                         goto nla_put_failure;
3829
3830                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3831                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3832                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3833                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3834                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3835                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3836                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3837                                sinfo->bss_param.dtim_period) ||
3838                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3839                                 sinfo->bss_param.beacon_interval))
3840                         goto nla_put_failure;
3841
3842                 nla_nest_end(msg, bss_param);
3843         }
3844         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3845             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3846                     sizeof(struct nl80211_sta_flag_update),
3847                     &sinfo->sta_flags))
3848                 goto nla_put_failure;
3849
3850         PUT_SINFO(T_OFFSET, t_offset, u64);
3851         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3852         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3853         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3854
3855 #undef PUT_SINFO
3856
3857         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3858                 struct nlattr *tidsattr;
3859                 int tid;
3860
3861                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3862                 if (!tidsattr)
3863                         goto nla_put_failure;
3864
3865                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3866                         struct cfg80211_tid_stats *tidstats;
3867                         struct nlattr *tidattr;
3868
3869                         tidstats = &sinfo->pertid[tid];
3870
3871                         if (!tidstats->filled)
3872                                 continue;
3873
3874                         tidattr = nla_nest_start(msg, tid + 1);
3875                         if (!tidattr)
3876                                 goto nla_put_failure;
3877
3878 #define PUT_TIDVAL(attr, memb, type) do {                               \
3879         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3880             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3881                              tidstats->memb))                           \
3882                 goto nla_put_failure;                                   \
3883         } while (0)
3884
3885                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3886                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3887                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3888                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3889
3890 #undef PUT_TIDVAL
3891                         nla_nest_end(msg, tidattr);
3892                 }
3893
3894                 nla_nest_end(msg, tidsattr);
3895         }
3896
3897         nla_nest_end(msg, sinfoattr);
3898
3899         if (sinfo->assoc_req_ies_len &&
3900             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3901                     sinfo->assoc_req_ies))
3902                 goto nla_put_failure;
3903
3904         genlmsg_end(msg, hdr);
3905         return 0;
3906
3907  nla_put_failure:
3908         genlmsg_cancel(msg, hdr);
3909         return -EMSGSIZE;
3910 }
3911
3912 static int nl80211_dump_station(struct sk_buff *skb,
3913                                 struct netlink_callback *cb)
3914 {
3915         struct station_info sinfo;
3916         struct cfg80211_registered_device *rdev;
3917         struct wireless_dev *wdev;
3918         u8 mac_addr[ETH_ALEN];
3919         int sta_idx = cb->args[2];
3920         int err;
3921
3922         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3923         if (err)
3924                 return err;
3925
3926         if (!wdev->netdev) {
3927                 err = -EINVAL;
3928                 goto out_err;
3929         }
3930
3931         if (!rdev->ops->dump_station) {
3932                 err = -EOPNOTSUPP;
3933                 goto out_err;
3934         }
3935
3936         while (1) {
3937                 memset(&sinfo, 0, sizeof(sinfo));
3938                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3939                                         mac_addr, &sinfo);
3940                 if (err == -ENOENT)
3941                         break;
3942                 if (err)
3943                         goto out_err;
3944
3945                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3946                                 NETLINK_CB(cb->skb).portid,
3947                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3948                                 rdev, wdev->netdev, mac_addr,
3949                                 &sinfo) < 0)
3950                         goto out;
3951
3952                 sta_idx++;
3953         }
3954
3955
3956  out:
3957         cb->args[2] = sta_idx;
3958         err = skb->len;
3959  out_err:
3960         nl80211_finish_wdev_dump(rdev);
3961
3962         return err;
3963 }
3964
3965 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3966 {
3967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3968         struct net_device *dev = info->user_ptr[1];
3969         struct station_info sinfo;
3970         struct sk_buff *msg;
3971         u8 *mac_addr = NULL;
3972         int err;
3973
3974         memset(&sinfo, 0, sizeof(sinfo));
3975
3976         if (!info->attrs[NL80211_ATTR_MAC])
3977                 return -EINVAL;
3978
3979         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3980
3981         if (!rdev->ops->get_station)
3982                 return -EOPNOTSUPP;
3983
3984         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3985         if (err)
3986                 return err;
3987
3988         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3989         if (!msg)
3990                 return -ENOMEM;
3991
3992         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3993                                  info->snd_portid, info->snd_seq, 0,
3994                                  rdev, dev, mac_addr, &sinfo) < 0) {
3995                 nlmsg_free(msg);
3996                 return -ENOBUFS;
3997         }
3998
3999         return genlmsg_reply(msg, info);
4000 }
4001
4002 int cfg80211_check_station_change(struct wiphy *wiphy,
4003                                   struct station_parameters *params,
4004                                   enum cfg80211_station_type statype)
4005 {
4006         if (params->listen_interval != -1 &&
4007             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4008                 return -EINVAL;
4009
4010         if (params->support_p2p_ps != -1 &&
4011             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4012                 return -EINVAL;
4013
4014         if (params->aid &&
4015             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4016             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4017                 return -EINVAL;
4018
4019         /* When you run into this, adjust the code below for the new flag */
4020         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4021
4022         switch (statype) {
4023         case CFG80211_STA_MESH_PEER_KERNEL:
4024         case CFG80211_STA_MESH_PEER_USER:
4025                 /*
4026                  * No ignoring the TDLS flag here -- the userspace mesh
4027                  * code doesn't have the bug of including TDLS in the
4028                  * mask everywhere.
4029                  */
4030                 if (params->sta_flags_mask &
4031                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4032                                   BIT(NL80211_STA_FLAG_MFP) |
4033                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4034                         return -EINVAL;
4035                 break;
4036         case CFG80211_STA_TDLS_PEER_SETUP:
4037         case CFG80211_STA_TDLS_PEER_ACTIVE:
4038                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4039                         return -EINVAL;
4040                 /* ignore since it can't change */
4041                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4042                 break;
4043         default:
4044                 /* disallow mesh-specific things */
4045                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4046                         return -EINVAL;
4047                 if (params->local_pm)
4048                         return -EINVAL;
4049                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4050                         return -EINVAL;
4051         }
4052
4053         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4054             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4055                 /* TDLS can't be set, ... */
4056                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4057                         return -EINVAL;
4058                 /*
4059                  * ... but don't bother the driver with it. This works around
4060                  * a hostapd/wpa_supplicant issue -- it always includes the
4061                  * TLDS_PEER flag in the mask even for AP mode.
4062                  */
4063                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4064         }
4065
4066         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4067             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4068                 /* reject other things that can't change */
4069                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4070                         return -EINVAL;
4071                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4072                         return -EINVAL;
4073                 if (params->supported_rates)
4074                         return -EINVAL;
4075                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4076                         return -EINVAL;
4077         }
4078
4079         if (statype != CFG80211_STA_AP_CLIENT &&
4080             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4081                 if (params->vlan)
4082                         return -EINVAL;
4083         }
4084
4085         switch (statype) {
4086         case CFG80211_STA_AP_MLME_CLIENT:
4087                 /* Use this only for authorizing/unauthorizing a station */
4088                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4089                         return -EOPNOTSUPP;
4090                 break;
4091         case CFG80211_STA_AP_CLIENT:
4092         case CFG80211_STA_AP_CLIENT_UNASSOC:
4093                 /* accept only the listed bits */
4094                 if (params->sta_flags_mask &
4095                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4096                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4097                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4098                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4099                                   BIT(NL80211_STA_FLAG_WME) |
4100                                   BIT(NL80211_STA_FLAG_MFP)))
4101                         return -EINVAL;
4102
4103                 /* but authenticated/associated only if driver handles it */
4104                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4105                     params->sta_flags_mask &
4106                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4107                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4108                         return -EINVAL;
4109                 break;
4110         case CFG80211_STA_IBSS:
4111         case CFG80211_STA_AP_STA:
4112                 /* reject any changes other than AUTHORIZED */
4113                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4114                         return -EINVAL;
4115                 break;
4116         case CFG80211_STA_TDLS_PEER_SETUP:
4117                 /* reject any changes other than AUTHORIZED or WME */
4118                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4119                                                BIT(NL80211_STA_FLAG_WME)))
4120                         return -EINVAL;
4121                 /* force (at least) rates when authorizing */
4122                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4123                     !params->supported_rates)
4124                         return -EINVAL;
4125                 break;
4126         case CFG80211_STA_TDLS_PEER_ACTIVE:
4127                 /* reject any changes */
4128                 return -EINVAL;
4129         case CFG80211_STA_MESH_PEER_KERNEL:
4130                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4131                         return -EINVAL;
4132                 break;
4133         case CFG80211_STA_MESH_PEER_USER:
4134                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4135                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4136                         return -EINVAL;
4137                 break;
4138         }
4139
4140         return 0;
4141 }
4142 EXPORT_SYMBOL(cfg80211_check_station_change);
4143
4144 /*
4145  * Get vlan interface making sure it is running and on the right wiphy.
4146  */
4147 static struct net_device *get_vlan(struct genl_info *info,
4148                                    struct cfg80211_registered_device *rdev)
4149 {
4150         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4151         struct net_device *v;
4152         int ret;
4153
4154         if (!vlanattr)
4155                 return NULL;
4156
4157         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4158         if (!v)
4159                 return ERR_PTR(-ENODEV);
4160
4161         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4162                 ret = -EINVAL;
4163                 goto error;
4164         }
4165
4166         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4167             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4168             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4169                 ret = -EINVAL;
4170                 goto error;
4171         }
4172
4173         if (!netif_running(v)) {
4174                 ret = -ENETDOWN;
4175                 goto error;
4176         }
4177
4178         return v;
4179  error:
4180         dev_put(v);
4181         return ERR_PTR(ret);
4182 }
4183
4184 static const struct nla_policy
4185 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4186         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4187         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4188 };
4189
4190 static int nl80211_parse_sta_wme(struct genl_info *info,
4191                                  struct station_parameters *params)
4192 {
4193         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4194         struct nlattr *nla;
4195         int err;
4196
4197         /* parse WME attributes if present */
4198         if (!info->attrs[NL80211_ATTR_STA_WME])
4199                 return 0;
4200
4201         nla = info->attrs[NL80211_ATTR_STA_WME];
4202         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4203                                nl80211_sta_wme_policy);
4204         if (err)
4205                 return err;
4206
4207         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4208                 params->uapsd_queues = nla_get_u8(
4209                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4210         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4211                 return -EINVAL;
4212
4213         if (tb[NL80211_STA_WME_MAX_SP])
4214                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4215
4216         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4217                 return -EINVAL;
4218
4219         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4220
4221         return 0;
4222 }
4223
4224 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4225                                       struct station_parameters *params)
4226 {
4227         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4228                 params->supported_channels =
4229                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4230                 params->supported_channels_len =
4231                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4232                 /*
4233                  * Need to include at least one (first channel, number of
4234                  * channels) tuple for each subband, and must have proper
4235                  * tuples for the rest of the data as well.
4236                  */
4237                 if (params->supported_channels_len < 2)
4238                         return -EINVAL;
4239                 if (params->supported_channels_len % 2)
4240                         return -EINVAL;
4241         }
4242
4243         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4244                 params->supported_oper_classes =
4245                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4246                 params->supported_oper_classes_len =
4247                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4248                 /*
4249                  * The value of the Length field of the Supported Operating
4250                  * Classes element is between 2 and 253.
4251                  */
4252                 if (params->supported_oper_classes_len < 2 ||
4253                     params->supported_oper_classes_len > 253)
4254                         return -EINVAL;
4255         }
4256         return 0;
4257 }
4258
4259 static int nl80211_set_station_tdls(struct genl_info *info,
4260                                     struct station_parameters *params)
4261 {
4262         int err;
4263         /* Dummy STA entry gets updated once the peer capabilities are known */
4264         if (info->attrs[NL80211_ATTR_PEER_AID])
4265                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4266         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4267                 params->ht_capa =
4268                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4269         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4270                 params->vht_capa =
4271                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4272
4273         err = nl80211_parse_sta_channel_info(info, params);
4274         if (err)
4275                 return err;
4276
4277         return nl80211_parse_sta_wme(info, params);
4278 }
4279
4280 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4281 {
4282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4283         struct net_device *dev = info->user_ptr[1];
4284         struct station_parameters params;
4285         u8 *mac_addr;
4286         int err;
4287
4288         memset(&params, 0, sizeof(params));
4289
4290         if (!rdev->ops->change_station)
4291                 return -EOPNOTSUPP;
4292
4293         /*
4294          * AID and listen_interval properties can be set only for unassociated
4295          * station. Include these parameters here and will check them in
4296          * cfg80211_check_station_change().
4297          */
4298         if (info->attrs[NL80211_ATTR_STA_AID])
4299                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4300
4301         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4302                 params.listen_interval =
4303                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4304         else
4305                 params.listen_interval = -1;
4306
4307         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4308                 u8 tmp;
4309
4310                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4311                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4312                         return -EINVAL;
4313
4314                 params.support_p2p_ps = tmp;
4315         } else {
4316                 params.support_p2p_ps = -1;
4317         }
4318
4319         if (!info->attrs[NL80211_ATTR_MAC])
4320                 return -EINVAL;
4321
4322         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4323
4324         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4325                 params.supported_rates =
4326                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4327                 params.supported_rates_len =
4328                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4329         }
4330
4331         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4332                 params.capability =
4333                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4334                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4335         }
4336
4337         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4338                 params.ext_capab =
4339                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4340                 params.ext_capab_len =
4341                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4342         }
4343
4344         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4345                 return -EINVAL;
4346
4347         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4348                 params.plink_action =
4349                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4350                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4351                         return -EINVAL;
4352         }
4353
4354         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4355                 params.plink_state =
4356                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4357                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4358                         return -EINVAL;
4359                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4360         }
4361
4362         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4363                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4364                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4365
4366                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4367                     pm > NL80211_MESH_POWER_MAX)
4368                         return -EINVAL;
4369
4370                 params.local_pm = pm;
4371         }
4372
4373         /* Include parameters for TDLS peer (will check later) */
4374         err = nl80211_set_station_tdls(info, &params);
4375         if (err)
4376                 return err;
4377
4378         params.vlan = get_vlan(info, rdev);
4379         if (IS_ERR(params.vlan))
4380                 return PTR_ERR(params.vlan);
4381
4382         switch (dev->ieee80211_ptr->iftype) {
4383         case NL80211_IFTYPE_AP:
4384         case NL80211_IFTYPE_AP_VLAN:
4385         case NL80211_IFTYPE_P2P_GO:
4386         case NL80211_IFTYPE_P2P_CLIENT:
4387         case NL80211_IFTYPE_STATION:
4388         case NL80211_IFTYPE_ADHOC:
4389         case NL80211_IFTYPE_MESH_POINT:
4390                 break;
4391         default:
4392                 err = -EOPNOTSUPP;
4393                 goto out_put_vlan;
4394         }
4395
4396         /* driver will call cfg80211_check_station_change() */
4397         err = rdev_change_station(rdev, dev, mac_addr, &params);
4398
4399  out_put_vlan:
4400         if (params.vlan)
4401                 dev_put(params.vlan);
4402
4403         return err;
4404 }
4405
4406 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4407 {
4408         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4409         int err;
4410         struct net_device *dev = info->user_ptr[1];
4411         struct station_parameters params;
4412         u8 *mac_addr = NULL;
4413         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4414                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4415
4416         memset(&params, 0, sizeof(params));
4417
4418         if (!rdev->ops->add_station)
4419                 return -EOPNOTSUPP;
4420
4421         if (!info->attrs[NL80211_ATTR_MAC])
4422                 return -EINVAL;
4423
4424         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4425                 return -EINVAL;
4426
4427         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4428                 return -EINVAL;
4429
4430         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4431             !info->attrs[NL80211_ATTR_PEER_AID])
4432                 return -EINVAL;
4433
4434         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4435         params.supported_rates =
4436                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4437         params.supported_rates_len =
4438                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4439         params.listen_interval =
4440                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4441
4442         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4443                 u8 tmp;
4444
4445                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4446                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4447                         return -EINVAL;
4448
4449                 params.support_p2p_ps = tmp;
4450         } else {
4451                 /*
4452                  * if not specified, assume it's supported for P2P GO interface,
4453                  * and is NOT supported for AP interface
4454                  */
4455                 params.support_p2p_ps =
4456                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4457         }
4458
4459         if (info->attrs[NL80211_ATTR_PEER_AID])
4460                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4461         else
4462                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4463         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4464                 return -EINVAL;
4465
4466         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4467                 params.capability =
4468                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4469                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4470         }
4471
4472         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4473                 params.ext_capab =
4474                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4475                 params.ext_capab_len =
4476                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4477         }
4478
4479         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4480                 params.ht_capa =
4481                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4482
4483         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4484                 params.vht_capa =
4485                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4486
4487         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4488                 params.opmode_notif_used = true;
4489                 params.opmode_notif =
4490                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4491         }
4492
4493         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4494                 params.plink_action =
4495                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4496                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4497                         return -EINVAL;
4498         }
4499
4500         err = nl80211_parse_sta_channel_info(info, &params);
4501         if (err)
4502                 return err;
4503
4504         err = nl80211_parse_sta_wme(info, &params);
4505         if (err)
4506                 return err;
4507
4508         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4509                 return -EINVAL;
4510
4511         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4512          * as userspace might just pass through the capabilities from the IEs
4513          * directly, rather than enforcing this restriction and returning an
4514          * error in this case.
4515          */
4516         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4517                 params.ht_capa = NULL;
4518                 params.vht_capa = NULL;
4519         }
4520
4521         /* When you run into this, adjust the code below for the new flag */
4522         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4523
4524         switch (dev->ieee80211_ptr->iftype) {
4525         case NL80211_IFTYPE_AP:
4526         case NL80211_IFTYPE_AP_VLAN:
4527         case NL80211_IFTYPE_P2P_GO:
4528                 /* ignore WME attributes if iface/sta is not capable */
4529                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4530                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4531                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4532
4533                 /* TDLS peers cannot be added */
4534                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4535                     info->attrs[NL80211_ATTR_PEER_AID])
4536                         return -EINVAL;
4537                 /* but don't bother the driver with it */
4538                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4539
4540                 /* allow authenticated/associated only if driver handles it */
4541                 if (!(rdev->wiphy.features &
4542                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4543                     params.sta_flags_mask & auth_assoc)
4544                         return -EINVAL;
4545
4546                 /* Older userspace, or userspace wanting to be compatible with
4547                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
4548                  * and assoc flags in the mask, but assumes the station will be
4549                  * added as associated anyway since this was the required driver
4550                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
4551                  * introduced.
4552                  * In order to not bother drivers with this quirk in the API
4553                  * set the flags in both the mask and set for new stations in
4554                  * this case.
4555                  */
4556                 if (!(params.sta_flags_mask & auth_assoc)) {
4557                         params.sta_flags_mask |= auth_assoc;
4558                         params.sta_flags_set |= auth_assoc;
4559                 }
4560
4561                 /* must be last in here for error handling */
4562                 params.vlan = get_vlan(info, rdev);
4563                 if (IS_ERR(params.vlan))
4564                         return PTR_ERR(params.vlan);
4565                 break;
4566         case NL80211_IFTYPE_MESH_POINT:
4567                 /* ignore uAPSD data */
4568                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4569
4570                 /* associated is disallowed */
4571                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4572                         return -EINVAL;
4573                 /* TDLS peers cannot be added */
4574                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4575                     info->attrs[NL80211_ATTR_PEER_AID])
4576                         return -EINVAL;
4577                 break;
4578         case NL80211_IFTYPE_STATION:
4579         case NL80211_IFTYPE_P2P_CLIENT:
4580                 /* ignore uAPSD data */
4581                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4582
4583                 /* these are disallowed */
4584                 if (params.sta_flags_mask &
4585                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4586                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4587                         return -EINVAL;
4588                 /* Only TDLS peers can be added */
4589                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4590                         return -EINVAL;
4591                 /* Can only add if TDLS ... */
4592                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4593                         return -EOPNOTSUPP;
4594                 /* ... with external setup is supported */
4595                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4596                         return -EOPNOTSUPP;
4597                 /*
4598                  * Older wpa_supplicant versions always mark the TDLS peer
4599                  * as authorized, but it shouldn't yet be.
4600                  */
4601                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4602                 break;
4603         default:
4604                 return -EOPNOTSUPP;
4605         }
4606
4607         /* be aware of params.vlan when changing code here */
4608
4609         err = rdev_add_station(rdev, dev, mac_addr, &params);
4610
4611         if (params.vlan)
4612                 dev_put(params.vlan);
4613         return err;
4614 }
4615
4616 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4617 {
4618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4619         struct net_device *dev = info->user_ptr[1];
4620         struct station_del_parameters params;
4621
4622         memset(&params, 0, sizeof(params));
4623
4624         if (info->attrs[NL80211_ATTR_MAC])
4625                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4626
4627         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4628             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4629             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4630             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4631                 return -EINVAL;
4632
4633         if (!rdev->ops->del_station)
4634                 return -EOPNOTSUPP;
4635
4636         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4637                 params.subtype =
4638                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4639                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4640                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4641                         return -EINVAL;
4642         } else {
4643                 /* Default to Deauthentication frame */
4644                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4645         }
4646
4647         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4648                 params.reason_code =
4649                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4650                 if (params.reason_code == 0)
4651                         return -EINVAL; /* 0 is reserved */
4652         } else {
4653                 /* Default to reason code 2 */
4654                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4655         }
4656
4657         return rdev_del_station(rdev, dev, &params);
4658 }
4659
4660 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4661                                 int flags, struct net_device *dev,
4662                                 u8 *dst, u8 *next_hop,
4663                                 struct mpath_info *pinfo)
4664 {
4665         void *hdr;
4666         struct nlattr *pinfoattr;
4667
4668         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4669         if (!hdr)
4670                 return -1;
4671
4672         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4673             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4674             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4675             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4676                 goto nla_put_failure;
4677
4678         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4679         if (!pinfoattr)
4680                 goto nla_put_failure;
4681         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4682             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4683                         pinfo->frame_qlen))
4684                 goto nla_put_failure;
4685         if (((pinfo->filled & MPATH_INFO_SN) &&
4686              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4687             ((pinfo->filled & MPATH_INFO_METRIC) &&
4688              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4689                          pinfo->metric)) ||
4690             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4691              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4692                          pinfo->exptime)) ||
4693             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4694              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4695                         pinfo->flags)) ||
4696             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4697              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4698                          pinfo->discovery_timeout)) ||
4699             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4700              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4701                         pinfo->discovery_retries)))
4702                 goto nla_put_failure;
4703
4704         nla_nest_end(msg, pinfoattr);
4705
4706         genlmsg_end(msg, hdr);
4707         return 0;
4708
4709  nla_put_failure:
4710         genlmsg_cancel(msg, hdr);
4711         return -EMSGSIZE;
4712 }
4713
4714 static int nl80211_dump_mpath(struct sk_buff *skb,
4715                               struct netlink_callback *cb)
4716 {
4717         struct mpath_info pinfo;
4718         struct cfg80211_registered_device *rdev;
4719         struct wireless_dev *wdev;
4720         u8 dst[ETH_ALEN];
4721         u8 next_hop[ETH_ALEN];
4722         int path_idx = cb->args[2];
4723         int err;
4724
4725         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4726         if (err)
4727                 return err;
4728
4729         if (!rdev->ops->dump_mpath) {
4730                 err = -EOPNOTSUPP;
4731                 goto out_err;
4732         }
4733
4734         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4735                 err = -EOPNOTSUPP;
4736                 goto out_err;
4737         }
4738
4739         while (1) {
4740                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4741                                       next_hop, &pinfo);
4742                 if (err == -ENOENT)
4743                         break;
4744                 if (err)
4745                         goto out_err;
4746
4747                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4748                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4749                                        wdev->netdev, dst, next_hop,
4750                                        &pinfo) < 0)
4751                         goto out;
4752
4753                 path_idx++;
4754         }
4755
4756
4757  out:
4758         cb->args[2] = path_idx;
4759         err = skb->len;
4760  out_err:
4761         nl80211_finish_wdev_dump(rdev);
4762         return err;
4763 }
4764
4765 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4766 {
4767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4768         int err;
4769         struct net_device *dev = info->user_ptr[1];
4770         struct mpath_info pinfo;
4771         struct sk_buff *msg;
4772         u8 *dst = NULL;
4773         u8 next_hop[ETH_ALEN];
4774
4775         memset(&pinfo, 0, sizeof(pinfo));
4776
4777         if (!info->attrs[NL80211_ATTR_MAC])
4778                 return -EINVAL;
4779
4780         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4781
4782         if (!rdev->ops->get_mpath)
4783                 return -EOPNOTSUPP;
4784
4785         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4786                 return -EOPNOTSUPP;
4787
4788         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4789         if (err)
4790                 return err;
4791
4792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4793         if (!msg)
4794                 return -ENOMEM;
4795
4796         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4797                                  dev, dst, next_hop, &pinfo) < 0) {
4798                 nlmsg_free(msg);
4799                 return -ENOBUFS;
4800         }
4801
4802         return genlmsg_reply(msg, info);
4803 }
4804
4805 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4806 {
4807         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4808         struct net_device *dev = info->user_ptr[1];
4809         u8 *dst = NULL;
4810         u8 *next_hop = NULL;
4811
4812         if (!info->attrs[NL80211_ATTR_MAC])
4813                 return -EINVAL;
4814
4815         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4816                 return -EINVAL;
4817
4818         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4819         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4820
4821         if (!rdev->ops->change_mpath)
4822                 return -EOPNOTSUPP;
4823
4824         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4825                 return -EOPNOTSUPP;
4826
4827         return rdev_change_mpath(rdev, dev, dst, next_hop);
4828 }
4829
4830 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4831 {
4832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4833         struct net_device *dev = info->user_ptr[1];
4834         u8 *dst = NULL;
4835         u8 *next_hop = NULL;
4836
4837         if (!info->attrs[NL80211_ATTR_MAC])
4838                 return -EINVAL;
4839
4840         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4841                 return -EINVAL;
4842
4843         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4844         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4845
4846         if (!rdev->ops->add_mpath)
4847                 return -EOPNOTSUPP;
4848
4849         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4850                 return -EOPNOTSUPP;
4851
4852         return rdev_add_mpath(rdev, dev, dst, next_hop);
4853 }
4854
4855 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4856 {
4857         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4858         struct net_device *dev = info->user_ptr[1];
4859         u8 *dst = NULL;
4860
4861         if (info->attrs[NL80211_ATTR_MAC])
4862                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4863
4864         if (!rdev->ops->del_mpath)
4865                 return -EOPNOTSUPP;
4866
4867         return rdev_del_mpath(rdev, dev, dst);
4868 }
4869
4870 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4871 {
4872         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4873         int err;
4874         struct net_device *dev = info->user_ptr[1];
4875         struct mpath_info pinfo;
4876         struct sk_buff *msg;
4877         u8 *dst = NULL;
4878         u8 mpp[ETH_ALEN];
4879
4880         memset(&pinfo, 0, sizeof(pinfo));
4881
4882         if (!info->attrs[NL80211_ATTR_MAC])
4883                 return -EINVAL;
4884
4885         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4886
4887         if (!rdev->ops->get_mpp)
4888                 return -EOPNOTSUPP;
4889
4890         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4891                 return -EOPNOTSUPP;
4892
4893         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4894         if (err)
4895                 return err;
4896
4897         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4898         if (!msg)
4899                 return -ENOMEM;
4900
4901         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4902                                dev, dst, mpp, &pinfo) < 0) {
4903                 nlmsg_free(msg);
4904                 return -ENOBUFS;
4905         }
4906
4907         return genlmsg_reply(msg, info);
4908 }
4909
4910 static int nl80211_dump_mpp(struct sk_buff *skb,
4911                             struct netlink_callback *cb)
4912 {
4913         struct mpath_info pinfo;
4914         struct cfg80211_registered_device *rdev;
4915         struct wireless_dev *wdev;
4916         u8 dst[ETH_ALEN];
4917         u8 mpp[ETH_ALEN];
4918         int path_idx = cb->args[2];
4919         int err;
4920
4921         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4922         if (err)
4923                 return err;
4924
4925         if (!rdev->ops->dump_mpp) {
4926                 err = -EOPNOTSUPP;
4927                 goto out_err;
4928         }
4929
4930         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4931                 err = -EOPNOTSUPP;
4932                 goto out_err;
4933         }
4934
4935         while (1) {
4936                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4937                                     mpp, &pinfo);
4938                 if (err == -ENOENT)
4939                         break;
4940                 if (err)
4941                         goto out_err;
4942
4943                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4944                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4945                                        wdev->netdev, dst, mpp,
4946                                        &pinfo) < 0)
4947                         goto out;
4948
4949                 path_idx++;
4950         }
4951
4952  out:
4953         cb->args[2] = path_idx;
4954         err = skb->len;
4955  out_err:
4956         nl80211_finish_wdev_dump(rdev);
4957         return err;
4958 }
4959
4960 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4961 {
4962         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4963         struct net_device *dev = info->user_ptr[1];
4964         struct wireless_dev *wdev = dev->ieee80211_ptr;
4965         struct bss_parameters params;
4966         int err;
4967
4968         memset(&params, 0, sizeof(params));
4969         /* default to not changing parameters */
4970         params.use_cts_prot = -1;
4971         params.use_short_preamble = -1;
4972         params.use_short_slot_time = -1;
4973         params.ap_isolate = -1;
4974         params.ht_opmode = -1;
4975         params.p2p_ctwindow = -1;
4976         params.p2p_opp_ps = -1;
4977
4978         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4979                 params.use_cts_prot =
4980                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4981         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4982                 params.use_short_preamble =
4983                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4984         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4985                 params.use_short_slot_time =
4986                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4987         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4988                 params.basic_rates =
4989                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4990                 params.basic_rates_len =
4991                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4992         }
4993         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4994                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4995         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4996                 params.ht_opmode =
4997                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4998
4999         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5000                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5001                         return -EINVAL;
5002                 params.p2p_ctwindow =
5003                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5004                 if (params.p2p_ctwindow < 0)
5005                         return -EINVAL;
5006                 if (params.p2p_ctwindow != 0 &&
5007                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5008                         return -EINVAL;
5009         }
5010
5011         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5012                 u8 tmp;
5013
5014                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5015                         return -EINVAL;
5016                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5017                 if (tmp > 1)
5018                         return -EINVAL;
5019                 params.p2p_opp_ps = tmp;
5020                 if (params.p2p_opp_ps &&
5021                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5022                         return -EINVAL;
5023         }
5024
5025         if (!rdev->ops->change_bss)
5026                 return -EOPNOTSUPP;
5027
5028         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5029             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5030                 return -EOPNOTSUPP;
5031
5032         wdev_lock(wdev);
5033         err = rdev_change_bss(rdev, dev, &params);
5034         wdev_unlock(wdev);
5035
5036         return err;
5037 }
5038
5039 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5040 {
5041         char *data = NULL;
5042         bool is_indoor;
5043         enum nl80211_user_reg_hint_type user_reg_hint_type;
5044         u32 owner_nlportid;
5045
5046
5047         /*
5048          * You should only get this when cfg80211 hasn't yet initialized
5049          * completely when built-in to the kernel right between the time
5050          * window between nl80211_init() and regulatory_init(), if that is
5051          * even possible.
5052          */
5053         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5054                 return -EINPROGRESS;
5055
5056         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5057                 user_reg_hint_type =
5058                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5059         else
5060                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5061
5062         switch (user_reg_hint_type) {
5063         case NL80211_USER_REG_HINT_USER:
5064         case NL80211_USER_REG_HINT_CELL_BASE:
5065                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5066                         return -EINVAL;
5067
5068                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5069                 return regulatory_hint_user(data, user_reg_hint_type);
5070         case NL80211_USER_REG_HINT_INDOOR:
5071                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5072                         owner_nlportid = info->snd_portid;
5073                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5074                 } else {
5075                         owner_nlportid = 0;
5076                         is_indoor = true;
5077                 }
5078
5079                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5080         default:
5081                 return -EINVAL;
5082         }
5083 }
5084
5085 static int nl80211_get_mesh_config(struct sk_buff *skb,
5086                                    struct genl_info *info)
5087 {
5088         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5089         struct net_device *dev = info->user_ptr[1];
5090         struct wireless_dev *wdev = dev->ieee80211_ptr;
5091         struct mesh_config cur_params;
5092         int err = 0;
5093         void *hdr;
5094         struct nlattr *pinfoattr;
5095         struct sk_buff *msg;
5096
5097         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5098                 return -EOPNOTSUPP;
5099
5100         if (!rdev->ops->get_mesh_config)
5101                 return -EOPNOTSUPP;
5102
5103         wdev_lock(wdev);
5104         /* If not connected, get default parameters */
5105         if (!wdev->mesh_id_len)
5106                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5107         else
5108                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5109         wdev_unlock(wdev);
5110
5111         if (err)
5112                 return err;
5113
5114         /* Draw up a netlink message to send back */
5115         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5116         if (!msg)
5117                 return -ENOMEM;
5118         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5119                              NL80211_CMD_GET_MESH_CONFIG);
5120         if (!hdr)
5121                 goto out;
5122         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5123         if (!pinfoattr)
5124                 goto nla_put_failure;
5125         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5126             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5127                         cur_params.dot11MeshRetryTimeout) ||
5128             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5129                         cur_params.dot11MeshConfirmTimeout) ||
5130             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5131                         cur_params.dot11MeshHoldingTimeout) ||
5132             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5133                         cur_params.dot11MeshMaxPeerLinks) ||
5134             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5135                        cur_params.dot11MeshMaxRetries) ||
5136             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5137                        cur_params.dot11MeshTTL) ||
5138             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5139                        cur_params.element_ttl) ||
5140             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5141                        cur_params.auto_open_plinks) ||
5142             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5143                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5144             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5145                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5146             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5147                         cur_params.path_refresh_time) ||
5148             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5149                         cur_params.min_discovery_timeout) ||
5150             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5151                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5152             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5153                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5154             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5155                         cur_params.dot11MeshHWMPperrMinInterval) ||
5156             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5157                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5158             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5159                        cur_params.dot11MeshHWMPRootMode) ||
5160             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5161                         cur_params.dot11MeshHWMPRannInterval) ||
5162             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5163                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5164             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5165                        cur_params.dot11MeshForwarding) ||
5166             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5167                         cur_params.rssi_threshold) ||
5168             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5169                         cur_params.ht_opmode) ||
5170             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5171                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5172             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5173                         cur_params.dot11MeshHWMProotInterval) ||
5174             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5175                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5176             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5177                         cur_params.power_mode) ||
5178             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5179                         cur_params.dot11MeshAwakeWindowDuration) ||
5180             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5181                         cur_params.plink_timeout))
5182                 goto nla_put_failure;
5183         nla_nest_end(msg, pinfoattr);
5184         genlmsg_end(msg, hdr);
5185         return genlmsg_reply(msg, info);
5186
5187  nla_put_failure:
5188         genlmsg_cancel(msg, hdr);
5189  out:
5190         nlmsg_free(msg);
5191         return -ENOBUFS;
5192 }
5193
5194 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5195         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5196         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5197         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5198         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5199         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5200         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5201         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5202         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5203         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5204         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5205         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5206         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5207         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5208         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5209         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5210         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5211         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5212         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5213         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5214         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5215         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5216         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5217         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5218         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5219         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5220         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5221         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5222         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5223 };
5224
5225 static const struct nla_policy
5226         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5227         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5228         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5229         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5230         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5231         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5232         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5233         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5234                                     .len = IEEE80211_MAX_DATA_LEN },
5235         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5236 };
5237
5238 static int nl80211_parse_mesh_config(struct genl_info *info,
5239                                      struct mesh_config *cfg,
5240                                      u32 *mask_out)
5241 {
5242         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5243         u32 mask = 0;
5244
5245 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5246 do {                                                                        \
5247         if (tb[attr]) {                                                     \
5248                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5249                         return -EINVAL;                                     \
5250                 cfg->param = fn(tb[attr]);                                  \
5251                 mask |= (1 << (attr - 1));                                  \
5252         }                                                                   \
5253 } while (0)
5254
5255
5256         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5257                 return -EINVAL;
5258         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5259                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5260                              nl80211_meshconf_params_policy))
5261                 return -EINVAL;
5262
5263         /* This makes sure that there aren't more than 32 mesh config
5264          * parameters (otherwise our bitfield scheme would not work.) */
5265         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5266
5267         /* Fill in the params struct */
5268         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5269                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5270                                   nla_get_u16);
5271         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5272                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5273                                   nla_get_u16);
5274         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5275                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5276                                   nla_get_u16);
5277         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5278                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5279                                   nla_get_u16);
5280         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5281                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5282                                   nla_get_u8);
5283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5284                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5286                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5287                                   nla_get_u8);
5288         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5289                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5290                                   nla_get_u8);
5291         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5292                                   1, 255, mask,
5293                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5294                                   nla_get_u32);
5295         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5296                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5297                                   nla_get_u8);
5298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5299                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5300                                   nla_get_u32);
5301         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5302                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5303                                   nla_get_u16);
5304         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5305                                   1, 65535, mask,
5306                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5307                                   nla_get_u32);
5308         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5309                                   1, 65535, mask,
5310                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5311                                   nla_get_u16);
5312         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5313                                   1, 65535, mask,
5314                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5315                                   nla_get_u16);
5316         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5317                                   dot11MeshHWMPnetDiameterTraversalTime,
5318                                   1, 65535, mask,
5319                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5320                                   nla_get_u16);
5321         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5322                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5323                                   nla_get_u8);
5324         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5325                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5326                                   nla_get_u16);
5327         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5328                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5329                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5330                                   nla_get_u8);
5331         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5332                                   mask, NL80211_MESHCONF_FORWARDING,
5333                                   nla_get_u8);
5334         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5335                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5336                                   nla_get_s32);
5337         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5338                                   mask, NL80211_MESHCONF_HT_OPMODE,
5339                                   nla_get_u16);
5340         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5341                                   1, 65535, mask,
5342                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5343                                   nla_get_u32);
5344         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5345                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5346                                   nla_get_u16);
5347         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5348                                   dot11MeshHWMPconfirmationInterval,
5349                                   1, 65535, mask,
5350                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5351                                   nla_get_u16);
5352         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5353                                   NL80211_MESH_POWER_ACTIVE,
5354                                   NL80211_MESH_POWER_MAX,
5355                                   mask, NL80211_MESHCONF_POWER_MODE,
5356                                   nla_get_u32);
5357         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5358                                   0, 65535, mask,
5359                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5360         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5361                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5362                                   nla_get_u32);
5363         if (mask_out)
5364                 *mask_out = mask;
5365
5366         return 0;
5367
5368 #undef FILL_IN_MESH_PARAM_IF_SET
5369 }
5370
5371 static int nl80211_parse_mesh_setup(struct genl_info *info,
5372                                      struct mesh_setup *setup)
5373 {
5374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5375         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5376
5377         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5378                 return -EINVAL;
5379         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5380                              info->attrs[NL80211_ATTR_MESH_SETUP],
5381                              nl80211_mesh_setup_params_policy))
5382                 return -EINVAL;
5383
5384         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5385                 setup->sync_method =
5386                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5387                  IEEE80211_SYNC_METHOD_VENDOR :
5388                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5389
5390         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5391                 setup->path_sel_proto =
5392                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5393                  IEEE80211_PATH_PROTOCOL_VENDOR :
5394                  IEEE80211_PATH_PROTOCOL_HWMP;
5395
5396         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5397                 setup->path_metric =
5398                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5399                  IEEE80211_PATH_METRIC_VENDOR :
5400                  IEEE80211_PATH_METRIC_AIRTIME;
5401
5402
5403         if (tb[NL80211_MESH_SETUP_IE]) {
5404                 struct nlattr *ieattr =
5405                         tb[NL80211_MESH_SETUP_IE];
5406                 if (!is_valid_ie_attr(ieattr))
5407                         return -EINVAL;
5408                 setup->ie = nla_data(ieattr);
5409                 setup->ie_len = nla_len(ieattr);
5410         }
5411         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5412             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5413                 return -EINVAL;
5414         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5415         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5416         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5417         if (setup->is_secure)
5418                 setup->user_mpm = true;
5419
5420         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5421                 if (!setup->user_mpm)
5422                         return -EINVAL;
5423                 setup->auth_id =
5424                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5425         }
5426
5427         return 0;
5428 }
5429
5430 static int nl80211_update_mesh_config(struct sk_buff *skb,
5431                                       struct genl_info *info)
5432 {
5433         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5434         struct net_device *dev = info->user_ptr[1];
5435         struct wireless_dev *wdev = dev->ieee80211_ptr;
5436         struct mesh_config cfg;
5437         u32 mask;
5438         int err;
5439
5440         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5441                 return -EOPNOTSUPP;
5442
5443         if (!rdev->ops->update_mesh_config)
5444                 return -EOPNOTSUPP;
5445
5446         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5447         if (err)
5448                 return err;
5449
5450         wdev_lock(wdev);
5451         if (!wdev->mesh_id_len)
5452                 err = -ENOLINK;
5453
5454         if (!err)
5455                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5456
5457         wdev_unlock(wdev);
5458
5459         return err;
5460 }
5461
5462 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5463                               struct sk_buff *msg)
5464 {
5465         struct nlattr *nl_reg_rules;
5466         unsigned int i;
5467
5468         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5469             (regdom->dfs_region &&
5470              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5471                 goto nla_put_failure;
5472
5473         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5474         if (!nl_reg_rules)
5475                 goto nla_put_failure;
5476
5477         for (i = 0; i < regdom->n_reg_rules; i++) {
5478                 struct nlattr *nl_reg_rule;
5479                 const struct ieee80211_reg_rule *reg_rule;
5480                 const struct ieee80211_freq_range *freq_range;
5481                 const struct ieee80211_power_rule *power_rule;
5482                 unsigned int max_bandwidth_khz;
5483
5484                 reg_rule = &regdom->reg_rules[i];
5485                 freq_range = &reg_rule->freq_range;
5486                 power_rule = &reg_rule->power_rule;
5487
5488                 nl_reg_rule = nla_nest_start(msg, i);
5489                 if (!nl_reg_rule)
5490                         goto nla_put_failure;
5491
5492                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5493                 if (!max_bandwidth_khz)
5494                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5495                                                                   reg_rule);
5496
5497                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5498                                 reg_rule->flags) ||
5499                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5500                                 freq_range->start_freq_khz) ||
5501                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5502                                 freq_range->end_freq_khz) ||
5503                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5504                                 max_bandwidth_khz) ||
5505                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5506                                 power_rule->max_antenna_gain) ||
5507                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5508                                 power_rule->max_eirp) ||
5509                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5510                                 reg_rule->dfs_cac_ms))
5511                         goto nla_put_failure;
5512
5513                 nla_nest_end(msg, nl_reg_rule);
5514         }
5515
5516         nla_nest_end(msg, nl_reg_rules);
5517         return 0;
5518
5519 nla_put_failure:
5520         return -EMSGSIZE;
5521 }
5522
5523 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5524 {
5525         const struct ieee80211_regdomain *regdom = NULL;
5526         struct cfg80211_registered_device *rdev;
5527         struct wiphy *wiphy = NULL;
5528         struct sk_buff *msg;
5529         void *hdr;
5530
5531         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5532         if (!msg)
5533                 return -ENOBUFS;
5534
5535         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5536                              NL80211_CMD_GET_REG);
5537         if (!hdr)
5538                 goto put_failure;
5539
5540         if (info->attrs[NL80211_ATTR_WIPHY]) {
5541                 bool self_managed;
5542
5543                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5544                 if (IS_ERR(rdev)) {
5545                         nlmsg_free(msg);
5546                         return PTR_ERR(rdev);
5547                 }
5548
5549                 wiphy = &rdev->wiphy;
5550                 self_managed = wiphy->regulatory_flags &
5551                                REGULATORY_WIPHY_SELF_MANAGED;
5552                 regdom = get_wiphy_regdom(wiphy);
5553
5554                 /* a self-managed-reg device must have a private regdom */
5555                 if (WARN_ON(!regdom && self_managed)) {
5556                         nlmsg_free(msg);
5557                         return -EINVAL;
5558                 }
5559
5560                 if (regdom &&
5561                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5562                         goto nla_put_failure;
5563         }
5564
5565         if (!wiphy && reg_last_request_cell_base() &&
5566             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5567                         NL80211_USER_REG_HINT_CELL_BASE))
5568                 goto nla_put_failure;
5569
5570         rcu_read_lock();
5571
5572         if (!regdom)
5573                 regdom = rcu_dereference(cfg80211_regdomain);
5574
5575         if (nl80211_put_regdom(regdom, msg))
5576                 goto nla_put_failure_rcu;
5577
5578         rcu_read_unlock();
5579
5580         genlmsg_end(msg, hdr);
5581         return genlmsg_reply(msg, info);
5582
5583 nla_put_failure_rcu:
5584         rcu_read_unlock();
5585 nla_put_failure:
5586         genlmsg_cancel(msg, hdr);
5587 put_failure:
5588         nlmsg_free(msg);
5589         return -EMSGSIZE;
5590 }
5591
5592 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5593                                u32 seq, int flags, struct wiphy *wiphy,
5594                                const struct ieee80211_regdomain *regdom)
5595 {
5596         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5597                                    NL80211_CMD_GET_REG);
5598
5599         if (!hdr)
5600                 return -1;
5601
5602         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5603
5604         if (nl80211_put_regdom(regdom, msg))
5605                 goto nla_put_failure;
5606
5607         if (!wiphy && reg_last_request_cell_base() &&
5608             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5609                         NL80211_USER_REG_HINT_CELL_BASE))
5610                 goto nla_put_failure;
5611
5612         if (wiphy &&
5613             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5614                 goto nla_put_failure;
5615
5616         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5617             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5618                 goto nla_put_failure;
5619
5620         genlmsg_end(msg, hdr);
5621         return 0;
5622
5623 nla_put_failure:
5624         genlmsg_cancel(msg, hdr);
5625         return -EMSGSIZE;
5626 }
5627
5628 static int nl80211_get_reg_dump(struct sk_buff *skb,
5629                                 struct netlink_callback *cb)
5630 {
5631         const struct ieee80211_regdomain *regdom = NULL;
5632         struct cfg80211_registered_device *rdev;
5633         int err, reg_idx, start = cb->args[2];
5634
5635         rtnl_lock();
5636
5637         if (cfg80211_regdomain && start == 0) {
5638                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5639                                           NLM_F_MULTI, NULL,
5640                                           rtnl_dereference(cfg80211_regdomain));
5641                 if (err < 0)
5642                         goto out_err;
5643         }
5644
5645         /* the global regdom is idx 0 */
5646         reg_idx = 1;
5647         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5648                 regdom = get_wiphy_regdom(&rdev->wiphy);
5649                 if (!regdom)
5650                         continue;
5651
5652                 if (++reg_idx <= start)
5653                         continue;
5654
5655                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5656                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5657                 if (err < 0) {
5658                         reg_idx--;
5659                         break;
5660                 }
5661         }
5662
5663         cb->args[2] = reg_idx;
5664         err = skb->len;
5665 out_err:
5666         rtnl_unlock();
5667         return err;
5668 }
5669
5670 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
5671 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
5672         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
5673         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
5674         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
5675         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
5676         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
5677         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
5678         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
5679 };
5680
5681 static int parse_reg_rule(struct nlattr *tb[],
5682         struct ieee80211_reg_rule *reg_rule)
5683 {
5684         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
5685         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
5686
5687         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
5688                 return -EINVAL;
5689         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
5690                 return -EINVAL;
5691         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
5692                 return -EINVAL;
5693         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
5694                 return -EINVAL;
5695         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
5696                 return -EINVAL;
5697
5698         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
5699
5700         freq_range->start_freq_khz =
5701                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
5702         freq_range->end_freq_khz =
5703                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
5704         freq_range->max_bandwidth_khz =
5705                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
5706
5707         power_rule->max_eirp =
5708                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
5709
5710         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
5711                 power_rule->max_antenna_gain =
5712                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
5713
5714         if (tb[NL80211_ATTR_DFS_CAC_TIME])
5715                 reg_rule->dfs_cac_ms =
5716                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
5717
5718         return 0;
5719 }
5720
5721 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5722 {
5723         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5724         struct nlattr *nl_reg_rule;
5725         char *alpha2;
5726         int rem_reg_rules, r;
5727         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5728         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5729         struct ieee80211_regdomain *rd;
5730
5731         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5732                 return -EINVAL;
5733
5734         if (!info->attrs[NL80211_ATTR_REG_RULES])
5735                 return -EINVAL;
5736
5737         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5738
5739         if (info->attrs[NL80211_ATTR_DFS_REGION])
5740                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5741
5742         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5743                             rem_reg_rules) {
5744                 num_rules++;
5745                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5746                         return -EINVAL;
5747         }
5748
5749         if (!reg_is_valid_request(alpha2))
5750                 return -EINVAL;
5751
5752         size_of_regd = sizeof(struct ieee80211_regdomain) +
5753                        num_rules * sizeof(struct ieee80211_reg_rule);
5754
5755         rd = kzalloc(size_of_regd, GFP_KERNEL);
5756         if (!rd)
5757                 return -ENOMEM;
5758
5759         rd->n_reg_rules = num_rules;
5760         rd->alpha2[0] = alpha2[0];
5761         rd->alpha2[1] = alpha2[1];
5762
5763         /*
5764          * Disable DFS master mode if the DFS region was
5765          * not supported or known on this kernel.
5766          */
5767         if (reg_supported_dfs_region(dfs_region))
5768                 rd->dfs_region = dfs_region;
5769
5770         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5771                             rem_reg_rules) {
5772                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5773                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5774                               reg_rule_policy);
5775                 if (r)
5776                         goto bad_reg;
5777                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5778                 if (r)
5779                         goto bad_reg;
5780
5781                 rule_idx++;
5782
5783                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5784                         r = -EINVAL;
5785                         goto bad_reg;
5786                 }
5787         }
5788
5789         r = set_regdom(rd, REGD_SOURCE_CRDA);
5790         /* set_regdom took ownership */
5791         rd = NULL;
5792
5793  bad_reg:
5794         kfree(rd);
5795         return r;
5796 }
5797 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
5798
5799 static int validate_scan_freqs(struct nlattr *freqs)
5800 {
5801         struct nlattr *attr1, *attr2;
5802         int n_channels = 0, tmp1, tmp2;
5803
5804         nla_for_each_nested(attr1, freqs, tmp1) {
5805                 n_channels++;
5806                 /*
5807                  * Some hardware has a limited channel list for
5808                  * scanning, and it is pretty much nonsensical
5809                  * to scan for a channel twice, so disallow that
5810                  * and don't require drivers to check that the
5811                  * channel list they get isn't longer than what
5812                  * they can scan, as long as they can scan all
5813                  * the channels they registered at once.
5814                  */
5815                 nla_for_each_nested(attr2, freqs, tmp2)
5816                         if (attr1 != attr2 &&
5817                             nla_get_u32(attr1) == nla_get_u32(attr2))
5818                                 return 0;
5819         }
5820
5821         return n_channels;
5822 }
5823
5824 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
5825 {
5826         return b < NUM_NL80211_BANDS && wiphy->bands[b];
5827 }
5828
5829 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
5830                             struct cfg80211_bss_selection *bss_select)
5831 {
5832         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
5833         struct nlattr *nest;
5834         int err;
5835         bool found = false;
5836         int i;
5837
5838         /* only process one nested attribute */
5839         nest = nla_data(nla);
5840         if (!nla_ok(nest, nla_len(nest)))
5841                 return -EINVAL;
5842
5843         err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
5844                         nla_len(nest), nl80211_bss_select_policy);
5845         if (err)
5846                 return err;
5847
5848         /* only one attribute may be given */
5849         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
5850                 if (attr[i]) {
5851                         if (found)
5852                                 return -EINVAL;
5853                         found = true;
5854                 }
5855         }
5856
5857         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
5858
5859         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
5860                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
5861
5862         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
5863                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
5864                 bss_select->param.band_pref =
5865                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
5866                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
5867                         return -EINVAL;
5868         }
5869
5870         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
5871                 struct nl80211_bss_select_rssi_adjust *adj_param;
5872
5873                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
5874                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
5875                 bss_select->param.adjust.band = adj_param->band;
5876                 bss_select->param.adjust.delta = adj_param->delta;
5877                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
5878                         return -EINVAL;
5879         }
5880
5881         /* user-space did not provide behaviour attribute */
5882         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
5883                 return -EINVAL;
5884
5885         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
5886                 return -EINVAL;
5887
5888         return 0;
5889 }
5890
5891 static int nl80211_parse_random_mac(struct nlattr **attrs,
5892                                     u8 *mac_addr, u8 *mac_addr_mask)
5893 {
5894         int i;
5895
5896         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5897                 eth_zero_addr(mac_addr);
5898                 eth_zero_addr(mac_addr_mask);
5899                 mac_addr[0] = 0x2;
5900                 mac_addr_mask[0] = 0x3;
5901
5902                 return 0;
5903         }
5904
5905         /* need both or none */
5906         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5907                 return -EINVAL;
5908
5909         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5910         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5911
5912         /* don't allow or configure an mcast address */
5913         if (!is_multicast_ether_addr(mac_addr_mask) ||
5914             is_multicast_ether_addr(mac_addr))
5915                 return -EINVAL;
5916
5917         /*
5918          * allow users to pass a MAC address that has bits set outside
5919          * of the mask, but don't bother drivers with having to deal
5920          * with such bits
5921          */
5922         for (i = 0; i < ETH_ALEN; i++)
5923                 mac_addr[i] &= mac_addr_mask[i];
5924
5925         return 0;
5926 }
5927
5928 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5929 {
5930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5931         struct wireless_dev *wdev = info->user_ptr[1];
5932         struct cfg80211_scan_request *request;
5933         struct nlattr *attr;
5934         struct wiphy *wiphy;
5935         int err, tmp, n_ssids = 0, n_channels, i;
5936         size_t ie_len;
5937
5938         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5939                 return -EINVAL;
5940
5941         wiphy = &rdev->wiphy;
5942
5943         if (!rdev->ops->scan)
5944                 return -EOPNOTSUPP;
5945
5946         if (rdev->scan_req || rdev->scan_msg) {
5947                 err = -EBUSY;
5948                 goto unlock;
5949         }
5950
5951         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5952                 n_channels = validate_scan_freqs(
5953                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5954                 if (!n_channels) {
5955                         err = -EINVAL;
5956                         goto unlock;
5957                 }
5958         } else {
5959                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5960         }
5961
5962         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5963                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5964                         n_ssids++;
5965
5966         if (n_ssids > wiphy->max_scan_ssids) {
5967                 err = -EINVAL;
5968                 goto unlock;
5969         }
5970
5971         if (info->attrs[NL80211_ATTR_IE])
5972                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5973         else
5974                 ie_len = 0;
5975
5976         if (ie_len > wiphy->max_scan_ie_len) {
5977                 err = -EINVAL;
5978                 goto unlock;
5979         }
5980
5981         request = kzalloc(sizeof(*request)
5982                         + sizeof(*request->ssids) * n_ssids
5983                         + sizeof(*request->channels) * n_channels
5984                         + ie_len, GFP_KERNEL);
5985         if (!request) {
5986                 err = -ENOMEM;
5987                 goto unlock;
5988         }
5989
5990         if (n_ssids)
5991                 request->ssids = (void *)&request->channels[n_channels];
5992         request->n_ssids = n_ssids;
5993         if (ie_len) {
5994                 if (n_ssids)
5995                         request->ie = (void *)(request->ssids + n_ssids);
5996                 else
5997                         request->ie = (void *)(request->channels + n_channels);
5998         }
5999
6000         i = 0;
6001         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6002                 /* user specified, bail out if channel not found */
6003                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6004                         struct ieee80211_channel *chan;
6005
6006                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6007
6008                         if (!chan) {
6009                                 err = -EINVAL;
6010                                 goto out_free;
6011                         }
6012
6013                         /* ignore disabled channels */
6014                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6015                                 continue;
6016
6017                         request->channels[i] = chan;
6018                         i++;
6019                 }
6020         } else {
6021                 enum nl80211_band band;
6022
6023                 /* all channels */
6024                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6025                         int j;
6026                         if (!wiphy->bands[band])
6027                                 continue;
6028                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6029                                 struct ieee80211_channel *chan;
6030
6031                                 chan = &wiphy->bands[band]->channels[j];
6032
6033                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6034                                         continue;
6035
6036                                 request->channels[i] = chan;
6037                                 i++;
6038                         }
6039                 }
6040         }
6041
6042         if (!i) {
6043                 err = -EINVAL;
6044                 goto out_free;
6045         }
6046
6047         request->n_channels = i;
6048
6049         i = 0;
6050         if (n_ssids) {
6051                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6052                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6053                                 err = -EINVAL;
6054                                 goto out_free;
6055                         }
6056                         request->ssids[i].ssid_len = nla_len(attr);
6057                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6058                         i++;
6059                 }
6060         }
6061
6062         if (info->attrs[NL80211_ATTR_IE]) {
6063                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6064                 memcpy((void *)request->ie,
6065                        nla_data(info->attrs[NL80211_ATTR_IE]),
6066                        request->ie_len);
6067         }
6068
6069         for (i = 0; i < NUM_NL80211_BANDS; i++)
6070                 if (wiphy->bands[i])
6071                         request->rates[i] =
6072                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6073
6074         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6075                 nla_for_each_nested(attr,
6076                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6077                                     tmp) {
6078                         enum nl80211_band band = nla_type(attr);
6079
6080                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6081                                 err = -EINVAL;
6082                                 goto out_free;
6083                         }
6084
6085                         if (!wiphy->bands[band])
6086                                 continue;
6087
6088                         err = ieee80211_get_ratemask(wiphy->bands[band],
6089                                                      nla_data(attr),
6090                                                      nla_len(attr),
6091                                                      &request->rates[band]);
6092                         if (err)
6093                                 goto out_free;
6094                 }
6095         }
6096
6097         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6098                 request->flags = nla_get_u32(
6099                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6100                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6101                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6102                         err = -EOPNOTSUPP;
6103                         goto out_free;
6104                 }
6105
6106                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6107                         if (!(wiphy->features &
6108                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6109                                 err = -EOPNOTSUPP;
6110                                 goto out_free;
6111                         }
6112
6113                         if (wdev->current_bss) {
6114                                 err = -EOPNOTSUPP;
6115                                 goto out_free;
6116                         }
6117
6118                         err = nl80211_parse_random_mac(info->attrs,
6119                                                        request->mac_addr,
6120                                                        request->mac_addr_mask);
6121                         if (err)
6122                                 goto out_free;
6123                 }
6124         }
6125
6126         request->no_cck =
6127                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6128
6129         if (info->attrs[NL80211_ATTR_MAC])
6130                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6131                        ETH_ALEN);
6132         else
6133                 eth_broadcast_addr(request->bssid);
6134
6135         request->wdev = wdev;
6136         request->wiphy = &rdev->wiphy;
6137         request->scan_start = jiffies;
6138
6139         rdev->scan_req = request;
6140         err = rdev_scan(rdev, request);
6141
6142         if (!err) {
6143                 nl80211_send_scan_start(rdev, wdev);
6144                 if (wdev->netdev)
6145                         dev_hold(wdev->netdev);
6146         } else {
6147  out_free:
6148                 rdev->scan_req = NULL;
6149                 kfree(request);
6150         }
6151
6152  unlock:
6153         return err;
6154 }
6155
6156 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6157 {
6158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6159         struct wireless_dev *wdev = info->user_ptr[1];
6160
6161         if (!rdev->ops->abort_scan)
6162                 return -EOPNOTSUPP;
6163
6164         if (rdev->scan_msg)
6165                 return 0;
6166
6167         if (!rdev->scan_req)
6168                 return -ENOENT;
6169
6170         rdev_abort_scan(rdev, wdev);
6171         return 0;
6172 }
6173
6174 static int
6175 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6176                                struct cfg80211_sched_scan_request *request,
6177                                struct nlattr **attrs)
6178 {
6179         int tmp, err, i = 0;
6180         struct nlattr *attr;
6181
6182         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6183                 u32 interval;
6184
6185                 /*
6186                  * If scan plans are not specified,
6187                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6188                  * case one scan plan will be set with the specified scan
6189                  * interval and infinite number of iterations.
6190                  */
6191                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6192                         return -EINVAL;
6193
6194                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6195                 if (!interval)
6196                         return -EINVAL;
6197
6198                 request->scan_plans[0].interval =
6199                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6200                 if (!request->scan_plans[0].interval)
6201                         return -EINVAL;
6202
6203                 if (request->scan_plans[0].interval >
6204                     wiphy->max_sched_scan_plan_interval)
6205                         request->scan_plans[0].interval =
6206                                 wiphy->max_sched_scan_plan_interval;
6207
6208                 return 0;
6209         }
6210
6211         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6212                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6213
6214                 if (WARN_ON(i >= n_plans))
6215                         return -EINVAL;
6216
6217                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6218                                 nla_data(attr), nla_len(attr),
6219                                 nl80211_plan_policy);
6220                 if (err)
6221                         return err;
6222
6223                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6224                         return -EINVAL;
6225
6226                 request->scan_plans[i].interval =
6227                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6228                 if (!request->scan_plans[i].interval ||
6229                     request->scan_plans[i].interval >
6230                     wiphy->max_sched_scan_plan_interval)
6231                         return -EINVAL;
6232
6233                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6234                         request->scan_plans[i].iterations =
6235                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6236                         if (!request->scan_plans[i].iterations ||
6237                             (request->scan_plans[i].iterations >
6238                              wiphy->max_sched_scan_plan_iterations))
6239                                 return -EINVAL;
6240                 } else if (i < n_plans - 1) {
6241                         /*
6242                          * All scan plans but the last one must specify
6243                          * a finite number of iterations
6244                          */
6245                         return -EINVAL;
6246                 }
6247
6248                 i++;
6249         }
6250
6251         /*
6252          * The last scan plan must not specify the number of
6253          * iterations, it is supposed to run infinitely
6254          */
6255         if (request->scan_plans[n_plans - 1].iterations)
6256                 return  -EINVAL;
6257
6258         return 0;
6259 }
6260
6261 static struct cfg80211_sched_scan_request *
6262 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6263                          struct nlattr **attrs)
6264 {
6265         struct cfg80211_sched_scan_request *request;
6266         struct nlattr *attr;
6267         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6268         enum nl80211_band band;
6269         size_t ie_len;
6270         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6271         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6272
6273         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6274                 return ERR_PTR(-EINVAL);
6275
6276         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6277                 n_channels = validate_scan_freqs(
6278                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6279                 if (!n_channels)
6280                         return ERR_PTR(-EINVAL);
6281         } else {
6282                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6283         }
6284
6285         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6286                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6287                                     tmp)
6288                         n_ssids++;
6289
6290         if (n_ssids > wiphy->max_sched_scan_ssids)
6291                 return ERR_PTR(-EINVAL);
6292
6293         /*
6294          * First, count the number of 'real' matchsets. Due to an issue with
6295          * the old implementation, matchsets containing only the RSSI attribute
6296          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6297          * RSSI for all matchsets, rather than their own matchset for reporting
6298          * all APs with a strong RSSI. This is needed to be compatible with
6299          * older userspace that treated a matchset with only the RSSI as the
6300          * global RSSI for all other matchsets - if there are other matchsets.
6301          */
6302         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6303                 nla_for_each_nested(attr,
6304                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6305                                     tmp) {
6306                         struct nlattr *rssi;
6307
6308                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6309                                         nla_data(attr), nla_len(attr),
6310                                         nl80211_match_policy);
6311                         if (err)
6312                                 return ERR_PTR(err);
6313                         /* add other standalone attributes here */
6314                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6315                                 n_match_sets++;
6316                                 continue;
6317                         }
6318                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6319                         if (rssi)
6320                                 default_match_rssi = nla_get_s32(rssi);
6321                 }
6322         }
6323
6324         /* However, if there's no other matchset, add the RSSI one */
6325         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6326                 n_match_sets = 1;
6327
6328         if (n_match_sets > wiphy->max_match_sets)
6329                 return ERR_PTR(-EINVAL);
6330
6331         if (attrs[NL80211_ATTR_IE])
6332                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6333         else
6334                 ie_len = 0;
6335
6336         if (ie_len > wiphy->max_sched_scan_ie_len)
6337                 return ERR_PTR(-EINVAL);
6338
6339         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6340                 /*
6341                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6342                  * each scan plan already specifies its own interval
6343                  */
6344                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6345                         return ERR_PTR(-EINVAL);
6346
6347                 nla_for_each_nested(attr,
6348                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6349                         n_plans++;
6350         } else {
6351                 /*
6352                  * The scan interval attribute is kept for backward
6353                  * compatibility. If no scan plans are specified and sched scan
6354                  * interval is specified, one scan plan will be set with this
6355                  * scan interval and infinite number of iterations.
6356                  */
6357                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6358                         return ERR_PTR(-EINVAL);
6359
6360                 n_plans = 1;
6361         }
6362
6363         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6364                 return ERR_PTR(-EINVAL);
6365
6366         request = kzalloc(sizeof(*request)
6367                         + sizeof(*request->ssids) * n_ssids
6368                         + sizeof(*request->match_sets) * n_match_sets
6369                         + sizeof(*request->scan_plans) * n_plans
6370                         + sizeof(*request->channels) * n_channels
6371                         + ie_len, GFP_KERNEL);
6372         if (!request)
6373                 return ERR_PTR(-ENOMEM);
6374
6375         if (n_ssids)
6376                 request->ssids = (void *)&request->channels[n_channels];
6377         request->n_ssids = n_ssids;
6378         if (ie_len) {
6379                 if (n_ssids)
6380                         request->ie = (void *)(request->ssids + n_ssids);
6381                 else
6382                         request->ie = (void *)(request->channels + n_channels);
6383         }
6384
6385         if (n_match_sets) {
6386                 if (request->ie)
6387                         request->match_sets = (void *)(request->ie + ie_len);
6388                 else if (n_ssids)
6389                         request->match_sets =
6390                                 (void *)(request->ssids + n_ssids);
6391                 else
6392                         request->match_sets =
6393                                 (void *)(request->channels + n_channels);
6394         }
6395         request->n_match_sets = n_match_sets;
6396
6397         if (n_match_sets)
6398                 request->scan_plans = (void *)(request->match_sets +
6399                                                n_match_sets);
6400         else if (request->ie)
6401                 request->scan_plans = (void *)(request->ie + ie_len);
6402         else if (n_ssids)
6403                 request->scan_plans = (void *)(request->ssids + n_ssids);
6404         else
6405                 request->scan_plans = (void *)(request->channels + n_channels);
6406
6407         request->n_scan_plans = n_plans;
6408
6409         i = 0;
6410         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6411                 /* user specified, bail out if channel not found */
6412                 nla_for_each_nested(attr,
6413                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6414                                     tmp) {
6415                         struct ieee80211_channel *chan;
6416
6417                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6418
6419                         if (!chan) {
6420                                 err = -EINVAL;
6421                                 goto out_free;
6422                         }
6423
6424                         /* ignore disabled channels */
6425                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6426                                 continue;
6427
6428                         request->channels[i] = chan;
6429                         i++;
6430                 }
6431         } else {
6432                 /* all channels */
6433                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6434                         int j;
6435                         if (!wiphy->bands[band])
6436                                 continue;
6437                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6438                                 struct ieee80211_channel *chan;
6439
6440                                 chan = &wiphy->bands[band]->channels[j];
6441
6442                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6443                                         continue;
6444
6445                                 request->channels[i] = chan;
6446                                 i++;
6447                         }
6448                 }
6449         }
6450
6451         if (!i) {
6452                 err = -EINVAL;
6453                 goto out_free;
6454         }
6455
6456         request->n_channels = i;
6457
6458         i = 0;
6459         if (n_ssids) {
6460                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6461                                     tmp) {
6462                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6463                                 err = -EINVAL;
6464                                 goto out_free;
6465                         }
6466                         request->ssids[i].ssid_len = nla_len(attr);
6467                         memcpy(request->ssids[i].ssid, nla_data(attr),
6468                                nla_len(attr));
6469                         i++;
6470                 }
6471         }
6472
6473         i = 0;
6474         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6475                 nla_for_each_nested(attr,
6476                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6477                                     tmp) {
6478                         struct nlattr *ssid, *rssi;
6479
6480                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6481                                         nla_data(attr), nla_len(attr),
6482                                         nl80211_match_policy);
6483                         if (err)
6484                                 goto out_free;
6485                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6486                         if (ssid) {
6487                                 if (WARN_ON(i >= n_match_sets)) {
6488                                         /* this indicates a programming error,
6489                                          * the loop above should have verified
6490                                          * things properly
6491                                          */
6492                                         err = -EINVAL;
6493                                         goto out_free;
6494                                 }
6495
6496                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6497                                         err = -EINVAL;
6498                                         goto out_free;
6499                                 }
6500                                 memcpy(request->match_sets[i].ssid.ssid,
6501                                        nla_data(ssid), nla_len(ssid));
6502                                 request->match_sets[i].ssid.ssid_len =
6503                                         nla_len(ssid);
6504                                 /* special attribute - old implemenation w/a */
6505                                 request->match_sets[i].rssi_thold =
6506                                         default_match_rssi;
6507                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6508                                 if (rssi)
6509                                         request->match_sets[i].rssi_thold =
6510                                                 nla_get_s32(rssi);
6511                         }
6512                         i++;
6513                 }
6514
6515                 /* there was no other matchset, so the RSSI one is alone */
6516                 if (i == 0 && n_match_sets)
6517                         request->match_sets[0].rssi_thold = default_match_rssi;
6518
6519                 request->min_rssi_thold = INT_MAX;
6520                 for (i = 0; i < n_match_sets; i++)
6521                         request->min_rssi_thold =
6522                                 min(request->match_sets[i].rssi_thold,
6523                                     request->min_rssi_thold);
6524         } else {
6525                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6526         }
6527
6528         if (ie_len) {
6529                 request->ie_len = ie_len;
6530                 memcpy((void *)request->ie,
6531                        nla_data(attrs[NL80211_ATTR_IE]),
6532                        request->ie_len);
6533         }
6534
6535         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6536                 request->flags = nla_get_u32(
6537                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6538                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6539                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6540                         err = -EOPNOTSUPP;
6541                         goto out_free;
6542                 }
6543
6544                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6545                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6546
6547                         if (!wdev) /* must be net-detect */
6548                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6549
6550                         if (!(wiphy->features & flg)) {
6551                                 err = -EOPNOTSUPP;
6552                                 goto out_free;
6553                         }
6554
6555                         if (wdev && wdev->current_bss) {
6556                                 err = -EOPNOTSUPP;
6557                                 goto out_free;
6558                         }
6559
6560                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6561                                                        request->mac_addr_mask);
6562                         if (err)
6563                                 goto out_free;
6564                 }
6565         }
6566
6567         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6568                 request->delay =
6569                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6570
6571         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6572         if (err)
6573                 goto out_free;
6574
6575         request->scan_start = jiffies;
6576
6577         return request;
6578
6579 out_free:
6580         kfree(request);
6581         return ERR_PTR(err);
6582 }
6583
6584 static int nl80211_start_sched_scan(struct sk_buff *skb,
6585                                     struct genl_info *info)
6586 {
6587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6588         struct net_device *dev = info->user_ptr[1];
6589         struct wireless_dev *wdev = dev->ieee80211_ptr;
6590         struct cfg80211_sched_scan_request *sched_scan_req;
6591         int err;
6592
6593         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6594             !rdev->ops->sched_scan_start)
6595                 return -EOPNOTSUPP;
6596
6597         if (rdev->sched_scan_req)
6598                 return -EINPROGRESS;
6599
6600         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6601                                                   info->attrs);
6602
6603         err = PTR_ERR_OR_ZERO(sched_scan_req);
6604         if (err)
6605                 goto out_err;
6606
6607         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6608         if (err)
6609                 goto out_free;
6610
6611         sched_scan_req->dev = dev;
6612         sched_scan_req->wiphy = &rdev->wiphy;
6613
6614         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6615                 sched_scan_req->owner_nlportid = info->snd_portid;
6616
6617         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6618
6619         nl80211_send_sched_scan(rdev, dev,
6620                                 NL80211_CMD_START_SCHED_SCAN);
6621         return 0;
6622
6623 out_free:
6624         kfree(sched_scan_req);
6625 out_err:
6626         return err;
6627 }
6628
6629 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6630                                    struct genl_info *info)
6631 {
6632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6633
6634         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6635             !rdev->ops->sched_scan_stop)
6636                 return -EOPNOTSUPP;
6637
6638         return __cfg80211_stop_sched_scan(rdev, false);
6639 }
6640
6641 static int nl80211_start_radar_detection(struct sk_buff *skb,
6642                                          struct genl_info *info)
6643 {
6644         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6645         struct net_device *dev = info->user_ptr[1];
6646         struct wireless_dev *wdev = dev->ieee80211_ptr;
6647         struct cfg80211_chan_def chandef;
6648         enum nl80211_dfs_regions dfs_region;
6649         unsigned int cac_time_ms;
6650         int err;
6651
6652         dfs_region = reg_get_dfs_region(wdev->wiphy);
6653         if (dfs_region == NL80211_DFS_UNSET)
6654                 return -EINVAL;
6655
6656         err = nl80211_parse_chandef(rdev, info, &chandef);
6657         if (err)
6658                 return err;
6659
6660         if (netif_carrier_ok(dev))
6661                 return -EBUSY;
6662
6663         if (wdev->cac_started)
6664                 return -EBUSY;
6665
6666         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6667                                             wdev->iftype);
6668         if (err < 0)
6669                 return err;
6670
6671         if (err == 0)
6672                 return -EINVAL;
6673
6674         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6675                 return -EINVAL;
6676
6677         if (!rdev->ops->start_radar_detection)
6678                 return -EOPNOTSUPP;
6679
6680         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6681         if (WARN_ON(!cac_time_ms))
6682                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6683
6684         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
6685         if (!err) {
6686                 wdev->chandef = chandef;
6687                 wdev->cac_started = true;
6688                 wdev->cac_start_time = jiffies;
6689                 wdev->cac_time_ms = cac_time_ms;
6690         }
6691         return err;
6692 }
6693
6694 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6695 {
6696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6697         struct net_device *dev = info->user_ptr[1];
6698         struct wireless_dev *wdev = dev->ieee80211_ptr;
6699         struct cfg80211_csa_settings params;
6700         /* csa_attrs is defined static to avoid waste of stack size - this
6701          * function is called under RTNL lock, so this should not be a problem.
6702          */
6703         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6704         int err;
6705         bool need_new_beacon = false;
6706         int len, i;
6707         u32 cs_count;
6708
6709         if (!rdev->ops->channel_switch ||
6710             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6711                 return -EOPNOTSUPP;
6712
6713         switch (dev->ieee80211_ptr->iftype) {
6714         case NL80211_IFTYPE_AP:
6715         case NL80211_IFTYPE_P2P_GO:
6716                 need_new_beacon = true;
6717
6718                 /* useless if AP is not running */
6719                 if (!wdev->beacon_interval)
6720                         return -ENOTCONN;
6721                 break;
6722         case NL80211_IFTYPE_ADHOC:
6723                 if (!wdev->ssid_len)
6724                         return -ENOTCONN;
6725                 break;
6726         case NL80211_IFTYPE_MESH_POINT:
6727                 if (!wdev->mesh_id_len)
6728                         return -ENOTCONN;
6729                 break;
6730         default:
6731                 return -EOPNOTSUPP;
6732         }
6733
6734         memset(&params, 0, sizeof(params));
6735
6736         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6737             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6738                 return -EINVAL;
6739
6740         /* only important for AP, IBSS and mesh create IEs internally */
6741         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6742                 return -EINVAL;
6743
6744         /* Even though the attribute is u32, the specification says
6745          * u8, so let's make sure we don't overflow.
6746          */
6747         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6748         if (cs_count > 255)
6749                 return -EINVAL;
6750
6751         params.count = cs_count;
6752
6753         if (!need_new_beacon)
6754                 goto skip_beacons;
6755
6756         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6757         if (err)
6758                 return err;
6759
6760         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6761                                info->attrs[NL80211_ATTR_CSA_IES],
6762                                nl80211_policy);
6763         if (err)
6764                 return err;
6765
6766         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6767         if (err)
6768                 return err;
6769
6770         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6771                 return -EINVAL;
6772
6773         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6774         if (!len || (len % sizeof(u16)))
6775                 return -EINVAL;
6776
6777         params.n_counter_offsets_beacon = len / sizeof(u16);
6778         if (rdev->wiphy.max_num_csa_counters &&
6779             (params.n_counter_offsets_beacon >
6780              rdev->wiphy.max_num_csa_counters))
6781                 return -EINVAL;
6782
6783         params.counter_offsets_beacon =
6784                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6785
6786         /* sanity checks - counters should fit and be the same */
6787         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6788                 u16 offset = params.counter_offsets_beacon[i];
6789
6790                 if (offset >= params.beacon_csa.tail_len)
6791                         return -EINVAL;
6792
6793                 if (params.beacon_csa.tail[offset] != params.count)
6794                         return -EINVAL;
6795         }
6796
6797         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6798                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6799                 if (!len || (len % sizeof(u16)))
6800                         return -EINVAL;
6801
6802                 params.n_counter_offsets_presp = len / sizeof(u16);
6803                 if (rdev->wiphy.max_num_csa_counters &&
6804                     (params.n_counter_offsets_beacon >
6805                      rdev->wiphy.max_num_csa_counters))
6806                         return -EINVAL;
6807
6808                 params.counter_offsets_presp =
6809                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6810
6811                 /* sanity checks - counters should fit and be the same */
6812                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6813                         u16 offset = params.counter_offsets_presp[i];
6814
6815                         if (offset >= params.beacon_csa.probe_resp_len)
6816                                 return -EINVAL;
6817
6818                         if (params.beacon_csa.probe_resp[offset] !=
6819                             params.count)
6820                                 return -EINVAL;
6821                 }
6822         }
6823
6824 skip_beacons:
6825         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6826         if (err)
6827                 return err;
6828
6829         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
6830                                            wdev->iftype))
6831                 return -EINVAL;
6832
6833         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6834                                             &params.chandef,
6835                                             wdev->iftype);
6836         if (err < 0)
6837                 return err;
6838
6839         if (err > 0)
6840                 params.radar_required = true;
6841
6842         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6843                 params.block_tx = true;
6844
6845         wdev_lock(wdev);
6846         err = rdev_channel_switch(rdev, dev, &params);
6847         wdev_unlock(wdev);
6848
6849         return err;
6850 }
6851
6852 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6853                             u32 seq, int flags,
6854                             struct cfg80211_registered_device *rdev,
6855                             struct wireless_dev *wdev,
6856                             struct cfg80211_internal_bss *intbss)
6857 {
6858         struct cfg80211_bss *res = &intbss->pub;
6859         const struct cfg80211_bss_ies *ies;
6860         void *hdr;
6861         struct nlattr *bss;
6862
6863         ASSERT_WDEV_LOCK(wdev);
6864
6865         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6866                              NL80211_CMD_NEW_SCAN_RESULTS);
6867         if (!hdr)
6868                 return -1;
6869
6870         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6871
6872         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6873                 goto nla_put_failure;
6874         if (wdev->netdev &&
6875             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6876                 goto nla_put_failure;
6877         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6878                 goto nla_put_failure;
6879
6880         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6881         if (!bss)
6882                 goto nla_put_failure;
6883         if ((!is_zero_ether_addr(res->bssid) &&
6884              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6885                 goto nla_put_failure;
6886
6887         rcu_read_lock();
6888         /* indicate whether we have probe response data or not */
6889         if (rcu_access_pointer(res->proberesp_ies) &&
6890             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6891                 goto fail_unlock_rcu;
6892
6893         /* this pointer prefers to be pointed to probe response data
6894          * but is always valid
6895          */
6896         ies = rcu_dereference(res->ies);
6897         if (ies) {
6898                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6899                         goto fail_unlock_rcu;
6900                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6901                                         ies->len, ies->data))
6902                         goto fail_unlock_rcu;
6903         }
6904
6905         /* and this pointer is always (unless driver didn't know) beacon data */
6906         ies = rcu_dereference(res->beacon_ies);
6907         if (ies && ies->from_beacon) {
6908                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6909                         goto fail_unlock_rcu;
6910                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6911                                         ies->len, ies->data))
6912                         goto fail_unlock_rcu;
6913         }
6914         rcu_read_unlock();
6915
6916         if (res->beacon_interval &&
6917             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6918                 goto nla_put_failure;
6919         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6920             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6921             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6922             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6923                         jiffies_to_msecs(jiffies - intbss->ts)))
6924                 goto nla_put_failure;
6925
6926         if (intbss->ts_boottime &&
6927             nla_put_u64(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
6928                         intbss->ts_boottime))
6929                 goto nla_put_failure;
6930
6931         switch (rdev->wiphy.signal_type) {
6932         case CFG80211_SIGNAL_TYPE_MBM:
6933                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6934                         goto nla_put_failure;
6935                 break;
6936         case CFG80211_SIGNAL_TYPE_UNSPEC:
6937                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6938                         goto nla_put_failure;
6939                 break;
6940         default:
6941                 break;
6942         }
6943
6944         switch (wdev->iftype) {
6945         case NL80211_IFTYPE_P2P_CLIENT:
6946         case NL80211_IFTYPE_STATION:
6947                 if (intbss == wdev->current_bss &&
6948                     nla_put_u32(msg, NL80211_BSS_STATUS,
6949                                 NL80211_BSS_STATUS_ASSOCIATED))
6950                         goto nla_put_failure;
6951                 break;
6952         case NL80211_IFTYPE_ADHOC:
6953                 if (intbss == wdev->current_bss &&
6954                     nla_put_u32(msg, NL80211_BSS_STATUS,
6955                                 NL80211_BSS_STATUS_IBSS_JOINED))
6956                         goto nla_put_failure;
6957                 break;
6958         default:
6959                 break;
6960         }
6961
6962         nla_nest_end(msg, bss);
6963
6964         genlmsg_end(msg, hdr);
6965         return 0;
6966
6967  fail_unlock_rcu:
6968         rcu_read_unlock();
6969  nla_put_failure:
6970         genlmsg_cancel(msg, hdr);
6971         return -EMSGSIZE;
6972 }
6973
6974 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6975 {
6976         struct cfg80211_registered_device *rdev;
6977         struct cfg80211_internal_bss *scan;
6978         struct wireless_dev *wdev;
6979         int start = cb->args[2], idx = 0;
6980         int err;
6981
6982         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6983         if (err)
6984                 return err;
6985
6986         wdev_lock(wdev);
6987         spin_lock_bh(&rdev->bss_lock);
6988         cfg80211_bss_expire(rdev);
6989
6990         cb->seq = rdev->bss_generation;
6991
6992         list_for_each_entry(scan, &rdev->bss_list, list) {
6993                 if (++idx <= start)
6994                         continue;
6995                 if (nl80211_send_bss(skb, cb,
6996                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6997                                 rdev, wdev, scan) < 0) {
6998                         idx--;
6999                         break;
7000                 }
7001         }
7002
7003         spin_unlock_bh(&rdev->bss_lock);
7004         wdev_unlock(wdev);
7005
7006         cb->args[2] = idx;
7007         nl80211_finish_wdev_dump(rdev);
7008
7009         return skb->len;
7010 }
7011
7012 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7013                                int flags, struct net_device *dev,
7014                                bool allow_radio_stats,
7015                                struct survey_info *survey)
7016 {
7017         void *hdr;
7018         struct nlattr *infoattr;
7019
7020         /* skip radio stats if userspace didn't request them */
7021         if (!survey->channel && !allow_radio_stats)
7022                 return 0;
7023
7024         hdr = nl80211hdr_put(msg, portid, seq, flags,
7025                              NL80211_CMD_NEW_SURVEY_RESULTS);
7026         if (!hdr)
7027                 return -ENOMEM;
7028
7029         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7030                 goto nla_put_failure;
7031
7032         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7033         if (!infoattr)
7034                 goto nla_put_failure;
7035
7036         if (survey->channel &&
7037             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7038                         survey->channel->center_freq))
7039                 goto nla_put_failure;
7040
7041         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7042             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7043                 goto nla_put_failure;
7044         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7045             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7046                 goto nla_put_failure;
7047         if ((survey->filled & SURVEY_INFO_TIME) &&
7048             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
7049                         survey->time))
7050                 goto nla_put_failure;
7051         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7052             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7053                         survey->time_busy))
7054                 goto nla_put_failure;
7055         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7056             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7057                         survey->time_ext_busy))
7058                 goto nla_put_failure;
7059         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7060             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
7061                         survey->time_rx))
7062                 goto nla_put_failure;
7063         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7064             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
7065                         survey->time_tx))
7066                 goto nla_put_failure;
7067         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7068             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7069                         survey->time_scan))
7070                 goto nla_put_failure;
7071
7072         nla_nest_end(msg, infoattr);
7073
7074         genlmsg_end(msg, hdr);
7075         return 0;
7076
7077  nla_put_failure:
7078         genlmsg_cancel(msg, hdr);
7079         return -EMSGSIZE;
7080 }
7081
7082 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7083 {
7084         struct survey_info survey;
7085         struct cfg80211_registered_device *rdev;
7086         struct wireless_dev *wdev;
7087         int survey_idx = cb->args[2];
7088         int res;
7089         bool radio_stats;
7090
7091         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7092         if (res)
7093                 return res;
7094
7095         /* prepare_wdev_dump parsed the attributes */
7096         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7097
7098         if (!wdev->netdev) {
7099                 res = -EINVAL;
7100                 goto out_err;
7101         }
7102
7103         if (!rdev->ops->dump_survey) {
7104                 res = -EOPNOTSUPP;
7105                 goto out_err;
7106         }
7107
7108         while (1) {
7109                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7110                 if (res == -ENOENT)
7111                         break;
7112                 if (res)
7113                         goto out_err;
7114
7115                 /* don't send disabled channels, but do send non-channel data */
7116                 if (survey.channel &&
7117                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7118                         survey_idx++;
7119                         continue;
7120                 }
7121
7122                 if (nl80211_send_survey(skb,
7123                                 NETLINK_CB(cb->skb).portid,
7124                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7125                                 wdev->netdev, radio_stats, &survey) < 0)
7126                         goto out;
7127                 survey_idx++;
7128         }
7129
7130  out:
7131         cb->args[2] = survey_idx;
7132         res = skb->len;
7133  out_err:
7134         nl80211_finish_wdev_dump(rdev);
7135         return res;
7136 }
7137
7138 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7139 {
7140         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7141                                   NL80211_WPA_VERSION_2));
7142 }
7143
7144 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7145 {
7146         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7147         struct net_device *dev = info->user_ptr[1];
7148         struct ieee80211_channel *chan;
7149         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7150         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7151         enum nl80211_auth_type auth_type;
7152         struct key_parse key;
7153         bool local_state_change;
7154
7155         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7156                 return -EINVAL;
7157
7158         if (!info->attrs[NL80211_ATTR_MAC])
7159                 return -EINVAL;
7160
7161         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7162                 return -EINVAL;
7163
7164         if (!info->attrs[NL80211_ATTR_SSID])
7165                 return -EINVAL;
7166
7167         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7168                 return -EINVAL;
7169
7170         err = nl80211_parse_key(info, &key);
7171         if (err)
7172                 return err;
7173
7174         if (key.idx >= 0) {
7175                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7176                         return -EINVAL;
7177                 if (!key.p.key || !key.p.key_len)
7178                         return -EINVAL;
7179                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7180                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7181                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7182                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7183                         return -EINVAL;
7184                 if (key.idx > 4)
7185                         return -EINVAL;
7186         } else {
7187                 key.p.key_len = 0;
7188                 key.p.key = NULL;
7189         }
7190
7191         if (key.idx >= 0) {
7192                 int i;
7193                 bool ok = false;
7194                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7195                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7196                                 ok = true;
7197                                 break;
7198                         }
7199                 }
7200                 if (!ok)
7201                         return -EINVAL;
7202         }
7203
7204         if (!rdev->ops->auth)
7205                 return -EOPNOTSUPP;
7206
7207         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7208             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7209                 return -EOPNOTSUPP;
7210
7211         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7212         chan = nl80211_get_valid_chan(&rdev->wiphy,
7213                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7214         if (!chan)
7215                 return -EINVAL;
7216
7217         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7218         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7219
7220         if (info->attrs[NL80211_ATTR_IE]) {
7221                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7222                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7223         }
7224
7225         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7226         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7227                 return -EINVAL;
7228
7229         if (auth_type == NL80211_AUTHTYPE_SAE &&
7230             !info->attrs[NL80211_ATTR_SAE_DATA])
7231                 return -EINVAL;
7232
7233         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7234                 if (auth_type != NL80211_AUTHTYPE_SAE)
7235                         return -EINVAL;
7236                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7237                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7238                 /* need to include at least Auth Transaction and Status Code */
7239                 if (sae_data_len < 4)
7240                         return -EINVAL;
7241         }
7242
7243         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7244
7245         /*
7246          * Since we no longer track auth state, ignore
7247          * requests to only change local state.
7248          */
7249         if (local_state_change)
7250                 return 0;
7251
7252         wdev_lock(dev->ieee80211_ptr);
7253         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7254                                  ssid, ssid_len, ie, ie_len,
7255                                  key.p.key, key.p.key_len, key.idx,
7256                                  sae_data, sae_data_len);
7257         wdev_unlock(dev->ieee80211_ptr);
7258         return err;
7259 }
7260
7261 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7262                                    struct genl_info *info,
7263                                    struct cfg80211_crypto_settings *settings,
7264                                    int cipher_limit)
7265 {
7266         memset(settings, 0, sizeof(*settings));
7267
7268         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7269
7270         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7271                 u16 proto;
7272                 proto = nla_get_u16(
7273                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7274                 settings->control_port_ethertype = cpu_to_be16(proto);
7275                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7276                     proto != ETH_P_PAE)
7277                         return -EINVAL;
7278                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7279                         settings->control_port_no_encrypt = true;
7280         } else
7281                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7282
7283         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7284                 void *data;
7285                 int len, i;
7286
7287                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7288                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7289                 settings->n_ciphers_pairwise = len / sizeof(u32);
7290
7291                 if (len % sizeof(u32))
7292                         return -EINVAL;
7293
7294                 if (settings->n_ciphers_pairwise > cipher_limit)
7295                         return -EINVAL;
7296
7297                 memcpy(settings->ciphers_pairwise, data, len);
7298
7299                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7300                         if (!cfg80211_supported_cipher_suite(
7301                                         &rdev->wiphy,
7302                                         settings->ciphers_pairwise[i]))
7303                                 return -EINVAL;
7304         }
7305
7306         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7307                 settings->cipher_group =
7308                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7309                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7310                                                      settings->cipher_group))
7311                         return -EINVAL;
7312         }
7313
7314         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7315                 settings->wpa_versions =
7316                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7317                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7318                         return -EINVAL;
7319         }
7320
7321         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7322                 void *data;
7323                 int len;
7324
7325                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7326                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7327                 settings->n_akm_suites = len / sizeof(u32);
7328
7329                 if (len % sizeof(u32))
7330                         return -EINVAL;
7331
7332                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7333                         return -EINVAL;
7334
7335                 memcpy(settings->akm_suites, data, len);
7336         }
7337
7338         return 0;
7339 }
7340
7341 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7342 {
7343         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7344         struct net_device *dev = info->user_ptr[1];
7345         struct ieee80211_channel *chan;
7346         struct cfg80211_assoc_request req = {};
7347         const u8 *bssid, *ssid;
7348         int err, ssid_len = 0;
7349
7350         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7351                 return -EINVAL;
7352
7353         if (!info->attrs[NL80211_ATTR_MAC] ||
7354             !info->attrs[NL80211_ATTR_SSID] ||
7355             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7356                 return -EINVAL;
7357
7358         if (!rdev->ops->assoc)
7359                 return -EOPNOTSUPP;
7360
7361         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7362             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7363                 return -EOPNOTSUPP;
7364
7365         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7366
7367         chan = nl80211_get_valid_chan(&rdev->wiphy,
7368                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7369         if (!chan)
7370                 return -EINVAL;
7371
7372         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7373         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7374
7375         if (info->attrs[NL80211_ATTR_IE]) {
7376                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7377                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7378         }
7379
7380         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7381                 enum nl80211_mfp mfp =
7382                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7383                 if (mfp == NL80211_MFP_REQUIRED)
7384                         req.use_mfp = true;
7385                 else if (mfp != NL80211_MFP_NO)
7386                         return -EINVAL;
7387         }
7388
7389         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7390                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7391
7392         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7393                 req.flags |= ASSOC_REQ_DISABLE_HT;
7394
7395         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7396                 memcpy(&req.ht_capa_mask,
7397                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7398                        sizeof(req.ht_capa_mask));
7399
7400         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7401                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7402                         return -EINVAL;
7403                 memcpy(&req.ht_capa,
7404                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7405                        sizeof(req.ht_capa));
7406         }
7407
7408         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7409                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7410
7411         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7412                 memcpy(&req.vht_capa_mask,
7413                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7414                        sizeof(req.vht_capa_mask));
7415
7416         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7417                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7418                         return -EINVAL;
7419                 memcpy(&req.vht_capa,
7420                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7421                        sizeof(req.vht_capa));
7422         }
7423
7424         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7425                 if (!((rdev->wiphy.features &
7426                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
7427                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
7428                     !wiphy_ext_feature_isset(&rdev->wiphy,
7429                                              NL80211_EXT_FEATURE_RRM))
7430                         return -EINVAL;
7431                 req.flags |= ASSOC_REQ_USE_RRM;
7432         }
7433
7434         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7435         if (!err) {
7436                 wdev_lock(dev->ieee80211_ptr);
7437                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7438                                           ssid, ssid_len, &req);
7439                 wdev_unlock(dev->ieee80211_ptr);
7440         }
7441
7442         return err;
7443 }
7444
7445 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7446 {
7447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7448         struct net_device *dev = info->user_ptr[1];
7449         const u8 *ie = NULL, *bssid;
7450         int ie_len = 0, err;
7451         u16 reason_code;
7452         bool local_state_change;
7453
7454         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7455                 return -EINVAL;
7456
7457         if (!info->attrs[NL80211_ATTR_MAC])
7458                 return -EINVAL;
7459
7460         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7461                 return -EINVAL;
7462
7463         if (!rdev->ops->deauth)
7464                 return -EOPNOTSUPP;
7465
7466         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7467             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7468                 return -EOPNOTSUPP;
7469
7470         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7471
7472         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7473         if (reason_code == 0) {
7474                 /* Reason Code 0 is reserved */
7475                 return -EINVAL;
7476         }
7477
7478         if (info->attrs[NL80211_ATTR_IE]) {
7479                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7480                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7481         }
7482
7483         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7484
7485         wdev_lock(dev->ieee80211_ptr);
7486         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7487                                    local_state_change);
7488         wdev_unlock(dev->ieee80211_ptr);
7489         return err;
7490 }
7491
7492 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7493 {
7494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7495         struct net_device *dev = info->user_ptr[1];
7496         const u8 *ie = NULL, *bssid;
7497         int ie_len = 0, err;
7498         u16 reason_code;
7499         bool local_state_change;
7500
7501         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7502                 return -EINVAL;
7503
7504         if (!info->attrs[NL80211_ATTR_MAC])
7505                 return -EINVAL;
7506
7507         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7508                 return -EINVAL;
7509
7510         if (!rdev->ops->disassoc)
7511                 return -EOPNOTSUPP;
7512
7513         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7514             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7515                 return -EOPNOTSUPP;
7516
7517         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7518
7519         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7520         if (reason_code == 0) {
7521                 /* Reason Code 0 is reserved */
7522                 return -EINVAL;
7523         }
7524
7525         if (info->attrs[NL80211_ATTR_IE]) {
7526                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7527                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7528         }
7529
7530         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7531
7532         wdev_lock(dev->ieee80211_ptr);
7533         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7534                                      local_state_change);
7535         wdev_unlock(dev->ieee80211_ptr);
7536         return err;
7537 }
7538
7539 static bool
7540 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7541                          int mcast_rate[NUM_NL80211_BANDS],
7542                          int rateval)
7543 {
7544         struct wiphy *wiphy = &rdev->wiphy;
7545         bool found = false;
7546         int band, i;
7547
7548         for (band = 0; band < NUM_NL80211_BANDS; band++) {
7549                 struct ieee80211_supported_band *sband;
7550
7551                 sband = wiphy->bands[band];
7552                 if (!sband)
7553                         continue;
7554
7555                 for (i = 0; i < sband->n_bitrates; i++) {
7556                         if (sband->bitrates[i].bitrate == rateval) {
7557                                 mcast_rate[band] = i + 1;
7558                                 found = true;
7559                                 break;
7560                         }
7561                 }
7562         }
7563
7564         return found;
7565 }
7566
7567 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7568 {
7569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7570         struct net_device *dev = info->user_ptr[1];
7571         struct cfg80211_ibss_params ibss;
7572         struct wiphy *wiphy;
7573         struct cfg80211_cached_keys *connkeys = NULL;
7574         int err;
7575
7576         memset(&ibss, 0, sizeof(ibss));
7577
7578         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7579                 return -EINVAL;
7580
7581         if (!info->attrs[NL80211_ATTR_SSID] ||
7582             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7583                 return -EINVAL;
7584
7585         ibss.beacon_interval = 100;
7586
7587         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7588                 ibss.beacon_interval =
7589                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7590                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7591                         return -EINVAL;
7592         }
7593
7594         if (!rdev->ops->join_ibss)
7595                 return -EOPNOTSUPP;
7596
7597         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7598                 return -EOPNOTSUPP;
7599
7600         wiphy = &rdev->wiphy;
7601
7602         if (info->attrs[NL80211_ATTR_MAC]) {
7603                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7604
7605                 if (!is_valid_ether_addr(ibss.bssid))
7606                         return -EINVAL;
7607         }
7608         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7609         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7610
7611         if (info->attrs[NL80211_ATTR_IE]) {
7612                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7613                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7614         }
7615
7616         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7617         if (err)
7618                 return err;
7619
7620         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7621                                      NL80211_IFTYPE_ADHOC))
7622                 return -EINVAL;
7623
7624         switch (ibss.chandef.width) {
7625         case NL80211_CHAN_WIDTH_5:
7626         case NL80211_CHAN_WIDTH_10:
7627         case NL80211_CHAN_WIDTH_20_NOHT:
7628                 break;
7629         case NL80211_CHAN_WIDTH_20:
7630         case NL80211_CHAN_WIDTH_40:
7631                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7632                         return -EINVAL;
7633                 break;
7634         case NL80211_CHAN_WIDTH_80:
7635         case NL80211_CHAN_WIDTH_80P80:
7636         case NL80211_CHAN_WIDTH_160:
7637                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7638                         return -EINVAL;
7639                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7640                                              NL80211_EXT_FEATURE_VHT_IBSS))
7641                         return -EINVAL;
7642                 break;
7643         default:
7644                 return -EINVAL;
7645         }
7646
7647         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7648         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7649
7650         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7651                 u8 *rates =
7652                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7653                 int n_rates =
7654                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7655                 struct ieee80211_supported_band *sband =
7656                         wiphy->bands[ibss.chandef.chan->band];
7657
7658                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7659                                              &ibss.basic_rates);
7660                 if (err)
7661                         return err;
7662         }
7663
7664         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7665                 memcpy(&ibss.ht_capa_mask,
7666                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7667                        sizeof(ibss.ht_capa_mask));
7668
7669         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7670                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7671                         return -EINVAL;
7672                 memcpy(&ibss.ht_capa,
7673                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7674                        sizeof(ibss.ht_capa));
7675         }
7676
7677         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7678             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7679                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7680                 return -EINVAL;
7681
7682         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7683                 bool no_ht = false;
7684
7685                 connkeys = nl80211_parse_connkeys(rdev,
7686                                           info->attrs[NL80211_ATTR_KEYS],
7687                                           &no_ht);
7688                 if (IS_ERR(connkeys))
7689                         return PTR_ERR(connkeys);
7690
7691                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7692                     no_ht) {
7693                         kzfree(connkeys);
7694                         return -EINVAL;
7695                 }
7696         }
7697
7698         ibss.control_port =
7699                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7700
7701         ibss.userspace_handles_dfs =
7702                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7703
7704         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7705         if (err)
7706                 kzfree(connkeys);
7707         return err;
7708 }
7709
7710 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7711 {
7712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7713         struct net_device *dev = info->user_ptr[1];
7714
7715         if (!rdev->ops->leave_ibss)
7716                 return -EOPNOTSUPP;
7717
7718         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7719                 return -EOPNOTSUPP;
7720
7721         return cfg80211_leave_ibss(rdev, dev, false);
7722 }
7723
7724 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7725 {
7726         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7727         struct net_device *dev = info->user_ptr[1];
7728         int mcast_rate[NUM_NL80211_BANDS];
7729         u32 nla_rate;
7730         int err;
7731
7732         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7733             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7734             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7735                 return -EOPNOTSUPP;
7736
7737         if (!rdev->ops->set_mcast_rate)
7738                 return -EOPNOTSUPP;
7739
7740         memset(mcast_rate, 0, sizeof(mcast_rate));
7741
7742         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7743                 return -EINVAL;
7744
7745         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7746         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7747                 return -EINVAL;
7748
7749         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
7750
7751         return err;
7752 }
7753
7754 static struct sk_buff *
7755 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7756                             struct wireless_dev *wdev, int approxlen,
7757                             u32 portid, u32 seq, enum nl80211_commands cmd,
7758                             enum nl80211_attrs attr,
7759                             const struct nl80211_vendor_cmd_info *info,
7760                             gfp_t gfp)
7761 {
7762         struct sk_buff *skb;
7763         void *hdr;
7764         struct nlattr *data;
7765
7766         skb = nlmsg_new(approxlen + 100, gfp);
7767         if (!skb)
7768                 return NULL;
7769
7770         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7771         if (!hdr) {
7772                 kfree_skb(skb);
7773                 return NULL;
7774         }
7775
7776         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7777                 goto nla_put_failure;
7778
7779         if (info) {
7780                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7781                                 info->vendor_id))
7782                         goto nla_put_failure;
7783                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7784                                 info->subcmd))
7785                         goto nla_put_failure;
7786         }
7787
7788         if (wdev) {
7789                 if (nla_put_u64(skb, NL80211_ATTR_WDEV,
7790                                 wdev_id(wdev)))
7791                         goto nla_put_failure;
7792                 if (wdev->netdev &&
7793                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
7794                                 wdev->netdev->ifindex))
7795                         goto nla_put_failure;
7796         }
7797
7798         data = nla_nest_start(skb, attr);
7799
7800         ((void **)skb->cb)[0] = rdev;
7801         ((void **)skb->cb)[1] = hdr;
7802         ((void **)skb->cb)[2] = data;
7803
7804         return skb;
7805
7806  nla_put_failure:
7807         kfree_skb(skb);
7808         return NULL;
7809 }
7810
7811 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7812                                            struct wireless_dev *wdev,
7813                                            enum nl80211_commands cmd,
7814                                            enum nl80211_attrs attr,
7815                                            int vendor_event_idx,
7816                                            int approxlen, gfp_t gfp)
7817 {
7818         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7819         const struct nl80211_vendor_cmd_info *info;
7820
7821         switch (cmd) {
7822         case NL80211_CMD_TESTMODE:
7823                 if (WARN_ON(vendor_event_idx != -1))
7824                         return NULL;
7825                 info = NULL;
7826                 break;
7827         case NL80211_CMD_VENDOR:
7828                 if (WARN_ON(vendor_event_idx < 0 ||
7829                             vendor_event_idx >= wiphy->n_vendor_events))
7830                         return NULL;
7831                 info = &wiphy->vendor_events[vendor_event_idx];
7832                 break;
7833         default:
7834                 WARN_ON(1);
7835                 return NULL;
7836         }
7837
7838         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
7839                                            cmd, attr, info, gfp);
7840 }
7841 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7842
7843 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7844 {
7845         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7846         void *hdr = ((void **)skb->cb)[1];
7847         struct nlattr *data = ((void **)skb->cb)[2];
7848         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7849
7850         /* clear CB data for netlink core to own from now on */
7851         memset(skb->cb, 0, sizeof(skb->cb));
7852
7853         nla_nest_end(skb, data);
7854         genlmsg_end(skb, hdr);
7855
7856         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7857                 mcgrp = NL80211_MCGRP_VENDOR;
7858
7859         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7860                                 mcgrp, gfp);
7861 }
7862 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7863
7864 #ifdef CONFIG_NL80211_TESTMODE
7865 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7866 {
7867         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7868         struct wireless_dev *wdev =
7869                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7870         int err;
7871
7872         if (!rdev->ops->testmode_cmd)
7873                 return -EOPNOTSUPP;
7874
7875         if (IS_ERR(wdev)) {
7876                 err = PTR_ERR(wdev);
7877                 if (err != -EINVAL)
7878                         return err;
7879                 wdev = NULL;
7880         } else if (wdev->wiphy != &rdev->wiphy) {
7881                 return -EINVAL;
7882         }
7883
7884         if (!info->attrs[NL80211_ATTR_TESTDATA])
7885                 return -EINVAL;
7886
7887         rdev->cur_cmd_info = info;
7888         err = rdev_testmode_cmd(rdev, wdev,
7889                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7890                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7891         rdev->cur_cmd_info = NULL;
7892
7893         return err;
7894 }
7895
7896 static int nl80211_testmode_dump(struct sk_buff *skb,
7897                                  struct netlink_callback *cb)
7898 {
7899         struct cfg80211_registered_device *rdev;
7900         int err;
7901         long phy_idx;
7902         void *data = NULL;
7903         int data_len = 0;
7904
7905         rtnl_lock();
7906
7907         if (cb->args[0]) {
7908                 /*
7909                  * 0 is a valid index, but not valid for args[0],
7910                  * so we need to offset by 1.
7911                  */
7912                 phy_idx = cb->args[0] - 1;
7913         } else {
7914                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7915                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7916                                   nl80211_policy);
7917                 if (err)
7918                         goto out_err;
7919
7920                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7921                                                   nl80211_fam.attrbuf);
7922                 if (IS_ERR(rdev)) {
7923                         err = PTR_ERR(rdev);
7924                         goto out_err;
7925                 }
7926                 phy_idx = rdev->wiphy_idx;
7927                 rdev = NULL;
7928
7929                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7930                         cb->args[1] =
7931                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7932         }
7933
7934         if (cb->args[1]) {
7935                 data = nla_data((void *)cb->args[1]);
7936                 data_len = nla_len((void *)cb->args[1]);
7937         }
7938
7939         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7940         if (!rdev) {
7941                 err = -ENOENT;
7942                 goto out_err;
7943         }
7944
7945         if (!rdev->ops->testmode_dump) {
7946                 err = -EOPNOTSUPP;
7947                 goto out_err;
7948         }
7949
7950         while (1) {
7951                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7952                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7953                                            NL80211_CMD_TESTMODE);
7954                 struct nlattr *tmdata;
7955
7956                 if (!hdr)
7957                         break;
7958
7959                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7960                         genlmsg_cancel(skb, hdr);
7961                         break;
7962                 }
7963
7964                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7965                 if (!tmdata) {
7966                         genlmsg_cancel(skb, hdr);
7967                         break;
7968                 }
7969                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7970                 nla_nest_end(skb, tmdata);
7971
7972                 if (err == -ENOBUFS || err == -ENOENT) {
7973                         genlmsg_cancel(skb, hdr);
7974                         break;
7975                 } else if (err) {
7976                         genlmsg_cancel(skb, hdr);
7977                         goto out_err;
7978                 }
7979
7980                 genlmsg_end(skb, hdr);
7981         }
7982
7983         err = skb->len;
7984         /* see above */
7985         cb->args[0] = phy_idx + 1;
7986  out_err:
7987         rtnl_unlock();
7988         return err;
7989 }
7990 #endif
7991
7992 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7993 {
7994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7995         struct net_device *dev = info->user_ptr[1];
7996         struct cfg80211_connect_params connect;
7997         struct wiphy *wiphy;
7998         struct cfg80211_cached_keys *connkeys = NULL;
7999         int err;
8000
8001         memset(&connect, 0, sizeof(connect));
8002
8003         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8004                 return -EINVAL;
8005
8006         if (!info->attrs[NL80211_ATTR_SSID] ||
8007             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8008                 return -EINVAL;
8009
8010         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8011                 connect.auth_type =
8012                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8013                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8014                                              NL80211_CMD_CONNECT))
8015                         return -EINVAL;
8016         } else
8017                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8018
8019         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8020
8021         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8022                                       NL80211_MAX_NR_CIPHER_SUITES);
8023         if (err)
8024                 return err;
8025
8026         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8027             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8028                 return -EOPNOTSUPP;
8029
8030         wiphy = &rdev->wiphy;
8031
8032         connect.bg_scan_period = -1;
8033         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8034                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8035                 connect.bg_scan_period =
8036                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8037         }
8038
8039         if (info->attrs[NL80211_ATTR_MAC])
8040                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8041         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8042                 connect.bssid_hint =
8043                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8044         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8045         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8046
8047         if (info->attrs[NL80211_ATTR_IE]) {
8048                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8049                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8050         }
8051
8052         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8053                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8054                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8055                     connect.mfp != NL80211_MFP_NO)
8056                         return -EINVAL;
8057         } else {
8058                 connect.mfp = NL80211_MFP_NO;
8059         }
8060
8061         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8062                 connect.prev_bssid =
8063                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8064
8065         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8066                 connect.channel = nl80211_get_valid_chan(
8067                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8068                 if (!connect.channel)
8069                         return -EINVAL;
8070         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8071                 connect.channel_hint = nl80211_get_valid_chan(
8072                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8073                 if (!connect.channel_hint)
8074                         return -EINVAL;
8075         }
8076
8077         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8078                 connkeys = nl80211_parse_connkeys(rdev,
8079                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8080                 if (IS_ERR(connkeys))
8081                         return PTR_ERR(connkeys);
8082         }
8083
8084         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8085                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8086
8087         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8088                 memcpy(&connect.ht_capa_mask,
8089                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8090                        sizeof(connect.ht_capa_mask));
8091
8092         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8093                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8094                         kzfree(connkeys);
8095                         return -EINVAL;
8096                 }
8097                 memcpy(&connect.ht_capa,
8098                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8099                        sizeof(connect.ht_capa));
8100         }
8101
8102         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8103                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8104
8105         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8106                 memcpy(&connect.vht_capa_mask,
8107                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8108                        sizeof(connect.vht_capa_mask));
8109
8110         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8111                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8112                         kzfree(connkeys);
8113                         return -EINVAL;
8114                 }
8115                 memcpy(&connect.vht_capa,
8116                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8117                        sizeof(connect.vht_capa));
8118         }
8119
8120         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8121                 if (!((rdev->wiphy.features &
8122                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8123                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8124                     !wiphy_ext_feature_isset(&rdev->wiphy,
8125                                              NL80211_EXT_FEATURE_RRM)) {
8126                         kzfree(connkeys);
8127                         return -EINVAL;
8128                 }
8129                 connect.flags |= ASSOC_REQ_USE_RRM;
8130         }
8131
8132         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8133         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8134                 kzfree(connkeys);
8135                 return -EOPNOTSUPP;
8136         }
8137
8138         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8139                 /* bss selection makes no sense if bssid is set */
8140                 if (connect.bssid) {
8141                         kzfree(connkeys);
8142                         return -EINVAL;
8143                 }
8144
8145                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8146                                        wiphy, &connect.bss_select);
8147                 if (err) {
8148                         kzfree(connkeys);
8149                         return err;
8150                 }
8151         }
8152
8153         wdev_lock(dev->ieee80211_ptr);
8154         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8155                                connect.prev_bssid);
8156         wdev_unlock(dev->ieee80211_ptr);
8157         if (err)
8158                 kzfree(connkeys);
8159         return err;
8160 }
8161
8162 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8163 {
8164         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8165         struct net_device *dev = info->user_ptr[1];
8166         u16 reason;
8167         int ret;
8168
8169         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8170                 reason = WLAN_REASON_DEAUTH_LEAVING;
8171         else
8172                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8173
8174         if (reason == 0)
8175                 return -EINVAL;
8176
8177         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8178             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8179                 return -EOPNOTSUPP;
8180
8181         wdev_lock(dev->ieee80211_ptr);
8182         ret = cfg80211_disconnect(rdev, dev, reason, true);
8183         wdev_unlock(dev->ieee80211_ptr);
8184         return ret;
8185 }
8186
8187 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8188 {
8189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8190         struct net *net;
8191         int err;
8192
8193         if (info->attrs[NL80211_ATTR_PID]) {
8194                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8195
8196                 net = get_net_ns_by_pid(pid);
8197         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8198                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8199
8200                 net = get_net_ns_by_fd(fd);
8201         } else {
8202                 return -EINVAL;
8203         }
8204
8205         if (IS_ERR(net))
8206                 return PTR_ERR(net);
8207
8208         err = 0;
8209
8210         /* check if anything to do */
8211         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8212                 err = cfg80211_switch_netns(rdev, net);
8213
8214         put_net(net);
8215         return err;
8216 }
8217
8218 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8219 {
8220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8221         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8222                         struct cfg80211_pmksa *pmksa) = NULL;
8223         struct net_device *dev = info->user_ptr[1];
8224         struct cfg80211_pmksa pmksa;
8225
8226         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8227
8228         if (!info->attrs[NL80211_ATTR_MAC])
8229                 return -EINVAL;
8230
8231         if (!info->attrs[NL80211_ATTR_PMKID])
8232                 return -EINVAL;
8233
8234         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8235         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8236
8237         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8238             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8239                 return -EOPNOTSUPP;
8240
8241         switch (info->genlhdr->cmd) {
8242         case NL80211_CMD_SET_PMKSA:
8243                 rdev_ops = rdev->ops->set_pmksa;
8244                 break;
8245         case NL80211_CMD_DEL_PMKSA:
8246                 rdev_ops = rdev->ops->del_pmksa;
8247                 break;
8248         default:
8249                 WARN_ON(1);
8250                 break;
8251         }
8252
8253         if (!rdev_ops)
8254                 return -EOPNOTSUPP;
8255
8256         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8257 }
8258
8259 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8260 {
8261         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8262         struct net_device *dev = info->user_ptr[1];
8263
8264         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8265             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8266                 return -EOPNOTSUPP;
8267
8268         if (!rdev->ops->flush_pmksa)
8269                 return -EOPNOTSUPP;
8270
8271         return rdev_flush_pmksa(rdev, dev);
8272 }
8273
8274 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8275 {
8276         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8277         struct net_device *dev = info->user_ptr[1];
8278         u8 action_code, dialog_token;
8279         u32 peer_capability = 0;
8280         u16 status_code;
8281         u8 *peer;
8282         bool initiator;
8283
8284         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8285             !rdev->ops->tdls_mgmt)
8286                 return -EOPNOTSUPP;
8287
8288         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8289             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8290             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8291             !info->attrs[NL80211_ATTR_IE] ||
8292             !info->attrs[NL80211_ATTR_MAC])
8293                 return -EINVAL;
8294
8295         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8296         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8297         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8298         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8299         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8300         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8301                 peer_capability =
8302                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8303
8304         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8305                               dialog_token, status_code, peer_capability,
8306                               initiator,
8307                               nla_data(info->attrs[NL80211_ATTR_IE]),
8308                               nla_len(info->attrs[NL80211_ATTR_IE]));
8309 }
8310
8311 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8312 {
8313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8314         struct net_device *dev = info->user_ptr[1];
8315         enum nl80211_tdls_operation operation;
8316         u8 *peer;
8317
8318         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8319             !rdev->ops->tdls_oper)
8320                 return -EOPNOTSUPP;
8321
8322         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8323             !info->attrs[NL80211_ATTR_MAC])
8324                 return -EINVAL;
8325
8326         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8327         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8328
8329         return rdev_tdls_oper(rdev, dev, peer, operation);
8330 }
8331
8332 static int nl80211_remain_on_channel(struct sk_buff *skb,
8333                                      struct genl_info *info)
8334 {
8335         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8336         struct wireless_dev *wdev = info->user_ptr[1];
8337         struct cfg80211_chan_def chandef;
8338         struct sk_buff *msg;
8339         void *hdr;
8340         u64 cookie;
8341         u32 duration;
8342         int err;
8343
8344         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8345             !info->attrs[NL80211_ATTR_DURATION])
8346                 return -EINVAL;
8347
8348         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8349
8350         if (!rdev->ops->remain_on_channel ||
8351             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8352                 return -EOPNOTSUPP;
8353
8354         /*
8355          * We should be on that channel for at least a minimum amount of
8356          * time (10ms) but no longer than the driver supports.
8357          */
8358         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8359             duration > rdev->wiphy.max_remain_on_channel_duration)
8360                 return -EINVAL;
8361
8362         err = nl80211_parse_chandef(rdev, info, &chandef);
8363         if (err)
8364                 return err;
8365
8366         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8367         if (!msg)
8368                 return -ENOMEM;
8369
8370         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8371                              NL80211_CMD_REMAIN_ON_CHANNEL);
8372         if (!hdr) {
8373                 err = -ENOBUFS;
8374                 goto free_msg;
8375         }
8376
8377         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8378                                      duration, &cookie);
8379
8380         if (err)
8381                 goto free_msg;
8382
8383         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8384                 goto nla_put_failure;
8385
8386         genlmsg_end(msg, hdr);
8387
8388         return genlmsg_reply(msg, info);
8389
8390  nla_put_failure:
8391         err = -ENOBUFS;
8392  free_msg:
8393         nlmsg_free(msg);
8394         return err;
8395 }
8396
8397 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8398                                             struct genl_info *info)
8399 {
8400         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8401         struct wireless_dev *wdev = info->user_ptr[1];
8402         u64 cookie;
8403
8404         if (!info->attrs[NL80211_ATTR_COOKIE])
8405                 return -EINVAL;
8406
8407         if (!rdev->ops->cancel_remain_on_channel)
8408                 return -EOPNOTSUPP;
8409
8410         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8411
8412         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8413 }
8414
8415 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8416                            u8 *rates, u8 rates_len)
8417 {
8418         u8 i;
8419         u32 mask = 0;
8420
8421         for (i = 0; i < rates_len; i++) {
8422                 int rate = (rates[i] & 0x7f) * 5;
8423                 int ridx;
8424                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8425                         struct ieee80211_rate *srate =
8426                                 &sband->bitrates[ridx];
8427                         if (rate == srate->bitrate) {
8428                                 mask |= 1 << ridx;
8429                                 break;
8430                         }
8431                 }
8432                 if (ridx == sband->n_bitrates)
8433                         return 0; /* rate not found */
8434         }
8435
8436         return mask;
8437 }
8438
8439 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8440                                u8 *rates, u8 rates_len,
8441                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8442 {
8443         u8 i;
8444
8445         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8446
8447         for (i = 0; i < rates_len; i++) {
8448                 int ridx, rbit;
8449
8450                 ridx = rates[i] / 8;
8451                 rbit = BIT(rates[i] % 8);
8452
8453                 /* check validity */
8454                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8455                         return false;
8456
8457                 /* check availability */
8458                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8459                         mcs[ridx] |= rbit;
8460                 else
8461                         return false;
8462         }
8463
8464         return true;
8465 }
8466
8467 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8468 {
8469         u16 mcs_mask = 0;
8470
8471         switch (vht_mcs_map) {
8472         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8473                 break;
8474         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8475                 mcs_mask = 0x00FF;
8476                 break;
8477         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8478                 mcs_mask = 0x01FF;
8479                 break;
8480         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8481                 mcs_mask = 0x03FF;
8482                 break;
8483         default:
8484                 break;
8485         }
8486
8487         return mcs_mask;
8488 }
8489
8490 static void vht_build_mcs_mask(u16 vht_mcs_map,
8491                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8492 {
8493         u8 nss;
8494
8495         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8496                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8497                 vht_mcs_map >>= 2;
8498         }
8499 }
8500
8501 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8502                              struct nl80211_txrate_vht *txrate,
8503                              u16 mcs[NL80211_VHT_NSS_MAX])
8504 {
8505         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8506         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8507         u8 i;
8508
8509         if (!sband->vht_cap.vht_supported)
8510                 return false;
8511
8512         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8513
8514         /* Build vht_mcs_mask from VHT capabilities */
8515         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8516
8517         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8518                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8519                         mcs[i] = txrate->mcs[i];
8520                 else
8521                         return false;
8522         }
8523
8524         return true;
8525 }
8526
8527 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8528         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8529                                     .len = NL80211_MAX_SUPP_RATES },
8530         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8531                                 .len = NL80211_MAX_SUPP_HT_RATES },
8532         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8533         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8534 };
8535
8536 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8537                                        struct genl_info *info)
8538 {
8539         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8541         struct cfg80211_bitrate_mask mask;
8542         int rem, i;
8543         struct net_device *dev = info->user_ptr[1];
8544         struct nlattr *tx_rates;
8545         struct ieee80211_supported_band *sband;
8546         u16 vht_tx_mcs_map;
8547
8548         if (!rdev->ops->set_bitrate_mask)
8549                 return -EOPNOTSUPP;
8550
8551         memset(&mask, 0, sizeof(mask));
8552         /* Default to all rates enabled */
8553         for (i = 0; i < NUM_NL80211_BANDS; i++) {
8554                 sband = rdev->wiphy.bands[i];
8555
8556                 if (!sband)
8557                         continue;
8558
8559                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8560                 memcpy(mask.control[i].ht_mcs,
8561                        sband->ht_cap.mcs.rx_mask,
8562                        sizeof(mask.control[i].ht_mcs));
8563
8564                 if (!sband->vht_cap.vht_supported)
8565                         continue;
8566
8567                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8568                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8569         }
8570
8571         /* if no rates are given set it back to the defaults */
8572         if (!info->attrs[NL80211_ATTR_TX_RATES])
8573                 goto out;
8574
8575         /*
8576          * The nested attribute uses enum nl80211_band as the index. This maps
8577          * directly to the enum nl80211_band values used in cfg80211.
8578          */
8579         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8580         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8581                 enum nl80211_band band = nla_type(tx_rates);
8582                 int err;
8583
8584                 if (band < 0 || band >= NUM_NL80211_BANDS)
8585                         return -EINVAL;
8586                 sband = rdev->wiphy.bands[band];
8587                 if (sband == NULL)
8588                         return -EINVAL;
8589                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8590                                 nla_len(tx_rates), nl80211_txattr_policy);
8591                 if (err)
8592                         return err;
8593                 if (tb[NL80211_TXRATE_LEGACY]) {
8594                         mask.control[band].legacy = rateset_to_mask(
8595                                 sband,
8596                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8597                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8598                         if ((mask.control[band].legacy == 0) &&
8599                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8600                                 return -EINVAL;
8601                 }
8602                 if (tb[NL80211_TXRATE_HT]) {
8603                         if (!ht_rateset_to_mask(
8604                                         sband,
8605                                         nla_data(tb[NL80211_TXRATE_HT]),
8606                                         nla_len(tb[NL80211_TXRATE_HT]),
8607                                         mask.control[band].ht_mcs))
8608                                 return -EINVAL;
8609                 }
8610                 if (tb[NL80211_TXRATE_VHT]) {
8611                         if (!vht_set_mcs_mask(
8612                                         sband,
8613                                         nla_data(tb[NL80211_TXRATE_VHT]),
8614                                         mask.control[band].vht_mcs))
8615                                 return -EINVAL;
8616                 }
8617                 if (tb[NL80211_TXRATE_GI]) {
8618                         mask.control[band].gi =
8619                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8620                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8621                                 return -EINVAL;
8622                 }
8623
8624                 if (mask.control[band].legacy == 0) {
8625                         /* don't allow empty legacy rates if HT or VHT
8626                          * are not even supported.
8627                          */
8628                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8629                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8630                                 return -EINVAL;
8631
8632                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8633                                 if (mask.control[band].ht_mcs[i])
8634                                         goto out;
8635
8636                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8637                                 if (mask.control[band].vht_mcs[i])
8638                                         goto out;
8639
8640                         /* legacy and mcs rates may not be both empty */
8641                         return -EINVAL;
8642                 }
8643         }
8644
8645 out:
8646         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8647 }
8648
8649 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8650 {
8651         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8652         struct wireless_dev *wdev = info->user_ptr[1];
8653         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8654
8655         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8656                 return -EINVAL;
8657
8658         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8659                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8660
8661         switch (wdev->iftype) {
8662         case NL80211_IFTYPE_STATION:
8663         case NL80211_IFTYPE_ADHOC:
8664         case NL80211_IFTYPE_P2P_CLIENT:
8665         case NL80211_IFTYPE_AP:
8666         case NL80211_IFTYPE_AP_VLAN:
8667         case NL80211_IFTYPE_MESH_POINT:
8668         case NL80211_IFTYPE_P2P_GO:
8669         case NL80211_IFTYPE_P2P_DEVICE:
8670                 break;
8671         default:
8672                 return -EOPNOTSUPP;
8673         }
8674
8675         /* not much point in registering if we can't reply */
8676         if (!rdev->ops->mgmt_tx)
8677                 return -EOPNOTSUPP;
8678
8679         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8680                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8681                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8682 }
8683
8684 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8685 {
8686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8687         struct wireless_dev *wdev = info->user_ptr[1];
8688         struct cfg80211_chan_def chandef;
8689         int err;
8690         void *hdr = NULL;
8691         u64 cookie;
8692         struct sk_buff *msg = NULL;
8693         struct cfg80211_mgmt_tx_params params = {
8694                 .dont_wait_for_ack =
8695                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8696         };
8697
8698         if (!info->attrs[NL80211_ATTR_FRAME])
8699                 return -EINVAL;
8700
8701         if (!rdev->ops->mgmt_tx)
8702                 return -EOPNOTSUPP;
8703
8704         switch (wdev->iftype) {
8705         case NL80211_IFTYPE_P2P_DEVICE:
8706                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8707                         return -EINVAL;
8708         case NL80211_IFTYPE_STATION:
8709         case NL80211_IFTYPE_ADHOC:
8710         case NL80211_IFTYPE_P2P_CLIENT:
8711         case NL80211_IFTYPE_AP:
8712         case NL80211_IFTYPE_AP_VLAN:
8713         case NL80211_IFTYPE_MESH_POINT:
8714         case NL80211_IFTYPE_P2P_GO:
8715                 break;
8716         default:
8717                 return -EOPNOTSUPP;
8718         }
8719
8720         if (info->attrs[NL80211_ATTR_DURATION]) {
8721                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8722                         return -EINVAL;
8723                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8724
8725                 /*
8726                  * We should wait on the channel for at least a minimum amount
8727                  * of time (10ms) but no longer than the driver supports.
8728                  */
8729                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8730                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8731                         return -EINVAL;
8732
8733         }
8734
8735         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8736
8737         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8738                 return -EINVAL;
8739
8740         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8741
8742         /* get the channel if any has been specified, otherwise pass NULL to
8743          * the driver. The latter will use the current one
8744          */
8745         chandef.chan = NULL;
8746         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8747                 err = nl80211_parse_chandef(rdev, info, &chandef);
8748                 if (err)
8749                         return err;
8750         }
8751
8752         if (!chandef.chan && params.offchan)
8753                 return -EINVAL;
8754
8755         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8756         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8757
8758         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8759                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8760                 int i;
8761
8762                 if (len % sizeof(u16))
8763                         return -EINVAL;
8764
8765                 params.n_csa_offsets = len / sizeof(u16);
8766                 params.csa_offsets =
8767                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8768
8769                 /* check that all the offsets fit the frame */
8770                 for (i = 0; i < params.n_csa_offsets; i++) {
8771                         if (params.csa_offsets[i] >= params.len)
8772                                 return -EINVAL;
8773                 }
8774         }
8775
8776         if (!params.dont_wait_for_ack) {
8777                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8778                 if (!msg)
8779                         return -ENOMEM;
8780
8781                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8782                                      NL80211_CMD_FRAME);
8783                 if (!hdr) {
8784                         err = -ENOBUFS;
8785                         goto free_msg;
8786                 }
8787         }
8788
8789         params.chan = chandef.chan;
8790         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8791         if (err)
8792                 goto free_msg;
8793
8794         if (msg) {
8795                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8796                         goto nla_put_failure;
8797
8798                 genlmsg_end(msg, hdr);
8799                 return genlmsg_reply(msg, info);
8800         }
8801
8802         return 0;
8803
8804  nla_put_failure:
8805         err = -ENOBUFS;
8806  free_msg:
8807         nlmsg_free(msg);
8808         return err;
8809 }
8810
8811 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8812 {
8813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8814         struct wireless_dev *wdev = info->user_ptr[1];
8815         u64 cookie;
8816
8817         if (!info->attrs[NL80211_ATTR_COOKIE])
8818                 return -EINVAL;
8819
8820         if (!rdev->ops->mgmt_tx_cancel_wait)
8821                 return -EOPNOTSUPP;
8822
8823         switch (wdev->iftype) {
8824         case NL80211_IFTYPE_STATION:
8825         case NL80211_IFTYPE_ADHOC:
8826         case NL80211_IFTYPE_P2P_CLIENT:
8827         case NL80211_IFTYPE_AP:
8828         case NL80211_IFTYPE_AP_VLAN:
8829         case NL80211_IFTYPE_P2P_GO:
8830         case NL80211_IFTYPE_P2P_DEVICE:
8831                 break;
8832         default:
8833                 return -EOPNOTSUPP;
8834         }
8835
8836         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8837
8838         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8839 }
8840
8841 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8842 {
8843         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8844         struct wireless_dev *wdev;
8845         struct net_device *dev = info->user_ptr[1];
8846         u8 ps_state;
8847         bool state;
8848         int err;
8849
8850         if (!info->attrs[NL80211_ATTR_PS_STATE])
8851                 return -EINVAL;
8852
8853         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8854
8855         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8856                 return -EINVAL;
8857
8858         wdev = dev->ieee80211_ptr;
8859
8860         if (!rdev->ops->set_power_mgmt)
8861                 return -EOPNOTSUPP;
8862
8863         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8864
8865         if (state == wdev->ps)
8866                 return 0;
8867
8868         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8869         if (!err)
8870                 wdev->ps = state;
8871         return err;
8872 }
8873
8874 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8875 {
8876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8877         enum nl80211_ps_state ps_state;
8878         struct wireless_dev *wdev;
8879         struct net_device *dev = info->user_ptr[1];
8880         struct sk_buff *msg;
8881         void *hdr;
8882         int err;
8883
8884         wdev = dev->ieee80211_ptr;
8885
8886         if (!rdev->ops->set_power_mgmt)
8887                 return -EOPNOTSUPP;
8888
8889         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8890         if (!msg)
8891                 return -ENOMEM;
8892
8893         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8894                              NL80211_CMD_GET_POWER_SAVE);
8895         if (!hdr) {
8896                 err = -ENOBUFS;
8897                 goto free_msg;
8898         }
8899
8900         if (wdev->ps)
8901                 ps_state = NL80211_PS_ENABLED;
8902         else
8903                 ps_state = NL80211_PS_DISABLED;
8904
8905         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8906                 goto nla_put_failure;
8907
8908         genlmsg_end(msg, hdr);
8909         return genlmsg_reply(msg, info);
8910
8911  nla_put_failure:
8912         err = -ENOBUFS;
8913  free_msg:
8914         nlmsg_free(msg);
8915         return err;
8916 }
8917
8918 static const struct nla_policy
8919 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8920         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8921         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8922         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8923         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8924         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8925         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8926 };
8927
8928 static int nl80211_set_cqm_txe(struct genl_info *info,
8929                                u32 rate, u32 pkts, u32 intvl)
8930 {
8931         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8932         struct net_device *dev = info->user_ptr[1];
8933         struct wireless_dev *wdev = dev->ieee80211_ptr;
8934
8935         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8936                 return -EINVAL;
8937
8938         if (!rdev->ops->set_cqm_txe_config)
8939                 return -EOPNOTSUPP;
8940
8941         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8942             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8943                 return -EOPNOTSUPP;
8944
8945         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8946 }
8947
8948 static int nl80211_set_cqm_rssi(struct genl_info *info,
8949                                 s32 threshold, u32 hysteresis)
8950 {
8951         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8952         struct net_device *dev = info->user_ptr[1];
8953         struct wireless_dev *wdev = dev->ieee80211_ptr;
8954
8955         if (threshold > 0)
8956                 return -EINVAL;
8957
8958         /* disabling - hysteresis should also be zero then */
8959         if (threshold == 0)
8960                 hysteresis = 0;
8961
8962         if (!rdev->ops->set_cqm_rssi_config)
8963                 return -EOPNOTSUPP;
8964
8965         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8966             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8967                 return -EOPNOTSUPP;
8968
8969         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8970 }
8971
8972 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8973 {
8974         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8975         struct nlattr *cqm;
8976         int err;
8977
8978         cqm = info->attrs[NL80211_ATTR_CQM];
8979         if (!cqm)
8980                 return -EINVAL;
8981
8982         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8983                                nl80211_attr_cqm_policy);
8984         if (err)
8985                 return err;
8986
8987         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8988             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8989                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8990                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8991
8992                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8993         }
8994
8995         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8996             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8997             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8998                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8999                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9000                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9001
9002                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9003         }
9004
9005         return -EINVAL;
9006 }
9007
9008 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9009 {
9010         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9011         struct net_device *dev = info->user_ptr[1];
9012         struct ocb_setup setup = {};
9013         int err;
9014
9015         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9016         if (err)
9017                 return err;
9018
9019         return cfg80211_join_ocb(rdev, dev, &setup);
9020 }
9021
9022 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9023 {
9024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9025         struct net_device *dev = info->user_ptr[1];
9026
9027         return cfg80211_leave_ocb(rdev, dev);
9028 }
9029
9030 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9031 {
9032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9033         struct net_device *dev = info->user_ptr[1];
9034         struct mesh_config cfg;
9035         struct mesh_setup setup;
9036         int err;
9037
9038         /* start with default */
9039         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9040         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9041
9042         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9043                 /* and parse parameters if given */
9044                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9045                 if (err)
9046                         return err;
9047         }
9048
9049         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9050             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9051                 return -EINVAL;
9052
9053         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9054         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9055
9056         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9057             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9058                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9059                         return -EINVAL;
9060
9061         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9062                 setup.beacon_interval =
9063                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9064                 if (setup.beacon_interval < 10 ||
9065                     setup.beacon_interval > 10000)
9066                         return -EINVAL;
9067         }
9068
9069         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9070                 setup.dtim_period =
9071                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9072                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9073                         return -EINVAL;
9074         }
9075
9076         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9077                 /* parse additional setup parameters if given */
9078                 err = nl80211_parse_mesh_setup(info, &setup);
9079                 if (err)
9080                         return err;
9081         }
9082
9083         if (setup.user_mpm)
9084                 cfg.auto_open_plinks = false;
9085
9086         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9087                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9088                 if (err)
9089                         return err;
9090         } else {
9091                 /* cfg80211_join_mesh() will sort it out */
9092                 setup.chandef.chan = NULL;
9093         }
9094
9095         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9096                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9097                 int n_rates =
9098                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9099                 struct ieee80211_supported_band *sband;
9100
9101                 if (!setup.chandef.chan)
9102                         return -EINVAL;
9103
9104                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9105
9106                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9107                                              &setup.basic_rates);
9108                 if (err)
9109                         return err;
9110         }
9111
9112         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9113 }
9114
9115 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9116 {
9117         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9118         struct net_device *dev = info->user_ptr[1];
9119
9120         return cfg80211_leave_mesh(rdev, dev);
9121 }
9122
9123 #ifdef CONFIG_PM
9124 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9125                                         struct cfg80211_registered_device *rdev)
9126 {
9127         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9128         struct nlattr *nl_pats, *nl_pat;
9129         int i, pat_len;
9130
9131         if (!wowlan->n_patterns)
9132                 return 0;
9133
9134         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9135         if (!nl_pats)
9136                 return -ENOBUFS;
9137
9138         for (i = 0; i < wowlan->n_patterns; i++) {
9139                 nl_pat = nla_nest_start(msg, i + 1);
9140                 if (!nl_pat)
9141                         return -ENOBUFS;
9142                 pat_len = wowlan->patterns[i].pattern_len;
9143                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9144                             wowlan->patterns[i].mask) ||
9145                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9146                             wowlan->patterns[i].pattern) ||
9147                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9148                                 wowlan->patterns[i].pkt_offset))
9149                         return -ENOBUFS;
9150                 nla_nest_end(msg, nl_pat);
9151         }
9152         nla_nest_end(msg, nl_pats);
9153
9154         return 0;
9155 }
9156
9157 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9158                                    struct cfg80211_wowlan_tcp *tcp)
9159 {
9160         struct nlattr *nl_tcp;
9161
9162         if (!tcp)
9163                 return 0;
9164
9165         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9166         if (!nl_tcp)
9167                 return -ENOBUFS;
9168
9169         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9170             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9171             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9172             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9173             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9174             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9175                     tcp->payload_len, tcp->payload) ||
9176             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9177                         tcp->data_interval) ||
9178             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9179                     tcp->wake_len, tcp->wake_data) ||
9180             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9181                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9182                 return -ENOBUFS;
9183
9184         if (tcp->payload_seq.len &&
9185             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9186                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9187                 return -ENOBUFS;
9188
9189         if (tcp->payload_tok.len &&
9190             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9191                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9192                     &tcp->payload_tok))
9193                 return -ENOBUFS;
9194
9195         nla_nest_end(msg, nl_tcp);
9196
9197         return 0;
9198 }
9199
9200 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9201                                   struct cfg80211_sched_scan_request *req)
9202 {
9203         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9204         int i;
9205
9206         if (!req)
9207                 return 0;
9208
9209         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9210         if (!nd)
9211                 return -ENOBUFS;
9212
9213         if (req->n_scan_plans == 1 &&
9214             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9215                         req->scan_plans[0].interval * 1000))
9216                 return -ENOBUFS;
9217
9218         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9219                 return -ENOBUFS;
9220
9221         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9222         if (!freqs)
9223                 return -ENOBUFS;
9224
9225         for (i = 0; i < req->n_channels; i++)
9226                 nla_put_u32(msg, i, req->channels[i]->center_freq);
9227
9228         nla_nest_end(msg, freqs);
9229
9230         if (req->n_match_sets) {
9231                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9232                 for (i = 0; i < req->n_match_sets; i++) {
9233                         match = nla_nest_start(msg, i);
9234                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9235                                 req->match_sets[i].ssid.ssid_len,
9236                                 req->match_sets[i].ssid.ssid);
9237                         nla_nest_end(msg, match);
9238                 }
9239                 nla_nest_end(msg, matches);
9240         }
9241
9242         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9243         if (!scan_plans)
9244                 return -ENOBUFS;
9245
9246         for (i = 0; i < req->n_scan_plans; i++) {
9247                 scan_plan = nla_nest_start(msg, i + 1);
9248                 if (!scan_plan ||
9249                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9250                                 req->scan_plans[i].interval) ||
9251                     (req->scan_plans[i].iterations &&
9252                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9253                                  req->scan_plans[i].iterations)))
9254                         return -ENOBUFS;
9255                 nla_nest_end(msg, scan_plan);
9256         }
9257         nla_nest_end(msg, scan_plans);
9258
9259         nla_nest_end(msg, nd);
9260
9261         return 0;
9262 }
9263
9264 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9265 {
9266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9267         struct sk_buff *msg;
9268         void *hdr;
9269         u32 size = NLMSG_DEFAULT_SIZE;
9270
9271         if (!rdev->wiphy.wowlan)
9272                 return -EOPNOTSUPP;
9273
9274         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9275                 /* adjust size to have room for all the data */
9276                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9277                         rdev->wiphy.wowlan_config->tcp->payload_len +
9278                         rdev->wiphy.wowlan_config->tcp->wake_len +
9279                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9280         }
9281
9282         msg = nlmsg_new(size, GFP_KERNEL);
9283         if (!msg)
9284                 return -ENOMEM;
9285
9286         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9287                              NL80211_CMD_GET_WOWLAN);
9288         if (!hdr)
9289                 goto nla_put_failure;
9290
9291         if (rdev->wiphy.wowlan_config) {
9292                 struct nlattr *nl_wowlan;
9293
9294                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9295                 if (!nl_wowlan)
9296                         goto nla_put_failure;
9297
9298                 if ((rdev->wiphy.wowlan_config->any &&
9299                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9300                     (rdev->wiphy.wowlan_config->disconnect &&
9301                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9302                     (rdev->wiphy.wowlan_config->magic_pkt &&
9303                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9304                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9305                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9306                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9307                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9308                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9309                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9310                     (rdev->wiphy.wowlan_config->rfkill_release &&
9311                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9312                         goto nla_put_failure;
9313
9314                 if (nl80211_send_wowlan_patterns(msg, rdev))
9315                         goto nla_put_failure;
9316
9317                 if (nl80211_send_wowlan_tcp(msg,
9318                                             rdev->wiphy.wowlan_config->tcp))
9319                         goto nla_put_failure;
9320
9321                 if (nl80211_send_wowlan_nd(
9322                             msg,
9323                             rdev->wiphy.wowlan_config->nd_config))
9324                         goto nla_put_failure;
9325
9326                 nla_nest_end(msg, nl_wowlan);
9327         }
9328
9329         genlmsg_end(msg, hdr);
9330         return genlmsg_reply(msg, info);
9331
9332 nla_put_failure:
9333         nlmsg_free(msg);
9334         return -ENOBUFS;
9335 }
9336
9337 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9338                                     struct nlattr *attr,
9339                                     struct cfg80211_wowlan *trig)
9340 {
9341         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9342         struct cfg80211_wowlan_tcp *cfg;
9343         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9344         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9345         u32 size;
9346         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9347         int err, port;
9348
9349         if (!rdev->wiphy.wowlan->tcp)
9350                 return -EINVAL;
9351
9352         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9353                         nla_data(attr), nla_len(attr),
9354                         nl80211_wowlan_tcp_policy);
9355         if (err)
9356                 return err;
9357
9358         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9359             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9360             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9361             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9362             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9363             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9364             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9365             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9366                 return -EINVAL;
9367
9368         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9369         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9370                 return -EINVAL;
9371
9372         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9373                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9374             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9375                 return -EINVAL;
9376
9377         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9378         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9379                 return -EINVAL;
9380
9381         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9382         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9383                 return -EINVAL;
9384
9385         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9386                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9387
9388                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9389                 tokens_size = tokln - sizeof(*tok);
9390
9391                 if (!tok->len || tokens_size % tok->len)
9392                         return -EINVAL;
9393                 if (!rdev->wiphy.wowlan->tcp->tok)
9394                         return -EINVAL;
9395                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9396                         return -EINVAL;
9397                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9398                         return -EINVAL;
9399                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9400                         return -EINVAL;
9401                 if (tok->offset + tok->len > data_size)
9402                         return -EINVAL;
9403         }
9404
9405         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9406                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9407                 if (!rdev->wiphy.wowlan->tcp->seq)
9408                         return -EINVAL;
9409                 if (seq->len == 0 || seq->len > 4)
9410                         return -EINVAL;
9411                 if (seq->len + seq->offset > data_size)
9412                         return -EINVAL;
9413         }
9414
9415         size = sizeof(*cfg);
9416         size += data_size;
9417         size += wake_size + wake_mask_size;
9418         size += tokens_size;
9419
9420         cfg = kzalloc(size, GFP_KERNEL);
9421         if (!cfg)
9422                 return -ENOMEM;
9423         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9424         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9425         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9426                ETH_ALEN);
9427         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9428                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9429         else
9430                 port = 0;
9431 #ifdef CONFIG_INET
9432         /* allocate a socket and port for it and use it */
9433         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9434                             IPPROTO_TCP, &cfg->sock, 1);
9435         if (err) {
9436                 kfree(cfg);
9437                 return err;
9438         }
9439         if (inet_csk_get_port(cfg->sock->sk, port)) {
9440                 sock_release(cfg->sock);
9441                 kfree(cfg);
9442                 return -EADDRINUSE;
9443         }
9444         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9445 #else
9446         if (!port) {
9447                 kfree(cfg);
9448                 return -EINVAL;
9449         }
9450         cfg->src_port = port;
9451 #endif
9452
9453         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9454         cfg->payload_len = data_size;
9455         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9456         memcpy((void *)cfg->payload,
9457                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9458                data_size);
9459         if (seq)
9460                 cfg->payload_seq = *seq;
9461         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9462         cfg->wake_len = wake_size;
9463         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9464         memcpy((void *)cfg->wake_data,
9465                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9466                wake_size);
9467         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9468                          data_size + wake_size;
9469         memcpy((void *)cfg->wake_mask,
9470                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9471                wake_mask_size);
9472         if (tok) {
9473                 cfg->tokens_size = tokens_size;
9474                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9475         }
9476
9477         trig->tcp = cfg;
9478
9479         return 0;
9480 }
9481
9482 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9483                                    const struct wiphy_wowlan_support *wowlan,
9484                                    struct nlattr *attr,
9485                                    struct cfg80211_wowlan *trig)
9486 {
9487         struct nlattr **tb;
9488         int err;
9489
9490         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9491         if (!tb)
9492                 return -ENOMEM;
9493
9494         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9495                 err = -EOPNOTSUPP;
9496                 goto out;
9497         }
9498
9499         err = nla_parse(tb, NL80211_ATTR_MAX,
9500                         nla_data(attr), nla_len(attr),
9501                         nl80211_policy);
9502         if (err)
9503                 goto out;
9504
9505         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9506         err = PTR_ERR_OR_ZERO(trig->nd_config);
9507         if (err)
9508                 trig->nd_config = NULL;
9509
9510 out:
9511         kfree(tb);
9512         return err;
9513 }
9514
9515 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9516 {
9517         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9518         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9519         struct cfg80211_wowlan new_triggers = {};
9520         struct cfg80211_wowlan *ntrig;
9521         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9522         int err, i;
9523         bool prev_enabled = rdev->wiphy.wowlan_config;
9524         bool regular = false;
9525
9526         if (!wowlan)
9527                 return -EOPNOTSUPP;
9528
9529         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9530                 cfg80211_rdev_free_wowlan(rdev);
9531                 rdev->wiphy.wowlan_config = NULL;
9532                 goto set_wakeup;
9533         }
9534
9535         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9536                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9537                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9538                         nl80211_wowlan_policy);
9539         if (err)
9540                 return err;
9541
9542         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9543                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9544                         return -EINVAL;
9545                 new_triggers.any = true;
9546         }
9547
9548         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9549                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9550                         return -EINVAL;
9551                 new_triggers.disconnect = true;
9552                 regular = true;
9553         }
9554
9555         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9556                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9557                         return -EINVAL;
9558                 new_triggers.magic_pkt = true;
9559                 regular = true;
9560         }
9561
9562         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9563                 return -EINVAL;
9564
9565         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9566                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9567                         return -EINVAL;
9568                 new_triggers.gtk_rekey_failure = true;
9569                 regular = true;
9570         }
9571
9572         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9573                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9574                         return -EINVAL;
9575                 new_triggers.eap_identity_req = true;
9576                 regular = true;
9577         }
9578
9579         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9580                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9581                         return -EINVAL;
9582                 new_triggers.four_way_handshake = true;
9583                 regular = true;
9584         }
9585
9586         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9587                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9588                         return -EINVAL;
9589                 new_triggers.rfkill_release = true;
9590                 regular = true;
9591         }
9592
9593         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9594                 struct nlattr *pat;
9595                 int n_patterns = 0;
9596                 int rem, pat_len, mask_len, pkt_offset;
9597                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9598
9599                 regular = true;
9600
9601                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9602                                     rem)
9603                         n_patterns++;
9604                 if (n_patterns > wowlan->n_patterns)
9605                         return -EINVAL;
9606
9607                 new_triggers.patterns = kcalloc(n_patterns,
9608                                                 sizeof(new_triggers.patterns[0]),
9609                                                 GFP_KERNEL);
9610                 if (!new_triggers.patterns)
9611                         return -ENOMEM;
9612
9613                 new_triggers.n_patterns = n_patterns;
9614                 i = 0;
9615
9616                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9617                                     rem) {
9618                         u8 *mask_pat;
9619
9620                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9621                                   nla_len(pat), NULL);
9622                         err = -EINVAL;
9623                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9624                             !pat_tb[NL80211_PKTPAT_PATTERN])
9625                                 goto error;
9626                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9627                         mask_len = DIV_ROUND_UP(pat_len, 8);
9628                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9629                                 goto error;
9630                         if (pat_len > wowlan->pattern_max_len ||
9631                             pat_len < wowlan->pattern_min_len)
9632                                 goto error;
9633
9634                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9635                                 pkt_offset = 0;
9636                         else
9637                                 pkt_offset = nla_get_u32(
9638                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9639                         if (pkt_offset > wowlan->max_pkt_offset)
9640                                 goto error;
9641                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9642
9643                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9644                         if (!mask_pat) {
9645                                 err = -ENOMEM;
9646                                 goto error;
9647                         }
9648                         new_triggers.patterns[i].mask = mask_pat;
9649                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9650                                mask_len);
9651                         mask_pat += mask_len;
9652                         new_triggers.patterns[i].pattern = mask_pat;
9653                         new_triggers.patterns[i].pattern_len = pat_len;
9654                         memcpy(mask_pat,
9655                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9656                                pat_len);
9657                         i++;
9658                 }
9659         }
9660
9661         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9662                 regular = true;
9663                 err = nl80211_parse_wowlan_tcp(
9664                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9665                         &new_triggers);
9666                 if (err)
9667                         goto error;
9668         }
9669
9670         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9671                 regular = true;
9672                 err = nl80211_parse_wowlan_nd(
9673                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9674                         &new_triggers);
9675                 if (err)
9676                         goto error;
9677         }
9678
9679         /* The 'any' trigger means the device continues operating more or less
9680          * as in its normal operation mode and wakes up the host on most of the
9681          * normal interrupts (like packet RX, ...)
9682          * It therefore makes little sense to combine with the more constrained
9683          * wakeup trigger modes.
9684          */
9685         if (new_triggers.any && regular) {
9686                 err = -EINVAL;
9687                 goto error;
9688         }
9689
9690         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9691         if (!ntrig) {
9692                 err = -ENOMEM;
9693                 goto error;
9694         }
9695         cfg80211_rdev_free_wowlan(rdev);
9696         rdev->wiphy.wowlan_config = ntrig;
9697
9698  set_wakeup:
9699         if (rdev->ops->set_wakeup &&
9700             prev_enabled != !!rdev->wiphy.wowlan_config)
9701                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9702
9703         return 0;
9704  error:
9705         for (i = 0; i < new_triggers.n_patterns; i++)
9706                 kfree(new_triggers.patterns[i].mask);
9707         kfree(new_triggers.patterns);
9708         if (new_triggers.tcp && new_triggers.tcp->sock)
9709                 sock_release(new_triggers.tcp->sock);
9710         kfree(new_triggers.tcp);
9711         kfree(new_triggers.nd_config);
9712         return err;
9713 }
9714 #endif
9715
9716 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9717                                        struct cfg80211_registered_device *rdev)
9718 {
9719         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9720         int i, j, pat_len;
9721         struct cfg80211_coalesce_rules *rule;
9722
9723         if (!rdev->coalesce->n_rules)
9724                 return 0;
9725
9726         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9727         if (!nl_rules)
9728                 return -ENOBUFS;
9729
9730         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9731                 nl_rule = nla_nest_start(msg, i + 1);
9732                 if (!nl_rule)
9733                         return -ENOBUFS;
9734
9735                 rule = &rdev->coalesce->rules[i];
9736                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9737                                 rule->delay))
9738                         return -ENOBUFS;
9739
9740                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9741                                 rule->condition))
9742                         return -ENOBUFS;
9743
9744                 nl_pats = nla_nest_start(msg,
9745                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9746                 if (!nl_pats)
9747                         return -ENOBUFS;
9748
9749                 for (j = 0; j < rule->n_patterns; j++) {
9750                         nl_pat = nla_nest_start(msg, j + 1);
9751                         if (!nl_pat)
9752                                 return -ENOBUFS;
9753                         pat_len = rule->patterns[j].pattern_len;
9754                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9755                                     DIV_ROUND_UP(pat_len, 8),
9756                                     rule->patterns[j].mask) ||
9757                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9758                                     rule->patterns[j].pattern) ||
9759                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9760                                         rule->patterns[j].pkt_offset))
9761                                 return -ENOBUFS;
9762                         nla_nest_end(msg, nl_pat);
9763                 }
9764                 nla_nest_end(msg, nl_pats);
9765                 nla_nest_end(msg, nl_rule);
9766         }
9767         nla_nest_end(msg, nl_rules);
9768
9769         return 0;
9770 }
9771
9772 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9773 {
9774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9775         struct sk_buff *msg;
9776         void *hdr;
9777
9778         if (!rdev->wiphy.coalesce)
9779                 return -EOPNOTSUPP;
9780
9781         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9782         if (!msg)
9783                 return -ENOMEM;
9784
9785         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9786                              NL80211_CMD_GET_COALESCE);
9787         if (!hdr)
9788                 goto nla_put_failure;
9789
9790         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9791                 goto nla_put_failure;
9792
9793         genlmsg_end(msg, hdr);
9794         return genlmsg_reply(msg, info);
9795
9796 nla_put_failure:
9797         nlmsg_free(msg);
9798         return -ENOBUFS;
9799 }
9800
9801 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9802 {
9803         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9804         int i, j;
9805         struct cfg80211_coalesce_rules *rule;
9806
9807         if (!coalesce)
9808                 return;
9809
9810         for (i = 0; i < coalesce->n_rules; i++) {
9811                 rule = &coalesce->rules[i];
9812                 for (j = 0; j < rule->n_patterns; j++)
9813                         kfree(rule->patterns[j].mask);
9814                 kfree(rule->patterns);
9815         }
9816         kfree(coalesce->rules);
9817         kfree(coalesce);
9818         rdev->coalesce = NULL;
9819 }
9820
9821 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9822                                        struct nlattr *rule,
9823                                        struct cfg80211_coalesce_rules *new_rule)
9824 {
9825         int err, i;
9826         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9827         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9828         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9829         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9830
9831         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9832                         nla_len(rule), nl80211_coalesce_policy);
9833         if (err)
9834                 return err;
9835
9836         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9837                 new_rule->delay =
9838                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9839         if (new_rule->delay > coalesce->max_delay)
9840                 return -EINVAL;
9841
9842         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9843                 new_rule->condition =
9844                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9845         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9846             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9847                 return -EINVAL;
9848
9849         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9850                 return -EINVAL;
9851
9852         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9853                             rem)
9854                 n_patterns++;
9855         if (n_patterns > coalesce->n_patterns)
9856                 return -EINVAL;
9857
9858         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9859                                      GFP_KERNEL);
9860         if (!new_rule->patterns)
9861                 return -ENOMEM;
9862
9863         new_rule->n_patterns = n_patterns;
9864         i = 0;
9865
9866         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9867                             rem) {
9868                 u8 *mask_pat;
9869
9870                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9871                           nla_len(pat), NULL);
9872                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9873                     !pat_tb[NL80211_PKTPAT_PATTERN])
9874                         return -EINVAL;
9875                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9876                 mask_len = DIV_ROUND_UP(pat_len, 8);
9877                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9878                         return -EINVAL;
9879                 if (pat_len > coalesce->pattern_max_len ||
9880                     pat_len < coalesce->pattern_min_len)
9881                         return -EINVAL;
9882
9883                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9884                         pkt_offset = 0;
9885                 else
9886                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9887                 if (pkt_offset > coalesce->max_pkt_offset)
9888                         return -EINVAL;
9889                 new_rule->patterns[i].pkt_offset = pkt_offset;
9890
9891                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9892                 if (!mask_pat)
9893                         return -ENOMEM;
9894
9895                 new_rule->patterns[i].mask = mask_pat;
9896                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9897                        mask_len);
9898
9899                 mask_pat += mask_len;
9900                 new_rule->patterns[i].pattern = mask_pat;
9901                 new_rule->patterns[i].pattern_len = pat_len;
9902                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9903                        pat_len);
9904                 i++;
9905         }
9906
9907         return 0;
9908 }
9909
9910 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9911 {
9912         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9913         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9914         struct cfg80211_coalesce new_coalesce = {};
9915         struct cfg80211_coalesce *n_coalesce;
9916         int err, rem_rule, n_rules = 0, i, j;
9917         struct nlattr *rule;
9918         struct cfg80211_coalesce_rules *tmp_rule;
9919
9920         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9921                 return -EOPNOTSUPP;
9922
9923         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9924                 cfg80211_rdev_free_coalesce(rdev);
9925                 rdev_set_coalesce(rdev, NULL);
9926                 return 0;
9927         }
9928
9929         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9930                             rem_rule)
9931                 n_rules++;
9932         if (n_rules > coalesce->n_rules)
9933                 return -EINVAL;
9934
9935         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9936                                      GFP_KERNEL);
9937         if (!new_coalesce.rules)
9938                 return -ENOMEM;
9939
9940         new_coalesce.n_rules = n_rules;
9941         i = 0;
9942
9943         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9944                             rem_rule) {
9945                 err = nl80211_parse_coalesce_rule(rdev, rule,
9946                                                   &new_coalesce.rules[i]);
9947                 if (err)
9948                         goto error;
9949
9950                 i++;
9951         }
9952
9953         err = rdev_set_coalesce(rdev, &new_coalesce);
9954         if (err)
9955                 goto error;
9956
9957         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9958         if (!n_coalesce) {
9959                 err = -ENOMEM;
9960                 goto error;
9961         }
9962         cfg80211_rdev_free_coalesce(rdev);
9963         rdev->coalesce = n_coalesce;
9964
9965         return 0;
9966 error:
9967         for (i = 0; i < new_coalesce.n_rules; i++) {
9968                 tmp_rule = &new_coalesce.rules[i];
9969                 for (j = 0; j < tmp_rule->n_patterns; j++)
9970                         kfree(tmp_rule->patterns[j].mask);
9971                 kfree(tmp_rule->patterns);
9972         }
9973         kfree(new_coalesce.rules);
9974
9975         return err;
9976 }
9977
9978 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9979 {
9980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9981         struct net_device *dev = info->user_ptr[1];
9982         struct wireless_dev *wdev = dev->ieee80211_ptr;
9983         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9984         struct cfg80211_gtk_rekey_data rekey_data;
9985         int err;
9986
9987         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9988                 return -EINVAL;
9989
9990         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9991                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9992                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9993                         nl80211_rekey_policy);
9994         if (err)
9995                 return err;
9996
9997         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9998                 return -ERANGE;
9999         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10000                 return -ERANGE;
10001         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10002                 return -ERANGE;
10003
10004         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10005         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10006         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10007
10008         wdev_lock(wdev);
10009         if (!wdev->current_bss) {
10010                 err = -ENOTCONN;
10011                 goto out;
10012         }
10013
10014         if (!rdev->ops->set_rekey_data) {
10015                 err = -EOPNOTSUPP;
10016                 goto out;
10017         }
10018
10019         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10020  out:
10021         wdev_unlock(wdev);
10022         return err;
10023 }
10024
10025 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10026                                              struct genl_info *info)
10027 {
10028         struct net_device *dev = info->user_ptr[1];
10029         struct wireless_dev *wdev = dev->ieee80211_ptr;
10030
10031         if (wdev->iftype != NL80211_IFTYPE_AP &&
10032             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10033                 return -EINVAL;
10034
10035         if (wdev->ap_unexpected_nlportid)
10036                 return -EBUSY;
10037
10038         wdev->ap_unexpected_nlportid = info->snd_portid;
10039         return 0;
10040 }
10041
10042 static int nl80211_probe_client(struct sk_buff *skb,
10043                                 struct genl_info *info)
10044 {
10045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10046         struct net_device *dev = info->user_ptr[1];
10047         struct wireless_dev *wdev = dev->ieee80211_ptr;
10048         struct sk_buff *msg;
10049         void *hdr;
10050         const u8 *addr;
10051         u64 cookie;
10052         int err;
10053
10054         if (wdev->iftype != NL80211_IFTYPE_AP &&
10055             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10056                 return -EOPNOTSUPP;
10057
10058         if (!info->attrs[NL80211_ATTR_MAC])
10059                 return -EINVAL;
10060
10061         if (!rdev->ops->probe_client)
10062                 return -EOPNOTSUPP;
10063
10064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10065         if (!msg)
10066                 return -ENOMEM;
10067
10068         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10069                              NL80211_CMD_PROBE_CLIENT);
10070         if (!hdr) {
10071                 err = -ENOBUFS;
10072                 goto free_msg;
10073         }
10074
10075         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10076
10077         err = rdev_probe_client(rdev, dev, addr, &cookie);
10078         if (err)
10079                 goto free_msg;
10080
10081         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10082                 goto nla_put_failure;
10083
10084         genlmsg_end(msg, hdr);
10085
10086         return genlmsg_reply(msg, info);
10087
10088  nla_put_failure:
10089         err = -ENOBUFS;
10090  free_msg:
10091         nlmsg_free(msg);
10092         return err;
10093 }
10094
10095 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10096 {
10097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10098         struct cfg80211_beacon_registration *reg, *nreg;
10099         int rv;
10100
10101         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10102                 return -EOPNOTSUPP;
10103
10104         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10105         if (!nreg)
10106                 return -ENOMEM;
10107
10108         /* First, check if already registered. */
10109         spin_lock_bh(&rdev->beacon_registrations_lock);
10110         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10111                 if (reg->nlportid == info->snd_portid) {
10112                         rv = -EALREADY;
10113                         goto out_err;
10114                 }
10115         }
10116         /* Add it to the list */
10117         nreg->nlportid = info->snd_portid;
10118         list_add(&nreg->list, &rdev->beacon_registrations);
10119
10120         spin_unlock_bh(&rdev->beacon_registrations_lock);
10121
10122         return 0;
10123 out_err:
10124         spin_unlock_bh(&rdev->beacon_registrations_lock);
10125         kfree(nreg);
10126         return rv;
10127 }
10128
10129 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10130 {
10131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10132         struct wireless_dev *wdev = info->user_ptr[1];
10133         int err;
10134
10135         if (!rdev->ops->start_p2p_device)
10136                 return -EOPNOTSUPP;
10137
10138         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10139                 return -EOPNOTSUPP;
10140
10141         if (wdev->p2p_started)
10142                 return 0;
10143
10144         if (rfkill_blocked(rdev->rfkill))
10145                 return -ERFKILL;
10146
10147         err = rdev_start_p2p_device(rdev, wdev);
10148         if (err)
10149                 return err;
10150
10151         wdev->p2p_started = true;
10152         rdev->opencount++;
10153
10154         return 0;
10155 }
10156
10157 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10158 {
10159         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10160         struct wireless_dev *wdev = info->user_ptr[1];
10161
10162         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10163                 return -EOPNOTSUPP;
10164
10165         if (!rdev->ops->stop_p2p_device)
10166                 return -EOPNOTSUPP;
10167
10168         cfg80211_stop_p2p_device(rdev, wdev);
10169
10170         return 0;
10171 }
10172
10173 static int nl80211_get_protocol_features(struct sk_buff *skb,
10174                                          struct genl_info *info)
10175 {
10176         void *hdr;
10177         struct sk_buff *msg;
10178
10179         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10180         if (!msg)
10181                 return -ENOMEM;
10182
10183         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10184                              NL80211_CMD_GET_PROTOCOL_FEATURES);
10185         if (!hdr)
10186                 goto nla_put_failure;
10187
10188         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
10189                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
10190                 goto nla_put_failure;
10191
10192         genlmsg_end(msg, hdr);
10193         return genlmsg_reply(msg, info);
10194
10195  nla_put_failure:
10196         kfree_skb(msg);
10197         return -ENOBUFS;
10198 }
10199
10200 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
10201 {
10202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10203         struct cfg80211_update_ft_ies_params ft_params;
10204         struct net_device *dev = info->user_ptr[1];
10205
10206         if (!rdev->ops->update_ft_ies)
10207                 return -EOPNOTSUPP;
10208
10209         if (!info->attrs[NL80211_ATTR_MDID] ||
10210             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
10211                 return -EINVAL;
10212
10213         memset(&ft_params, 0, sizeof(ft_params));
10214         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10215         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10216         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10217
10218         return rdev_update_ft_ies(rdev, dev, &ft_params);
10219 }
10220
10221 static int nl80211_crit_protocol_start(struct sk_buff *skb,
10222                                        struct genl_info *info)
10223 {
10224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10225         struct wireless_dev *wdev = info->user_ptr[1];
10226         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10227         u16 duration;
10228         int ret;
10229
10230         if (!rdev->ops->crit_proto_start)
10231                 return -EOPNOTSUPP;
10232
10233         if (WARN_ON(!rdev->ops->crit_proto_stop))
10234                 return -EINVAL;
10235
10236         if (rdev->crit_proto_nlportid)
10237                 return -EBUSY;
10238
10239         /* determine protocol if provided */
10240         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10241                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10242
10243         if (proto >= NUM_NL80211_CRIT_PROTO)
10244                 return -EINVAL;
10245
10246         /* timeout must be provided */
10247         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10248                 return -EINVAL;
10249
10250         duration =
10251                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10252
10253         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10254                 return -ERANGE;
10255
10256         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10257         if (!ret)
10258                 rdev->crit_proto_nlportid = info->snd_portid;
10259
10260         return ret;
10261 }
10262
10263 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10264                                       struct genl_info *info)
10265 {
10266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10267         struct wireless_dev *wdev = info->user_ptr[1];
10268
10269         if (!rdev->ops->crit_proto_stop)
10270                 return -EOPNOTSUPP;
10271
10272         if (rdev->crit_proto_nlportid) {
10273                 rdev->crit_proto_nlportid = 0;
10274                 rdev_crit_proto_stop(rdev, wdev);
10275         }
10276         return 0;
10277 }
10278
10279 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10280 {
10281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10282         struct wireless_dev *wdev =
10283                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10284         int i, err;
10285         u32 vid, subcmd;
10286
10287         if (!rdev->wiphy.vendor_commands)
10288                 return -EOPNOTSUPP;
10289
10290         if (IS_ERR(wdev)) {
10291                 err = PTR_ERR(wdev);
10292                 if (err != -EINVAL)
10293                         return err;
10294                 wdev = NULL;
10295         } else if (wdev->wiphy != &rdev->wiphy) {
10296                 return -EINVAL;
10297         }
10298
10299         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10300             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10301                 return -EINVAL;
10302
10303         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10304         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10305         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10306                 const struct wiphy_vendor_command *vcmd;
10307                 void *data = NULL;
10308                 int len = 0;
10309
10310                 vcmd = &rdev->wiphy.vendor_commands[i];
10311
10312                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10313                         continue;
10314
10315                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10316                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10317                         if (!wdev)
10318                                 return -EINVAL;
10319                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10320                             !wdev->netdev)
10321                                 return -EINVAL;
10322
10323                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10324                                 if (wdev->netdev &&
10325                                     !netif_running(wdev->netdev))
10326                                         return -ENETDOWN;
10327                                 if (!wdev->netdev && !wdev->p2p_started)
10328                                         return -ENETDOWN;
10329                         }
10330
10331                         if (!vcmd->doit)
10332                                 return -EOPNOTSUPP;
10333                 } else {
10334                         wdev = NULL;
10335                 }
10336
10337                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10338                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10339                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10340                 }
10341
10342                 rdev->cur_cmd_info = info;
10343                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10344                                                           data, len);
10345                 rdev->cur_cmd_info = NULL;
10346                 return err;
10347         }
10348
10349         return -EOPNOTSUPP;
10350 }
10351
10352 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10353                                        struct netlink_callback *cb,
10354                                        struct cfg80211_registered_device **rdev,
10355                                        struct wireless_dev **wdev)
10356 {
10357         u32 vid, subcmd;
10358         unsigned int i;
10359         int vcmd_idx = -1;
10360         int err;
10361         void *data = NULL;
10362         unsigned int data_len = 0;
10363
10364         rtnl_lock();
10365
10366         if (cb->args[0]) {
10367                 /* subtract the 1 again here */
10368                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10369                 struct wireless_dev *tmp;
10370
10371                 if (!wiphy) {
10372                         err = -ENODEV;
10373                         goto out_unlock;
10374                 }
10375                 *rdev = wiphy_to_rdev(wiphy);
10376                 *wdev = NULL;
10377
10378                 if (cb->args[1]) {
10379                         list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
10380                                 if (tmp->identifier == cb->args[1] - 1) {
10381                                         *wdev = tmp;
10382                                         break;
10383                                 }
10384                         }
10385                 }
10386
10387                 /* keep rtnl locked in successful case */
10388                 return 0;
10389         }
10390
10391         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10392                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10393                           nl80211_policy);
10394         if (err)
10395                 goto out_unlock;
10396
10397         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10398             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10399                 err = -EINVAL;
10400                 goto out_unlock;
10401         }
10402
10403         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10404                                            nl80211_fam.attrbuf);
10405         if (IS_ERR(*wdev))
10406                 *wdev = NULL;
10407
10408         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10409                                            nl80211_fam.attrbuf);
10410         if (IS_ERR(*rdev)) {
10411                 err = PTR_ERR(*rdev);
10412                 goto out_unlock;
10413         }
10414
10415         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10416         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10417
10418         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10419                 const struct wiphy_vendor_command *vcmd;
10420
10421                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10422
10423                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10424                         continue;
10425
10426                 if (!vcmd->dumpit) {
10427                         err = -EOPNOTSUPP;
10428                         goto out_unlock;
10429                 }
10430
10431                 vcmd_idx = i;
10432                 break;
10433         }
10434
10435         if (vcmd_idx < 0) {
10436                 err = -EOPNOTSUPP;
10437                 goto out_unlock;
10438         }
10439
10440         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10441                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10442                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10443         }
10444
10445         /* 0 is the first index - add 1 to parse only once */
10446         cb->args[0] = (*rdev)->wiphy_idx + 1;
10447         /* add 1 to know if it was NULL */
10448         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10449         cb->args[2] = vcmd_idx;
10450         cb->args[3] = (unsigned long)data;
10451         cb->args[4] = data_len;
10452
10453         /* keep rtnl locked in successful case */
10454         return 0;
10455  out_unlock:
10456         rtnl_unlock();
10457         return err;
10458 }
10459
10460 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10461                                    struct netlink_callback *cb)
10462 {
10463         struct cfg80211_registered_device *rdev;
10464         struct wireless_dev *wdev;
10465         unsigned int vcmd_idx;
10466         const struct wiphy_vendor_command *vcmd;
10467         void *data;
10468         int data_len;
10469         int err;
10470         struct nlattr *vendor_data;
10471
10472         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10473         if (err)
10474                 return err;
10475
10476         vcmd_idx = cb->args[2];
10477         data = (void *)cb->args[3];
10478         data_len = cb->args[4];
10479         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10480
10481         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10482                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10483                 if (!wdev)
10484                         return -EINVAL;
10485                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10486                     !wdev->netdev)
10487                         return -EINVAL;
10488
10489                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10490                         if (wdev->netdev &&
10491                             !netif_running(wdev->netdev))
10492                                 return -ENETDOWN;
10493                         if (!wdev->netdev && !wdev->p2p_started)
10494                                 return -ENETDOWN;
10495                 }
10496         }
10497
10498         while (1) {
10499                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10500                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10501                                            NL80211_CMD_VENDOR);
10502                 if (!hdr)
10503                         break;
10504
10505                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10506                     (wdev && nla_put_u64(skb, NL80211_ATTR_WDEV,
10507                                          wdev_id(wdev)))) {
10508                         genlmsg_cancel(skb, hdr);
10509                         break;
10510                 }
10511
10512                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10513                 if (!vendor_data) {
10514                         genlmsg_cancel(skb, hdr);
10515                         break;
10516                 }
10517
10518                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10519                                    (unsigned long *)&cb->args[5]);
10520                 nla_nest_end(skb, vendor_data);
10521
10522                 if (err == -ENOBUFS || err == -ENOENT) {
10523                         genlmsg_cancel(skb, hdr);
10524                         break;
10525                 } else if (err) {
10526                         genlmsg_cancel(skb, hdr);
10527                         goto out;
10528                 }
10529
10530                 genlmsg_end(skb, hdr);
10531         }
10532
10533         err = skb->len;
10534  out:
10535         rtnl_unlock();
10536         return err;
10537 }
10538
10539 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10540                                            enum nl80211_commands cmd,
10541                                            enum nl80211_attrs attr,
10542                                            int approxlen)
10543 {
10544         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10545
10546         if (WARN_ON(!rdev->cur_cmd_info))
10547                 return NULL;
10548
10549         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10550                                            rdev->cur_cmd_info->snd_portid,
10551                                            rdev->cur_cmd_info->snd_seq,
10552                                            cmd, attr, NULL, GFP_KERNEL);
10553 }
10554 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10555
10556 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10557 {
10558         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10559         void *hdr = ((void **)skb->cb)[1];
10560         struct nlattr *data = ((void **)skb->cb)[2];
10561
10562         /* clear CB data for netlink core to own from now on */
10563         memset(skb->cb, 0, sizeof(skb->cb));
10564
10565         if (WARN_ON(!rdev->cur_cmd_info)) {
10566                 kfree_skb(skb);
10567                 return -EINVAL;
10568         }
10569
10570         nla_nest_end(skb, data);
10571         genlmsg_end(skb, hdr);
10572         return genlmsg_reply(skb, rdev->cur_cmd_info);
10573 }
10574 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10575
10576
10577 static int nl80211_set_qos_map(struct sk_buff *skb,
10578                                struct genl_info *info)
10579 {
10580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10581         struct cfg80211_qos_map *qos_map = NULL;
10582         struct net_device *dev = info->user_ptr[1];
10583         u8 *pos, len, num_des, des_len, des;
10584         int ret;
10585
10586         if (!rdev->ops->set_qos_map)
10587                 return -EOPNOTSUPP;
10588
10589         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10590                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10591                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10592
10593                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10594                     len > IEEE80211_QOS_MAP_LEN_MAX)
10595                         return -EINVAL;
10596
10597                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10598                 if (!qos_map)
10599                         return -ENOMEM;
10600
10601                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10602                 if (num_des) {
10603                         des_len = num_des *
10604                                 sizeof(struct cfg80211_dscp_exception);
10605                         memcpy(qos_map->dscp_exception, pos, des_len);
10606                         qos_map->num_des = num_des;
10607                         for (des = 0; des < num_des; des++) {
10608                                 if (qos_map->dscp_exception[des].up > 7) {
10609                                         kfree(qos_map);
10610                                         return -EINVAL;
10611                                 }
10612                         }
10613                         pos += des_len;
10614                 }
10615                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10616         }
10617
10618         wdev_lock(dev->ieee80211_ptr);
10619         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10620         if (!ret)
10621                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10622         wdev_unlock(dev->ieee80211_ptr);
10623
10624         kfree(qos_map);
10625         return ret;
10626 }
10627
10628 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10629 {
10630         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10631         struct net_device *dev = info->user_ptr[1];
10632         struct wireless_dev *wdev = dev->ieee80211_ptr;
10633         const u8 *peer;
10634         u8 tsid, up;
10635         u16 admitted_time = 0;
10636         int err;
10637
10638         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10639                 return -EOPNOTSUPP;
10640
10641         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10642             !info->attrs[NL80211_ATTR_USER_PRIO])
10643                 return -EINVAL;
10644
10645         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10646         if (tsid >= IEEE80211_NUM_TIDS)
10647                 return -EINVAL;
10648
10649         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10650         if (up >= IEEE80211_NUM_UPS)
10651                 return -EINVAL;
10652
10653         /* WMM uses TIDs 0-7 even for TSPEC */
10654         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10655                 /* TODO: handle 802.11 TSPEC/admission control
10656                  * need more attributes for that (e.g. BA session requirement);
10657                  * change the WMM adminssion test above to allow both then
10658                  */
10659                 return -EINVAL;
10660         }
10661
10662         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10663
10664         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10665                 admitted_time =
10666                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10667                 if (!admitted_time)
10668                         return -EINVAL;
10669         }
10670
10671         wdev_lock(wdev);
10672         switch (wdev->iftype) {
10673         case NL80211_IFTYPE_STATION:
10674         case NL80211_IFTYPE_P2P_CLIENT:
10675                 if (wdev->current_bss)
10676                         break;
10677                 err = -ENOTCONN;
10678                 goto out;
10679         default:
10680                 err = -EOPNOTSUPP;
10681                 goto out;
10682         }
10683
10684         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10685
10686  out:
10687         wdev_unlock(wdev);
10688         return err;
10689 }
10690
10691 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10692 {
10693         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10694         struct net_device *dev = info->user_ptr[1];
10695         struct wireless_dev *wdev = dev->ieee80211_ptr;
10696         const u8 *peer;
10697         u8 tsid;
10698         int err;
10699
10700         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10701                 return -EINVAL;
10702
10703         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10704         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10705
10706         wdev_lock(wdev);
10707         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10708         wdev_unlock(wdev);
10709
10710         return err;
10711 }
10712
10713 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10714                                        struct genl_info *info)
10715 {
10716         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10717         struct net_device *dev = info->user_ptr[1];
10718         struct wireless_dev *wdev = dev->ieee80211_ptr;
10719         struct cfg80211_chan_def chandef = {};
10720         const u8 *addr;
10721         u8 oper_class;
10722         int err;
10723
10724         if (!rdev->ops->tdls_channel_switch ||
10725             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10726                 return -EOPNOTSUPP;
10727
10728         switch (dev->ieee80211_ptr->iftype) {
10729         case NL80211_IFTYPE_STATION:
10730         case NL80211_IFTYPE_P2P_CLIENT:
10731                 break;
10732         default:
10733                 return -EOPNOTSUPP;
10734         }
10735
10736         if (!info->attrs[NL80211_ATTR_MAC] ||
10737             !info->attrs[NL80211_ATTR_OPER_CLASS])
10738                 return -EINVAL;
10739
10740         err = nl80211_parse_chandef(rdev, info, &chandef);
10741         if (err)
10742                 return err;
10743
10744         /*
10745          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10746          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10747          * specification is not defined for them.
10748          */
10749         if (chandef.chan->band == NL80211_BAND_2GHZ &&
10750             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10751             chandef.width != NL80211_CHAN_WIDTH_20)
10752                 return -EINVAL;
10753
10754         /* we will be active on the TDLS link */
10755         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10756                                            wdev->iftype))
10757                 return -EINVAL;
10758
10759         /* don't allow switching to DFS channels */
10760         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10761                 return -EINVAL;
10762
10763         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10764         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10765
10766         wdev_lock(wdev);
10767         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10768         wdev_unlock(wdev);
10769
10770         return err;
10771 }
10772
10773 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10774                                               struct genl_info *info)
10775 {
10776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10777         struct net_device *dev = info->user_ptr[1];
10778         struct wireless_dev *wdev = dev->ieee80211_ptr;
10779         const u8 *addr;
10780
10781         if (!rdev->ops->tdls_channel_switch ||
10782             !rdev->ops->tdls_cancel_channel_switch ||
10783             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10784                 return -EOPNOTSUPP;
10785
10786         switch (dev->ieee80211_ptr->iftype) {
10787         case NL80211_IFTYPE_STATION:
10788         case NL80211_IFTYPE_P2P_CLIENT:
10789                 break;
10790         default:
10791                 return -EOPNOTSUPP;
10792         }
10793
10794         if (!info->attrs[NL80211_ATTR_MAC])
10795                 return -EINVAL;
10796
10797         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10798
10799         wdev_lock(wdev);
10800         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10801         wdev_unlock(wdev);
10802
10803         return 0;
10804 }
10805
10806 #define NL80211_FLAG_NEED_WIPHY         0x01
10807 #define NL80211_FLAG_NEED_NETDEV        0x02
10808 #define NL80211_FLAG_NEED_RTNL          0x04
10809 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10810 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10811                                          NL80211_FLAG_CHECK_NETDEV_UP)
10812 #define NL80211_FLAG_NEED_WDEV          0x10
10813 /* If a netdev is associated, it must be UP, P2P must be started */
10814 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10815                                          NL80211_FLAG_CHECK_NETDEV_UP)
10816 #define NL80211_FLAG_CLEAR_SKB          0x20
10817
10818 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10819                             struct genl_info *info)
10820 {
10821         struct cfg80211_registered_device *rdev;
10822         struct wireless_dev *wdev;
10823         struct net_device *dev;
10824         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10825
10826         if (rtnl)
10827                 rtnl_lock();
10828
10829         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10830                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10831                 if (IS_ERR(rdev)) {
10832                         if (rtnl)
10833                                 rtnl_unlock();
10834                         return PTR_ERR(rdev);
10835                 }
10836                 info->user_ptr[0] = rdev;
10837         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10838                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10839                 ASSERT_RTNL();
10840
10841                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10842                                                   info->attrs);
10843                 if (IS_ERR(wdev)) {
10844                         if (rtnl)
10845                                 rtnl_unlock();
10846                         return PTR_ERR(wdev);
10847                 }
10848
10849                 dev = wdev->netdev;
10850                 rdev = wiphy_to_rdev(wdev->wiphy);
10851
10852                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10853                         if (!dev) {
10854                                 if (rtnl)
10855                                         rtnl_unlock();
10856                                 return -EINVAL;
10857                         }
10858
10859                         info->user_ptr[1] = dev;
10860                 } else {
10861                         info->user_ptr[1] = wdev;
10862                 }
10863
10864                 if (dev) {
10865                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10866                             !netif_running(dev)) {
10867                                 if (rtnl)
10868                                         rtnl_unlock();
10869                                 return -ENETDOWN;
10870                         }
10871
10872                         dev_hold(dev);
10873                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10874                         if (!wdev->p2p_started) {
10875                                 if (rtnl)
10876                                         rtnl_unlock();
10877                                 return -ENETDOWN;
10878                         }
10879                 }
10880
10881                 info->user_ptr[0] = rdev;
10882         }
10883
10884         return 0;
10885 }
10886
10887 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10888                               struct genl_info *info)
10889 {
10890         if (info->user_ptr[1]) {
10891                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10892                         struct wireless_dev *wdev = info->user_ptr[1];
10893
10894                         if (wdev->netdev)
10895                                 dev_put(wdev->netdev);
10896                 } else {
10897                         dev_put(info->user_ptr[1]);
10898                 }
10899         }
10900
10901         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10902                 rtnl_unlock();
10903
10904         /* If needed, clear the netlink message payload from the SKB
10905          * as it might contain key data that shouldn't stick around on
10906          * the heap after the SKB is freed. The netlink message header
10907          * is still needed for further processing, so leave it intact.
10908          */
10909         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10910                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10911
10912                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10913         }
10914 }
10915
10916 static const struct genl_ops nl80211_ops[] = {
10917         {
10918                 .cmd = NL80211_CMD_GET_WIPHY,
10919                 .doit = nl80211_get_wiphy,
10920                 .dumpit = nl80211_dump_wiphy,
10921                 .done = nl80211_dump_wiphy_done,
10922                 .policy = nl80211_policy,
10923                 /* can be retrieved by unprivileged users */
10924                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10925                                   NL80211_FLAG_NEED_RTNL,
10926         },
10927         {
10928                 .cmd = NL80211_CMD_SET_WIPHY,
10929                 .doit = nl80211_set_wiphy,
10930                 .policy = nl80211_policy,
10931                 .flags = GENL_ADMIN_PERM,
10932                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10933         },
10934         {
10935                 .cmd = NL80211_CMD_GET_INTERFACE,
10936                 .doit = nl80211_get_interface,
10937                 .dumpit = nl80211_dump_interface,
10938                 .policy = nl80211_policy,
10939                 /* can be retrieved by unprivileged users */
10940                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10941                                   NL80211_FLAG_NEED_RTNL,
10942         },
10943         {
10944                 .cmd = NL80211_CMD_SET_INTERFACE,
10945                 .doit = nl80211_set_interface,
10946                 .policy = nl80211_policy,
10947                 .flags = GENL_ADMIN_PERM,
10948                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10949                                   NL80211_FLAG_NEED_RTNL,
10950         },
10951         {
10952                 .cmd = NL80211_CMD_NEW_INTERFACE,
10953                 .doit = nl80211_new_interface,
10954                 .policy = nl80211_policy,
10955                 .flags = GENL_ADMIN_PERM,
10956                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10957                                   NL80211_FLAG_NEED_RTNL,
10958         },
10959         {
10960                 .cmd = NL80211_CMD_DEL_INTERFACE,
10961                 .doit = nl80211_del_interface,
10962                 .policy = nl80211_policy,
10963                 .flags = GENL_ADMIN_PERM,
10964                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10965                                   NL80211_FLAG_NEED_RTNL,
10966         },
10967         {
10968                 .cmd = NL80211_CMD_GET_KEY,
10969                 .doit = nl80211_get_key,
10970                 .policy = nl80211_policy,
10971                 .flags = GENL_ADMIN_PERM,
10972                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10973                                   NL80211_FLAG_NEED_RTNL,
10974         },
10975         {
10976                 .cmd = NL80211_CMD_SET_KEY,
10977                 .doit = nl80211_set_key,
10978                 .policy = nl80211_policy,
10979                 .flags = GENL_ADMIN_PERM,
10980                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10981                                   NL80211_FLAG_NEED_RTNL |
10982                                   NL80211_FLAG_CLEAR_SKB,
10983         },
10984         {
10985                 .cmd = NL80211_CMD_NEW_KEY,
10986                 .doit = nl80211_new_key,
10987                 .policy = nl80211_policy,
10988                 .flags = GENL_ADMIN_PERM,
10989                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10990                                   NL80211_FLAG_NEED_RTNL |
10991                                   NL80211_FLAG_CLEAR_SKB,
10992         },
10993         {
10994                 .cmd = NL80211_CMD_DEL_KEY,
10995                 .doit = nl80211_del_key,
10996                 .policy = nl80211_policy,
10997                 .flags = GENL_ADMIN_PERM,
10998                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10999                                   NL80211_FLAG_NEED_RTNL,
11000         },
11001         {
11002                 .cmd = NL80211_CMD_SET_BEACON,
11003                 .policy = nl80211_policy,
11004                 .flags = GENL_ADMIN_PERM,
11005                 .doit = nl80211_set_beacon,
11006                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11007                                   NL80211_FLAG_NEED_RTNL,
11008         },
11009         {
11010                 .cmd = NL80211_CMD_START_AP,
11011                 .policy = nl80211_policy,
11012                 .flags = GENL_ADMIN_PERM,
11013                 .doit = nl80211_start_ap,
11014                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11015                                   NL80211_FLAG_NEED_RTNL,
11016         },
11017         {
11018                 .cmd = NL80211_CMD_STOP_AP,
11019                 .policy = nl80211_policy,
11020                 .flags = GENL_ADMIN_PERM,
11021                 .doit = nl80211_stop_ap,
11022                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11023                                   NL80211_FLAG_NEED_RTNL,
11024         },
11025         {
11026                 .cmd = NL80211_CMD_GET_STATION,
11027                 .doit = nl80211_get_station,
11028                 .dumpit = nl80211_dump_station,
11029                 .policy = nl80211_policy,
11030                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11031                                   NL80211_FLAG_NEED_RTNL,
11032         },
11033         {
11034                 .cmd = NL80211_CMD_SET_STATION,
11035                 .doit = nl80211_set_station,
11036                 .policy = nl80211_policy,
11037                 .flags = GENL_ADMIN_PERM,
11038                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11039                                   NL80211_FLAG_NEED_RTNL,
11040         },
11041         {
11042                 .cmd = NL80211_CMD_NEW_STATION,
11043                 .doit = nl80211_new_station,
11044                 .policy = nl80211_policy,
11045                 .flags = GENL_ADMIN_PERM,
11046                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11047                                   NL80211_FLAG_NEED_RTNL,
11048         },
11049         {
11050                 .cmd = NL80211_CMD_DEL_STATION,
11051                 .doit = nl80211_del_station,
11052                 .policy = nl80211_policy,
11053                 .flags = GENL_ADMIN_PERM,
11054                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11055                                   NL80211_FLAG_NEED_RTNL,
11056         },
11057         {
11058                 .cmd = NL80211_CMD_GET_MPATH,
11059                 .doit = nl80211_get_mpath,
11060                 .dumpit = nl80211_dump_mpath,
11061                 .policy = nl80211_policy,
11062                 .flags = GENL_ADMIN_PERM,
11063                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11064                                   NL80211_FLAG_NEED_RTNL,
11065         },
11066         {
11067                 .cmd = NL80211_CMD_GET_MPP,
11068                 .doit = nl80211_get_mpp,
11069                 .dumpit = nl80211_dump_mpp,
11070                 .policy = nl80211_policy,
11071                 .flags = GENL_ADMIN_PERM,
11072                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11073                                   NL80211_FLAG_NEED_RTNL,
11074         },
11075         {
11076                 .cmd = NL80211_CMD_SET_MPATH,
11077                 .doit = nl80211_set_mpath,
11078                 .policy = nl80211_policy,
11079                 .flags = GENL_ADMIN_PERM,
11080                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11081                                   NL80211_FLAG_NEED_RTNL,
11082         },
11083         {
11084                 .cmd = NL80211_CMD_NEW_MPATH,
11085                 .doit = nl80211_new_mpath,
11086                 .policy = nl80211_policy,
11087                 .flags = GENL_ADMIN_PERM,
11088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11089                                   NL80211_FLAG_NEED_RTNL,
11090         },
11091         {
11092                 .cmd = NL80211_CMD_DEL_MPATH,
11093                 .doit = nl80211_del_mpath,
11094                 .policy = nl80211_policy,
11095                 .flags = GENL_ADMIN_PERM,
11096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11097                                   NL80211_FLAG_NEED_RTNL,
11098         },
11099         {
11100                 .cmd = NL80211_CMD_SET_BSS,
11101                 .doit = nl80211_set_bss,
11102                 .policy = nl80211_policy,
11103                 .flags = GENL_ADMIN_PERM,
11104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11105                                   NL80211_FLAG_NEED_RTNL,
11106         },
11107         {
11108                 .cmd = NL80211_CMD_GET_REG,
11109                 .doit = nl80211_get_reg_do,
11110                 .dumpit = nl80211_get_reg_dump,
11111                 .policy = nl80211_policy,
11112                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11113                 /* can be retrieved by unprivileged users */
11114         },
11115 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
11116         {
11117                 .cmd = NL80211_CMD_SET_REG,
11118                 .doit = nl80211_set_reg,
11119                 .policy = nl80211_policy,
11120                 .flags = GENL_ADMIN_PERM,
11121                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11122         },
11123 #endif
11124         {
11125                 .cmd = NL80211_CMD_REQ_SET_REG,
11126                 .doit = nl80211_req_set_reg,
11127                 .policy = nl80211_policy,
11128                 .flags = GENL_ADMIN_PERM,
11129         },
11130         {
11131                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
11132                 .doit = nl80211_get_mesh_config,
11133                 .policy = nl80211_policy,
11134                 /* can be retrieved by unprivileged users */
11135                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11136                                   NL80211_FLAG_NEED_RTNL,
11137         },
11138         {
11139                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
11140                 .doit = nl80211_update_mesh_config,
11141                 .policy = nl80211_policy,
11142                 .flags = GENL_ADMIN_PERM,
11143                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11144                                   NL80211_FLAG_NEED_RTNL,
11145         },
11146         {
11147                 .cmd = NL80211_CMD_TRIGGER_SCAN,
11148                 .doit = nl80211_trigger_scan,
11149                 .policy = nl80211_policy,
11150                 .flags = GENL_ADMIN_PERM,
11151                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11152                                   NL80211_FLAG_NEED_RTNL,
11153         },
11154         {
11155                 .cmd = NL80211_CMD_ABORT_SCAN,
11156                 .doit = nl80211_abort_scan,
11157                 .policy = nl80211_policy,
11158                 .flags = GENL_ADMIN_PERM,
11159                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11160                                   NL80211_FLAG_NEED_RTNL,
11161         },
11162         {
11163                 .cmd = NL80211_CMD_GET_SCAN,
11164                 .policy = nl80211_policy,
11165                 .dumpit = nl80211_dump_scan,
11166         },
11167         {
11168                 .cmd = NL80211_CMD_START_SCHED_SCAN,
11169                 .doit = nl80211_start_sched_scan,
11170                 .policy = nl80211_policy,
11171                 .flags = GENL_ADMIN_PERM,
11172                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11173                                   NL80211_FLAG_NEED_RTNL,
11174         },
11175         {
11176                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
11177                 .doit = nl80211_stop_sched_scan,
11178                 .policy = nl80211_policy,
11179                 .flags = GENL_ADMIN_PERM,
11180                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11181                                   NL80211_FLAG_NEED_RTNL,
11182         },
11183         {
11184                 .cmd = NL80211_CMD_AUTHENTICATE,
11185                 .doit = nl80211_authenticate,
11186                 .policy = nl80211_policy,
11187                 .flags = GENL_ADMIN_PERM,
11188                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11189                                   NL80211_FLAG_NEED_RTNL |
11190                                   NL80211_FLAG_CLEAR_SKB,
11191         },
11192         {
11193                 .cmd = NL80211_CMD_ASSOCIATE,
11194                 .doit = nl80211_associate,
11195                 .policy = nl80211_policy,
11196                 .flags = GENL_ADMIN_PERM,
11197                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11198                                   NL80211_FLAG_NEED_RTNL,
11199         },
11200         {
11201                 .cmd = NL80211_CMD_DEAUTHENTICATE,
11202                 .doit = nl80211_deauthenticate,
11203                 .policy = nl80211_policy,
11204                 .flags = GENL_ADMIN_PERM,
11205                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11206                                   NL80211_FLAG_NEED_RTNL,
11207         },
11208         {
11209                 .cmd = NL80211_CMD_DISASSOCIATE,
11210                 .doit = nl80211_disassociate,
11211                 .policy = nl80211_policy,
11212                 .flags = GENL_ADMIN_PERM,
11213                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11214                                   NL80211_FLAG_NEED_RTNL,
11215         },
11216         {
11217                 .cmd = NL80211_CMD_JOIN_IBSS,
11218                 .doit = nl80211_join_ibss,
11219                 .policy = nl80211_policy,
11220                 .flags = GENL_ADMIN_PERM,
11221                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11222                                   NL80211_FLAG_NEED_RTNL,
11223         },
11224         {
11225                 .cmd = NL80211_CMD_LEAVE_IBSS,
11226                 .doit = nl80211_leave_ibss,
11227                 .policy = nl80211_policy,
11228                 .flags = GENL_ADMIN_PERM,
11229                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11230                                   NL80211_FLAG_NEED_RTNL,
11231         },
11232 #ifdef CONFIG_NL80211_TESTMODE
11233         {
11234                 .cmd = NL80211_CMD_TESTMODE,
11235                 .doit = nl80211_testmode_do,
11236                 .dumpit = nl80211_testmode_dump,
11237                 .policy = nl80211_policy,
11238                 .flags = GENL_ADMIN_PERM,
11239                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11240                                   NL80211_FLAG_NEED_RTNL,
11241         },
11242 #endif
11243         {
11244                 .cmd = NL80211_CMD_CONNECT,
11245                 .doit = nl80211_connect,
11246                 .policy = nl80211_policy,
11247                 .flags = GENL_ADMIN_PERM,
11248                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11249                                   NL80211_FLAG_NEED_RTNL,
11250         },
11251         {
11252                 .cmd = NL80211_CMD_DISCONNECT,
11253                 .doit = nl80211_disconnect,
11254                 .policy = nl80211_policy,
11255                 .flags = GENL_ADMIN_PERM,
11256                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11257                                   NL80211_FLAG_NEED_RTNL,
11258         },
11259         {
11260                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
11261                 .doit = nl80211_wiphy_netns,
11262                 .policy = nl80211_policy,
11263                 .flags = GENL_ADMIN_PERM,
11264                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11265                                   NL80211_FLAG_NEED_RTNL,
11266         },
11267         {
11268                 .cmd = NL80211_CMD_GET_SURVEY,
11269                 .policy = nl80211_policy,
11270                 .dumpit = nl80211_dump_survey,
11271         },
11272         {
11273                 .cmd = NL80211_CMD_SET_PMKSA,
11274                 .doit = nl80211_setdel_pmksa,
11275                 .policy = nl80211_policy,
11276                 .flags = GENL_ADMIN_PERM,
11277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11278                                   NL80211_FLAG_NEED_RTNL,
11279         },
11280         {
11281                 .cmd = NL80211_CMD_DEL_PMKSA,
11282                 .doit = nl80211_setdel_pmksa,
11283                 .policy = nl80211_policy,
11284                 .flags = GENL_ADMIN_PERM,
11285                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11286                                   NL80211_FLAG_NEED_RTNL,
11287         },
11288         {
11289                 .cmd = NL80211_CMD_FLUSH_PMKSA,
11290                 .doit = nl80211_flush_pmksa,
11291                 .policy = nl80211_policy,
11292                 .flags = GENL_ADMIN_PERM,
11293                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11294                                   NL80211_FLAG_NEED_RTNL,
11295         },
11296         {
11297                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11298                 .doit = nl80211_remain_on_channel,
11299                 .policy = nl80211_policy,
11300                 .flags = GENL_ADMIN_PERM,
11301                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11302                                   NL80211_FLAG_NEED_RTNL,
11303         },
11304         {
11305                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11306                 .doit = nl80211_cancel_remain_on_channel,
11307                 .policy = nl80211_policy,
11308                 .flags = GENL_ADMIN_PERM,
11309                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11310                                   NL80211_FLAG_NEED_RTNL,
11311         },
11312         {
11313                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11314                 .doit = nl80211_set_tx_bitrate_mask,
11315                 .policy = nl80211_policy,
11316                 .flags = GENL_ADMIN_PERM,
11317                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11318                                   NL80211_FLAG_NEED_RTNL,
11319         },
11320         {
11321                 .cmd = NL80211_CMD_REGISTER_FRAME,
11322                 .doit = nl80211_register_mgmt,
11323                 .policy = nl80211_policy,
11324                 .flags = GENL_ADMIN_PERM,
11325                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11326                                   NL80211_FLAG_NEED_RTNL,
11327         },
11328         {
11329                 .cmd = NL80211_CMD_FRAME,
11330                 .doit = nl80211_tx_mgmt,
11331                 .policy = nl80211_policy,
11332                 .flags = GENL_ADMIN_PERM,
11333                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11334                                   NL80211_FLAG_NEED_RTNL,
11335         },
11336         {
11337                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11338                 .doit = nl80211_tx_mgmt_cancel_wait,
11339                 .policy = nl80211_policy,
11340                 .flags = GENL_ADMIN_PERM,
11341                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11342                                   NL80211_FLAG_NEED_RTNL,
11343         },
11344         {
11345                 .cmd = NL80211_CMD_SET_POWER_SAVE,
11346                 .doit = nl80211_set_power_save,
11347                 .policy = nl80211_policy,
11348                 .flags = GENL_ADMIN_PERM,
11349                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11350                                   NL80211_FLAG_NEED_RTNL,
11351         },
11352         {
11353                 .cmd = NL80211_CMD_GET_POWER_SAVE,
11354                 .doit = nl80211_get_power_save,
11355                 .policy = nl80211_policy,
11356                 /* can be retrieved by unprivileged users */
11357                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11358                                   NL80211_FLAG_NEED_RTNL,
11359         },
11360         {
11361                 .cmd = NL80211_CMD_SET_CQM,
11362                 .doit = nl80211_set_cqm,
11363                 .policy = nl80211_policy,
11364                 .flags = GENL_ADMIN_PERM,
11365                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11366                                   NL80211_FLAG_NEED_RTNL,
11367         },
11368         {
11369                 .cmd = NL80211_CMD_SET_CHANNEL,
11370                 .doit = nl80211_set_channel,
11371                 .policy = nl80211_policy,
11372                 .flags = GENL_ADMIN_PERM,
11373                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11374                                   NL80211_FLAG_NEED_RTNL,
11375         },
11376         {
11377                 .cmd = NL80211_CMD_SET_WDS_PEER,
11378                 .doit = nl80211_set_wds_peer,
11379                 .policy = nl80211_policy,
11380                 .flags = GENL_ADMIN_PERM,
11381                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11382                                   NL80211_FLAG_NEED_RTNL,
11383         },
11384         {
11385                 .cmd = NL80211_CMD_JOIN_MESH,
11386                 .doit = nl80211_join_mesh,
11387                 .policy = nl80211_policy,
11388                 .flags = GENL_ADMIN_PERM,
11389                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11390                                   NL80211_FLAG_NEED_RTNL,
11391         },
11392         {
11393                 .cmd = NL80211_CMD_LEAVE_MESH,
11394                 .doit = nl80211_leave_mesh,
11395                 .policy = nl80211_policy,
11396                 .flags = GENL_ADMIN_PERM,
11397                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11398                                   NL80211_FLAG_NEED_RTNL,
11399         },
11400         {
11401                 .cmd = NL80211_CMD_JOIN_OCB,
11402                 .doit = nl80211_join_ocb,
11403                 .policy = nl80211_policy,
11404                 .flags = GENL_ADMIN_PERM,
11405                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11406                                   NL80211_FLAG_NEED_RTNL,
11407         },
11408         {
11409                 .cmd = NL80211_CMD_LEAVE_OCB,
11410                 .doit = nl80211_leave_ocb,
11411                 .policy = nl80211_policy,
11412                 .flags = GENL_ADMIN_PERM,
11413                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11414                                   NL80211_FLAG_NEED_RTNL,
11415         },
11416 #ifdef CONFIG_PM
11417         {
11418                 .cmd = NL80211_CMD_GET_WOWLAN,
11419                 .doit = nl80211_get_wowlan,
11420                 .policy = nl80211_policy,
11421                 /* can be retrieved by unprivileged users */
11422                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11423                                   NL80211_FLAG_NEED_RTNL,
11424         },
11425         {
11426                 .cmd = NL80211_CMD_SET_WOWLAN,
11427                 .doit = nl80211_set_wowlan,
11428                 .policy = nl80211_policy,
11429                 .flags = GENL_ADMIN_PERM,
11430                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11431                                   NL80211_FLAG_NEED_RTNL,
11432         },
11433 #endif
11434         {
11435                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11436                 .doit = nl80211_set_rekey_data,
11437                 .policy = nl80211_policy,
11438                 .flags = GENL_ADMIN_PERM,
11439                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11440                                   NL80211_FLAG_NEED_RTNL |
11441                                   NL80211_FLAG_CLEAR_SKB,
11442         },
11443         {
11444                 .cmd = NL80211_CMD_TDLS_MGMT,
11445                 .doit = nl80211_tdls_mgmt,
11446                 .policy = nl80211_policy,
11447                 .flags = GENL_ADMIN_PERM,
11448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11449                                   NL80211_FLAG_NEED_RTNL,
11450         },
11451         {
11452                 .cmd = NL80211_CMD_TDLS_OPER,
11453                 .doit = nl80211_tdls_oper,
11454                 .policy = nl80211_policy,
11455                 .flags = GENL_ADMIN_PERM,
11456                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11457                                   NL80211_FLAG_NEED_RTNL,
11458         },
11459         {
11460                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11461                 .doit = nl80211_register_unexpected_frame,
11462                 .policy = nl80211_policy,
11463                 .flags = GENL_ADMIN_PERM,
11464                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11465                                   NL80211_FLAG_NEED_RTNL,
11466         },
11467         {
11468                 .cmd = NL80211_CMD_PROBE_CLIENT,
11469                 .doit = nl80211_probe_client,
11470                 .policy = nl80211_policy,
11471                 .flags = GENL_ADMIN_PERM,
11472                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11473                                   NL80211_FLAG_NEED_RTNL,
11474         },
11475         {
11476                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11477                 .doit = nl80211_register_beacons,
11478                 .policy = nl80211_policy,
11479                 .flags = GENL_ADMIN_PERM,
11480                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11481                                   NL80211_FLAG_NEED_RTNL,
11482         },
11483         {
11484                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11485                 .doit = nl80211_set_noack_map,
11486                 .policy = nl80211_policy,
11487                 .flags = GENL_ADMIN_PERM,
11488                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11489                                   NL80211_FLAG_NEED_RTNL,
11490         },
11491         {
11492                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11493                 .doit = nl80211_start_p2p_device,
11494                 .policy = nl80211_policy,
11495                 .flags = GENL_ADMIN_PERM,
11496                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11497                                   NL80211_FLAG_NEED_RTNL,
11498         },
11499         {
11500                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11501                 .doit = nl80211_stop_p2p_device,
11502                 .policy = nl80211_policy,
11503                 .flags = GENL_ADMIN_PERM,
11504                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11505                                   NL80211_FLAG_NEED_RTNL,
11506         },
11507         {
11508                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11509                 .doit = nl80211_set_mcast_rate,
11510                 .policy = nl80211_policy,
11511                 .flags = GENL_ADMIN_PERM,
11512                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11513                                   NL80211_FLAG_NEED_RTNL,
11514         },
11515         {
11516                 .cmd = NL80211_CMD_SET_MAC_ACL,
11517                 .doit = nl80211_set_mac_acl,
11518                 .policy = nl80211_policy,
11519                 .flags = GENL_ADMIN_PERM,
11520                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11521                                   NL80211_FLAG_NEED_RTNL,
11522         },
11523         {
11524                 .cmd = NL80211_CMD_RADAR_DETECT,
11525                 .doit = nl80211_start_radar_detection,
11526                 .policy = nl80211_policy,
11527                 .flags = GENL_ADMIN_PERM,
11528                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11529                                   NL80211_FLAG_NEED_RTNL,
11530         },
11531         {
11532                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11533                 .doit = nl80211_get_protocol_features,
11534                 .policy = nl80211_policy,
11535         },
11536         {
11537                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11538                 .doit = nl80211_update_ft_ies,
11539                 .policy = nl80211_policy,
11540                 .flags = GENL_ADMIN_PERM,
11541                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11542                                   NL80211_FLAG_NEED_RTNL,
11543         },
11544         {
11545                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11546                 .doit = nl80211_crit_protocol_start,
11547                 .policy = nl80211_policy,
11548                 .flags = GENL_ADMIN_PERM,
11549                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11550                                   NL80211_FLAG_NEED_RTNL,
11551         },
11552         {
11553                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11554                 .doit = nl80211_crit_protocol_stop,
11555                 .policy = nl80211_policy,
11556                 .flags = GENL_ADMIN_PERM,
11557                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11558                                   NL80211_FLAG_NEED_RTNL,
11559         },
11560         {
11561                 .cmd = NL80211_CMD_GET_COALESCE,
11562                 .doit = nl80211_get_coalesce,
11563                 .policy = nl80211_policy,
11564                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11565                                   NL80211_FLAG_NEED_RTNL,
11566         },
11567         {
11568                 .cmd = NL80211_CMD_SET_COALESCE,
11569                 .doit = nl80211_set_coalesce,
11570                 .policy = nl80211_policy,
11571                 .flags = GENL_ADMIN_PERM,
11572                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11573                                   NL80211_FLAG_NEED_RTNL,
11574         },
11575         {
11576                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11577                 .doit = nl80211_channel_switch,
11578                 .policy = nl80211_policy,
11579                 .flags = GENL_ADMIN_PERM,
11580                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11581                                   NL80211_FLAG_NEED_RTNL,
11582         },
11583         {
11584                 .cmd = NL80211_CMD_VENDOR,
11585                 .doit = nl80211_vendor_cmd,
11586                 .dumpit = nl80211_vendor_cmd_dump,
11587                 .policy = nl80211_policy,
11588                 .flags = GENL_ADMIN_PERM,
11589                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11590                                   NL80211_FLAG_NEED_RTNL,
11591         },
11592         {
11593                 .cmd = NL80211_CMD_SET_QOS_MAP,
11594                 .doit = nl80211_set_qos_map,
11595                 .policy = nl80211_policy,
11596                 .flags = GENL_ADMIN_PERM,
11597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11598                                   NL80211_FLAG_NEED_RTNL,
11599         },
11600         {
11601                 .cmd = NL80211_CMD_ADD_TX_TS,
11602                 .doit = nl80211_add_tx_ts,
11603                 .policy = nl80211_policy,
11604                 .flags = GENL_ADMIN_PERM,
11605                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11606                                   NL80211_FLAG_NEED_RTNL,
11607         },
11608         {
11609                 .cmd = NL80211_CMD_DEL_TX_TS,
11610                 .doit = nl80211_del_tx_ts,
11611                 .policy = nl80211_policy,
11612                 .flags = GENL_ADMIN_PERM,
11613                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11614                                   NL80211_FLAG_NEED_RTNL,
11615         },
11616         {
11617                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11618                 .doit = nl80211_tdls_channel_switch,
11619                 .policy = nl80211_policy,
11620                 .flags = GENL_ADMIN_PERM,
11621                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11622                                   NL80211_FLAG_NEED_RTNL,
11623         },
11624         {
11625                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11626                 .doit = nl80211_tdls_cancel_channel_switch,
11627                 .policy = nl80211_policy,
11628                 .flags = GENL_ADMIN_PERM,
11629                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11630                                   NL80211_FLAG_NEED_RTNL,
11631         },
11632 };
11633
11634 /* notification functions */
11635
11636 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11637                           enum nl80211_commands cmd)
11638 {
11639         struct sk_buff *msg;
11640         struct nl80211_dump_wiphy_state state = {};
11641
11642         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11643                 cmd != NL80211_CMD_DEL_WIPHY);
11644
11645         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11646         if (!msg)
11647                 return;
11648
11649         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11650                 nlmsg_free(msg);
11651                 return;
11652         }
11653
11654         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11655                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11656 }
11657
11658 static int nl80211_add_scan_req(struct sk_buff *msg,
11659                                 struct cfg80211_registered_device *rdev)
11660 {
11661         struct cfg80211_scan_request *req = rdev->scan_req;
11662         struct nlattr *nest;
11663         int i;
11664
11665         if (WARN_ON(!req))
11666                 return 0;
11667
11668         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11669         if (!nest)
11670                 goto nla_put_failure;
11671         for (i = 0; i < req->n_ssids; i++) {
11672                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11673                         goto nla_put_failure;
11674         }
11675         nla_nest_end(msg, nest);
11676
11677         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11678         if (!nest)
11679                 goto nla_put_failure;
11680         for (i = 0; i < req->n_channels; i++) {
11681                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11682                         goto nla_put_failure;
11683         }
11684         nla_nest_end(msg, nest);
11685
11686         if (req->ie &&
11687             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11688                 goto nla_put_failure;
11689
11690         if (req->flags &&
11691             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11692                 goto nla_put_failure;
11693
11694         return 0;
11695  nla_put_failure:
11696         return -ENOBUFS;
11697 }
11698
11699 static int nl80211_send_scan_msg(struct sk_buff *msg,
11700                                  struct cfg80211_registered_device *rdev,
11701                                  struct wireless_dev *wdev,
11702                                  u32 portid, u32 seq, int flags,
11703                                  u32 cmd)
11704 {
11705         void *hdr;
11706
11707         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11708         if (!hdr)
11709                 return -1;
11710
11711         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11712             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11713                                          wdev->netdev->ifindex)) ||
11714             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11715                 goto nla_put_failure;
11716
11717         /* ignore errors and send incomplete event anyway */
11718         nl80211_add_scan_req(msg, rdev);
11719
11720         genlmsg_end(msg, hdr);
11721         return 0;
11722
11723  nla_put_failure:
11724         genlmsg_cancel(msg, hdr);
11725         return -EMSGSIZE;
11726 }
11727
11728 static int
11729 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11730                             struct cfg80211_registered_device *rdev,
11731                             struct net_device *netdev,
11732                             u32 portid, u32 seq, int flags, u32 cmd)
11733 {
11734         void *hdr;
11735
11736         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11737         if (!hdr)
11738                 return -1;
11739
11740         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11741             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11742                 goto nla_put_failure;
11743
11744         genlmsg_end(msg, hdr);
11745         return 0;
11746
11747  nla_put_failure:
11748         genlmsg_cancel(msg, hdr);
11749         return -EMSGSIZE;
11750 }
11751
11752 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11753                              struct wireless_dev *wdev)
11754 {
11755         struct sk_buff *msg;
11756
11757         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11758         if (!msg)
11759                 return;
11760
11761         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11762                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11763                 nlmsg_free(msg);
11764                 return;
11765         }
11766
11767         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11768                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11769 }
11770
11771 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11772                                        struct wireless_dev *wdev, bool aborted)
11773 {
11774         struct sk_buff *msg;
11775
11776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11777         if (!msg)
11778                 return NULL;
11779
11780         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11781                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11782                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11783                 nlmsg_free(msg);
11784                 return NULL;
11785         }
11786
11787         return msg;
11788 }
11789
11790 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11791                               struct sk_buff *msg)
11792 {
11793         if (!msg)
11794                 return;
11795
11796         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11797                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11798 }
11799
11800 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11801                                      struct net_device *netdev)
11802 {
11803         struct sk_buff *msg;
11804
11805         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11806         if (!msg)
11807                 return;
11808
11809         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11810                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11811                 nlmsg_free(msg);
11812                 return;
11813         }
11814
11815         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11816                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11817 }
11818
11819 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11820                              struct net_device *netdev, u32 cmd)
11821 {
11822         struct sk_buff *msg;
11823
11824         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11825         if (!msg)
11826                 return;
11827
11828         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11829                 nlmsg_free(msg);
11830                 return;
11831         }
11832
11833         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11834                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11835 }
11836
11837 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11838                                           struct regulatory_request *request)
11839 {
11840         /* Userspace can always count this one always being set */
11841         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11842                 goto nla_put_failure;
11843
11844         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11845                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11846                                NL80211_REGDOM_TYPE_WORLD))
11847                         goto nla_put_failure;
11848         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11849                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11850                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11851                         goto nla_put_failure;
11852         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11853                    request->intersect) {
11854                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11855                                NL80211_REGDOM_TYPE_INTERSECTION))
11856                         goto nla_put_failure;
11857         } else {
11858                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11859                                NL80211_REGDOM_TYPE_COUNTRY) ||
11860                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11861                                    request->alpha2))
11862                         goto nla_put_failure;
11863         }
11864
11865         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11866                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11867
11868                 if (wiphy &&
11869                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11870                         goto nla_put_failure;
11871
11872                 if (wiphy &&
11873                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11874                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11875                         goto nla_put_failure;
11876         }
11877
11878         return true;
11879
11880 nla_put_failure:
11881         return false;
11882 }
11883
11884 /*
11885  * This can happen on global regulatory changes or device specific settings
11886  * based on custom regulatory domains.
11887  */
11888 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11889                                      struct regulatory_request *request)
11890 {
11891         struct sk_buff *msg;
11892         void *hdr;
11893
11894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11895         if (!msg)
11896                 return;
11897
11898         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11899         if (!hdr) {
11900                 nlmsg_free(msg);
11901                 return;
11902         }
11903
11904         if (nl80211_reg_change_event_fill(msg, request) == false)
11905                 goto nla_put_failure;
11906
11907         genlmsg_end(msg, hdr);
11908
11909         rcu_read_lock();
11910         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11911                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11912         rcu_read_unlock();
11913
11914         return;
11915
11916 nla_put_failure:
11917         genlmsg_cancel(msg, hdr);
11918         nlmsg_free(msg);
11919 }
11920
11921 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11922                                     struct net_device *netdev,
11923                                     const u8 *buf, size_t len,
11924                                     enum nl80211_commands cmd, gfp_t gfp,
11925                                     int uapsd_queues)
11926 {
11927         struct sk_buff *msg;
11928         void *hdr;
11929
11930         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11931         if (!msg)
11932                 return;
11933
11934         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11935         if (!hdr) {
11936                 nlmsg_free(msg);
11937                 return;
11938         }
11939
11940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11941             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11942             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11943                 goto nla_put_failure;
11944
11945         if (uapsd_queues >= 0) {
11946                 struct nlattr *nla_wmm =
11947                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11948                 if (!nla_wmm)
11949                         goto nla_put_failure;
11950
11951                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11952                                uapsd_queues))
11953                         goto nla_put_failure;
11954
11955                 nla_nest_end(msg, nla_wmm);
11956         }
11957
11958         genlmsg_end(msg, hdr);
11959
11960         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11961                                 NL80211_MCGRP_MLME, gfp);
11962         return;
11963
11964  nla_put_failure:
11965         genlmsg_cancel(msg, hdr);
11966         nlmsg_free(msg);
11967 }
11968
11969 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11970                           struct net_device *netdev, const u8 *buf,
11971                           size_t len, gfp_t gfp)
11972 {
11973         nl80211_send_mlme_event(rdev, netdev, buf, len,
11974                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11975 }
11976
11977 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11978                            struct net_device *netdev, const u8 *buf,
11979                            size_t len, gfp_t gfp, int uapsd_queues)
11980 {
11981         nl80211_send_mlme_event(rdev, netdev, buf, len,
11982                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11983 }
11984
11985 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11986                          struct net_device *netdev, const u8 *buf,
11987                          size_t len, gfp_t gfp)
11988 {
11989         nl80211_send_mlme_event(rdev, netdev, buf, len,
11990                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11991 }
11992
11993 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11994                            struct net_device *netdev, const u8 *buf,
11995                            size_t len, gfp_t gfp)
11996 {
11997         nl80211_send_mlme_event(rdev, netdev, buf, len,
11998                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11999 }
12000
12001 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
12002                                   size_t len)
12003 {
12004         struct wireless_dev *wdev = dev->ieee80211_ptr;
12005         struct wiphy *wiphy = wdev->wiphy;
12006         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12007         const struct ieee80211_mgmt *mgmt = (void *)buf;
12008         u32 cmd;
12009
12010         if (WARN_ON(len < 2))
12011                 return;
12012
12013         if (ieee80211_is_deauth(mgmt->frame_control))
12014                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
12015         else
12016                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
12017
12018         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
12019         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
12020 }
12021 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
12022
12023 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
12024                                       struct net_device *netdev, int cmd,
12025                                       const u8 *addr, gfp_t gfp)
12026 {
12027         struct sk_buff *msg;
12028         void *hdr;
12029
12030         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12031         if (!msg)
12032                 return;
12033
12034         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12035         if (!hdr) {
12036                 nlmsg_free(msg);
12037                 return;
12038         }
12039
12040         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12041             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12042             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
12043             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12044                 goto nla_put_failure;
12045
12046         genlmsg_end(msg, hdr);
12047
12048         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12049                                 NL80211_MCGRP_MLME, gfp);
12050         return;
12051
12052  nla_put_failure:
12053         genlmsg_cancel(msg, hdr);
12054         nlmsg_free(msg);
12055 }
12056
12057 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
12058                                struct net_device *netdev, const u8 *addr,
12059                                gfp_t gfp)
12060 {
12061         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
12062                                   addr, gfp);
12063 }
12064
12065 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
12066                                 struct net_device *netdev, const u8 *addr,
12067                                 gfp_t gfp)
12068 {
12069         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
12070                                   addr, gfp);
12071 }
12072
12073 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
12074                                  struct net_device *netdev, const u8 *bssid,
12075                                  const u8 *req_ie, size_t req_ie_len,
12076                                  const u8 *resp_ie, size_t resp_ie_len,
12077                                  u16 status, gfp_t gfp)
12078 {
12079         struct sk_buff *msg;
12080         void *hdr;
12081
12082         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12083         if (!msg)
12084                 return;
12085
12086         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
12087         if (!hdr) {
12088                 nlmsg_free(msg);
12089                 return;
12090         }
12091
12092         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12093             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12094             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
12095             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
12096             (req_ie &&
12097              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12098             (resp_ie &&
12099              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12100                 goto nla_put_failure;
12101
12102         genlmsg_end(msg, hdr);
12103
12104         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12105                                 NL80211_MCGRP_MLME, gfp);
12106         return;
12107
12108  nla_put_failure:
12109         genlmsg_cancel(msg, hdr);
12110         nlmsg_free(msg);
12111
12112 }
12113
12114 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
12115                          struct net_device *netdev, const u8 *bssid,
12116                          const u8 *req_ie, size_t req_ie_len,
12117                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
12118 {
12119         struct sk_buff *msg;
12120         void *hdr;
12121
12122         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12123         if (!msg)
12124                 return;
12125
12126         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
12127         if (!hdr) {
12128                 nlmsg_free(msg);
12129                 return;
12130         }
12131
12132         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12133             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12134             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
12135             (req_ie &&
12136              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12137             (resp_ie &&
12138              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12139                 goto nla_put_failure;
12140
12141         genlmsg_end(msg, hdr);
12142
12143         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12144                                 NL80211_MCGRP_MLME, gfp);
12145         return;
12146
12147  nla_put_failure:
12148         genlmsg_cancel(msg, hdr);
12149         nlmsg_free(msg);
12150
12151 }
12152
12153 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
12154                                struct net_device *netdev, u16 reason,
12155                                const u8 *ie, size_t ie_len, bool from_ap)
12156 {
12157         struct sk_buff *msg;
12158         void *hdr;
12159
12160         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12161         if (!msg)
12162                 return;
12163
12164         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
12165         if (!hdr) {
12166                 nlmsg_free(msg);
12167                 return;
12168         }
12169
12170         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12171             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12172             (from_ap && reason &&
12173              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
12174             (from_ap &&
12175              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
12176             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
12177                 goto nla_put_failure;
12178
12179         genlmsg_end(msg, hdr);
12180
12181         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12182                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12183         return;
12184
12185  nla_put_failure:
12186         genlmsg_cancel(msg, hdr);
12187         nlmsg_free(msg);
12188
12189 }
12190
12191 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
12192                              struct net_device *netdev, const u8 *bssid,
12193                              gfp_t gfp)
12194 {
12195         struct sk_buff *msg;
12196         void *hdr;
12197
12198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12199         if (!msg)
12200                 return;
12201
12202         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
12203         if (!hdr) {
12204                 nlmsg_free(msg);
12205                 return;
12206         }
12207
12208         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12209             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12210             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12211                 goto nla_put_failure;
12212
12213         genlmsg_end(msg, hdr);
12214
12215         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12216                                 NL80211_MCGRP_MLME, gfp);
12217         return;
12218
12219  nla_put_failure:
12220         genlmsg_cancel(msg, hdr);
12221         nlmsg_free(msg);
12222 }
12223
12224 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12225                                         const u8* ie, u8 ie_len, gfp_t gfp)
12226 {
12227         struct wireless_dev *wdev = dev->ieee80211_ptr;
12228         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12229         struct sk_buff *msg;
12230         void *hdr;
12231
12232         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12233                 return;
12234
12235         trace_cfg80211_notify_new_peer_candidate(dev, addr);
12236
12237         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12238         if (!msg)
12239                 return;
12240
12241         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12242         if (!hdr) {
12243                 nlmsg_free(msg);
12244                 return;
12245         }
12246
12247         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12248             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12249             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12250             (ie_len && ie &&
12251              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12252                 goto nla_put_failure;
12253
12254         genlmsg_end(msg, hdr);
12255
12256         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12257                                 NL80211_MCGRP_MLME, gfp);
12258         return;
12259
12260  nla_put_failure:
12261         genlmsg_cancel(msg, hdr);
12262         nlmsg_free(msg);
12263 }
12264 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12265
12266 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12267                                  struct net_device *netdev, const u8 *addr,
12268                                  enum nl80211_key_type key_type, int key_id,
12269                                  const u8 *tsc, gfp_t gfp)
12270 {
12271         struct sk_buff *msg;
12272         void *hdr;
12273
12274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12275         if (!msg)
12276                 return;
12277
12278         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12279         if (!hdr) {
12280                 nlmsg_free(msg);
12281                 return;
12282         }
12283
12284         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12285             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12286             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12287             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12288             (key_id != -1 &&
12289              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12290             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12291                 goto nla_put_failure;
12292
12293         genlmsg_end(msg, hdr);
12294
12295         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12296                                 NL80211_MCGRP_MLME, gfp);
12297         return;
12298
12299  nla_put_failure:
12300         genlmsg_cancel(msg, hdr);
12301         nlmsg_free(msg);
12302 }
12303
12304 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12305                                     struct ieee80211_channel *channel_before,
12306                                     struct ieee80211_channel *channel_after)
12307 {
12308         struct sk_buff *msg;
12309         void *hdr;
12310         struct nlattr *nl_freq;
12311
12312         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12313         if (!msg)
12314                 return;
12315
12316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12317         if (!hdr) {
12318                 nlmsg_free(msg);
12319                 return;
12320         }
12321
12322         /*
12323          * Since we are applying the beacon hint to a wiphy we know its
12324          * wiphy_idx is valid
12325          */
12326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12327                 goto nla_put_failure;
12328
12329         /* Before */
12330         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12331         if (!nl_freq)
12332                 goto nla_put_failure;
12333         if (nl80211_msg_put_channel(msg, channel_before, false))
12334                 goto nla_put_failure;
12335         nla_nest_end(msg, nl_freq);
12336
12337         /* After */
12338         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12339         if (!nl_freq)
12340                 goto nla_put_failure;
12341         if (nl80211_msg_put_channel(msg, channel_after, false))
12342                 goto nla_put_failure;
12343         nla_nest_end(msg, nl_freq);
12344
12345         genlmsg_end(msg, hdr);
12346
12347         rcu_read_lock();
12348         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12349                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12350         rcu_read_unlock();
12351
12352         return;
12353
12354 nla_put_failure:
12355         genlmsg_cancel(msg, hdr);
12356         nlmsg_free(msg);
12357 }
12358
12359 static void nl80211_send_remain_on_chan_event(
12360         int cmd, struct cfg80211_registered_device *rdev,
12361         struct wireless_dev *wdev, u64 cookie,
12362         struct ieee80211_channel *chan,
12363         unsigned int duration, gfp_t gfp)
12364 {
12365         struct sk_buff *msg;
12366         void *hdr;
12367
12368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12369         if (!msg)
12370                 return;
12371
12372         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12373         if (!hdr) {
12374                 nlmsg_free(msg);
12375                 return;
12376         }
12377
12378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12379             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12380                                          wdev->netdev->ifindex)) ||
12381             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12382             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12383             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12384                         NL80211_CHAN_NO_HT) ||
12385             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
12386                 goto nla_put_failure;
12387
12388         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12389             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12390                 goto nla_put_failure;
12391
12392         genlmsg_end(msg, hdr);
12393
12394         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12395                                 NL80211_MCGRP_MLME, gfp);
12396         return;
12397
12398  nla_put_failure:
12399         genlmsg_cancel(msg, hdr);
12400         nlmsg_free(msg);
12401 }
12402
12403 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12404                                struct ieee80211_channel *chan,
12405                                unsigned int duration, gfp_t gfp)
12406 {
12407         struct wiphy *wiphy = wdev->wiphy;
12408         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12409
12410         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12411         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12412                                           rdev, wdev, cookie, chan,
12413                                           duration, gfp);
12414 }
12415 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12416
12417 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12418                                         struct ieee80211_channel *chan,
12419                                         gfp_t gfp)
12420 {
12421         struct wiphy *wiphy = wdev->wiphy;
12422         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12423
12424         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12425         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12426                                           rdev, wdev, cookie, chan, 0, gfp);
12427 }
12428 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12429
12430 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12431                       struct station_info *sinfo, gfp_t gfp)
12432 {
12433         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12434         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12435         struct sk_buff *msg;
12436
12437         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12438
12439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12440         if (!msg)
12441                 return;
12442
12443         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12444                                  rdev, dev, mac_addr, sinfo) < 0) {
12445                 nlmsg_free(msg);
12446                 return;
12447         }
12448
12449         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12450                                 NL80211_MCGRP_MLME, gfp);
12451 }
12452 EXPORT_SYMBOL(cfg80211_new_sta);
12453
12454 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12455                             struct station_info *sinfo, gfp_t gfp)
12456 {
12457         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12458         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12459         struct sk_buff *msg;
12460         struct station_info empty_sinfo = {};
12461
12462         if (!sinfo)
12463                 sinfo = &empty_sinfo;
12464
12465         trace_cfg80211_del_sta(dev, mac_addr);
12466
12467         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12468         if (!msg)
12469                 return;
12470
12471         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12472                                  rdev, dev, mac_addr, sinfo) < 0) {
12473                 nlmsg_free(msg);
12474                 return;
12475         }
12476
12477         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12478                                 NL80211_MCGRP_MLME, gfp);
12479 }
12480 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12481
12482 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12483                           enum nl80211_connect_failed_reason reason,
12484                           gfp_t gfp)
12485 {
12486         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12487         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12488         struct sk_buff *msg;
12489         void *hdr;
12490
12491         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12492         if (!msg)
12493                 return;
12494
12495         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12496         if (!hdr) {
12497                 nlmsg_free(msg);
12498                 return;
12499         }
12500
12501         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12502             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12503             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12504                 goto nla_put_failure;
12505
12506         genlmsg_end(msg, hdr);
12507
12508         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12509                                 NL80211_MCGRP_MLME, gfp);
12510         return;
12511
12512  nla_put_failure:
12513         genlmsg_cancel(msg, hdr);
12514         nlmsg_free(msg);
12515 }
12516 EXPORT_SYMBOL(cfg80211_conn_failed);
12517
12518 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12519                                        const u8 *addr, gfp_t gfp)
12520 {
12521         struct wireless_dev *wdev = dev->ieee80211_ptr;
12522         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12523         struct sk_buff *msg;
12524         void *hdr;
12525         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12526
12527         if (!nlportid)
12528                 return false;
12529
12530         msg = nlmsg_new(100, gfp);
12531         if (!msg)
12532                 return true;
12533
12534         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12535         if (!hdr) {
12536                 nlmsg_free(msg);
12537                 return true;
12538         }
12539
12540         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12541             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12542             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12543                 goto nla_put_failure;
12544
12545         genlmsg_end(msg, hdr);
12546         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12547         return true;
12548
12549  nla_put_failure:
12550         genlmsg_cancel(msg, hdr);
12551         nlmsg_free(msg);
12552         return true;
12553 }
12554
12555 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12556                                 const u8 *addr, gfp_t gfp)
12557 {
12558         struct wireless_dev *wdev = dev->ieee80211_ptr;
12559         bool ret;
12560
12561         trace_cfg80211_rx_spurious_frame(dev, addr);
12562
12563         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12564                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12565                 trace_cfg80211_return_bool(false);
12566                 return false;
12567         }
12568         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12569                                          addr, gfp);
12570         trace_cfg80211_return_bool(ret);
12571         return ret;
12572 }
12573 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12574
12575 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12576                                         const u8 *addr, gfp_t gfp)
12577 {
12578         struct wireless_dev *wdev = dev->ieee80211_ptr;
12579         bool ret;
12580
12581         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12582
12583         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12584                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12585                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12586                 trace_cfg80211_return_bool(false);
12587                 return false;
12588         }
12589         ret = __nl80211_unexpected_frame(dev,
12590                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12591                                          addr, gfp);
12592         trace_cfg80211_return_bool(ret);
12593         return ret;
12594 }
12595 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12596
12597 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12598                       struct wireless_dev *wdev, u32 nlportid,
12599                       int freq, int sig_dbm,
12600                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12601 {
12602         struct net_device *netdev = wdev->netdev;
12603         struct sk_buff *msg;
12604         void *hdr;
12605
12606         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12607         if (!msg)
12608                 return -ENOMEM;
12609
12610         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12611         if (!hdr) {
12612                 nlmsg_free(msg);
12613                 return -ENOMEM;
12614         }
12615
12616         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12617             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12618                                         netdev->ifindex)) ||
12619             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12620             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12621             (sig_dbm &&
12622              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12623             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12624             (flags &&
12625              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12626                 goto nla_put_failure;
12627
12628         genlmsg_end(msg, hdr);
12629
12630         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12631
12632  nla_put_failure:
12633         genlmsg_cancel(msg, hdr);
12634         nlmsg_free(msg);
12635         return -ENOBUFS;
12636 }
12637
12638 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12639                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12640 {
12641         struct wiphy *wiphy = wdev->wiphy;
12642         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12643         struct net_device *netdev = wdev->netdev;
12644         struct sk_buff *msg;
12645         void *hdr;
12646
12647         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12648
12649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12650         if (!msg)
12651                 return;
12652
12653         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12654         if (!hdr) {
12655                 nlmsg_free(msg);
12656                 return;
12657         }
12658
12659         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12660             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12661                                    netdev->ifindex)) ||
12662             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12663             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12664             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12665             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12666                 goto nla_put_failure;
12667
12668         genlmsg_end(msg, hdr);
12669
12670         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12671                                 NL80211_MCGRP_MLME, gfp);
12672         return;
12673
12674  nla_put_failure:
12675         genlmsg_cancel(msg, hdr);
12676         nlmsg_free(msg);
12677 }
12678 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12679
12680 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12681                                             const char *mac, gfp_t gfp)
12682 {
12683         struct wireless_dev *wdev = dev->ieee80211_ptr;
12684         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12685         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12686         void **cb;
12687
12688         if (!msg)
12689                 return NULL;
12690
12691         cb = (void **)msg->cb;
12692
12693         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12694         if (!cb[0]) {
12695                 nlmsg_free(msg);
12696                 return NULL;
12697         }
12698
12699         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12700             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12701                 goto nla_put_failure;
12702
12703         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12704                 goto nla_put_failure;
12705
12706         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12707         if (!cb[1])
12708                 goto nla_put_failure;
12709
12710         cb[2] = rdev;
12711
12712         return msg;
12713  nla_put_failure:
12714         nlmsg_free(msg);
12715         return NULL;
12716 }
12717
12718 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12719 {
12720         void **cb = (void **)msg->cb;
12721         struct cfg80211_registered_device *rdev = cb[2];
12722
12723         nla_nest_end(msg, cb[1]);
12724         genlmsg_end(msg, cb[0]);
12725
12726         memset(msg->cb, 0, sizeof(msg->cb));
12727
12728         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12729                                 NL80211_MCGRP_MLME, gfp);
12730 }
12731
12732 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12733                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12734                               gfp_t gfp)
12735 {
12736         struct sk_buff *msg;
12737
12738         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12739
12740         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12741                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12742                 return;
12743
12744         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12745         if (!msg)
12746                 return;
12747
12748         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12749                         rssi_event))
12750                 goto nla_put_failure;
12751
12752         cfg80211_send_cqm(msg, gfp);
12753
12754         return;
12755
12756  nla_put_failure:
12757         nlmsg_free(msg);
12758 }
12759 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12760
12761 void cfg80211_cqm_txe_notify(struct net_device *dev,
12762                              const u8 *peer, u32 num_packets,
12763                              u32 rate, u32 intvl, gfp_t gfp)
12764 {
12765         struct sk_buff *msg;
12766
12767         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12768         if (!msg)
12769                 return;
12770
12771         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12772                 goto nla_put_failure;
12773
12774         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12775                 goto nla_put_failure;
12776
12777         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12778                 goto nla_put_failure;
12779
12780         cfg80211_send_cqm(msg, gfp);
12781         return;
12782
12783  nla_put_failure:
12784         nlmsg_free(msg);
12785 }
12786 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12787
12788 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12789                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12790 {
12791         struct sk_buff *msg;
12792
12793         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12794
12795         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12796         if (!msg)
12797                 return;
12798
12799         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12800                 goto nla_put_failure;
12801
12802         cfg80211_send_cqm(msg, gfp);
12803         return;
12804
12805  nla_put_failure:
12806         nlmsg_free(msg);
12807 }
12808 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12809
12810 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12811 {
12812         struct sk_buff *msg;
12813
12814         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12815         if (!msg)
12816                 return;
12817
12818         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12819                 goto nla_put_failure;
12820
12821         cfg80211_send_cqm(msg, gfp);
12822         return;
12823
12824  nla_put_failure:
12825         nlmsg_free(msg);
12826 }
12827 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12828
12829 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12830                                      struct net_device *netdev, const u8 *bssid,
12831                                      const u8 *replay_ctr, gfp_t gfp)
12832 {
12833         struct sk_buff *msg;
12834         struct nlattr *rekey_attr;
12835         void *hdr;
12836
12837         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12838         if (!msg)
12839                 return;
12840
12841         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12842         if (!hdr) {
12843                 nlmsg_free(msg);
12844                 return;
12845         }
12846
12847         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12848             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12849             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12850                 goto nla_put_failure;
12851
12852         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12853         if (!rekey_attr)
12854                 goto nla_put_failure;
12855
12856         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12857                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12858                 goto nla_put_failure;
12859
12860         nla_nest_end(msg, rekey_attr);
12861
12862         genlmsg_end(msg, hdr);
12863
12864         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12865                                 NL80211_MCGRP_MLME, gfp);
12866         return;
12867
12868  nla_put_failure:
12869         genlmsg_cancel(msg, hdr);
12870         nlmsg_free(msg);
12871 }
12872
12873 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12874                                const u8 *replay_ctr, gfp_t gfp)
12875 {
12876         struct wireless_dev *wdev = dev->ieee80211_ptr;
12877         struct wiphy *wiphy = wdev->wiphy;
12878         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12879
12880         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12881         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12882 }
12883 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12884
12885 static void
12886 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12887                                struct net_device *netdev, int index,
12888                                const u8 *bssid, bool preauth, gfp_t gfp)
12889 {
12890         struct sk_buff *msg;
12891         struct nlattr *attr;
12892         void *hdr;
12893
12894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12895         if (!msg)
12896                 return;
12897
12898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12899         if (!hdr) {
12900                 nlmsg_free(msg);
12901                 return;
12902         }
12903
12904         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12905             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12906                 goto nla_put_failure;
12907
12908         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12909         if (!attr)
12910                 goto nla_put_failure;
12911
12912         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12913             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12914             (preauth &&
12915              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12916                 goto nla_put_failure;
12917
12918         nla_nest_end(msg, attr);
12919
12920         genlmsg_end(msg, hdr);
12921
12922         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12923                                 NL80211_MCGRP_MLME, gfp);
12924         return;
12925
12926  nla_put_failure:
12927         genlmsg_cancel(msg, hdr);
12928         nlmsg_free(msg);
12929 }
12930
12931 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12932                                      const u8 *bssid, bool preauth, gfp_t gfp)
12933 {
12934         struct wireless_dev *wdev = dev->ieee80211_ptr;
12935         struct wiphy *wiphy = wdev->wiphy;
12936         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12937
12938         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12939         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12940 }
12941 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12942
12943 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12944                                      struct net_device *netdev,
12945                                      struct cfg80211_chan_def *chandef,
12946                                      gfp_t gfp,
12947                                      enum nl80211_commands notif,
12948                                      u8 count)
12949 {
12950         struct sk_buff *msg;
12951         void *hdr;
12952
12953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12954         if (!msg)
12955                 return;
12956
12957         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12958         if (!hdr) {
12959                 nlmsg_free(msg);
12960                 return;
12961         }
12962
12963         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12964                 goto nla_put_failure;
12965
12966         if (nl80211_send_chandef(msg, chandef))
12967                 goto nla_put_failure;
12968
12969         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12970             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12971                         goto nla_put_failure;
12972
12973         genlmsg_end(msg, hdr);
12974
12975         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12976                                 NL80211_MCGRP_MLME, gfp);
12977         return;
12978
12979  nla_put_failure:
12980         genlmsg_cancel(msg, hdr);
12981         nlmsg_free(msg);
12982 }
12983
12984 void cfg80211_ch_switch_notify(struct net_device *dev,
12985                                struct cfg80211_chan_def *chandef)
12986 {
12987         struct wireless_dev *wdev = dev->ieee80211_ptr;
12988         struct wiphy *wiphy = wdev->wiphy;
12989         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12990
12991         ASSERT_WDEV_LOCK(wdev);
12992
12993         trace_cfg80211_ch_switch_notify(dev, chandef);
12994
12995         wdev->chandef = *chandef;
12996         wdev->preset_chandef = *chandef;
12997         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12998                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12999 }
13000 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
13001
13002 void cfg80211_ch_switch_started_notify(struct net_device *dev,
13003                                        struct cfg80211_chan_def *chandef,
13004                                        u8 count)
13005 {
13006         struct wireless_dev *wdev = dev->ieee80211_ptr;
13007         struct wiphy *wiphy = wdev->wiphy;
13008         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13009
13010         trace_cfg80211_ch_switch_started_notify(dev, chandef);
13011
13012         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13013                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
13014 }
13015 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
13016
13017 void
13018 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
13019                      const struct cfg80211_chan_def *chandef,
13020                      enum nl80211_radar_event event,
13021                      struct net_device *netdev, gfp_t gfp)
13022 {
13023         struct sk_buff *msg;
13024         void *hdr;
13025
13026         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13027         if (!msg)
13028                 return;
13029
13030         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
13031         if (!hdr) {
13032                 nlmsg_free(msg);
13033                 return;
13034         }
13035
13036         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
13037                 goto nla_put_failure;
13038
13039         /* NOP and radar events don't need a netdev parameter */
13040         if (netdev) {
13041                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
13042
13043                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13044                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13045                         goto nla_put_failure;
13046         }
13047
13048         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
13049                 goto nla_put_failure;
13050
13051         if (nl80211_send_chandef(msg, chandef))
13052                 goto nla_put_failure;
13053
13054         genlmsg_end(msg, hdr);
13055
13056         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13057                                 NL80211_MCGRP_MLME, gfp);
13058         return;
13059
13060  nla_put_failure:
13061         genlmsg_cancel(msg, hdr);
13062         nlmsg_free(msg);
13063 }
13064
13065 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
13066                            u64 cookie, bool acked, gfp_t gfp)
13067 {
13068         struct wireless_dev *wdev = dev->ieee80211_ptr;
13069         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13070         struct sk_buff *msg;
13071         void *hdr;
13072
13073         trace_cfg80211_probe_status(dev, addr, cookie, acked);
13074
13075         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13076
13077         if (!msg)
13078                 return;
13079
13080         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
13081         if (!hdr) {
13082                 nlmsg_free(msg);
13083                 return;
13084         }
13085
13086         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13087             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13088             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13089             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
13090             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
13091                 goto nla_put_failure;
13092
13093         genlmsg_end(msg, hdr);
13094
13095         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13096                                 NL80211_MCGRP_MLME, gfp);
13097         return;
13098
13099  nla_put_failure:
13100         genlmsg_cancel(msg, hdr);
13101         nlmsg_free(msg);
13102 }
13103 EXPORT_SYMBOL(cfg80211_probe_status);
13104
13105 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
13106                                  const u8 *frame, size_t len,
13107                                  int freq, int sig_dbm)
13108 {
13109         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13110         struct sk_buff *msg;
13111         void *hdr;
13112         struct cfg80211_beacon_registration *reg;
13113
13114         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
13115
13116         spin_lock_bh(&rdev->beacon_registrations_lock);
13117         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13118                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
13119                 if (!msg) {
13120                         spin_unlock_bh(&rdev->beacon_registrations_lock);
13121                         return;
13122                 }
13123
13124                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13125                 if (!hdr)
13126                         goto nla_put_failure;
13127
13128                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13129                     (freq &&
13130                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
13131                     (sig_dbm &&
13132                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13133                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
13134                         goto nla_put_failure;
13135
13136                 genlmsg_end(msg, hdr);
13137
13138                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
13139         }
13140         spin_unlock_bh(&rdev->beacon_registrations_lock);
13141         return;
13142
13143  nla_put_failure:
13144         spin_unlock_bh(&rdev->beacon_registrations_lock);
13145         if (hdr)
13146                 genlmsg_cancel(msg, hdr);
13147         nlmsg_free(msg);
13148 }
13149 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
13150
13151 #ifdef CONFIG_PM
13152 static int cfg80211_net_detect_results(struct sk_buff *msg,
13153                                        struct cfg80211_wowlan_wakeup *wakeup)
13154 {
13155         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
13156         struct nlattr *nl_results, *nl_match, *nl_freqs;
13157         int i, j;
13158
13159         nl_results = nla_nest_start(
13160                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
13161         if (!nl_results)
13162                 return -EMSGSIZE;
13163
13164         for (i = 0; i < nd->n_matches; i++) {
13165                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
13166
13167                 nl_match = nla_nest_start(msg, i);
13168                 if (!nl_match)
13169                         break;
13170
13171                 /* The SSID attribute is optional in nl80211, but for
13172                  * simplicity reasons it's always present in the
13173                  * cfg80211 structure.  If a driver can't pass the
13174                  * SSID, that needs to be changed.  A zero length SSID
13175                  * is still a valid SSID (wildcard), so it cannot be
13176                  * used for this purpose.
13177                  */
13178                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
13179                             match->ssid.ssid)) {
13180                         nla_nest_cancel(msg, nl_match);
13181                         goto out;
13182                 }
13183
13184                 if (match->n_channels) {
13185                         nl_freqs = nla_nest_start(
13186                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
13187                         if (!nl_freqs) {
13188                                 nla_nest_cancel(msg, nl_match);
13189                                 goto out;
13190                         }
13191
13192                         for (j = 0; j < match->n_channels; j++) {
13193                                 if (nla_put_u32(msg, j, match->channels[j])) {
13194                                         nla_nest_cancel(msg, nl_freqs);
13195                                         nla_nest_cancel(msg, nl_match);
13196                                         goto out;
13197                                 }
13198                         }
13199
13200                         nla_nest_end(msg, nl_freqs);
13201                 }
13202
13203                 nla_nest_end(msg, nl_match);
13204         }
13205
13206 out:
13207         nla_nest_end(msg, nl_results);
13208         return 0;
13209 }
13210
13211 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
13212                                    struct cfg80211_wowlan_wakeup *wakeup,
13213                                    gfp_t gfp)
13214 {
13215         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13216         struct sk_buff *msg;
13217         void *hdr;
13218         int size = 200;
13219
13220         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
13221
13222         if (wakeup)
13223                 size += wakeup->packet_present_len;
13224
13225         msg = nlmsg_new(size, gfp);
13226         if (!msg)
13227                 return;
13228
13229         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13230         if (!hdr)
13231                 goto free_msg;
13232
13233         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13234             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13235                 goto free_msg;
13236
13237         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13238                                         wdev->netdev->ifindex))
13239                 goto free_msg;
13240
13241         if (wakeup) {
13242                 struct nlattr *reasons;
13243
13244                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13245                 if (!reasons)
13246                         goto free_msg;
13247
13248                 if (wakeup->disconnect &&
13249                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13250                         goto free_msg;
13251                 if (wakeup->magic_pkt &&
13252                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13253                         goto free_msg;
13254                 if (wakeup->gtk_rekey_failure &&
13255                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13256                         goto free_msg;
13257                 if (wakeup->eap_identity_req &&
13258                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13259                         goto free_msg;
13260                 if (wakeup->four_way_handshake &&
13261                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13262                         goto free_msg;
13263                 if (wakeup->rfkill_release &&
13264                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13265                         goto free_msg;
13266
13267                 if (wakeup->pattern_idx >= 0 &&
13268                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13269                                 wakeup->pattern_idx))
13270                         goto free_msg;
13271
13272                 if (wakeup->tcp_match &&
13273                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13274                         goto free_msg;
13275
13276                 if (wakeup->tcp_connlost &&
13277                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13278                         goto free_msg;
13279
13280                 if (wakeup->tcp_nomoretokens &&
13281                     nla_put_flag(msg,
13282                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13283                         goto free_msg;
13284
13285                 if (wakeup->packet) {
13286                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13287                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13288
13289                         if (!wakeup->packet_80211) {
13290                                 pkt_attr =
13291                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13292                                 len_attr =
13293                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13294                         }
13295
13296                         if (wakeup->packet_len &&
13297                             nla_put_u32(msg, len_attr, wakeup->packet_len))
13298                                 goto free_msg;
13299
13300                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13301                                     wakeup->packet))
13302                                 goto free_msg;
13303                 }
13304
13305                 if (wakeup->net_detect &&
13306                     cfg80211_net_detect_results(msg, wakeup))
13307                                 goto free_msg;
13308
13309                 nla_nest_end(msg, reasons);
13310         }
13311
13312         genlmsg_end(msg, hdr);
13313
13314         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13315                                 NL80211_MCGRP_MLME, gfp);
13316         return;
13317
13318  free_msg:
13319         nlmsg_free(msg);
13320 }
13321 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13322 #endif
13323
13324 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13325                                 enum nl80211_tdls_operation oper,
13326                                 u16 reason_code, gfp_t gfp)
13327 {
13328         struct wireless_dev *wdev = dev->ieee80211_ptr;
13329         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13330         struct sk_buff *msg;
13331         void *hdr;
13332
13333         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13334                                          reason_code);
13335
13336         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13337         if (!msg)
13338                 return;
13339
13340         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13341         if (!hdr) {
13342                 nlmsg_free(msg);
13343                 return;
13344         }
13345
13346         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13347             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13348             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13349             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13350             (reason_code > 0 &&
13351              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13352                 goto nla_put_failure;
13353
13354         genlmsg_end(msg, hdr);
13355
13356         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13357                                 NL80211_MCGRP_MLME, gfp);
13358         return;
13359
13360  nla_put_failure:
13361         genlmsg_cancel(msg, hdr);
13362         nlmsg_free(msg);
13363 }
13364 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13365
13366 static int nl80211_netlink_notify(struct notifier_block * nb,
13367                                   unsigned long state,
13368                                   void *_notify)
13369 {
13370         struct netlink_notify *notify = _notify;
13371         struct cfg80211_registered_device *rdev;
13372         struct wireless_dev *wdev;
13373         struct cfg80211_beacon_registration *reg, *tmp;
13374
13375         if (state != NETLINK_URELEASE)
13376                 return NOTIFY_DONE;
13377
13378         rcu_read_lock();
13379
13380         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13381                 bool schedule_destroy_work = false;
13382                 bool schedule_scan_stop = false;
13383                 struct cfg80211_sched_scan_request *sched_scan_req =
13384                         rcu_dereference(rdev->sched_scan_req);
13385
13386                 if (sched_scan_req && notify->portid &&
13387                     sched_scan_req->owner_nlportid == notify->portid)
13388                         schedule_scan_stop = true;
13389
13390                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
13391                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13392
13393                         if (wdev->owner_nlportid == notify->portid)
13394                                 schedule_destroy_work = true;
13395                 }
13396
13397                 spin_lock_bh(&rdev->beacon_registrations_lock);
13398                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13399                                          list) {
13400                         if (reg->nlportid == notify->portid) {
13401                                 list_del(&reg->list);
13402                                 kfree(reg);
13403                                 break;
13404                         }
13405                 }
13406                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13407
13408                 if (schedule_destroy_work) {
13409                         struct cfg80211_iface_destroy *destroy;
13410
13411                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13412                         if (destroy) {
13413                                 destroy->nlportid = notify->portid;
13414                                 spin_lock(&rdev->destroy_list_lock);
13415                                 list_add(&destroy->list, &rdev->destroy_list);
13416                                 spin_unlock(&rdev->destroy_list_lock);
13417                                 schedule_work(&rdev->destroy_work);
13418                         }
13419                 } else if (schedule_scan_stop) {
13420                         sched_scan_req->owner_nlportid = 0;
13421
13422                         if (rdev->ops->sched_scan_stop &&
13423                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13424                                 schedule_work(&rdev->sched_scan_stop_wk);
13425                 }
13426         }
13427
13428         rcu_read_unlock();
13429
13430         /*
13431          * It is possible that the user space process that is controlling the
13432          * indoor setting disappeared, so notify the regulatory core.
13433          */
13434         regulatory_netlink_notify(notify->portid);
13435         return NOTIFY_OK;
13436 }
13437
13438 static struct notifier_block nl80211_netlink_notifier = {
13439         .notifier_call = nl80211_netlink_notify,
13440 };
13441
13442 void cfg80211_ft_event(struct net_device *netdev,
13443                        struct cfg80211_ft_event_params *ft_event)
13444 {
13445         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13446         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13447         struct sk_buff *msg;
13448         void *hdr;
13449
13450         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13451
13452         if (!ft_event->target_ap)
13453                 return;
13454
13455         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13456         if (!msg)
13457                 return;
13458
13459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13460         if (!hdr)
13461                 goto out;
13462
13463         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13464             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13465             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13466                 goto out;
13467
13468         if (ft_event->ies &&
13469             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13470                 goto out;
13471         if (ft_event->ric_ies &&
13472             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13473                     ft_event->ric_ies))
13474                 goto out;
13475
13476         genlmsg_end(msg, hdr);
13477
13478         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13479                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13480         return;
13481  out:
13482         nlmsg_free(msg);
13483 }
13484 EXPORT_SYMBOL(cfg80211_ft_event);
13485
13486 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13487 {
13488         struct cfg80211_registered_device *rdev;
13489         struct sk_buff *msg;
13490         void *hdr;
13491         u32 nlportid;
13492
13493         rdev = wiphy_to_rdev(wdev->wiphy);
13494         if (!rdev->crit_proto_nlportid)
13495                 return;
13496
13497         nlportid = rdev->crit_proto_nlportid;
13498         rdev->crit_proto_nlportid = 0;
13499
13500         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13501         if (!msg)
13502                 return;
13503
13504         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13505         if (!hdr)
13506                 goto nla_put_failure;
13507
13508         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13509             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13510                 goto nla_put_failure;
13511
13512         genlmsg_end(msg, hdr);
13513
13514         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13515         return;
13516
13517  nla_put_failure:
13518         if (hdr)
13519                 genlmsg_cancel(msg, hdr);
13520         nlmsg_free(msg);
13521
13522 }
13523 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13524
13525 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13526 {
13527         struct wiphy *wiphy = wdev->wiphy;
13528         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13529         struct sk_buff *msg;
13530         void *hdr;
13531
13532         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13533         if (!msg)
13534                 return;
13535
13536         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13537         if (!hdr)
13538                 goto out;
13539
13540         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13541             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13542             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13543                 goto out;
13544
13545         genlmsg_end(msg, hdr);
13546
13547         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13548                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13549         return;
13550  out:
13551         nlmsg_free(msg);
13552 }
13553
13554 /* initialisation/exit functions */
13555
13556 int nl80211_init(void)
13557 {
13558         int err;
13559
13560         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13561                                                    nl80211_mcgrps);
13562         if (err)
13563                 return err;
13564
13565         err = netlink_register_notifier(&nl80211_netlink_notifier);
13566         if (err)
13567                 goto err_out;
13568
13569         return 0;
13570  err_out:
13571         genl_unregister_family(&nl80211_fam);
13572         return err;
13573 }
13574
13575 void nl80211_exit(void)
13576 {
13577         netlink_unregister_notifier(&nl80211_netlink_notifier);
13578         genl_unregister_family(&nl80211_fam);
13579 }