net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2016  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170
 171                 netdev = __dev_get_by_index(netns, ifindex);
 172                 if (netdev) {
 173                         if (netdev->ieee80211_ptr)
 174                                 tmp = wiphy_to_rdev(
 175                                         netdev->ieee80211_ptr->wiphy);
 176                         else
 177                                 tmp = NULL;
 178
 179                         /* not wireless device -- return error */
 180                         if (!tmp)
 181                                 return ERR_PTR(-EINVAL);
 182
 183                         /* mismatch -- return error */
 184                         if (rdev && tmp != rdev)
 185                                 return ERR_PTR(-EINVAL);
 186
 187                         rdev = tmp;
 188                 }
 189         }
 190
 191         if (!rdev)
 192                 return ERR_PTR(-ENODEV);
 193
 194         if (netns != wiphy_net(&rdev->wiphy))
 195                 return ERR_PTR(-ENODEV);
 196
 197         return rdev;
 198 }
 199
 200 /*
 201  * This function returns a pointer to the driver
 202  * that the genl_info item that is passed refers to.
 203  *
 204  * The result of this can be a PTR_ERR and hence must
 205  * be checked with IS_ERR() for errors.
 206  */
 207 static struct cfg80211_registered_device *
 208 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 209 {
 210         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 211 }
 212
 213 /* policy for the attributes */
 214 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 215         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 216         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 217                                       .len = 20-1 },
 218         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 219
 220         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 221         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 224         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 228         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 230         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 231         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 232
 233         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 236
 237         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 238         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 239
 240         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 241         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 242                                     .len = WLAN_MAX_KEY_LEN },
 243         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 244         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 245         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 246         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 247         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 248
 249         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 250         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 251         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 254                                        .len = IEEE80211_MAX_DATA_LEN },
 255         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 257         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 258         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 259                                                .len = NL80211_MAX_SUPP_RATES },
 260         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 261         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 262         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 263         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 264                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 265         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 266
 267         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 268         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 269
 270         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 274                                            .len = NL80211_MAX_SUPP_RATES },
 275         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 276
 277         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 278         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 279
 280         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 281
 282         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 283         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 284                               .len = IEEE80211_MAX_DATA_LEN },
 285         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 286         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 287
 288         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 289                                 .len = IEEE80211_MAX_SSID_LEN },
 290         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 291         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 292         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 295         [NL80211_ATTR_STA_FLAGS2] = {
 296                 .len = sizeof(struct nl80211_sta_flag_update),
 297         },
 298         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 300         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 303         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 304         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 305         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 306         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 307                                  .len = WLAN_PMKID_LEN },
 308         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 309         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 310         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 311         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 312                                  .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 314         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 315         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 316         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 317         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 320         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 324         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 325         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 328         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 329         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 332         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 335                                          .len = IEEE80211_MAX_DATA_LEN },
 336         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 347                                       .len = IEEE80211_MAX_DATA_LEN },
 348         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 351                 .len = NL80211_HT_CAPABILITY_LEN
 352         },
 353         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 354         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 355         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 356         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 357         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 359         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 360         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 361         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 362         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 363         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 364         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 365         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 366         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 367         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 368         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 369         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 370                 .len = NL80211_VHT_CAPABILITY_LEN,
 371         },
 372         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 373         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 374                                   .len = IEEE80211_MAX_DATA_LEN },
 375         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 376         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 377         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 378         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 379         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 384         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 385         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 387         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 388         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 389                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 390         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 391         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 392         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 393         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 395         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 397         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 398         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 399         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 400         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 401         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 402         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 403         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 404         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 405         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 406         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 407         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 408         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 409                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 410         },
 411         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 412 };
 413
 414 /* policy for the key attributes */
 415 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 416         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 417         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 418         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 419         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 420         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 421         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 422         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 423         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 424 };
 425
 426 /* policy for the key default flags */
 427 static const struct nla_policy
 428 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 429         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 430         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 431 };
 432
 433 /* policy for WoWLAN attributes */
 434 static const struct nla_policy
 435 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 436         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 437         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 438         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 439         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 440         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 441         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 442         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 443         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 444         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 445         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 446 };
 447
 448 static const struct nla_policy
 449 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 450         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 451         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 452         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 453         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 454         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 455         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 456         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 457                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 458         },
 459         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 460                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 461         },
 462         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 463         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 464         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 465 };
 466
 467 /* policy for coalesce rule attributes */
 468 static const struct nla_policy
 469 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 470         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 471         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 472         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 473 };
 474
 475 /* policy for GTK rekey offload attributes */
 476 static const struct nla_policy
 477 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 478         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 479         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 480         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 481 };
 482
 483 static const struct nla_policy
 484 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 485         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 486                                                  .len = IEEE80211_MAX_SSID_LEN },
 487         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 488 };
 489
 490 static const struct nla_policy
 491 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 492         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 493         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 494 };
 495
 496 static const struct nla_policy
 497 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 498         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 499         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 500         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 501                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 502         },
 503 };
 504
 505 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 506                                      struct netlink_callback *cb,
 507                                      struct cfg80211_registered_device **rdev,
 508                                      struct wireless_dev **wdev)
 509 {
 510         int err;
 511
 512         rtnl_lock();
 513
 514         if (!cb->args[0]) {
 515                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 516                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 517                                   nl80211_policy);
 518                 if (err)
 519                         goto out_unlock;
 520
 521                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 522                                                    nl80211_fam.attrbuf);
 523                 if (IS_ERR(*wdev)) {
 524                         err = PTR_ERR(*wdev);
 525                         goto out_unlock;
 526                 }
 527                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 528                 /* 0 is the first index - add 1 to parse only once */
 529                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 530                 cb->args[1] = (*wdev)->identifier;
 531         } else {
 532                 /* subtract the 1 again here */
 533                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 534                 struct wireless_dev *tmp;
 535
 536                 if (!wiphy) {
 537                         err = -ENODEV;
 538                         goto out_unlock;
 539                 }
 540                 *rdev = wiphy_to_rdev(wiphy);
 541                 *wdev = NULL;
 542
 543                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 544                         if (tmp->identifier == cb->args[1]) {
 545                                 *wdev = tmp;
 546                                 break;
 547                         }
 548                 }
 549
 550                 if (!*wdev) {
 551                         err = -ENODEV;
 552                         goto out_unlock;
 553                 }
 554         }
 555
 556         return 0;
 557  out_unlock:
 558         rtnl_unlock();
 559         return err;
 560 }
 561
 562 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 563 {
 564         rtnl_unlock();
 565 }
 566
 567 /* IE validation */
 568 static bool is_valid_ie_attr(const struct nlattr *attr)
 569 {
 570         const u8 *pos;
 571         int len;
 572
 573         if (!attr)
 574                 return true;
 575
 576         pos = nla_data(attr);
 577         len = nla_len(attr);
 578
 579         while (len) {
 580                 u8 elemlen;
 581
 582                 if (len < 2)
 583                         return false;
 584                 len -= 2;
 585
 586                 elemlen = pos[1];
 587                 if (elemlen > len)
 588                         return false;
 589
 590                 len -= elemlen;
 591                 pos += 2 + elemlen;
 592         }
 593
 594         return true;
 595 }
 596
 597 /* message building helper */
 598 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 599                                    int flags, u8 cmd)
 600 {
 601         /* since there is no private header just add the generic one */
 602         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 603 }
 604
 605 static int nl80211_msg_put_channel(struct sk_buff *msg,
 606                                    struct ieee80211_channel *chan,
 607                                    bool large)
 608 {
 609         /* Some channels must be completely excluded from the
 610          * list to protect old user-space tools from breaking
 611          */
 612         if (!large && chan->flags &
 613             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 614                 return 0;
 615
 616         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 617                         chan->center_freq))
 618                 goto nla_put_failure;
 619
 620         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 621             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 622                 goto nla_put_failure;
 623         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 624                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 625                         goto nla_put_failure;
 626                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 627                         goto nla_put_failure;
 628         }
 629         if (chan->flags & IEEE80211_CHAN_RADAR) {
 630                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 631                         goto nla_put_failure;
 632                 if (large) {
 633                         u32 time;
 634
 635                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 636
 637                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 638                                         chan->dfs_state))
 639                                 goto nla_put_failure;
 640                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 641                                         time))
 642                                 goto nla_put_failure;
 643                         if (nla_put_u32(msg,
 644                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 645                                         chan->dfs_cac_ms))
 646                                 goto nla_put_failure;
 647                 }
 648         }
 649
 650         if (large) {
 651                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 652                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 653                         goto nla_put_failure;
 654                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 655                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 656                         goto nla_put_failure;
 657                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 658                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 659                         goto nla_put_failure;
 660                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 661                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 662                         goto nla_put_failure;
 663                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 664                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 665                         goto nla_put_failure;
 666                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 667                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 668                         goto nla_put_failure;
 669                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 670                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 671                         goto nla_put_failure;
 672                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 673                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 674                         goto nla_put_failure;
 675         }
 676
 677         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 678                         DBM_TO_MBM(chan->max_power)))
 679                 goto nla_put_failure;
 680
 681         return 0;
 682
 683  nla_put_failure:
 684         return -ENOBUFS;
 685 }
 686
 687 /* netlink command implementations */
 688
 689 struct key_parse {
 690         struct key_params p;
 691         int idx;
 692         int type;
 693         bool def, defmgmt;
 694         bool def_uni, def_multi;
 695 };
 696
 697 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 698 {
 699         struct nlattr *tb[NL80211_KEY_MAX + 1];
 700         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 701                                    nl80211_key_policy);
 702         if (err)
 703                 return err;
 704
 705         k->def = !!tb[NL80211_KEY_DEFAULT];
 706         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 707
 708         if (k->def) {
 709                 k->def_uni = true;
 710                 k->def_multi = true;
 711         }
 712         if (k->defmgmt)
 713                 k->def_multi = true;
 714
 715         if (tb[NL80211_KEY_IDX])
 716                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 717
 718         if (tb[NL80211_KEY_DATA]) {
 719                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 720                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 721         }
 722
 723         if (tb[NL80211_KEY_SEQ]) {
 724                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 725                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 726         }
 727
 728         if (tb[NL80211_KEY_CIPHER])
 729                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 730
 731         if (tb[NL80211_KEY_TYPE]) {
 732                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 733                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 734                         return -EINVAL;
 735         }
 736
 737         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 738                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 739
 740                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 741                                        tb[NL80211_KEY_DEFAULT_TYPES],
 742                                        nl80211_key_default_policy);
 743                 if (err)
 744                         return err;
 745
 746                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 747                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 748         }
 749
 750         return 0;
 751 }
 752
 753 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 754 {
 755         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 756                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 757                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 758         }
 759
 760         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 761                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 762                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 763         }
 764
 765         if (info->attrs[NL80211_ATTR_KEY_IDX])
 766                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 767
 768         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 769                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 770
 771         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 772         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 773
 774         if (k->def) {
 775                 k->def_uni = true;
 776                 k->def_multi = true;
 777         }
 778         if (k->defmgmt)
 779                 k->def_multi = true;
 780
 781         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 782                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 783                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 784                         return -EINVAL;
 785         }
 786
 787         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 788                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 789                 int err = nla_parse_nested(
 790                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 791                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 792                                 nl80211_key_default_policy);
 793                 if (err)
 794                         return err;
 795
 796                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 797                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 798         }
 799
 800         return 0;
 801 }
 802
 803 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 804 {
 805         int err;
 806
 807         memset(k, 0, sizeof(*k));
 808         k->idx = -1;
 809         k->type = -1;
 810
 811         if (info->attrs[NL80211_ATTR_KEY])
 812                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 813         else
 814                 err = nl80211_parse_key_old(info, k);
 815
 816         if (err)
 817                 return err;
 818
 819         if (k->def && k->defmgmt)
 820                 return -EINVAL;
 821
 822         if (k->defmgmt) {
 823                 if (k->def_uni || !k->def_multi)
 824                         return -EINVAL;
 825         }
 826
 827         if (k->idx != -1) {
 828                 if (k->defmgmt) {
 829                         if (k->idx < 4 || k->idx > 5)
 830                                 return -EINVAL;
 831                 } else if (k->def) {
 832                         if (k->idx < 0 || k->idx > 3)
 833                                 return -EINVAL;
 834                 } else {
 835                         if (k->idx < 0 || k->idx > 5)
 836                                 return -EINVAL;
 837                 }
 838         }
 839
 840         return 0;
 841 }
 842
 843 static struct cfg80211_cached_keys *
 844 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 845                        struct nlattr *keys, bool *no_ht)
 846 {
 847         struct key_parse parse;
 848         struct nlattr *key;
 849         struct cfg80211_cached_keys *result;
 850         int rem, err, def = 0;
 851
 852         result = kzalloc(sizeof(*result), GFP_KERNEL);
 853         if (!result)
 854                 return ERR_PTR(-ENOMEM);
 855
 856         result->def = -1;
 857         result->defmgmt = -1;
 858
 859         nla_for_each_nested(key, keys, rem) {
 860                 memset(&parse, 0, sizeof(parse));
 861                 parse.idx = -1;
 862
 863                 err = nl80211_parse_key_new(key, &parse);
 864                 if (err)
 865                         goto error;
 866                 err = -EINVAL;
 867                 if (!parse.p.key)
 868                         goto error;
 869                 if (parse.idx < 0 || parse.idx > 3)
 870                         goto error;
 871                 if (parse.def) {
 872                         if (def)
 873                                 goto error;
 874                         def = 1;
 875                         result->def = parse.idx;
 876                         if (!parse.def_uni || !parse.def_multi)
 877                                 goto error;
 878                 } else if (parse.defmgmt)
 879                         goto error;
 880                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 881                                                      parse.idx, false, NULL);
 882                 if (err)
 883                         goto error;
 884                 result->params[parse.idx].cipher = parse.p.cipher;
 885                 result->params[parse.idx].key_len = parse.p.key_len;
 886                 result->params[parse.idx].key = result->data[parse.idx];
 887                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 888
 889                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 890                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 891                         if (no_ht)
 892                                 *no_ht = true;
 893                 }
 894         }
 895
 896         return result;
 897  error:
 898         kfree(result);
 899         return ERR_PTR(err);
 900 }
 901
 902 static int nl80211_key_allowed(struct wireless_dev *wdev)
 903 {
 904         ASSERT_WDEV_LOCK(wdev);
 905
 906         switch (wdev->iftype) {
 907         case NL80211_IFTYPE_AP:
 908         case NL80211_IFTYPE_AP_VLAN:
 909         case NL80211_IFTYPE_P2P_GO:
 910         case NL80211_IFTYPE_MESH_POINT:
 911                 break;
 912         case NL80211_IFTYPE_ADHOC:
 913         case NL80211_IFTYPE_STATION:
 914         case NL80211_IFTYPE_P2P_CLIENT:
 915                 if (!wdev->current_bss)
 916                         return -ENOLINK;
 917                 break;
 918         case NL80211_IFTYPE_UNSPECIFIED:
 919         case NL80211_IFTYPE_OCB:
 920         case NL80211_IFTYPE_MONITOR:
 921         case NL80211_IFTYPE_P2P_DEVICE:
 922         case NL80211_IFTYPE_WDS:
 923         case NUM_NL80211_IFTYPES:
 924                 return -EINVAL;
 925         }
 926
 927         return 0;
 928 }
 929
 930 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 931                                                         struct nlattr *tb)
 932 {
 933         struct ieee80211_channel *chan;
 934
 935         if (tb == NULL)
 936                 return NULL;
 937         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 938         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 939                 return NULL;
 940         return chan;
 941 }
 942
 943 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 944 {
 945         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 946         int i;
 947
 948         if (!nl_modes)
 949                 goto nla_put_failure;
 950
 951         i = 0;
 952         while (ifmodes) {
 953                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 954                         goto nla_put_failure;
 955                 ifmodes >>= 1;
 956                 i++;
 957         }
 958
 959         nla_nest_end(msg, nl_modes);
 960         return 0;
 961
 962 nla_put_failure:
 963         return -ENOBUFS;
 964 }
 965
 966 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 967                                           struct sk_buff *msg,
 968                                           bool large)
 969 {
 970         struct nlattr *nl_combis;
 971         int i, j;
 972
 973         nl_combis = nla_nest_start(msg,
 974                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 975         if (!nl_combis)
 976                 goto nla_put_failure;
 977
 978         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 979                 const struct ieee80211_iface_combination *c;
 980                 struct nlattr *nl_combi, *nl_limits;
 981
 982                 c = &wiphy->iface_combinations[i];
 983
 984                 nl_combi = nla_nest_start(msg, i + 1);
 985                 if (!nl_combi)
 986                         goto nla_put_failure;
 987
 988                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 989                 if (!nl_limits)
 990                         goto nla_put_failure;
 991
 992                 for (j = 0; j < c->n_limits; j++) {
 993                         struct nlattr *nl_limit;
 994
 995                         nl_limit = nla_nest_start(msg, j + 1);
 996                         if (!nl_limit)
 997                                 goto nla_put_failure;
 998                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 999                                         c->limits[j].max))
1000                                 goto nla_put_failure;
1001                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1002                                                 c->limits[j].types))
1003                                 goto nla_put_failure;
1004                         nla_nest_end(msg, nl_limit);
1005                 }
1006
1007                 nla_nest_end(msg, nl_limits);
1008
1009                 if (c->beacon_int_infra_match &&
1010                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1011                         goto nla_put_failure;
1012                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1013                                 c->num_different_channels) ||
1014                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1015                                 c->max_interfaces))
1016                         goto nla_put_failure;
1017                 if (large &&
1018                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1019                                 c->radar_detect_widths) ||
1020                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1021                                 c->radar_detect_regions)))
1022                         goto nla_put_failure;
1023
1024                 nla_nest_end(msg, nl_combi);
1025         }
1026
1027         nla_nest_end(msg, nl_combis);
1028
1029         return 0;
1030 nla_put_failure:
1031         return -ENOBUFS;
1032 }
1033
1034 #ifdef CONFIG_PM
1035 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1036                                         struct sk_buff *msg)
1037 {
1038         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1039         struct nlattr *nl_tcp;
1040
1041         if (!tcp)
1042                 return 0;
1043
1044         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1045         if (!nl_tcp)
1046                 return -ENOBUFS;
1047
1048         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1049                         tcp->data_payload_max))
1050                 return -ENOBUFS;
1051
1052         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1053                         tcp->data_payload_max))
1054                 return -ENOBUFS;
1055
1056         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1057                 return -ENOBUFS;
1058
1059         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1060                                 sizeof(*tcp->tok), tcp->tok))
1061                 return -ENOBUFS;
1062
1063         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1064                         tcp->data_interval_max))
1065                 return -ENOBUFS;
1066
1067         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1068                         tcp->wake_payload_max))
1069                 return -ENOBUFS;
1070
1071         nla_nest_end(msg, nl_tcp);
1072         return 0;
1073 }
1074
1075 static int nl80211_send_wowlan(struct sk_buff *msg,
1076                                struct cfg80211_registered_device *rdev,
1077                                bool large)
1078 {
1079         struct nlattr *nl_wowlan;
1080
1081         if (!rdev->wiphy.wowlan)
1082                 return 0;
1083
1084         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1085         if (!nl_wowlan)
1086                 return -ENOBUFS;
1087
1088         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1089              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1090             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1091              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1092             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1093              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1094             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1095              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1096             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1097              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1098             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1099              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1100             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1101              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1102             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1103              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1104                 return -ENOBUFS;
1105
1106         if (rdev->wiphy.wowlan->n_patterns) {
1107                 struct nl80211_pattern_support pat = {
1108                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1109                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1110                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1111                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1112                 };
1113
1114                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1115                             sizeof(pat), &pat))
1116                         return -ENOBUFS;
1117         }
1118
1119         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1120             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1121                         rdev->wiphy.wowlan->max_nd_match_sets))
1122                 return -ENOBUFS;
1123
1124         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1125                 return -ENOBUFS;
1126
1127         nla_nest_end(msg, nl_wowlan);
1128
1129         return 0;
1130 }
1131 #endif
1132
1133 static int nl80211_send_coalesce(struct sk_buff *msg,
1134                                  struct cfg80211_registered_device *rdev)
1135 {
1136         struct nl80211_coalesce_rule_support rule;
1137
1138         if (!rdev->wiphy.coalesce)
1139                 return 0;
1140
1141         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1142         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1143         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1144         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1145         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1146         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1147
1148         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1149                 return -ENOBUFS;
1150
1151         return 0;
1152 }
1153
1154 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1155                                       struct ieee80211_supported_band *sband)
1156 {
1157         struct nlattr *nl_rates, *nl_rate;
1158         struct ieee80211_rate *rate;
1159         int i;
1160
1161         /* add HT info */
1162         if (sband->ht_cap.ht_supported &&
1163             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1164                      sizeof(sband->ht_cap.mcs),
1165                      &sband->ht_cap.mcs) ||
1166              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1167                          sband->ht_cap.cap) ||
1168              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1169                         sband->ht_cap.ampdu_factor) ||
1170              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1171                         sband->ht_cap.ampdu_density)))
1172                 return -ENOBUFS;
1173
1174         /* add VHT info */
1175         if (sband->vht_cap.vht_supported &&
1176             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1177                      sizeof(sband->vht_cap.vht_mcs),
1178                      &sband->vht_cap.vht_mcs) ||
1179              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1180                          sband->vht_cap.cap)))
1181                 return -ENOBUFS;
1182
1183         /* add bitrates */
1184         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1185         if (!nl_rates)
1186                 return -ENOBUFS;
1187
1188         for (i = 0; i < sband->n_bitrates; i++) {
1189                 nl_rate = nla_nest_start(msg, i);
1190                 if (!nl_rate)
1191                         return -ENOBUFS;
1192
1193                 rate = &sband->bitrates[i];
1194                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1195                                 rate->bitrate))
1196                         return -ENOBUFS;
1197                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1198                     nla_put_flag(msg,
1199                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1200                         return -ENOBUFS;
1201
1202                 nla_nest_end(msg, nl_rate);
1203         }
1204
1205         nla_nest_end(msg, nl_rates);
1206
1207         return 0;
1208 }
1209
1210 static int
1211 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1212                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1213 {
1214         u16 stypes;
1215         struct nlattr *nl_ftypes, *nl_ifs;
1216         enum nl80211_iftype ift;
1217         int i;
1218
1219         if (!mgmt_stypes)
1220                 return 0;
1221
1222         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1223         if (!nl_ifs)
1224                 return -ENOBUFS;
1225
1226         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1227                 nl_ftypes = nla_nest_start(msg, ift);
1228                 if (!nl_ftypes)
1229                         return -ENOBUFS;
1230                 i = 0;
1231                 stypes = mgmt_stypes[ift].tx;
1232                 while (stypes) {
1233                         if ((stypes & 1) &&
1234                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1235                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1236                                 return -ENOBUFS;
1237                         stypes >>= 1;
1238                         i++;
1239                 }
1240                 nla_nest_end(msg, nl_ftypes);
1241         }
1242
1243         nla_nest_end(msg, nl_ifs);
1244
1245         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1246         if (!nl_ifs)
1247                 return -ENOBUFS;
1248
1249         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1250                 nl_ftypes = nla_nest_start(msg, ift);
1251                 if (!nl_ftypes)
1252                         return -ENOBUFS;
1253                 i = 0;
1254                 stypes = mgmt_stypes[ift].rx;
1255                 while (stypes) {
1256                         if ((stypes & 1) &&
1257                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1258                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1259                                 return -ENOBUFS;
1260                         stypes >>= 1;
1261                         i++;
1262                 }
1263                 nla_nest_end(msg, nl_ftypes);
1264         }
1265         nla_nest_end(msg, nl_ifs);
1266
1267         return 0;
1268 }
1269
1270 struct nl80211_dump_wiphy_state {
1271         s64 filter_wiphy;
1272         long start;
1273         long split_start, band_start, chan_start, capa_start;
1274         bool split;
1275 };
1276
1277 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1278                               enum nl80211_commands cmd,
1279                               struct sk_buff *msg, u32 portid, u32 seq,
1280                               int flags, struct nl80211_dump_wiphy_state *state)
1281 {
1282         void *hdr;
1283         struct nlattr *nl_bands, *nl_band;
1284         struct nlattr *nl_freqs, *nl_freq;
1285         struct nlattr *nl_cmds;
1286         enum nl80211_band band;
1287         struct ieee80211_channel *chan;
1288         int i;
1289         const struct ieee80211_txrx_stypes *mgmt_stypes =
1290                                 rdev->wiphy.mgmt_stypes;
1291         u32 features;
1292
1293         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1294         if (!hdr)
1295                 return -ENOBUFS;
1296
1297         if (WARN_ON(!state))
1298                 return -EINVAL;
1299
1300         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1301             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1302                            wiphy_name(&rdev->wiphy)) ||
1303             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1304                         cfg80211_rdev_list_generation))
1305                 goto nla_put_failure;
1306
1307         if (cmd != NL80211_CMD_NEW_WIPHY)
1308                 goto finish;
1309
1310         switch (state->split_start) {
1311         case 0:
1312                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1313                                rdev->wiphy.retry_short) ||
1314                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1315                                rdev->wiphy.retry_long) ||
1316                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1317                                 rdev->wiphy.frag_threshold) ||
1318                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1319                                 rdev->wiphy.rts_threshold) ||
1320                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1321                                rdev->wiphy.coverage_class) ||
1322                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1323                                rdev->wiphy.max_scan_ssids) ||
1324                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1325                                rdev->wiphy.max_sched_scan_ssids) ||
1326                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1327                                 rdev->wiphy.max_scan_ie_len) ||
1328                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1329                                 rdev->wiphy.max_sched_scan_ie_len) ||
1330                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1331                                rdev->wiphy.max_match_sets) ||
1332                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1333                                 rdev->wiphy.max_sched_scan_plans) ||
1334                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1335                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1336                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1337                                 rdev->wiphy.max_sched_scan_plan_iterations))
1338                         goto nla_put_failure;
1339
1340                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1341                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1342                         goto nla_put_failure;
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1344                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1345                         goto nla_put_failure;
1346                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1347                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1348                         goto nla_put_failure;
1349                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1350                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1351                         goto nla_put_failure;
1352                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1353                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1354                         goto nla_put_failure;
1355                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1356                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1357                         goto nla_put_failure;
1358                 state->split_start++;
1359                 if (state->split)
1360                         break;
1361         case 1:
1362                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1363                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1364                             rdev->wiphy.cipher_suites))
1365                         goto nla_put_failure;
1366
1367                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1368                                rdev->wiphy.max_num_pmkids))
1369                         goto nla_put_failure;
1370
1371                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1372                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1373                         goto nla_put_failure;
1374
1375                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1376                                 rdev->wiphy.available_antennas_tx) ||
1377                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1378                                 rdev->wiphy.available_antennas_rx))
1379                         goto nla_put_failure;
1380
1381                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1382                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1383                                 rdev->wiphy.probe_resp_offload))
1384                         goto nla_put_failure;
1385
1386                 if ((rdev->wiphy.available_antennas_tx ||
1387                      rdev->wiphy.available_antennas_rx) &&
1388                     rdev->ops->get_antenna) {
1389                         u32 tx_ant = 0, rx_ant = 0;
1390                         int res;
1391
1392                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1393                         if (!res) {
1394                                 if (nla_put_u32(msg,
1395                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1396                                                 tx_ant) ||
1397                                     nla_put_u32(msg,
1398                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1399                                                 rx_ant))
1400                                         goto nla_put_failure;
1401                         }
1402                 }
1403
1404                 state->split_start++;
1405                 if (state->split)
1406                         break;
1407         case 2:
1408                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1409                                         rdev->wiphy.interface_modes))
1410                                 goto nla_put_failure;
1411                 state->split_start++;
1412                 if (state->split)
1413                         break;
1414         case 3:
1415                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1416                 if (!nl_bands)
1417                         goto nla_put_failure;
1418
1419                 for (band = state->band_start;
1420                      band < NUM_NL80211_BANDS; band++) {
1421                         struct ieee80211_supported_band *sband;
1422
1423                         sband = rdev->wiphy.bands[band];
1424
1425                         if (!sband)
1426                                 continue;
1427
1428                         nl_band = nla_nest_start(msg, band);
1429                         if (!nl_band)
1430                                 goto nla_put_failure;
1431
1432                         switch (state->chan_start) {
1433                         case 0:
1434                                 if (nl80211_send_band_rateinfo(msg, sband))
1435                                         goto nla_put_failure;
1436                                 state->chan_start++;
1437                                 if (state->split)
1438                                         break;
1439                         default:
1440                                 /* add frequencies */
1441                                 nl_freqs = nla_nest_start(
1442                                         msg, NL80211_BAND_ATTR_FREQS);
1443                                 if (!nl_freqs)
1444                                         goto nla_put_failure;
1445
1446                                 for (i = state->chan_start - 1;
1447                                      i < sband->n_channels;
1448                                      i++) {
1449                                         nl_freq = nla_nest_start(msg, i);
1450                                         if (!nl_freq)
1451                                                 goto nla_put_failure;
1452
1453                                         chan = &sband->channels[i];
1454
1455                                         if (nl80211_msg_put_channel(
1456                                                         msg, chan,
1457                                                         state->split))
1458                                                 goto nla_put_failure;
1459
1460                                         nla_nest_end(msg, nl_freq);
1461                                         if (state->split)
1462                                                 break;
1463                                 }
1464                                 if (i < sband->n_channels)
1465                                         state->chan_start = i + 2;
1466                                 else
1467                                         state->chan_start = 0;
1468                                 nla_nest_end(msg, nl_freqs);
1469                         }
1470
1471                         nla_nest_end(msg, nl_band);
1472
1473                         if (state->split) {
1474                                 /* start again here */
1475                                 if (state->chan_start)
1476                                         band--;
1477                                 break;
1478                         }
1479                 }
1480                 nla_nest_end(msg, nl_bands);
1481
1482                 if (band < NUM_NL80211_BANDS)
1483                         state->band_start = band + 1;
1484                 else
1485                         state->band_start = 0;
1486
1487                 /* if bands & channels are done, continue outside */
1488                 if (state->band_start == 0 && state->chan_start == 0)
1489                         state->split_start++;
1490                 if (state->split)
1491                         break;
1492         case 4:
1493                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1494                 if (!nl_cmds)
1495                         goto nla_put_failure;
1496
1497                 i = 0;
1498 #define CMD(op, n)                                                      \
1499                  do {                                                   \
1500                         if (rdev->ops->op) {                            \
1501                                 i++;                                    \
1502                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1503                                         goto nla_put_failure;           \
1504                         }                                               \
1505                 } while (0)
1506
1507                 CMD(add_virtual_intf, NEW_INTERFACE);
1508                 CMD(change_virtual_intf, SET_INTERFACE);
1509                 CMD(add_key, NEW_KEY);
1510                 CMD(start_ap, START_AP);
1511                 CMD(add_station, NEW_STATION);
1512                 CMD(add_mpath, NEW_MPATH);
1513                 CMD(update_mesh_config, SET_MESH_CONFIG);
1514                 CMD(change_bss, SET_BSS);
1515                 CMD(auth, AUTHENTICATE);
1516                 CMD(assoc, ASSOCIATE);
1517                 CMD(deauth, DEAUTHENTICATE);
1518                 CMD(disassoc, DISASSOCIATE);
1519                 CMD(join_ibss, JOIN_IBSS);
1520                 CMD(join_mesh, JOIN_MESH);
1521                 CMD(set_pmksa, SET_PMKSA);
1522                 CMD(del_pmksa, DEL_PMKSA);
1523                 CMD(flush_pmksa, FLUSH_PMKSA);
1524                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1525                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1526                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1527                 CMD(mgmt_tx, FRAME);
1528                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1529                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1530                         i++;
1531                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1532                                 goto nla_put_failure;
1533                 }
1534                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1535                     rdev->ops->join_mesh) {
1536                         i++;
1537                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1538                                 goto nla_put_failure;
1539                 }
1540                 CMD(set_wds_peer, SET_WDS_PEER);
1541                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1542                         CMD(tdls_mgmt, TDLS_MGMT);
1543                         CMD(tdls_oper, TDLS_OPER);
1544                 }
1545                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1546                         CMD(sched_scan_start, START_SCHED_SCAN);
1547                 CMD(probe_client, PROBE_CLIENT);
1548                 CMD(set_noack_map, SET_NOACK_MAP);
1549                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1550                         i++;
1551                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1552                                 goto nla_put_failure;
1553                 }
1554                 CMD(start_p2p_device, START_P2P_DEVICE);
1555                 CMD(set_mcast_rate, SET_MCAST_RATE);
1556 #ifdef CONFIG_NL80211_TESTMODE
1557                 CMD(testmode_cmd, TESTMODE);
1558 #endif
1559                 if (state->split) {
1560                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1561                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1562                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1563                                 CMD(channel_switch, CHANNEL_SWITCH);
1564                         CMD(set_qos_map, SET_QOS_MAP);
1565                         if (rdev->wiphy.features &
1566                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1567                                 CMD(add_tx_ts, ADD_TX_TS);
1568                 }
1569                 /* add into the if now */
1570 #undef CMD
1571
1572                 if (rdev->ops->connect || rdev->ops->auth) {
1573                         i++;
1574                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1575                                 goto nla_put_failure;
1576                 }
1577
1578                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1579                         i++;
1580                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1581                                 goto nla_put_failure;
1582                 }
1583
1584                 nla_nest_end(msg, nl_cmds);
1585                 state->split_start++;
1586                 if (state->split)
1587                         break;
1588         case 5:
1589                 if (rdev->ops->remain_on_channel &&
1590                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1591                     nla_put_u32(msg,
1592                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1593                                 rdev->wiphy.max_remain_on_channel_duration))
1594                         goto nla_put_failure;
1595
1596                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1597                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1598                         goto nla_put_failure;
1599
1600                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1601                         goto nla_put_failure;
1602                 state->split_start++;
1603                 if (state->split)
1604                         break;
1605         case 6:
1606 #ifdef CONFIG_PM
1607                 if (nl80211_send_wowlan(msg, rdev, state->split))
1608                         goto nla_put_failure;
1609                 state->split_start++;
1610                 if (state->split)
1611                         break;
1612 #else
1613                 state->split_start++;
1614 #endif
1615         case 7:
1616                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1617                                         rdev->wiphy.software_iftypes))
1618                         goto nla_put_failure;
1619
1620                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1621                                                    state->split))
1622                         goto nla_put_failure;
1623
1624                 state->split_start++;
1625                 if (state->split)
1626                         break;
1627         case 8:
1628                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1629                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1630                                 rdev->wiphy.ap_sme_capa))
1631                         goto nla_put_failure;
1632
1633                 features = rdev->wiphy.features;
1634                 /*
1635                  * We can only add the per-channel limit information if the
1636                  * dump is split, otherwise it makes it too big. Therefore
1637                  * only advertise it in that case.
1638                  */
1639                 if (state->split)
1640                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1641                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1642                         goto nla_put_failure;
1643
1644                 if (rdev->wiphy.ht_capa_mod_mask &&
1645                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1646                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1647                             rdev->wiphy.ht_capa_mod_mask))
1648                         goto nla_put_failure;
1649
1650                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1651                     rdev->wiphy.max_acl_mac_addrs &&
1652                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1653                                 rdev->wiphy.max_acl_mac_addrs))
1654                         goto nla_put_failure;
1655
1656                 /*
1657                  * Any information below this point is only available to
1658                  * applications that can deal with it being split. This
1659                  * helps ensure that newly added capabilities don't break
1660                  * older tools by overrunning their buffers.
1661                  *
1662                  * We still increment split_start so that in the split
1663                  * case we'll continue with more data in the next round,
1664                  * but break unconditionally so unsplit data stops here.
1665                  */
1666                 state->split_start++;
1667                 break;
1668         case 9:
1669                 if (rdev->wiphy.extended_capabilities &&
1670                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1671                              rdev->wiphy.extended_capabilities_len,
1672                              rdev->wiphy.extended_capabilities) ||
1673                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1674                              rdev->wiphy.extended_capabilities_len,
1675                              rdev->wiphy.extended_capabilities_mask)))
1676                         goto nla_put_failure;
1677
1678                 if (rdev->wiphy.vht_capa_mod_mask &&
1679                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1680                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1681                             rdev->wiphy.vht_capa_mod_mask))
1682                         goto nla_put_failure;
1683
1684                 state->split_start++;
1685                 break;
1686         case 10:
1687                 if (nl80211_send_coalesce(msg, rdev))
1688                         goto nla_put_failure;
1689
1690                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1691                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1692                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1693                         goto nla_put_failure;
1694
1695                 if (rdev->wiphy.max_ap_assoc_sta &&
1696                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1697                                 rdev->wiphy.max_ap_assoc_sta))
1698                         goto nla_put_failure;
1699
1700                 state->split_start++;
1701                 break;
1702         case 11:
1703                 if (rdev->wiphy.n_vendor_commands) {
1704                         const struct nl80211_vendor_cmd_info *info;
1705                         struct nlattr *nested;
1706
1707                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1708                         if (!nested)
1709                                 goto nla_put_failure;
1710
1711                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1712                                 info = &rdev->wiphy.vendor_commands[i].info;
1713                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1714                                         goto nla_put_failure;
1715                         }
1716                         nla_nest_end(msg, nested);
1717                 }
1718
1719                 if (rdev->wiphy.n_vendor_events) {
1720                         const struct nl80211_vendor_cmd_info *info;
1721                         struct nlattr *nested;
1722
1723                         nested = nla_nest_start(msg,
1724                                                 NL80211_ATTR_VENDOR_EVENTS);
1725                         if (!nested)
1726                                 goto nla_put_failure;
1727
1728                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1729                                 info = &rdev->wiphy.vendor_events[i];
1730                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1731                                         goto nla_put_failure;
1732                         }
1733                         nla_nest_end(msg, nested);
1734                 }
1735                 state->split_start++;
1736                 break;
1737         case 12:
1738                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1739                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1740                                rdev->wiphy.max_num_csa_counters))
1741                         goto nla_put_failure;
1742
1743                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1744                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1745                         goto nla_put_failure;
1746
1747                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1748                             sizeof(rdev->wiphy.ext_features),
1749                             rdev->wiphy.ext_features))
1750                         goto nla_put_failure;
1751
1752                 if (rdev->wiphy.bss_select_support) {
1753                         struct nlattr *nested;
1754                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1755
1756                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1757                         if (!nested)
1758                                 goto nla_put_failure;
1759
1760                         i = 0;
1761                         while (bss_select_support) {
1762                                 if ((bss_select_support & 1) &&
1763                                     nla_put_flag(msg, i))
1764                                         goto nla_put_failure;
1765                                 i++;
1766                                 bss_select_support >>= 1;
1767                         }
1768                         nla_nest_end(msg, nested);
1769                 }
1770
1771                 state->split_start++;
1772                 break;
1773         case 13:
1774                 if (rdev->wiphy.num_iftype_ext_capab &&
1775                     rdev->wiphy.iftype_ext_capab) {
1776                         struct nlattr *nested_ext_capab, *nested;
1777
1778                         nested = nla_nest_start(msg,
1779                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1780                         if (!nested)
1781                                 goto nla_put_failure;
1782
1783                         for (i = state->capa_start;
1784                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1785                                 const struct wiphy_iftype_ext_capab *capab;
1786
1787                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1788
1789                                 nested_ext_capab = nla_nest_start(msg, i);
1790                                 if (!nested_ext_capab ||
1791                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1792                                                 capab->iftype) ||
1793                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1794                                             capab->extended_capabilities_len,
1795                                             capab->extended_capabilities) ||
1796                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1797                                             capab->extended_capabilities_len,
1798                                             capab->extended_capabilities_mask))
1799                                         goto nla_put_failure;
1800
1801                                 nla_nest_end(msg, nested_ext_capab);
1802                                 if (state->split)
1803                                         break;
1804                         }
1805                         nla_nest_end(msg, nested);
1806                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1807                                 state->capa_start = i + 1;
1808                                 break;
1809                         }
1810                 }
1811
1812                 /* done */
1813                 state->split_start = 0;
1814                 break;
1815         }
1816  finish:
1817         genlmsg_end(msg, hdr);
1818         return 0;
1819
1820  nla_put_failure:
1821         genlmsg_cancel(msg, hdr);
1822         return -EMSGSIZE;
1823 }
1824
1825 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1826                                     struct netlink_callback *cb,
1827                                     struct nl80211_dump_wiphy_state *state)
1828 {
1829         struct nlattr **tb = nl80211_fam.attrbuf;
1830         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1831                               tb, nl80211_fam.maxattr, nl80211_policy);
1832         /* ignore parse errors for backward compatibility */
1833         if (ret)
1834                 return 0;
1835
1836         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1837         if (tb[NL80211_ATTR_WIPHY])
1838                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1839         if (tb[NL80211_ATTR_WDEV])
1840                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1841         if (tb[NL80211_ATTR_IFINDEX]) {
1842                 struct net_device *netdev;
1843                 struct cfg80211_registered_device *rdev;
1844                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1845
1846                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1847                 if (!netdev)
1848                         return -ENODEV;
1849                 if (netdev->ieee80211_ptr) {
1850                         rdev = wiphy_to_rdev(
1851                                 netdev->ieee80211_ptr->wiphy);
1852                         state->filter_wiphy = rdev->wiphy_idx;
1853                 }
1854         }
1855
1856         return 0;
1857 }
1858
1859 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1860 {
1861         int idx = 0, ret;
1862         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1863         struct cfg80211_registered_device *rdev;
1864
1865         rtnl_lock();
1866         if (!state) {
1867                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1868                 if (!state) {
1869                         rtnl_unlock();
1870                         return -ENOMEM;
1871                 }
1872                 state->filter_wiphy = -1;
1873                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1874                 if (ret) {
1875                         kfree(state);
1876                         rtnl_unlock();
1877                         return ret;
1878                 }
1879                 cb->args[0] = (long)state;
1880         }
1881
1882         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1883                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1884                         continue;
1885                 if (++idx <= state->start)
1886                         continue;
1887                 if (state->filter_wiphy != -1 &&
1888                     state->filter_wiphy != rdev->wiphy_idx)
1889                         continue;
1890                 /* attempt to fit multiple wiphy data chunks into the skb */
1891                 do {
1892                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1893                                                  skb,
1894                                                  NETLINK_CB(cb->skb).portid,
1895                                                  cb->nlh->nlmsg_seq,
1896                                                  NLM_F_MULTI, state);
1897                         if (ret < 0) {
1898                                 /*
1899                                  * If sending the wiphy data didn't fit (ENOBUFS
1900                                  * or EMSGSIZE returned), this SKB is still
1901                                  * empty (so it's not too big because another
1902                                  * wiphy dataset is already in the skb) and
1903                                  * we've not tried to adjust the dump allocation
1904                                  * yet ... then adjust the alloc size to be
1905                                  * bigger, and return 1 but with the empty skb.
1906                                  * This results in an empty message being RX'ed
1907                                  * in userspace, but that is ignored.
1908                                  *
1909                                  * We can then retry with the larger buffer.
1910                                  */
1911                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1912                                     !skb->len && !state->split &&
1913                                     cb->min_dump_alloc < 4096) {
1914                                         cb->min_dump_alloc = 4096;
1915                                         state->split_start = 0;
1916                                         rtnl_unlock();
1917                                         return 1;
1918                                 }
1919                                 idx--;
1920                                 break;
1921                         }
1922                 } while (state->split_start > 0);
1923                 break;
1924         }
1925         rtnl_unlock();
1926
1927         state->start = idx;
1928
1929         return skb->len;
1930 }
1931
1932 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1933 {
1934         kfree((void *)cb->args[0]);
1935         return 0;
1936 }
1937
1938 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1939 {
1940         struct sk_buff *msg;
1941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1942         struct nl80211_dump_wiphy_state state = {};
1943
1944         msg = nlmsg_new(4096, GFP_KERNEL);
1945         if (!msg)
1946                 return -ENOMEM;
1947
1948         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1949                                info->snd_portid, info->snd_seq, 0,
1950                                &state) < 0) {
1951                 nlmsg_free(msg);
1952                 return -ENOBUFS;
1953         }
1954
1955         return genlmsg_reply(msg, info);
1956 }
1957
1958 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1959         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1960         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1961         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1962         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1963         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1964 };
1965
1966 static int parse_txq_params(struct nlattr *tb[],
1967                             struct ieee80211_txq_params *txq_params)
1968 {
1969         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1970             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1971             !tb[NL80211_TXQ_ATTR_AIFS])
1972                 return -EINVAL;
1973
1974         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1975         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1976         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1977         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1978         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1979
1980         if (txq_params->ac >= NL80211_NUM_ACS)
1981                 return -EINVAL;
1982
1983         return 0;
1984 }
1985
1986 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1987 {
1988         /*
1989          * You can only set the channel explicitly for WDS interfaces,
1990          * all others have their channel managed via their respective
1991          * "establish a connection" command (connect, join, ...)
1992          *
1993          * For AP/GO and mesh mode, the channel can be set with the
1994          * channel userspace API, but is only stored and passed to the
1995          * low-level driver when the AP starts or the mesh is joined.
1996          * This is for backward compatibility, userspace can also give
1997          * the channel in the start-ap or join-mesh commands instead.
1998          *
1999          * Monitors are special as they are normally slaved to
2000          * whatever else is going on, so they have their own special
2001          * operation to set the monitor channel if possible.
2002          */
2003         return !wdev ||
2004                 wdev->iftype == NL80211_IFTYPE_AP ||
2005                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2006                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2007                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2008 }
2009
2010 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2011                                  struct genl_info *info,
2012                                  struct cfg80211_chan_def *chandef)
2013 {
2014         u32 control_freq;
2015
2016         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2017                 return -EINVAL;
2018
2019         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2020
2021         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2022         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2023         chandef->center_freq1 = control_freq;
2024         chandef->center_freq2 = 0;
2025
2026         /* Primary channel not allowed */
2027         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2028                 return -EINVAL;
2029
2030         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2031                 enum nl80211_channel_type chantype;
2032
2033                 chantype = nla_get_u32(
2034                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2035
2036                 switch (chantype) {
2037                 case NL80211_CHAN_NO_HT:
2038                 case NL80211_CHAN_HT20:
2039                 case NL80211_CHAN_HT40PLUS:
2040                 case NL80211_CHAN_HT40MINUS:
2041                         cfg80211_chandef_create(chandef, chandef->chan,
2042                                                 chantype);
2043                         break;
2044                 default:
2045                         return -EINVAL;
2046                 }
2047         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2048                 chandef->width =
2049                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2050                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2051                         chandef->center_freq1 =
2052                                 nla_get_u32(
2053                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2054                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2055                         chandef->center_freq2 =
2056                                 nla_get_u32(
2057                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2058         }
2059
2060         if (!cfg80211_chandef_valid(chandef))
2061                 return -EINVAL;
2062
2063         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2064                                      IEEE80211_CHAN_DISABLED))
2065                 return -EINVAL;
2066
2067         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2068              chandef->width == NL80211_CHAN_WIDTH_10) &&
2069             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2070                 return -EINVAL;
2071
2072         return 0;
2073 }
2074
2075 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2076                                  struct net_device *dev,
2077                                  struct genl_info *info)
2078 {
2079         struct cfg80211_chan_def chandef;
2080         int result;
2081         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2082         struct wireless_dev *wdev = NULL;
2083
2084         if (dev)
2085                 wdev = dev->ieee80211_ptr;
2086         if (!nl80211_can_set_dev_channel(wdev))
2087                 return -EOPNOTSUPP;
2088         if (wdev)
2089                 iftype = wdev->iftype;
2090
2091         result = nl80211_parse_chandef(rdev, info, &chandef);
2092         if (result)
2093                 return result;
2094
2095         switch (iftype) {
2096         case NL80211_IFTYPE_AP:
2097         case NL80211_IFTYPE_P2P_GO:
2098                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2099                                                    iftype)) {
2100                         result = -EINVAL;
2101                         break;
2102                 }
2103                 if (wdev->beacon_interval) {
2104                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2105                             !(rdev->wiphy.features &
2106                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2107                                 result = -EBUSY;
2108                                 break;
2109                         }
2110
2111                         /* Only allow dynamic channel width changes */
2112                         if (chandef.chan != wdev->preset_chandef.chan) {
2113                                 result = -EBUSY;
2114                                 break;
2115                         }
2116                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2117                         if (result)
2118                                 break;
2119                 }
2120                 wdev->preset_chandef = chandef;
2121                 result = 0;
2122                 break;
2123         case NL80211_IFTYPE_MESH_POINT:
2124                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2125                 break;
2126         case NL80211_IFTYPE_MONITOR:
2127                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2128                 break;
2129         default:
2130                 result = -EINVAL;
2131         }
2132
2133         return result;
2134 }
2135
2136 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2137 {
2138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2139         struct net_device *netdev = info->user_ptr[1];
2140
2141         return __nl80211_set_channel(rdev, netdev, info);
2142 }
2143
2144 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2145 {
2146         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2147         struct net_device *dev = info->user_ptr[1];
2148         struct wireless_dev *wdev = dev->ieee80211_ptr;
2149         const u8 *bssid;
2150
2151         if (!info->attrs[NL80211_ATTR_MAC])
2152                 return -EINVAL;
2153
2154         if (netif_running(dev))
2155                 return -EBUSY;
2156
2157         if (!rdev->ops->set_wds_peer)
2158                 return -EOPNOTSUPP;
2159
2160         if (wdev->iftype != NL80211_IFTYPE_WDS)
2161                 return -EOPNOTSUPP;
2162
2163         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2164         return rdev_set_wds_peer(rdev, dev, bssid);
2165 }
2166
2167 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2168 {
2169         struct cfg80211_registered_device *rdev;
2170         struct net_device *netdev = NULL;
2171         struct wireless_dev *wdev;
2172         int result = 0, rem_txq_params = 0;
2173         struct nlattr *nl_txq_params;
2174         u32 changed;
2175         u8 retry_short = 0, retry_long = 0;
2176         u32 frag_threshold = 0, rts_threshold = 0;
2177         u8 coverage_class = 0;
2178
2179         ASSERT_RTNL();
2180
2181         /*
2182          * Try to find the wiphy and netdev. Normally this
2183          * function shouldn't need the netdev, but this is
2184          * done for backward compatibility -- previously
2185          * setting the channel was done per wiphy, but now
2186          * it is per netdev. Previous userland like hostapd
2187          * also passed a netdev to set_wiphy, so that it is
2188          * possible to let that go to the right netdev!
2189          */
2190
2191         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2192                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2193
2194                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2195                 if (netdev && netdev->ieee80211_ptr)
2196                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2197                 else
2198                         netdev = NULL;
2199         }
2200
2201         if (!netdev) {
2202                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2203                                                   info->attrs);
2204                 if (IS_ERR(rdev))
2205                         return PTR_ERR(rdev);
2206                 wdev = NULL;
2207                 netdev = NULL;
2208                 result = 0;
2209         } else
2210                 wdev = netdev->ieee80211_ptr;
2211
2212         /*
2213          * end workaround code, by now the rdev is available
2214          * and locked, and wdev may or may not be NULL.
2215          */
2216
2217         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2218                 result = cfg80211_dev_rename(
2219                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2220
2221         if (result)
2222                 return result;
2223
2224         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2225                 struct ieee80211_txq_params txq_params;
2226                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2227
2228                 if (!rdev->ops->set_txq_params)
2229                         return -EOPNOTSUPP;
2230
2231                 if (!netdev)
2232                         return -EINVAL;
2233
2234                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2235                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2236                         return -EINVAL;
2237
2238                 if (!netif_running(netdev))
2239                         return -ENETDOWN;
2240
2241                 nla_for_each_nested(nl_txq_params,
2242                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2243                                     rem_txq_params) {
2244                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2245                                            nla_data(nl_txq_params),
2246                                            nla_len(nl_txq_params),
2247                                            txq_params_policy);
2248                         if (result)
2249                                 return result;
2250                         result = parse_txq_params(tb, &txq_params);
2251                         if (result)
2252                                 return result;
2253
2254                         result = rdev_set_txq_params(rdev, netdev,
2255                                                      &txq_params);
2256                         if (result)
2257                                 return result;
2258                 }
2259         }
2260
2261         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2262                 result = __nl80211_set_channel(
2263                         rdev,
2264                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2265                         info);
2266                 if (result)
2267                         return result;
2268         }
2269
2270         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2271                 struct wireless_dev *txp_wdev = wdev;
2272                 enum nl80211_tx_power_setting type;
2273                 int idx, mbm = 0;
2274
2275                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2276                         txp_wdev = NULL;
2277
2278                 if (!rdev->ops->set_tx_power)
2279                         return -EOPNOTSUPP;
2280
2281                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2282                 type = nla_get_u32(info->attrs[idx]);
2283
2284                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2285                     (type != NL80211_TX_POWER_AUTOMATIC))
2286                         return -EINVAL;
2287
2288                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2289                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2290                         mbm = nla_get_u32(info->attrs[idx]);
2291                 }
2292
2293                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2294                 if (result)
2295                         return result;
2296         }
2297
2298         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2299             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2300                 u32 tx_ant, rx_ant;
2301
2302                 if ((!rdev->wiphy.available_antennas_tx &&
2303                      !rdev->wiphy.available_antennas_rx) ||
2304                     !rdev->ops->set_antenna)
2305                         return -EOPNOTSUPP;
2306
2307                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2308                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2309
2310                 /* reject antenna configurations which don't match the
2311                  * available antenna masks, except for the "all" mask */
2312                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2313                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2314                         return -EINVAL;
2315
2316                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2317                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2318
2319                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2320                 if (result)
2321                         return result;
2322         }
2323
2324         changed = 0;
2325
2326         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2327                 retry_short = nla_get_u8(
2328                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2329                 if (retry_short == 0)
2330                         return -EINVAL;
2331
2332                 changed |= WIPHY_PARAM_RETRY_SHORT;
2333         }
2334
2335         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2336                 retry_long = nla_get_u8(
2337                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2338                 if (retry_long == 0)
2339                         return -EINVAL;
2340
2341                 changed |= WIPHY_PARAM_RETRY_LONG;
2342         }
2343
2344         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2345                 frag_threshold = nla_get_u32(
2346                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2347                 if (frag_threshold < 256)
2348                         return -EINVAL;
2349
2350                 if (frag_threshold != (u32) -1) {
2351                         /*
2352                          * Fragments (apart from the last one) are required to
2353                          * have even length. Make the fragmentation code
2354                          * simpler by stripping LSB should someone try to use
2355                          * odd threshold value.
2356                          */
2357                         frag_threshold &= ~0x1;
2358                 }
2359                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2360         }
2361
2362         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2363                 rts_threshold = nla_get_u32(
2364                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2365                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2366         }
2367
2368         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2369                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2370                         return -EINVAL;
2371
2372                 coverage_class = nla_get_u8(
2373                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2374                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2375         }
2376
2377         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2378                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2379                         return -EOPNOTSUPP;
2380
2381                 changed |= WIPHY_PARAM_DYN_ACK;
2382         }
2383
2384         if (changed) {
2385                 u8 old_retry_short, old_retry_long;
2386                 u32 old_frag_threshold, old_rts_threshold;
2387                 u8 old_coverage_class;
2388
2389                 if (!rdev->ops->set_wiphy_params)
2390                         return -EOPNOTSUPP;
2391
2392                 old_retry_short = rdev->wiphy.retry_short;
2393                 old_retry_long = rdev->wiphy.retry_long;
2394                 old_frag_threshold = rdev->wiphy.frag_threshold;
2395                 old_rts_threshold = rdev->wiphy.rts_threshold;
2396                 old_coverage_class = rdev->wiphy.coverage_class;
2397
2398                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2399                         rdev->wiphy.retry_short = retry_short;
2400                 if (changed & WIPHY_PARAM_RETRY_LONG)
2401                         rdev->wiphy.retry_long = retry_long;
2402                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2403                         rdev->wiphy.frag_threshold = frag_threshold;
2404                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2405                         rdev->wiphy.rts_threshold = rts_threshold;
2406                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2407                         rdev->wiphy.coverage_class = coverage_class;
2408
2409                 result = rdev_set_wiphy_params(rdev, changed);
2410                 if (result) {
2411                         rdev->wiphy.retry_short = old_retry_short;
2412                         rdev->wiphy.retry_long = old_retry_long;
2413                         rdev->wiphy.frag_threshold = old_frag_threshold;
2414                         rdev->wiphy.rts_threshold = old_rts_threshold;
2415                         rdev->wiphy.coverage_class = old_coverage_class;
2416                         return result;
2417                 }
2418         }
2419         return 0;
2420 }
2421
2422 static inline u64 wdev_id(struct wireless_dev *wdev)
2423 {
2424         return (u64)wdev->identifier |
2425                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2426 }
2427
2428 static int nl80211_send_chandef(struct sk_buff *msg,
2429                                 const struct cfg80211_chan_def *chandef)
2430 {
2431         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2432                 return -EINVAL;
2433
2434         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2435                         chandef->chan->center_freq))
2436                 return -ENOBUFS;
2437         switch (chandef->width) {
2438         case NL80211_CHAN_WIDTH_20_NOHT:
2439         case NL80211_CHAN_WIDTH_20:
2440         case NL80211_CHAN_WIDTH_40:
2441                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2442                                 cfg80211_get_chandef_type(chandef)))
2443                         return -ENOBUFS;
2444                 break;
2445         default:
2446                 break;
2447         }
2448         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2449                 return -ENOBUFS;
2450         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2451                 return -ENOBUFS;
2452         if (chandef->center_freq2 &&
2453             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2454                 return -ENOBUFS;
2455         return 0;
2456 }
2457
2458 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2459                               struct cfg80211_registered_device *rdev,
2460                               struct wireless_dev *wdev, bool removal)
2461 {
2462         struct net_device *dev = wdev->netdev;
2463         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2464         void *hdr;
2465
2466         if (removal)
2467                 cmd = NL80211_CMD_DEL_INTERFACE;
2468
2469         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2470         if (!hdr)
2471                 return -1;
2472
2473         if (dev &&
2474             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2475              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2476                 goto nla_put_failure;
2477
2478         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2479             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2480             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2481                               NL80211_ATTR_PAD) ||
2482             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2483             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2484                         rdev->devlist_generation ^
2485                         (cfg80211_rdev_list_generation << 2)))
2486                 goto nla_put_failure;
2487
2488         if (rdev->ops->get_channel) {
2489                 int ret;
2490                 struct cfg80211_chan_def chandef;
2491
2492                 ret = rdev_get_channel(rdev, wdev, &chandef);
2493                 if (ret == 0) {
2494                         if (nl80211_send_chandef(msg, &chandef))
2495                                 goto nla_put_failure;
2496                 }
2497         }
2498
2499         if (rdev->ops->get_tx_power) {
2500                 int dbm, ret;
2501
2502                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2503                 if (ret == 0 &&
2504                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2505                                 DBM_TO_MBM(dbm)))
2506                         goto nla_put_failure;
2507         }
2508
2509         if (wdev->ssid_len) {
2510                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2511                         goto nla_put_failure;
2512         }
2513
2514         genlmsg_end(msg, hdr);
2515         return 0;
2516
2517  nla_put_failure:
2518         genlmsg_cancel(msg, hdr);
2519         return -EMSGSIZE;
2520 }
2521
2522 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2523 {
2524         int wp_idx = 0;
2525         int if_idx = 0;
2526         int wp_start = cb->args[0];
2527         int if_start = cb->args[1];
2528         int filter_wiphy = -1;
2529         struct cfg80211_registered_device *rdev;
2530         struct wireless_dev *wdev;
2531
2532         rtnl_lock();
2533         if (!cb->args[2]) {
2534                 struct nl80211_dump_wiphy_state state = {
2535                         .filter_wiphy = -1,
2536                 };
2537                 int ret;
2538
2539                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2540                 if (ret)
2541                         return ret;
2542
2543                 filter_wiphy = state.filter_wiphy;
2544
2545                 /*
2546                  * if filtering, set cb->args[2] to +1 since 0 is the default
2547                  * value needed to determine that parsing is necessary.
2548                  */
2549                 if (filter_wiphy >= 0)
2550                         cb->args[2] = filter_wiphy + 1;
2551                 else
2552                         cb->args[2] = -1;
2553         } else if (cb->args[2] > 0) {
2554                 filter_wiphy = cb->args[2] - 1;
2555         }
2556
2557         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2558                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2559                         continue;
2560                 if (wp_idx < wp_start) {
2561                         wp_idx++;
2562                         continue;
2563                 }
2564
2565                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2566                         continue;
2567
2568                 if_idx = 0;
2569
2570                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2571                         if (if_idx < if_start) {
2572                                 if_idx++;
2573                                 continue;
2574                         }
2575                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2576                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2577                                                rdev, wdev, false) < 0) {
2578                                 goto out;
2579                         }
2580                         if_idx++;
2581                 }
2582
2583                 wp_idx++;
2584         }
2585  out:
2586         rtnl_unlock();
2587
2588         cb->args[0] = wp_idx;
2589         cb->args[1] = if_idx;
2590
2591         return skb->len;
2592 }
2593
2594 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2595 {
2596         struct sk_buff *msg;
2597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2598         struct wireless_dev *wdev = info->user_ptr[1];
2599
2600         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2601         if (!msg)
2602                 return -ENOMEM;
2603
2604         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2605                                rdev, wdev, false) < 0) {
2606                 nlmsg_free(msg);
2607                 return -ENOBUFS;
2608         }
2609
2610         return genlmsg_reply(msg, info);
2611 }
2612
2613 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2614         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2615         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2616         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2617         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2618         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2619         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2620 };
2621
2622 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2623 {
2624         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2625         int flag;
2626
2627         *mntrflags = 0;
2628
2629         if (!nla)
2630                 return -EINVAL;
2631
2632         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2633                              nla, mntr_flags_policy))
2634                 return -EINVAL;
2635
2636         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2637                 if (flags[flag])
2638                         *mntrflags |= (1<<flag);
2639
2640         return 0;
2641 }
2642
2643 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2644                                struct net_device *netdev, u8 use_4addr,
2645                                enum nl80211_iftype iftype)
2646 {
2647         if (!use_4addr) {
2648                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2649                         return -EBUSY;
2650                 return 0;
2651         }
2652
2653         switch (iftype) {
2654         case NL80211_IFTYPE_AP_VLAN:
2655                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2656                         return 0;
2657                 break;
2658         case NL80211_IFTYPE_STATION:
2659                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2660                         return 0;
2661                 break;
2662         default:
2663                 break;
2664         }
2665
2666         return -EOPNOTSUPP;
2667 }
2668
2669 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2670 {
2671         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2672         struct vif_params params;
2673         int err;
2674         enum nl80211_iftype otype, ntype;
2675         struct net_device *dev = info->user_ptr[1];
2676         u32 _flags, *flags = NULL;
2677         bool change = false;
2678
2679         memset(&params, 0, sizeof(params));
2680
2681         otype = ntype = dev->ieee80211_ptr->iftype;
2682
2683         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2684                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2685                 if (otype != ntype)
2686                         change = true;
2687                 if (ntype > NL80211_IFTYPE_MAX)
2688                         return -EINVAL;
2689         }
2690
2691         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2692                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2693
2694                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2695                         return -EINVAL;
2696                 if (netif_running(dev))
2697                         return -EBUSY;
2698
2699                 wdev_lock(wdev);
2700                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2701                              IEEE80211_MAX_MESH_ID_LEN);
2702                 wdev->mesh_id_up_len =
2703                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2704                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2705                        wdev->mesh_id_up_len);
2706                 wdev_unlock(wdev);
2707         }
2708
2709         if (info->attrs[NL80211_ATTR_4ADDR]) {
2710                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2711                 change = true;
2712                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2713                 if (err)
2714                         return err;
2715         } else {
2716                 params.use_4addr = -1;
2717         }
2718
2719         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2720                 if (ntype != NL80211_IFTYPE_MONITOR)
2721                         return -EINVAL;
2722                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2723                                           &_flags);
2724                 if (err)
2725                         return err;
2726
2727                 flags = &_flags;
2728                 change = true;
2729         }
2730
2731         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2732                 const u8 *mumimo_groups;
2733                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2734
2735                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2736                         return -EOPNOTSUPP;
2737
2738                 mumimo_groups =
2739                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2740
2741                 /* bits 0 and 63 are reserved and must be zero */
2742                 if ((mumimo_groups[0] & BIT(7)) ||
2743                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
2744                         return -EINVAL;
2745
2746                 memcpy(params.vht_mumimo_groups, mumimo_groups,
2747                        VHT_MUMIMO_GROUPS_DATA_LEN);
2748                 change = true;
2749         }
2750
2751         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2752                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2753
2754                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2755                         return -EOPNOTSUPP;
2756
2757                 nla_memcpy(params.macaddr,
2758                            info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR],
2759                            ETH_ALEN);
2760                 change = true;
2761         }
2762
2763         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2764             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2765                 return -EOPNOTSUPP;
2766
2767         if (change)
2768                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2769         else
2770                 err = 0;
2771
2772         if (!err && params.use_4addr != -1)
2773                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2774
2775         return err;
2776 }
2777
2778 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2779 {
2780         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2781         struct vif_params params;
2782         struct wireless_dev *wdev;
2783         struct sk_buff *msg;
2784         int err;
2785         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2786         u32 flags;
2787
2788         /* to avoid failing a new interface creation due to pending removal */
2789         cfg80211_destroy_ifaces(rdev);
2790
2791         memset(&params, 0, sizeof(params));
2792
2793         if (!info->attrs[NL80211_ATTR_IFNAME])
2794                 return -EINVAL;
2795
2796         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2797                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2798                 if (type > NL80211_IFTYPE_MAX)
2799                         return -EINVAL;
2800         }
2801
2802         if (!rdev->ops->add_virtual_intf ||
2803             !(rdev->wiphy.interface_modes & (1 << type)))
2804                 return -EOPNOTSUPP;
2805
2806         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2807              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2808             info->attrs[NL80211_ATTR_MAC]) {
2809                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2810                            ETH_ALEN);
2811                 if (!is_valid_ether_addr(params.macaddr))
2812                         return -EADDRNOTAVAIL;
2813         }
2814
2815         if (info->attrs[NL80211_ATTR_4ADDR]) {
2816                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2817                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2818                 if (err)
2819                         return err;
2820         }
2821
2822         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2823                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2824                                   &flags);
2825
2826         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2827             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2828                 return -EOPNOTSUPP;
2829
2830         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2831         if (!msg)
2832                 return -ENOMEM;
2833
2834         wdev = rdev_add_virtual_intf(rdev,
2835                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2836                                 NET_NAME_USER, type, err ? NULL : &flags,
2837                                 &params);
2838         if (WARN_ON(!wdev)) {
2839                 nlmsg_free(msg);
2840                 return -EPROTO;
2841         } else if (IS_ERR(wdev)) {
2842                 nlmsg_free(msg);
2843                 return PTR_ERR(wdev);
2844         }
2845
2846         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2847                 wdev->owner_nlportid = info->snd_portid;
2848
2849         switch (type) {
2850         case NL80211_IFTYPE_MESH_POINT:
2851                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2852                         break;
2853                 wdev_lock(wdev);
2854                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2855                              IEEE80211_MAX_MESH_ID_LEN);
2856                 wdev->mesh_id_up_len =
2857                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2858                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2859                        wdev->mesh_id_up_len);
2860                 wdev_unlock(wdev);
2861                 break;
2862         case NL80211_IFTYPE_P2P_DEVICE:
2863                 /*
2864                  * P2P Device doesn't have a netdev, so doesn't go
2865                  * through the netdev notifier and must be added here
2866                  */
2867                 mutex_init(&wdev->mtx);
2868                 INIT_LIST_HEAD(&wdev->event_list);
2869                 spin_lock_init(&wdev->event_lock);
2870                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2871                 spin_lock_init(&wdev->mgmt_registrations_lock);
2872
2873                 wdev->identifier = ++rdev->wdev_id;
2874                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2875                 rdev->devlist_generation++;
2876                 break;
2877         default:
2878                 break;
2879         }
2880
2881         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2882                                rdev, wdev, false) < 0) {
2883                 nlmsg_free(msg);
2884                 return -ENOBUFS;
2885         }
2886
2887         /*
2888          * For wdevs which have no associated netdev object (e.g. of type
2889          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
2890          * For all other types, the event will be generated from the
2891          * netdev notifier
2892          */
2893         if (!wdev->netdev)
2894                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
2895
2896         return genlmsg_reply(msg, info);
2897 }
2898
2899 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2900 {
2901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2902         struct wireless_dev *wdev = info->user_ptr[1];
2903
2904         if (!rdev->ops->del_virtual_intf)
2905                 return -EOPNOTSUPP;
2906
2907         /*
2908          * If we remove a wireless device without a netdev then clear
2909          * user_ptr[1] so that nl80211_post_doit won't dereference it
2910          * to check if it needs to do dev_put(). Otherwise it crashes
2911          * since the wdev has been freed, unlike with a netdev where
2912          * we need the dev_put() for the netdev to really be freed.
2913          */
2914         if (!wdev->netdev)
2915                 info->user_ptr[1] = NULL;
2916
2917         return rdev_del_virtual_intf(rdev, wdev);
2918 }
2919
2920 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2921 {
2922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2923         struct net_device *dev = info->user_ptr[1];
2924         u16 noack_map;
2925
2926         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2927                 return -EINVAL;
2928
2929         if (!rdev->ops->set_noack_map)
2930                 return -EOPNOTSUPP;
2931
2932         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2933
2934         return rdev_set_noack_map(rdev, dev, noack_map);
2935 }
2936
2937 struct get_key_cookie {
2938         struct sk_buff *msg;
2939         int error;
2940         int idx;
2941 };
2942
2943 static void get_key_callback(void *c, struct key_params *params)
2944 {
2945         struct nlattr *key;
2946         struct get_key_cookie *cookie = c;
2947
2948         if ((params->key &&
2949              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2950                      params->key_len, params->key)) ||
2951             (params->seq &&
2952              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2953                      params->seq_len, params->seq)) ||
2954             (params->cipher &&
2955              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2956                          params->cipher)))
2957                 goto nla_put_failure;
2958
2959         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2960         if (!key)
2961                 goto nla_put_failure;
2962
2963         if ((params->key &&
2964              nla_put(cookie->msg, NL80211_KEY_DATA,
2965                      params->key_len, params->key)) ||
2966             (params->seq &&
2967              nla_put(cookie->msg, NL80211_KEY_SEQ,
2968                      params->seq_len, params->seq)) ||
2969             (params->cipher &&
2970              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2971                          params->cipher)))
2972                 goto nla_put_failure;
2973
2974         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2975                 goto nla_put_failure;
2976
2977         nla_nest_end(cookie->msg, key);
2978
2979         return;
2980  nla_put_failure:
2981         cookie->error = 1;
2982 }
2983
2984 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2985 {
2986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2987         int err;
2988         struct net_device *dev = info->user_ptr[1];
2989         u8 key_idx = 0;
2990         const u8 *mac_addr = NULL;
2991         bool pairwise;
2992         struct get_key_cookie cookie = {
2993                 .error = 0,
2994         };
2995         void *hdr;
2996         struct sk_buff *msg;
2997
2998         if (info->attrs[NL80211_ATTR_KEY_IDX])
2999                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3000
3001         if (key_idx > 5)
3002                 return -EINVAL;
3003
3004         if (info->attrs[NL80211_ATTR_MAC])
3005                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3006
3007         pairwise = !!mac_addr;
3008         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3009                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3010
3011                 if (kt >= NUM_NL80211_KEYTYPES)
3012                         return -EINVAL;
3013                 if (kt != NL80211_KEYTYPE_GROUP &&
3014                     kt != NL80211_KEYTYPE_PAIRWISE)
3015                         return -EINVAL;
3016                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3017         }
3018
3019         if (!rdev->ops->get_key)
3020                 return -EOPNOTSUPP;
3021
3022         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3023                 return -ENOENT;
3024
3025         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3026         if (!msg)
3027                 return -ENOMEM;
3028
3029         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3030                              NL80211_CMD_NEW_KEY);
3031         if (!hdr)
3032                 goto nla_put_failure;
3033
3034         cookie.msg = msg;
3035         cookie.idx = key_idx;
3036
3037         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3038             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3039                 goto nla_put_failure;
3040         if (mac_addr &&
3041             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3042                 goto nla_put_failure;
3043
3044         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3045                            get_key_callback);
3046
3047         if (err)
3048                 goto free_msg;
3049
3050         if (cookie.error)
3051                 goto nla_put_failure;
3052
3053         genlmsg_end(msg, hdr);
3054         return genlmsg_reply(msg, info);
3055
3056  nla_put_failure:
3057         err = -ENOBUFS;
3058  free_msg:
3059         nlmsg_free(msg);
3060         return err;
3061 }
3062
3063 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3064 {
3065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3066         struct key_parse key;
3067         int err;
3068         struct net_device *dev = info->user_ptr[1];
3069
3070         err = nl80211_parse_key(info, &key);
3071         if (err)
3072                 return err;
3073
3074         if (key.idx < 0)
3075                 return -EINVAL;
3076
3077         /* only support setting default key */
3078         if (!key.def && !key.defmgmt)
3079                 return -EINVAL;
3080
3081         wdev_lock(dev->ieee80211_ptr);
3082
3083         if (key.def) {
3084                 if (!rdev->ops->set_default_key) {
3085                         err = -EOPNOTSUPP;
3086                         goto out;
3087                 }
3088
3089                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3090                 if (err)
3091                         goto out;
3092
3093                 err = rdev_set_default_key(rdev, dev, key.idx,
3094                                                  key.def_uni, key.def_multi);
3095
3096                 if (err)
3097                         goto out;
3098
3099 #ifdef CONFIG_CFG80211_WEXT
3100                 dev->ieee80211_ptr->wext.default_key = key.idx;
3101 #endif
3102         } else {
3103                 if (key.def_uni || !key.def_multi) {
3104                         err = -EINVAL;
3105                         goto out;
3106                 }
3107
3108                 if (!rdev->ops->set_default_mgmt_key) {
3109                         err = -EOPNOTSUPP;
3110                         goto out;
3111                 }
3112
3113                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3114                 if (err)
3115                         goto out;
3116
3117                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3118                 if (err)
3119                         goto out;
3120
3121 #ifdef CONFIG_CFG80211_WEXT
3122                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3123 #endif
3124         }
3125
3126  out:
3127         wdev_unlock(dev->ieee80211_ptr);
3128
3129         return err;
3130 }
3131
3132 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3133 {
3134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3135         int err;
3136         struct net_device *dev = info->user_ptr[1];
3137         struct key_parse key;
3138         const u8 *mac_addr = NULL;
3139
3140         err = nl80211_parse_key(info, &key);
3141         if (err)
3142                 return err;
3143
3144         if (!key.p.key)
3145                 return -EINVAL;
3146
3147         if (info->attrs[NL80211_ATTR_MAC])
3148                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3149
3150         if (key.type == -1) {
3151                 if (mac_addr)
3152                         key.type = NL80211_KEYTYPE_PAIRWISE;
3153                 else
3154                         key.type = NL80211_KEYTYPE_GROUP;
3155         }
3156
3157         /* for now */
3158         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3159             key.type != NL80211_KEYTYPE_GROUP)
3160                 return -EINVAL;
3161
3162         if (!rdev->ops->add_key)
3163                 return -EOPNOTSUPP;
3164
3165         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3166                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3167                                            mac_addr))
3168                 return -EINVAL;
3169
3170         wdev_lock(dev->ieee80211_ptr);
3171         err = nl80211_key_allowed(dev->ieee80211_ptr);
3172         if (!err)
3173                 err = rdev_add_key(rdev, dev, key.idx,
3174                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3175                                     mac_addr, &key.p);
3176         wdev_unlock(dev->ieee80211_ptr);
3177
3178         return err;
3179 }
3180
3181 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3182 {
3183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3184         int err;
3185         struct net_device *dev = info->user_ptr[1];
3186         u8 *mac_addr = NULL;
3187         struct key_parse key;
3188
3189         err = nl80211_parse_key(info, &key);
3190         if (err)
3191                 return err;
3192
3193         if (info->attrs[NL80211_ATTR_MAC])
3194                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3195
3196         if (key.type == -1) {
3197                 if (mac_addr)
3198                         key.type = NL80211_KEYTYPE_PAIRWISE;
3199                 else
3200                         key.type = NL80211_KEYTYPE_GROUP;
3201         }
3202
3203         /* for now */
3204         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3205             key.type != NL80211_KEYTYPE_GROUP)
3206                 return -EINVAL;
3207
3208         if (!rdev->ops->del_key)
3209                 return -EOPNOTSUPP;
3210
3211         wdev_lock(dev->ieee80211_ptr);
3212         err = nl80211_key_allowed(dev->ieee80211_ptr);
3213
3214         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3215             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3216                 err = -ENOENT;
3217
3218         if (!err)
3219                 err = rdev_del_key(rdev, dev, key.idx,
3220                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3221                                    mac_addr);
3222
3223 #ifdef CONFIG_CFG80211_WEXT
3224         if (!err) {
3225                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3226                         dev->ieee80211_ptr->wext.default_key = -1;
3227                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3228                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3229         }
3230 #endif
3231         wdev_unlock(dev->ieee80211_ptr);
3232
3233         return err;
3234 }
3235
3236 /* This function returns an error or the number of nested attributes */
3237 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3238 {
3239         struct nlattr *attr;
3240         int n_entries = 0, tmp;
3241
3242         nla_for_each_nested(attr, nl_attr, tmp) {
3243                 if (nla_len(attr) != ETH_ALEN)
3244                         return -EINVAL;
3245
3246                 n_entries++;
3247         }
3248
3249         return n_entries;
3250 }
3251
3252 /*
3253  * This function parses ACL information and allocates memory for ACL data.
3254  * On successful return, the calling function is responsible to free the
3255  * ACL buffer returned by this function.
3256  */
3257 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3258                                                 struct genl_info *info)
3259 {
3260         enum nl80211_acl_policy acl_policy;
3261         struct nlattr *attr;
3262         struct cfg80211_acl_data *acl;
3263         int i = 0, n_entries, tmp;
3264
3265         if (!wiphy->max_acl_mac_addrs)
3266                 return ERR_PTR(-EOPNOTSUPP);
3267
3268         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3269                 return ERR_PTR(-EINVAL);
3270
3271         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3272         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3273             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3274                 return ERR_PTR(-EINVAL);
3275
3276         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3277                 return ERR_PTR(-EINVAL);
3278
3279         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3280         if (n_entries < 0)
3281                 return ERR_PTR(n_entries);
3282
3283         if (n_entries > wiphy->max_acl_mac_addrs)
3284                 return ERR_PTR(-ENOTSUPP);
3285
3286         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3287                       GFP_KERNEL);
3288         if (!acl)
3289                 return ERR_PTR(-ENOMEM);
3290
3291         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3292                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3293                 i++;
3294         }
3295
3296         acl->n_acl_entries = n_entries;
3297         acl->acl_policy = acl_policy;
3298
3299         return acl;
3300 }
3301
3302 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3303 {
3304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3305         struct net_device *dev = info->user_ptr[1];
3306         struct cfg80211_acl_data *acl;
3307         int err;
3308
3309         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3310             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3311                 return -EOPNOTSUPP;
3312
3313         if (!dev->ieee80211_ptr->beacon_interval)
3314                 return -EINVAL;
3315
3316         acl = parse_acl_data(&rdev->wiphy, info);
3317         if (IS_ERR(acl))
3318                 return PTR_ERR(acl);
3319
3320         err = rdev_set_mac_acl(rdev, dev, acl);
3321
3322         kfree(acl);
3323
3324         return err;
3325 }
3326
3327 static int nl80211_parse_beacon(struct nlattr *attrs[],
3328                                 struct cfg80211_beacon_data *bcn)
3329 {
3330         bool haveinfo = false;
3331
3332         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3333             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3334             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3335             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3336                 return -EINVAL;
3337
3338         memset(bcn, 0, sizeof(*bcn));
3339
3340         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3341                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3342                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3343                 if (!bcn->head_len)
3344                         return -EINVAL;
3345                 haveinfo = true;
3346         }
3347
3348         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3349                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3350                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3351                 haveinfo = true;
3352         }
3353
3354         if (!haveinfo)
3355                 return -EINVAL;
3356
3357         if (attrs[NL80211_ATTR_IE]) {
3358                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3359                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3360         }
3361
3362         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3363                 bcn->proberesp_ies =
3364                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3365                 bcn->proberesp_ies_len =
3366                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3367         }
3368
3369         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3370                 bcn->assocresp_ies =
3371                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3372                 bcn->assocresp_ies_len =
3373                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3374         }
3375
3376         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3377                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3378                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3379         }
3380
3381         return 0;
3382 }
3383
3384 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3385                                    struct cfg80211_ap_settings *params)
3386 {
3387         struct wireless_dev *wdev;
3388         bool ret = false;
3389
3390         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3391                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3392                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3393                         continue;
3394
3395                 if (!wdev->preset_chandef.chan)
3396                         continue;
3397
3398                 params->chandef = wdev->preset_chandef;
3399                 ret = true;
3400                 break;
3401         }
3402
3403         return ret;
3404 }
3405
3406 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3407                                     enum nl80211_auth_type auth_type,
3408                                     enum nl80211_commands cmd)
3409 {
3410         if (auth_type > NL80211_AUTHTYPE_MAX)
3411                 return false;
3412
3413         switch (cmd) {
3414         case NL80211_CMD_AUTHENTICATE:
3415                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3416                     auth_type == NL80211_AUTHTYPE_SAE)
3417                         return false;
3418                 return true;
3419         case NL80211_CMD_CONNECT:
3420         case NL80211_CMD_START_AP:
3421                 /* SAE not supported yet */
3422                 if (auth_type == NL80211_AUTHTYPE_SAE)
3423                         return false;
3424                 return true;
3425         default:
3426                 return false;
3427         }
3428 }
3429
3430 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3431 {
3432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3433         struct net_device *dev = info->user_ptr[1];
3434         struct wireless_dev *wdev = dev->ieee80211_ptr;
3435         struct cfg80211_ap_settings params;
3436         int err;
3437
3438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3439             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3440                 return -EOPNOTSUPP;
3441
3442         if (!rdev->ops->start_ap)
3443                 return -EOPNOTSUPP;
3444
3445         if (wdev->beacon_interval)
3446                 return -EALREADY;
3447
3448         memset(&params, 0, sizeof(params));
3449
3450         /* these are required for START_AP */
3451         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3452             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3453             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3454                 return -EINVAL;
3455
3456         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3457         if (err)
3458                 return err;
3459
3460         params.beacon_interval =
3461                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3462         params.dtim_period =
3463                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3464
3465         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3466         if (err)
3467                 return err;
3468
3469         /*
3470          * In theory, some of these attributes should be required here
3471          * but since they were not used when the command was originally
3472          * added, keep them optional for old user space programs to let
3473          * them continue to work with drivers that do not need the
3474          * additional information -- drivers must check!
3475          */
3476         if (info->attrs[NL80211_ATTR_SSID]) {
3477                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3478                 params.ssid_len =
3479                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3480                 if (params.ssid_len == 0 ||
3481                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3482                         return -EINVAL;
3483         }
3484
3485         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3486                 params.hidden_ssid = nla_get_u32(
3487                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3488                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3489                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3490                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3491                         return -EINVAL;
3492         }
3493
3494         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3495
3496         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3497                 params.auth_type = nla_get_u32(
3498                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3499                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3500                                              NL80211_CMD_START_AP))
3501                         return -EINVAL;
3502         } else
3503                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3504
3505         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3506                                       NL80211_MAX_NR_CIPHER_SUITES);
3507         if (err)
3508                 return err;
3509
3510         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3511                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3512                         return -EOPNOTSUPP;
3513                 params.inactivity_timeout = nla_get_u16(
3514                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3515         }
3516
3517         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3518                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3519                         return -EINVAL;
3520                 params.p2p_ctwindow =
3521                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3522                 if (params.p2p_ctwindow > 127)
3523                         return -EINVAL;
3524                 if (params.p2p_ctwindow != 0 &&
3525                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3526                         return -EINVAL;
3527         }
3528
3529         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3530                 u8 tmp;
3531
3532                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3533                         return -EINVAL;
3534                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3535                 if (tmp > 1)
3536                         return -EINVAL;
3537                 params.p2p_opp_ps = tmp;
3538                 if (params.p2p_opp_ps != 0 &&
3539                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3540                         return -EINVAL;
3541         }
3542
3543         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3544                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3545                 if (err)
3546                         return err;
3547         } else if (wdev->preset_chandef.chan) {
3548                 params.chandef = wdev->preset_chandef;
3549         } else if (!nl80211_get_ap_channel(rdev, &params))
3550                 return -EINVAL;
3551
3552         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3553                                            wdev->iftype))
3554                 return -EINVAL;
3555
3556         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3557                 params.smps_mode =
3558                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3559                 switch (params.smps_mode) {
3560                 case NL80211_SMPS_OFF:
3561                         break;
3562                 case NL80211_SMPS_STATIC:
3563                         if (!(rdev->wiphy.features &
3564                               NL80211_FEATURE_STATIC_SMPS))
3565                                 return -EINVAL;
3566                         break;
3567                 case NL80211_SMPS_DYNAMIC:
3568                         if (!(rdev->wiphy.features &
3569                               NL80211_FEATURE_DYNAMIC_SMPS))
3570                                 return -EINVAL;
3571                         break;
3572                 default:
3573                         return -EINVAL;
3574                 }
3575         } else {
3576                 params.smps_mode = NL80211_SMPS_OFF;
3577         }
3578
3579         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3580         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3581                 return -EOPNOTSUPP;
3582
3583         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3584                 params.acl = parse_acl_data(&rdev->wiphy, info);
3585                 if (IS_ERR(params.acl))
3586                         return PTR_ERR(params.acl);
3587         }
3588
3589         wdev_lock(wdev);
3590         err = rdev_start_ap(rdev, dev, &params);
3591         if (!err) {
3592                 wdev->preset_chandef = params.chandef;
3593                 wdev->beacon_interval = params.beacon_interval;
3594                 wdev->chandef = params.chandef;
3595                 wdev->ssid_len = params.ssid_len;
3596                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3597         }
3598         wdev_unlock(wdev);
3599
3600         kfree(params.acl);
3601
3602         return err;
3603 }
3604
3605 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3606 {
3607         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3608         struct net_device *dev = info->user_ptr[1];
3609         struct wireless_dev *wdev = dev->ieee80211_ptr;
3610         struct cfg80211_beacon_data params;
3611         int err;
3612
3613         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3614             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3615                 return -EOPNOTSUPP;
3616
3617         if (!rdev->ops->change_beacon)
3618                 return -EOPNOTSUPP;
3619
3620         if (!wdev->beacon_interval)
3621                 return -EINVAL;
3622
3623         err = nl80211_parse_beacon(info->attrs, &params);
3624         if (err)
3625                 return err;
3626
3627         wdev_lock(wdev);
3628         err = rdev_change_beacon(rdev, dev, &params);
3629         wdev_unlock(wdev);
3630
3631         return err;
3632 }
3633
3634 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3635 {
3636         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3637         struct net_device *dev = info->user_ptr[1];
3638
3639         return cfg80211_stop_ap(rdev, dev, false);
3640 }
3641
3642 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3643         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3644         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3645         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3646         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3647         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3648         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3649 };
3650
3651 static int parse_station_flags(struct genl_info *info,
3652                                enum nl80211_iftype iftype,
3653                                struct station_parameters *params)
3654 {
3655         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3656         struct nlattr *nla;
3657         int flag;
3658
3659         /*
3660          * Try parsing the new attribute first so userspace
3661          * can specify both for older kernels.
3662          */
3663         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3664         if (nla) {
3665                 struct nl80211_sta_flag_update *sta_flags;
3666
3667                 sta_flags = nla_data(nla);
3668                 params->sta_flags_mask = sta_flags->mask;
3669                 params->sta_flags_set = sta_flags->set;
3670                 params->sta_flags_set &= params->sta_flags_mask;
3671                 if ((params->sta_flags_mask |
3672                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3673                         return -EINVAL;
3674                 return 0;
3675         }
3676
3677         /* if present, parse the old attribute */
3678
3679         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3680         if (!nla)
3681                 return 0;
3682
3683         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3684                              nla, sta_flags_policy))
3685                 return -EINVAL;
3686
3687         /*
3688          * Only allow certain flags for interface types so that
3689          * other attributes are silently ignored. Remember that
3690          * this is backward compatibility code with old userspace
3691          * and shouldn't be hit in other cases anyway.
3692          */
3693         switch (iftype) {
3694         case NL80211_IFTYPE_AP:
3695         case NL80211_IFTYPE_AP_VLAN:
3696         case NL80211_IFTYPE_P2P_GO:
3697                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3698                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3699                                          BIT(NL80211_STA_FLAG_WME) |
3700                                          BIT(NL80211_STA_FLAG_MFP);
3701                 break;
3702         case NL80211_IFTYPE_P2P_CLIENT:
3703         case NL80211_IFTYPE_STATION:
3704                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3705                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3706                 break;
3707         case NL80211_IFTYPE_MESH_POINT:
3708                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3709                                          BIT(NL80211_STA_FLAG_MFP) |
3710                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3711         default:
3712                 return -EINVAL;
3713         }
3714
3715         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3716                 if (flags[flag]) {
3717                         params->sta_flags_set |= (1<<flag);
3718
3719                         /* no longer support new API additions in old API */
3720                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3721                                 return -EINVAL;
3722                 }
3723         }
3724
3725         return 0;
3726 }
3727
3728 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3729                                  int attr)
3730 {
3731         struct nlattr *rate;
3732         u32 bitrate;
3733         u16 bitrate_compat;
3734         enum nl80211_attrs rate_flg;
3735
3736         rate = nla_nest_start(msg, attr);
3737         if (!rate)
3738                 return false;
3739
3740         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3741         bitrate = cfg80211_calculate_bitrate(info);
3742         /* report 16-bit bitrate only if we can */
3743         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3744         if (bitrate > 0 &&
3745             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3746                 return false;
3747         if (bitrate_compat > 0 &&
3748             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3749                 return false;
3750
3751         switch (info->bw) {
3752         case RATE_INFO_BW_5:
3753                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3754                 break;
3755         case RATE_INFO_BW_10:
3756                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3757                 break;
3758         default:
3759                 WARN_ON(1);
3760                 /* fall through */
3761         case RATE_INFO_BW_20:
3762                 rate_flg = 0;
3763                 break;
3764         case RATE_INFO_BW_40:
3765                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3766                 break;
3767         case RATE_INFO_BW_80:
3768                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3769                 break;
3770         case RATE_INFO_BW_160:
3771                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3772                 break;
3773         }
3774
3775         if (rate_flg && nla_put_flag(msg, rate_flg))
3776                 return false;
3777
3778         if (info->flags & RATE_INFO_FLAGS_MCS) {
3779                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3780                         return false;
3781                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3782                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3783                         return false;
3784         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3785                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3786                         return false;
3787                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3788                         return false;
3789                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3790                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3791                         return false;
3792         }
3793
3794         nla_nest_end(msg, rate);
3795         return true;
3796 }
3797
3798 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3799                                int id)
3800 {
3801         void *attr;
3802         int i = 0;
3803
3804         if (!mask)
3805                 return true;
3806
3807         attr = nla_nest_start(msg, id);
3808         if (!attr)
3809                 return false;
3810
3811         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3812                 if (!(mask & BIT(i)))
3813                         continue;
3814
3815                 if (nla_put_u8(msg, i, signal[i]))
3816                         return false;
3817         }
3818
3819         nla_nest_end(msg, attr);
3820
3821         return true;
3822 }
3823
3824 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3825                                 u32 seq, int flags,
3826                                 struct cfg80211_registered_device *rdev,
3827                                 struct net_device *dev,
3828                                 const u8 *mac_addr, struct station_info *sinfo)
3829 {
3830         void *hdr;
3831         struct nlattr *sinfoattr, *bss_param;
3832
3833         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3834         if (!hdr)
3835                 return -1;
3836
3837         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3838             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3839             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3840                 goto nla_put_failure;
3841
3842         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3843         if (!sinfoattr)
3844                 goto nla_put_failure;
3845
3846 #define PUT_SINFO(attr, memb, type) do {                                \
3847         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
3848         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
3849             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3850                              sinfo->memb))                              \
3851                 goto nla_put_failure;                                   \
3852         } while (0)
3853 #define PUT_SINFO_U64(attr, memb) do {                                  \
3854         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
3855             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
3856                               sinfo->memb, NL80211_STA_INFO_PAD))       \
3857                 goto nla_put_failure;                                   \
3858         } while (0)
3859
3860         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3861         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3862
3863         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3864                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3865             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3866                         (u32)sinfo->rx_bytes))
3867                 goto nla_put_failure;
3868
3869         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3870                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3871             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3872                         (u32)sinfo->tx_bytes))
3873                 goto nla_put_failure;
3874
3875         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
3876         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
3877         PUT_SINFO(LLID, llid, u16);
3878         PUT_SINFO(PLID, plid, u16);
3879         PUT_SINFO(PLINK_STATE, plink_state, u8);
3880         PUT_SINFO_U64(RX_DURATION, rx_duration);
3881
3882         switch (rdev->wiphy.signal_type) {
3883         case CFG80211_SIGNAL_TYPE_MBM:
3884                 PUT_SINFO(SIGNAL, signal, u8);
3885                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3886                 break;
3887         default:
3888                 break;
3889         }
3890         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3891                 if (!nl80211_put_signal(msg, sinfo->chains,
3892                                         sinfo->chain_signal,
3893                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3894                         goto nla_put_failure;
3895         }
3896         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3897                 if (!nl80211_put_signal(msg, sinfo->chains,
3898                                         sinfo->chain_signal_avg,
3899                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3900                         goto nla_put_failure;
3901         }
3902         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3903                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3904                                           NL80211_STA_INFO_TX_BITRATE))
3905                         goto nla_put_failure;
3906         }
3907         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3908                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3909                                           NL80211_STA_INFO_RX_BITRATE))
3910                         goto nla_put_failure;
3911         }
3912
3913         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3914         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3915         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3916         PUT_SINFO(TX_FAILED, tx_failed, u32);
3917         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3918         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3919         PUT_SINFO(LOCAL_PM, local_pm, u32);
3920         PUT_SINFO(PEER_PM, peer_pm, u32);
3921         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3922
3923         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3924                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3925                 if (!bss_param)
3926                         goto nla_put_failure;
3927
3928                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3929                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3930                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3931                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3932                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3933                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3934                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3935                                sinfo->bss_param.dtim_period) ||
3936                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3937                                 sinfo->bss_param.beacon_interval))
3938                         goto nla_put_failure;
3939
3940                 nla_nest_end(msg, bss_param);
3941         }
3942         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3943             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3944                     sizeof(struct nl80211_sta_flag_update),
3945                     &sinfo->sta_flags))
3946                 goto nla_put_failure;
3947
3948         PUT_SINFO_U64(T_OFFSET, t_offset);
3949         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
3950         PUT_SINFO_U64(BEACON_RX, rx_beacon);
3951         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3952
3953 #undef PUT_SINFO
3954 #undef PUT_SINFO_U64
3955
3956         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3957                 struct nlattr *tidsattr;
3958                 int tid;
3959
3960                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3961                 if (!tidsattr)
3962                         goto nla_put_failure;
3963
3964                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3965                         struct cfg80211_tid_stats *tidstats;
3966                         struct nlattr *tidattr;
3967
3968                         tidstats = &sinfo->pertid[tid];
3969
3970                         if (!tidstats->filled)
3971                                 continue;
3972
3973                         tidattr = nla_nest_start(msg, tid + 1);
3974                         if (!tidattr)
3975                                 goto nla_put_failure;
3976
3977 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
3978         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3979             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
3980                               tidstats->memb, NL80211_TID_STATS_PAD))   \
3981                 goto nla_put_failure;                                   \
3982         } while (0)
3983
3984                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
3985                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
3986                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
3987                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
3988
3989 #undef PUT_TIDVAL_U64
3990                         nla_nest_end(msg, tidattr);
3991                 }
3992
3993                 nla_nest_end(msg, tidsattr);
3994         }
3995
3996         nla_nest_end(msg, sinfoattr);
3997
3998         if (sinfo->assoc_req_ies_len &&
3999             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4000                     sinfo->assoc_req_ies))
4001                 goto nla_put_failure;
4002
4003         genlmsg_end(msg, hdr);
4004         return 0;
4005
4006  nla_put_failure:
4007         genlmsg_cancel(msg, hdr);
4008         return -EMSGSIZE;
4009 }
4010
4011 static int nl80211_dump_station(struct sk_buff *skb,
4012                                 struct netlink_callback *cb)
4013 {
4014         struct station_info sinfo;
4015         struct cfg80211_registered_device *rdev;
4016         struct wireless_dev *wdev;
4017         u8 mac_addr[ETH_ALEN];
4018         int sta_idx = cb->args[2];
4019         int err;
4020
4021         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4022         if (err)
4023                 return err;
4024
4025         if (!wdev->netdev) {
4026                 err = -EINVAL;
4027                 goto out_err;
4028         }
4029
4030         if (!rdev->ops->dump_station) {
4031                 err = -EOPNOTSUPP;
4032                 goto out_err;
4033         }
4034
4035         while (1) {
4036                 memset(&sinfo, 0, sizeof(sinfo));
4037                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4038                                         mac_addr, &sinfo);
4039                 if (err == -ENOENT)
4040                         break;
4041                 if (err)
4042                         goto out_err;
4043
4044                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4045                                 NETLINK_CB(cb->skb).portid,
4046                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4047                                 rdev, wdev->netdev, mac_addr,
4048                                 &sinfo) < 0)
4049                         goto out;
4050
4051                 sta_idx++;
4052         }
4053
4054  out:
4055         cb->args[2] = sta_idx;
4056         err = skb->len;
4057  out_err:
4058         nl80211_finish_wdev_dump(rdev);
4059
4060         return err;
4061 }
4062
4063 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4064 {
4065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4066         struct net_device *dev = info->user_ptr[1];
4067         struct station_info sinfo;
4068         struct sk_buff *msg;
4069         u8 *mac_addr = NULL;
4070         int err;
4071
4072         memset(&sinfo, 0, sizeof(sinfo));
4073
4074         if (!info->attrs[NL80211_ATTR_MAC])
4075                 return -EINVAL;
4076
4077         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4078
4079         if (!rdev->ops->get_station)
4080                 return -EOPNOTSUPP;
4081
4082         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4083         if (err)
4084                 return err;
4085
4086         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4087         if (!msg)
4088                 return -ENOMEM;
4089
4090         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4091                                  info->snd_portid, info->snd_seq, 0,
4092                                  rdev, dev, mac_addr, &sinfo) < 0) {
4093                 nlmsg_free(msg);
4094                 return -ENOBUFS;
4095         }
4096
4097         return genlmsg_reply(msg, info);
4098 }
4099
4100 int cfg80211_check_station_change(struct wiphy *wiphy,
4101                                   struct station_parameters *params,
4102                                   enum cfg80211_station_type statype)
4103 {
4104         if (params->listen_interval != -1 &&
4105             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4106                 return -EINVAL;
4107
4108         if (params->support_p2p_ps != -1 &&
4109             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4110                 return -EINVAL;
4111
4112         if (params->aid &&
4113             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4114             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4115                 return -EINVAL;
4116
4117         /* When you run into this, adjust the code below for the new flag */
4118         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4119
4120         switch (statype) {
4121         case CFG80211_STA_MESH_PEER_KERNEL:
4122         case CFG80211_STA_MESH_PEER_USER:
4123                 /*
4124                  * No ignoring the TDLS flag here -- the userspace mesh
4125                  * code doesn't have the bug of including TDLS in the
4126                  * mask everywhere.
4127                  */
4128                 if (params->sta_flags_mask &
4129                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4130                                   BIT(NL80211_STA_FLAG_MFP) |
4131                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4132                         return -EINVAL;
4133                 break;
4134         case CFG80211_STA_TDLS_PEER_SETUP:
4135         case CFG80211_STA_TDLS_PEER_ACTIVE:
4136                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4137                         return -EINVAL;
4138                 /* ignore since it can't change */
4139                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4140                 break;
4141         default:
4142                 /* disallow mesh-specific things */
4143                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4144                         return -EINVAL;
4145                 if (params->local_pm)
4146                         return -EINVAL;
4147                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4148                         return -EINVAL;
4149         }
4150
4151         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4152             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4153                 /* TDLS can't be set, ... */
4154                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4155                         return -EINVAL;
4156                 /*
4157                  * ... but don't bother the driver with it. This works around
4158                  * a hostapd/wpa_supplicant issue -- it always includes the
4159                  * TLDS_PEER flag in the mask even for AP mode.
4160                  */
4161                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4162         }
4163
4164         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4165             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4166                 /* reject other things that can't change */
4167                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4168                         return -EINVAL;
4169                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4170                         return -EINVAL;
4171                 if (params->supported_rates)
4172                         return -EINVAL;
4173                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4174                         return -EINVAL;
4175         }
4176
4177         if (statype != CFG80211_STA_AP_CLIENT &&
4178             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4179                 if (params->vlan)
4180                         return -EINVAL;
4181         }
4182
4183         switch (statype) {
4184         case CFG80211_STA_AP_MLME_CLIENT:
4185                 /* Use this only for authorizing/unauthorizing a station */
4186                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4187                         return -EOPNOTSUPP;
4188                 break;
4189         case CFG80211_STA_AP_CLIENT:
4190         case CFG80211_STA_AP_CLIENT_UNASSOC:
4191                 /* accept only the listed bits */
4192                 if (params->sta_flags_mask &
4193                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4194                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4195                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4196                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4197                                   BIT(NL80211_STA_FLAG_WME) |
4198                                   BIT(NL80211_STA_FLAG_MFP)))
4199                         return -EINVAL;
4200
4201                 /* but authenticated/associated only if driver handles it */
4202                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4203                     params->sta_flags_mask &
4204                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4205                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4206                         return -EINVAL;
4207                 break;
4208         case CFG80211_STA_IBSS:
4209         case CFG80211_STA_AP_STA:
4210                 /* reject any changes other than AUTHORIZED */
4211                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4212                         return -EINVAL;
4213                 break;
4214         case CFG80211_STA_TDLS_PEER_SETUP:
4215                 /* reject any changes other than AUTHORIZED or WME */
4216                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4217                                                BIT(NL80211_STA_FLAG_WME)))
4218                         return -EINVAL;
4219                 /* force (at least) rates when authorizing */
4220                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4221                     !params->supported_rates)
4222                         return -EINVAL;
4223                 break;
4224         case CFG80211_STA_TDLS_PEER_ACTIVE:
4225                 /* reject any changes */
4226                 return -EINVAL;
4227         case CFG80211_STA_MESH_PEER_KERNEL:
4228                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4229                         return -EINVAL;
4230                 break;
4231         case CFG80211_STA_MESH_PEER_USER:
4232                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4233                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4234                         return -EINVAL;
4235                 break;
4236         }
4237
4238         return 0;
4239 }
4240 EXPORT_SYMBOL(cfg80211_check_station_change);
4241
4242 /*
4243  * Get vlan interface making sure it is running and on the right wiphy.
4244  */
4245 static struct net_device *get_vlan(struct genl_info *info,
4246                                    struct cfg80211_registered_device *rdev)
4247 {
4248         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4249         struct net_device *v;
4250         int ret;
4251
4252         if (!vlanattr)
4253                 return NULL;
4254
4255         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4256         if (!v)
4257                 return ERR_PTR(-ENODEV);
4258
4259         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4260                 ret = -EINVAL;
4261                 goto error;
4262         }
4263
4264         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4265             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4266             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4267                 ret = -EINVAL;
4268                 goto error;
4269         }
4270
4271         if (!netif_running(v)) {
4272                 ret = -ENETDOWN;
4273                 goto error;
4274         }
4275
4276         return v;
4277  error:
4278         dev_put(v);
4279         return ERR_PTR(ret);
4280 }
4281
4282 static const struct nla_policy
4283 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4284         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4285         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4286 };
4287
4288 static int nl80211_parse_sta_wme(struct genl_info *info,
4289                                  struct station_parameters *params)
4290 {
4291         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4292         struct nlattr *nla;
4293         int err;
4294
4295         /* parse WME attributes if present */
4296         if (!info->attrs[NL80211_ATTR_STA_WME])
4297                 return 0;
4298
4299         nla = info->attrs[NL80211_ATTR_STA_WME];
4300         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4301                                nl80211_sta_wme_policy);
4302         if (err)
4303                 return err;
4304
4305         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4306                 params->uapsd_queues = nla_get_u8(
4307                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4308         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4309                 return -EINVAL;
4310
4311         if (tb[NL80211_STA_WME_MAX_SP])
4312                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4313
4314         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4315                 return -EINVAL;
4316
4317         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4318
4319         return 0;
4320 }
4321
4322 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4323                                       struct station_parameters *params)
4324 {
4325         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4326                 params->supported_channels =
4327                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4328                 params->supported_channels_len =
4329                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4330                 /*
4331                  * Need to include at least one (first channel, number of
4332                  * channels) tuple for each subband, and must have proper
4333                  * tuples for the rest of the data as well.
4334                  */
4335                 if (params->supported_channels_len < 2)
4336                         return -EINVAL;
4337                 if (params->supported_channels_len % 2)
4338                         return -EINVAL;
4339         }
4340
4341         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4342                 params->supported_oper_classes =
4343                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4344                 params->supported_oper_classes_len =
4345                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4346                 /*
4347                  * The value of the Length field of the Supported Operating
4348                  * Classes element is between 2 and 253.
4349                  */
4350                 if (params->supported_oper_classes_len < 2 ||
4351                     params->supported_oper_classes_len > 253)
4352                         return -EINVAL;
4353         }
4354         return 0;
4355 }
4356
4357 static int nl80211_set_station_tdls(struct genl_info *info,
4358                                     struct station_parameters *params)
4359 {
4360         int err;
4361         /* Dummy STA entry gets updated once the peer capabilities are known */
4362         if (info->attrs[NL80211_ATTR_PEER_AID])
4363                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4364         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4365                 params->ht_capa =
4366                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4367         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4368                 params->vht_capa =
4369                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4370
4371         err = nl80211_parse_sta_channel_info(info, params);
4372         if (err)
4373                 return err;
4374
4375         return nl80211_parse_sta_wme(info, params);
4376 }
4377
4378 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4379 {
4380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4381         struct net_device *dev = info->user_ptr[1];
4382         struct station_parameters params;
4383         u8 *mac_addr;
4384         int err;
4385
4386         memset(&params, 0, sizeof(params));
4387
4388         if (!rdev->ops->change_station)
4389                 return -EOPNOTSUPP;
4390
4391         /*
4392          * AID and listen_interval properties can be set only for unassociated
4393          * station. Include these parameters here and will check them in
4394          * cfg80211_check_station_change().
4395          */
4396         if (info->attrs[NL80211_ATTR_STA_AID])
4397                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4398
4399         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4400                 params.listen_interval =
4401                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4402         else
4403                 params.listen_interval = -1;
4404
4405         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4406                 u8 tmp;
4407
4408                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4409                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4410                         return -EINVAL;
4411
4412                 params.support_p2p_ps = tmp;
4413         } else {
4414                 params.support_p2p_ps = -1;
4415         }
4416
4417         if (!info->attrs[NL80211_ATTR_MAC])
4418                 return -EINVAL;
4419
4420         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4421
4422         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4423                 params.supported_rates =
4424                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4425                 params.supported_rates_len =
4426                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4427         }
4428
4429         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4430                 params.capability =
4431                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4432                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4433         }
4434
4435         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4436                 params.ext_capab =
4437                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4438                 params.ext_capab_len =
4439                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4440         }
4441
4442         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4443                 return -EINVAL;
4444
4445         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4446                 params.plink_action =
4447                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4448                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4449                         return -EINVAL;
4450         }
4451
4452         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4453                 params.plink_state =
4454                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4455                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4456                         return -EINVAL;
4457                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4458                         params.peer_aid = nla_get_u16(
4459                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4460                         if (params.peer_aid > IEEE80211_MAX_AID)
4461                                 return -EINVAL;
4462                 }
4463                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4464         }
4465
4466         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4467                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4468                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4469
4470                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4471                     pm > NL80211_MESH_POWER_MAX)
4472                         return -EINVAL;
4473
4474                 params.local_pm = pm;
4475         }
4476
4477         /* Include parameters for TDLS peer (will check later) */
4478         err = nl80211_set_station_tdls(info, &params);
4479         if (err)
4480                 return err;
4481
4482         params.vlan = get_vlan(info, rdev);
4483         if (IS_ERR(params.vlan))
4484                 return PTR_ERR(params.vlan);
4485
4486         switch (dev->ieee80211_ptr->iftype) {
4487         case NL80211_IFTYPE_AP:
4488         case NL80211_IFTYPE_AP_VLAN:
4489         case NL80211_IFTYPE_P2P_GO:
4490         case NL80211_IFTYPE_P2P_CLIENT:
4491         case NL80211_IFTYPE_STATION:
4492         case NL80211_IFTYPE_ADHOC:
4493         case NL80211_IFTYPE_MESH_POINT:
4494                 break;
4495         default:
4496                 err = -EOPNOTSUPP;
4497                 goto out_put_vlan;
4498         }
4499
4500         /* driver will call cfg80211_check_station_change() */
4501         err = rdev_change_station(rdev, dev, mac_addr, &params);
4502
4503  out_put_vlan:
4504         if (params.vlan)
4505                 dev_put(params.vlan);
4506
4507         return err;
4508 }
4509
4510 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4511 {
4512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4513         int err;
4514         struct net_device *dev = info->user_ptr[1];
4515         struct station_parameters params;
4516         u8 *mac_addr = NULL;
4517         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4518                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4519
4520         memset(&params, 0, sizeof(params));
4521
4522         if (!rdev->ops->add_station)
4523                 return -EOPNOTSUPP;
4524
4525         if (!info->attrs[NL80211_ATTR_MAC])
4526                 return -EINVAL;
4527
4528         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4529                 return -EINVAL;
4530
4531         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4532                 return -EINVAL;
4533
4534         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4535             !info->attrs[NL80211_ATTR_PEER_AID])
4536                 return -EINVAL;
4537
4538         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4539         params.supported_rates =
4540                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4541         params.supported_rates_len =
4542                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4543         params.listen_interval =
4544                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4545
4546         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4547                 u8 tmp;
4548
4549                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4550                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4551                         return -EINVAL;
4552
4553                 params.support_p2p_ps = tmp;
4554         } else {
4555                 /*
4556                  * if not specified, assume it's supported for P2P GO interface,
4557                  * and is NOT supported for AP interface
4558                  */
4559                 params.support_p2p_ps =
4560                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4561         }
4562
4563         if (info->attrs[NL80211_ATTR_PEER_AID])
4564                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4565         else
4566                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4567         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4568                 return -EINVAL;
4569
4570         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4571                 params.capability =
4572                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4573                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4574         }
4575
4576         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4577                 params.ext_capab =
4578                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4579                 params.ext_capab_len =
4580                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4581         }
4582
4583         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4584                 params.ht_capa =
4585                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4586
4587         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4588                 params.vht_capa =
4589                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4590
4591         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4592                 params.opmode_notif_used = true;
4593                 params.opmode_notif =
4594                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4595         }
4596
4597         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4598                 params.plink_action =
4599                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4600                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4601                         return -EINVAL;
4602         }
4603
4604         err = nl80211_parse_sta_channel_info(info, &params);
4605         if (err)
4606                 return err;
4607
4608         err = nl80211_parse_sta_wme(info, &params);
4609         if (err)
4610                 return err;
4611
4612         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4613                 return -EINVAL;
4614
4615         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4616          * as userspace might just pass through the capabilities from the IEs
4617          * directly, rather than enforcing this restriction and returning an
4618          * error in this case.
4619          */
4620         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4621                 params.ht_capa = NULL;
4622                 params.vht_capa = NULL;
4623         }
4624
4625         /* When you run into this, adjust the code below for the new flag */
4626         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4627
4628         switch (dev->ieee80211_ptr->iftype) {
4629         case NL80211_IFTYPE_AP:
4630         case NL80211_IFTYPE_AP_VLAN:
4631         case NL80211_IFTYPE_P2P_GO:
4632                 /* ignore WME attributes if iface/sta is not capable */
4633                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4634                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4635                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4636
4637                 /* TDLS peers cannot be added */
4638                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4639                     info->attrs[NL80211_ATTR_PEER_AID])
4640                         return -EINVAL;
4641                 /* but don't bother the driver with it */
4642                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4643
4644                 /* allow authenticated/associated only if driver handles it */
4645                 if (!(rdev->wiphy.features &
4646                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4647                     params.sta_flags_mask & auth_assoc)
4648                         return -EINVAL;
4649
4650                 /* Older userspace, or userspace wanting to be compatible with
4651                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
4652                  * and assoc flags in the mask, but assumes the station will be
4653                  * added as associated anyway since this was the required driver
4654                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
4655                  * introduced.
4656                  * In order to not bother drivers with this quirk in the API
4657                  * set the flags in both the mask and set for new stations in
4658                  * this case.
4659                  */
4660                 if (!(params.sta_flags_mask & auth_assoc)) {
4661                         params.sta_flags_mask |= auth_assoc;
4662                         params.sta_flags_set |= auth_assoc;
4663                 }
4664
4665                 /* must be last in here for error handling */
4666                 params.vlan = get_vlan(info, rdev);
4667                 if (IS_ERR(params.vlan))
4668                         return PTR_ERR(params.vlan);
4669                 break;
4670         case NL80211_IFTYPE_MESH_POINT:
4671                 /* ignore uAPSD data */
4672                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4673
4674                 /* associated is disallowed */
4675                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4676                         return -EINVAL;
4677                 /* TDLS peers cannot be added */
4678                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4679                     info->attrs[NL80211_ATTR_PEER_AID])
4680                         return -EINVAL;
4681                 break;
4682         case NL80211_IFTYPE_STATION:
4683         case NL80211_IFTYPE_P2P_CLIENT:
4684                 /* ignore uAPSD data */
4685                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4686
4687                 /* these are disallowed */
4688                 if (params.sta_flags_mask &
4689                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4690                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4691                         return -EINVAL;
4692                 /* Only TDLS peers can be added */
4693                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4694                         return -EINVAL;
4695                 /* Can only add if TDLS ... */
4696                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4697                         return -EOPNOTSUPP;
4698                 /* ... with external setup is supported */
4699                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4700                         return -EOPNOTSUPP;
4701                 /*
4702                  * Older wpa_supplicant versions always mark the TDLS peer
4703                  * as authorized, but it shouldn't yet be.
4704                  */
4705                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4706                 break;
4707         default:
4708                 return -EOPNOTSUPP;
4709         }
4710
4711         /* be aware of params.vlan when changing code here */
4712
4713         err = rdev_add_station(rdev, dev, mac_addr, &params);
4714
4715         if (params.vlan)
4716                 dev_put(params.vlan);
4717         return err;
4718 }
4719
4720 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4721 {
4722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4723         struct net_device *dev = info->user_ptr[1];
4724         struct station_del_parameters params;
4725
4726         memset(&params, 0, sizeof(params));
4727
4728         if (info->attrs[NL80211_ATTR_MAC])
4729                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4730
4731         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4732             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4733             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4734             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4735                 return -EINVAL;
4736
4737         if (!rdev->ops->del_station)
4738                 return -EOPNOTSUPP;
4739
4740         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4741                 params.subtype =
4742                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4743                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4744                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4745                         return -EINVAL;
4746         } else {
4747                 /* Default to Deauthentication frame */
4748                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4749         }
4750
4751         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4752                 params.reason_code =
4753                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4754                 if (params.reason_code == 0)
4755                         return -EINVAL; /* 0 is reserved */
4756         } else {
4757                 /* Default to reason code 2 */
4758                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4759         }
4760
4761         return rdev_del_station(rdev, dev, &params);
4762 }
4763
4764 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4765                                 int flags, struct net_device *dev,
4766                                 u8 *dst, u8 *next_hop,
4767                                 struct mpath_info *pinfo)
4768 {
4769         void *hdr;
4770         struct nlattr *pinfoattr;
4771
4772         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4773         if (!hdr)
4774                 return -1;
4775
4776         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4777             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4778             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4779             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4780                 goto nla_put_failure;
4781
4782         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4783         if (!pinfoattr)
4784                 goto nla_put_failure;
4785         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4786             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4787                         pinfo->frame_qlen))
4788                 goto nla_put_failure;
4789         if (((pinfo->filled & MPATH_INFO_SN) &&
4790              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4791             ((pinfo->filled & MPATH_INFO_METRIC) &&
4792              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4793                          pinfo->metric)) ||
4794             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4795              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4796                          pinfo->exptime)) ||
4797             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4798              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4799                         pinfo->flags)) ||
4800             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4801              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4802                          pinfo->discovery_timeout)) ||
4803             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4804              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4805                         pinfo->discovery_retries)))
4806                 goto nla_put_failure;
4807
4808         nla_nest_end(msg, pinfoattr);
4809
4810         genlmsg_end(msg, hdr);
4811         return 0;
4812
4813  nla_put_failure:
4814         genlmsg_cancel(msg, hdr);
4815         return -EMSGSIZE;
4816 }
4817
4818 static int nl80211_dump_mpath(struct sk_buff *skb,
4819                               struct netlink_callback *cb)
4820 {
4821         struct mpath_info pinfo;
4822         struct cfg80211_registered_device *rdev;
4823         struct wireless_dev *wdev;
4824         u8 dst[ETH_ALEN];
4825         u8 next_hop[ETH_ALEN];
4826         int path_idx = cb->args[2];
4827         int err;
4828
4829         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4830         if (err)
4831                 return err;
4832
4833         if (!rdev->ops->dump_mpath) {
4834                 err = -EOPNOTSUPP;
4835                 goto out_err;
4836         }
4837
4838         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4839                 err = -EOPNOTSUPP;
4840                 goto out_err;
4841         }
4842
4843         while (1) {
4844                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4845                                       next_hop, &pinfo);
4846                 if (err == -ENOENT)
4847                         break;
4848                 if (err)
4849                         goto out_err;
4850
4851                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4852                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4853                                        wdev->netdev, dst, next_hop,
4854                                        &pinfo) < 0)
4855                         goto out;
4856
4857                 path_idx++;
4858         }
4859
4860  out:
4861         cb->args[2] = path_idx;
4862         err = skb->len;
4863  out_err:
4864         nl80211_finish_wdev_dump(rdev);
4865         return err;
4866 }
4867
4868 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4869 {
4870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4871         int err;
4872         struct net_device *dev = info->user_ptr[1];
4873         struct mpath_info pinfo;
4874         struct sk_buff *msg;
4875         u8 *dst = NULL;
4876         u8 next_hop[ETH_ALEN];
4877
4878         memset(&pinfo, 0, sizeof(pinfo));
4879
4880         if (!info->attrs[NL80211_ATTR_MAC])
4881                 return -EINVAL;
4882
4883         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4884
4885         if (!rdev->ops->get_mpath)
4886                 return -EOPNOTSUPP;
4887
4888         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4889                 return -EOPNOTSUPP;
4890
4891         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4892         if (err)
4893                 return err;
4894
4895         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4896         if (!msg)
4897                 return -ENOMEM;
4898
4899         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4900                                  dev, dst, next_hop, &pinfo) < 0) {
4901                 nlmsg_free(msg);
4902                 return -ENOBUFS;
4903         }
4904
4905         return genlmsg_reply(msg, info);
4906 }
4907
4908 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4909 {
4910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4911         struct net_device *dev = info->user_ptr[1];
4912         u8 *dst = NULL;
4913         u8 *next_hop = NULL;
4914
4915         if (!info->attrs[NL80211_ATTR_MAC])
4916                 return -EINVAL;
4917
4918         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4919                 return -EINVAL;
4920
4921         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4922         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4923
4924         if (!rdev->ops->change_mpath)
4925                 return -EOPNOTSUPP;
4926
4927         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4928                 return -EOPNOTSUPP;
4929
4930         return rdev_change_mpath(rdev, dev, dst, next_hop);
4931 }
4932
4933 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4934 {
4935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4936         struct net_device *dev = info->user_ptr[1];
4937         u8 *dst = NULL;
4938         u8 *next_hop = NULL;
4939
4940         if (!info->attrs[NL80211_ATTR_MAC])
4941                 return -EINVAL;
4942
4943         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4944                 return -EINVAL;
4945
4946         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4947         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4948
4949         if (!rdev->ops->add_mpath)
4950                 return -EOPNOTSUPP;
4951
4952         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4953                 return -EOPNOTSUPP;
4954
4955         return rdev_add_mpath(rdev, dev, dst, next_hop);
4956 }
4957
4958 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4959 {
4960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4961         struct net_device *dev = info->user_ptr[1];
4962         u8 *dst = NULL;
4963
4964         if (info->attrs[NL80211_ATTR_MAC])
4965                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4966
4967         if (!rdev->ops->del_mpath)
4968                 return -EOPNOTSUPP;
4969
4970         return rdev_del_mpath(rdev, dev, dst);
4971 }
4972
4973 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4974 {
4975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4976         int err;
4977         struct net_device *dev = info->user_ptr[1];
4978         struct mpath_info pinfo;
4979         struct sk_buff *msg;
4980         u8 *dst = NULL;
4981         u8 mpp[ETH_ALEN];
4982
4983         memset(&pinfo, 0, sizeof(pinfo));
4984
4985         if (!info->attrs[NL80211_ATTR_MAC])
4986                 return -EINVAL;
4987
4988         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4989
4990         if (!rdev->ops->get_mpp)
4991                 return -EOPNOTSUPP;
4992
4993         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4994                 return -EOPNOTSUPP;
4995
4996         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4997         if (err)
4998                 return err;
4999
5000         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5001         if (!msg)
5002                 return -ENOMEM;
5003
5004         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5005                                dev, dst, mpp, &pinfo) < 0) {
5006                 nlmsg_free(msg);
5007                 return -ENOBUFS;
5008         }
5009
5010         return genlmsg_reply(msg, info);
5011 }
5012
5013 static int nl80211_dump_mpp(struct sk_buff *skb,
5014                             struct netlink_callback *cb)
5015 {
5016         struct mpath_info pinfo;
5017         struct cfg80211_registered_device *rdev;
5018         struct wireless_dev *wdev;
5019         u8 dst[ETH_ALEN];
5020         u8 mpp[ETH_ALEN];
5021         int path_idx = cb->args[2];
5022         int err;
5023
5024         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5025         if (err)
5026                 return err;
5027
5028         if (!rdev->ops->dump_mpp) {
5029                 err = -EOPNOTSUPP;
5030                 goto out_err;
5031         }
5032
5033         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5034                 err = -EOPNOTSUPP;
5035                 goto out_err;
5036         }
5037
5038         while (1) {
5039                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5040                                     mpp, &pinfo);
5041                 if (err == -ENOENT)
5042                         break;
5043                 if (err)
5044                         goto out_err;
5045
5046                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5047                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5048                                        wdev->netdev, dst, mpp,
5049                                        &pinfo) < 0)
5050                         goto out;
5051
5052                 path_idx++;
5053         }
5054
5055  out:
5056         cb->args[2] = path_idx;
5057         err = skb->len;
5058  out_err:
5059         nl80211_finish_wdev_dump(rdev);
5060         return err;
5061 }
5062
5063 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5064 {
5065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5066         struct net_device *dev = info->user_ptr[1];
5067         struct wireless_dev *wdev = dev->ieee80211_ptr;
5068         struct bss_parameters params;
5069         int err;
5070
5071         memset(&params, 0, sizeof(params));
5072         /* default to not changing parameters */
5073         params.use_cts_prot = -1;
5074         params.use_short_preamble = -1;
5075         params.use_short_slot_time = -1;
5076         params.ap_isolate = -1;
5077         params.ht_opmode = -1;
5078         params.p2p_ctwindow = -1;
5079         params.p2p_opp_ps = -1;
5080
5081         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5082                 params.use_cts_prot =
5083                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5084         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5085                 params.use_short_preamble =
5086                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5087         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5088                 params.use_short_slot_time =
5089                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5090         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5091                 params.basic_rates =
5092                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5093                 params.basic_rates_len =
5094                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5095         }
5096         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5097                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5098         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5099                 params.ht_opmode =
5100                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5101
5102         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5103                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5104                         return -EINVAL;
5105                 params.p2p_ctwindow =
5106                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5107                 if (params.p2p_ctwindow < 0)
5108                         return -EINVAL;
5109                 if (params.p2p_ctwindow != 0 &&
5110                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5111                         return -EINVAL;
5112         }
5113
5114         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5115                 u8 tmp;
5116
5117                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5118                         return -EINVAL;
5119                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5120                 if (tmp > 1)
5121                         return -EINVAL;
5122                 params.p2p_opp_ps = tmp;
5123                 if (params.p2p_opp_ps &&
5124                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5125                         return -EINVAL;
5126         }
5127
5128         if (!rdev->ops->change_bss)
5129                 return -EOPNOTSUPP;
5130
5131         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5132             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5133                 return -EOPNOTSUPP;
5134
5135         wdev_lock(wdev);
5136         err = rdev_change_bss(rdev, dev, &params);
5137         wdev_unlock(wdev);
5138
5139         return err;
5140 }
5141
5142 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5143 {
5144         char *data = NULL;
5145         bool is_indoor;
5146         enum nl80211_user_reg_hint_type user_reg_hint_type;
5147         u32 owner_nlportid;
5148
5149         /*
5150          * You should only get this when cfg80211 hasn't yet initialized
5151          * completely when built-in to the kernel right between the time
5152          * window between nl80211_init() and regulatory_init(), if that is
5153          * even possible.
5154          */
5155         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5156                 return -EINPROGRESS;
5157
5158         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5159                 user_reg_hint_type =
5160                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5161         else
5162                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5163
5164         switch (user_reg_hint_type) {
5165         case NL80211_USER_REG_HINT_USER:
5166         case NL80211_USER_REG_HINT_CELL_BASE:
5167                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5168                         return -EINVAL;
5169
5170                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5171                 return regulatory_hint_user(data, user_reg_hint_type);
5172         case NL80211_USER_REG_HINT_INDOOR:
5173                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5174                         owner_nlportid = info->snd_portid;
5175                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5176                 } else {
5177                         owner_nlportid = 0;
5178                         is_indoor = true;
5179                 }
5180
5181                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5182         default:
5183                 return -EINVAL;
5184         }
5185 }
5186
5187 static int nl80211_get_mesh_config(struct sk_buff *skb,
5188                                    struct genl_info *info)
5189 {
5190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5191         struct net_device *dev = info->user_ptr[1];
5192         struct wireless_dev *wdev = dev->ieee80211_ptr;
5193         struct mesh_config cur_params;
5194         int err = 0;
5195         void *hdr;
5196         struct nlattr *pinfoattr;
5197         struct sk_buff *msg;
5198
5199         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5200                 return -EOPNOTSUPP;
5201
5202         if (!rdev->ops->get_mesh_config)
5203                 return -EOPNOTSUPP;
5204
5205         wdev_lock(wdev);
5206         /* If not connected, get default parameters */
5207         if (!wdev->mesh_id_len)
5208                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5209         else
5210                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5211         wdev_unlock(wdev);
5212
5213         if (err)
5214                 return err;
5215
5216         /* Draw up a netlink message to send back */
5217         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5218         if (!msg)
5219                 return -ENOMEM;
5220         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5221                              NL80211_CMD_GET_MESH_CONFIG);
5222         if (!hdr)
5223                 goto out;
5224         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5225         if (!pinfoattr)
5226                 goto nla_put_failure;
5227         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5228             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5229                         cur_params.dot11MeshRetryTimeout) ||
5230             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5231                         cur_params.dot11MeshConfirmTimeout) ||
5232             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5233                         cur_params.dot11MeshHoldingTimeout) ||
5234             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5235                         cur_params.dot11MeshMaxPeerLinks) ||
5236             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5237                        cur_params.dot11MeshMaxRetries) ||
5238             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5239                        cur_params.dot11MeshTTL) ||
5240             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5241                        cur_params.element_ttl) ||
5242             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5243                        cur_params.auto_open_plinks) ||
5244             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5245                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5246             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5247                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5248             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5249                         cur_params.path_refresh_time) ||
5250             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5251                         cur_params.min_discovery_timeout) ||
5252             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5253                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5254             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5255                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5256             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5257                         cur_params.dot11MeshHWMPperrMinInterval) ||
5258             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5259                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5260             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5261                        cur_params.dot11MeshHWMPRootMode) ||
5262             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5263                         cur_params.dot11MeshHWMPRannInterval) ||
5264             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5265                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5266             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5267                        cur_params.dot11MeshForwarding) ||
5268             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5269                         cur_params.rssi_threshold) ||
5270             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5271                         cur_params.ht_opmode) ||
5272             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5273                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5274             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5275                         cur_params.dot11MeshHWMProotInterval) ||
5276             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5277                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5278             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5279                         cur_params.power_mode) ||
5280             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5281                         cur_params.dot11MeshAwakeWindowDuration) ||
5282             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5283                         cur_params.plink_timeout))
5284                 goto nla_put_failure;
5285         nla_nest_end(msg, pinfoattr);
5286         genlmsg_end(msg, hdr);
5287         return genlmsg_reply(msg, info);
5288
5289  nla_put_failure:
5290         genlmsg_cancel(msg, hdr);
5291  out:
5292         nlmsg_free(msg);
5293         return -ENOBUFS;
5294 }
5295
5296 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5297         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5298         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5299         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5300         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5301         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5302         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5303         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5304         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5305         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5306         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5307         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5308         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5309         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5310         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5311         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5312         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5313         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5314         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5315         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5316         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5317         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5318         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5319         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5320         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5321         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5322         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5323         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5324         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5325 };
5326
5327 static const struct nla_policy
5328         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5329         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5330         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5331         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5332         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5333         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5334         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5335         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5336                                     .len = IEEE80211_MAX_DATA_LEN },
5337         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5338 };
5339
5340 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5341 {
5342         u8 val = nla_get_u8(nla);
5343         if (val < min || val > max)
5344                 return -EINVAL;
5345         *out = val;
5346         return 0;
5347 }
5348
5349 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5350 {
5351         u8 val = nla_get_u8(nla);
5352         if (val < min || val > max)
5353                 return -EINVAL;
5354         *out = val;
5355         return 0;
5356 }
5357
5358 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5359 {
5360         u16 val = nla_get_u16(nla);
5361         if (val < min || val > max)
5362                 return -EINVAL;
5363         *out = val;
5364         return 0;
5365 }
5366
5367 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5368 {
5369         u32 val = nla_get_u32(nla);
5370         if (val < min || val > max)
5371                 return -EINVAL;
5372         *out = val;
5373         return 0;
5374 }
5375
5376 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5377 {
5378         s32 val = nla_get_s32(nla);
5379         if (val < min || val > max)
5380                 return -EINVAL;
5381         *out = val;
5382         return 0;
5383 }
5384
5385 static int nl80211_check_power_mode(const struct nlattr *nla,
5386                                     enum nl80211_mesh_power_mode min,
5387                                     enum nl80211_mesh_power_mode max,
5388                                     enum nl80211_mesh_power_mode *out)
5389 {
5390         u32 val = nla_get_u32(nla);
5391         if (val < min || val > max)
5392                 return -EINVAL;
5393         *out = val;
5394         return 0;
5395 }
5396
5397 static int nl80211_parse_mesh_config(struct genl_info *info,
5398                                      struct mesh_config *cfg,
5399                                      u32 *mask_out)
5400 {
5401         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5402         u32 mask = 0;
5403         u16 ht_opmode;
5404
5405 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5406 do {                                                                        \
5407         if (tb[attr]) {                                                     \
5408                 if (fn(tb[attr], min, max, &cfg->param))                    \
5409                         return -EINVAL;                                     \
5410                 mask |= (1 << (attr - 1));                                  \
5411         }                                                                   \
5412 } while (0)
5413
5414         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5415                 return -EINVAL;
5416         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5417                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5418                              nl80211_meshconf_params_policy))
5419                 return -EINVAL;
5420
5421         /* This makes sure that there aren't more than 32 mesh config
5422          * parameters (otherwise our bitfield scheme would not work.) */
5423         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5424
5425         /* Fill in the params struct */
5426         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5427                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5428                                   nl80211_check_u16);
5429         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5430                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5431                                   nl80211_check_u16);
5432         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5433                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5434                                   nl80211_check_u16);
5435         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5436                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5437                                   nl80211_check_u16);
5438         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5439                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5440                                   nl80211_check_u8);
5441         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5442                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5443         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5444                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5445                                   nl80211_check_u8);
5446         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5447                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5448                                   nl80211_check_bool);
5449         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5450                                   1, 255, mask,
5451                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5452                                   nl80211_check_u32);
5453         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5454                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5455                                   nl80211_check_u8);
5456         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5457                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5458                                   nl80211_check_u32);
5459         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5460                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5461                                   nl80211_check_u16);
5462         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5463                                   1, 65535, mask,
5464                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5465                                   nl80211_check_u32);
5466         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5467                                   1, 65535, mask,
5468                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5469                                   nl80211_check_u16);
5470         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5471                                   1, 65535, mask,
5472                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5473                                   nl80211_check_u16);
5474         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5475                                   dot11MeshHWMPnetDiameterTraversalTime,
5476                                   1, 65535, mask,
5477                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5478                                   nl80211_check_u16);
5479         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5480                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5481                                   nl80211_check_u8);
5482         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5483                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5484                                   nl80211_check_u16);
5485         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5486                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5487                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5488                                   nl80211_check_bool);
5489         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5490                                   mask, NL80211_MESHCONF_FORWARDING,
5491                                   nl80211_check_bool);
5492         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5493                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5494                                   nl80211_check_s32);
5495         /*
5496          * Check HT operation mode based on
5497          * IEEE 802.11 2012 8.4.2.59 HT Operation element.
5498          */
5499         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5500                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5501
5502                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5503                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5504                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5505                         return -EINVAL;
5506
5507                 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
5508                     (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5509                         return -EINVAL;
5510
5511                 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
5512                 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
5513                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
5514                         if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
5515                                 return -EINVAL;
5516                         break;
5517                 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
5518                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
5519                         if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5520                                 return -EINVAL;
5521                         break;
5522                 }
5523                 cfg->ht_opmode = ht_opmode;
5524         }
5525         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5526                                   1, 65535, mask,
5527                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5528                                   nl80211_check_u32);
5529         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5530                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5531                                   nl80211_check_u16);
5532         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5533                                   dot11MeshHWMPconfirmationInterval,
5534                                   1, 65535, mask,
5535                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5536                                   nl80211_check_u16);
5537         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5538                                   NL80211_MESH_POWER_ACTIVE,
5539                                   NL80211_MESH_POWER_MAX,
5540                                   mask, NL80211_MESHCONF_POWER_MODE,
5541                                   nl80211_check_power_mode);
5542         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5543                                   0, 65535, mask,
5544                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
5545         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5546                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5547                                   nl80211_check_u32);
5548         if (mask_out)
5549                 *mask_out = mask;
5550
5551         return 0;
5552
5553 #undef FILL_IN_MESH_PARAM_IF_SET
5554 }
5555
5556 static int nl80211_parse_mesh_setup(struct genl_info *info,
5557                                      struct mesh_setup *setup)
5558 {
5559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5560         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5561
5562         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5563                 return -EINVAL;
5564         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5565                              info->attrs[NL80211_ATTR_MESH_SETUP],
5566                              nl80211_mesh_setup_params_policy))
5567                 return -EINVAL;
5568
5569         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5570                 setup->sync_method =
5571                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5572                  IEEE80211_SYNC_METHOD_VENDOR :
5573                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5574
5575         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5576                 setup->path_sel_proto =
5577                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5578                  IEEE80211_PATH_PROTOCOL_VENDOR :
5579                  IEEE80211_PATH_PROTOCOL_HWMP;
5580
5581         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5582                 setup->path_metric =
5583                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5584                  IEEE80211_PATH_METRIC_VENDOR :
5585                  IEEE80211_PATH_METRIC_AIRTIME;
5586
5587         if (tb[NL80211_MESH_SETUP_IE]) {
5588                 struct nlattr *ieattr =
5589                         tb[NL80211_MESH_SETUP_IE];
5590                 if (!is_valid_ie_attr(ieattr))
5591                         return -EINVAL;
5592                 setup->ie = nla_data(ieattr);
5593                 setup->ie_len = nla_len(ieattr);
5594         }
5595         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5596             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5597                 return -EINVAL;
5598         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5599         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5600         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5601         if (setup->is_secure)
5602                 setup->user_mpm = true;
5603
5604         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5605                 if (!setup->user_mpm)
5606                         return -EINVAL;
5607                 setup->auth_id =
5608                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5609         }
5610
5611         return 0;
5612 }
5613
5614 static int nl80211_update_mesh_config(struct sk_buff *skb,
5615                                       struct genl_info *info)
5616 {
5617         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5618         struct net_device *dev = info->user_ptr[1];
5619         struct wireless_dev *wdev = dev->ieee80211_ptr;
5620         struct mesh_config cfg;
5621         u32 mask;
5622         int err;
5623
5624         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5625                 return -EOPNOTSUPP;
5626
5627         if (!rdev->ops->update_mesh_config)
5628                 return -EOPNOTSUPP;
5629
5630         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5631         if (err)
5632                 return err;
5633
5634         wdev_lock(wdev);
5635         if (!wdev->mesh_id_len)
5636                 err = -ENOLINK;
5637
5638         if (!err)
5639                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5640
5641         wdev_unlock(wdev);
5642
5643         return err;
5644 }
5645
5646 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5647                               struct sk_buff *msg)
5648 {
5649         struct nlattr *nl_reg_rules;
5650         unsigned int i;
5651
5652         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5653             (regdom->dfs_region &&
5654              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5655                 goto nla_put_failure;
5656
5657         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5658         if (!nl_reg_rules)
5659                 goto nla_put_failure;
5660
5661         for (i = 0; i < regdom->n_reg_rules; i++) {
5662                 struct nlattr *nl_reg_rule;
5663                 const struct ieee80211_reg_rule *reg_rule;
5664                 const struct ieee80211_freq_range *freq_range;
5665                 const struct ieee80211_power_rule *power_rule;
5666                 unsigned int max_bandwidth_khz;
5667
5668                 reg_rule = &regdom->reg_rules[i];
5669                 freq_range = &reg_rule->freq_range;
5670                 power_rule = &reg_rule->power_rule;
5671
5672                 nl_reg_rule = nla_nest_start(msg, i);
5673                 if (!nl_reg_rule)
5674                         goto nla_put_failure;
5675
5676                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5677                 if (!max_bandwidth_khz)
5678                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5679                                                                   reg_rule);
5680
5681                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5682                                 reg_rule->flags) ||
5683                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5684                                 freq_range->start_freq_khz) ||
5685                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5686                                 freq_range->end_freq_khz) ||
5687                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5688                                 max_bandwidth_khz) ||
5689                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5690                                 power_rule->max_antenna_gain) ||
5691                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5692                                 power_rule->max_eirp) ||
5693                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5694                                 reg_rule->dfs_cac_ms))
5695                         goto nla_put_failure;
5696
5697                 nla_nest_end(msg, nl_reg_rule);
5698         }
5699
5700         nla_nest_end(msg, nl_reg_rules);
5701         return 0;
5702
5703 nla_put_failure:
5704         return -EMSGSIZE;
5705 }
5706
5707 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5708 {
5709         const struct ieee80211_regdomain *regdom = NULL;
5710         struct cfg80211_registered_device *rdev;
5711         struct wiphy *wiphy = NULL;
5712         struct sk_buff *msg;
5713         void *hdr;
5714
5715         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5716         if (!msg)
5717                 return -ENOBUFS;
5718
5719         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5720                              NL80211_CMD_GET_REG);
5721         if (!hdr)
5722                 goto put_failure;
5723
5724         if (info->attrs[NL80211_ATTR_WIPHY]) {
5725                 bool self_managed;
5726
5727                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5728                 if (IS_ERR(rdev)) {
5729                         nlmsg_free(msg);
5730                         return PTR_ERR(rdev);
5731                 }
5732
5733                 wiphy = &rdev->wiphy;
5734                 self_managed = wiphy->regulatory_flags &
5735                                REGULATORY_WIPHY_SELF_MANAGED;
5736                 regdom = get_wiphy_regdom(wiphy);
5737
5738                 /* a self-managed-reg device must have a private regdom */
5739                 if (WARN_ON(!regdom && self_managed)) {
5740                         nlmsg_free(msg);
5741                         return -EINVAL;
5742                 }
5743
5744                 if (regdom &&
5745                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5746                         goto nla_put_failure;
5747         }
5748
5749         if (!wiphy && reg_last_request_cell_base() &&
5750             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5751                         NL80211_USER_REG_HINT_CELL_BASE))
5752                 goto nla_put_failure;
5753
5754         rcu_read_lock();
5755
5756         if (!regdom)
5757                 regdom = rcu_dereference(cfg80211_regdomain);
5758
5759         if (nl80211_put_regdom(regdom, msg))
5760                 goto nla_put_failure_rcu;
5761
5762         rcu_read_unlock();
5763
5764         genlmsg_end(msg, hdr);
5765         return genlmsg_reply(msg, info);
5766
5767 nla_put_failure_rcu:
5768         rcu_read_unlock();
5769 nla_put_failure:
5770         genlmsg_cancel(msg, hdr);
5771 put_failure:
5772         nlmsg_free(msg);
5773         return -EMSGSIZE;
5774 }
5775
5776 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5777                                u32 seq, int flags, struct wiphy *wiphy,
5778                                const struct ieee80211_regdomain *regdom)
5779 {
5780         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5781                                    NL80211_CMD_GET_REG);
5782
5783         if (!hdr)
5784                 return -1;
5785
5786         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5787
5788         if (nl80211_put_regdom(regdom, msg))
5789                 goto nla_put_failure;
5790
5791         if (!wiphy && reg_last_request_cell_base() &&
5792             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5793                         NL80211_USER_REG_HINT_CELL_BASE))
5794                 goto nla_put_failure;
5795
5796         if (wiphy &&
5797             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5798                 goto nla_put_failure;
5799
5800         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5801             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5802                 goto nla_put_failure;
5803
5804         genlmsg_end(msg, hdr);
5805         return 0;
5806
5807 nla_put_failure:
5808         genlmsg_cancel(msg, hdr);
5809         return -EMSGSIZE;
5810 }
5811
5812 static int nl80211_get_reg_dump(struct sk_buff *skb,
5813                                 struct netlink_callback *cb)
5814 {
5815         const struct ieee80211_regdomain *regdom = NULL;
5816         struct cfg80211_registered_device *rdev;
5817         int err, reg_idx, start = cb->args[2];
5818
5819         rtnl_lock();
5820
5821         if (cfg80211_regdomain && start == 0) {
5822                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5823                                           NLM_F_MULTI, NULL,
5824                                           rtnl_dereference(cfg80211_regdomain));
5825                 if (err < 0)
5826                         goto out_err;
5827         }
5828
5829         /* the global regdom is idx 0 */
5830         reg_idx = 1;
5831         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5832                 regdom = get_wiphy_regdom(&rdev->wiphy);
5833                 if (!regdom)
5834                         continue;
5835
5836                 if (++reg_idx <= start)
5837                         continue;
5838
5839                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5840                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5841                 if (err < 0) {
5842                         reg_idx--;
5843                         break;
5844                 }
5845         }
5846
5847         cb->args[2] = reg_idx;
5848         err = skb->len;
5849 out_err:
5850         rtnl_unlock();
5851         return err;
5852 }
5853
5854 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
5855 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
5856         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
5857         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
5858         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
5859         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
5860         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
5861         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
5862         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
5863 };
5864
5865 static int parse_reg_rule(struct nlattr *tb[],
5866         struct ieee80211_reg_rule *reg_rule)
5867 {
5868         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
5869         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
5870
5871         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
5872                 return -EINVAL;
5873         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
5874                 return -EINVAL;
5875         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
5876                 return -EINVAL;
5877         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
5878                 return -EINVAL;
5879         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
5880                 return -EINVAL;
5881
5882         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
5883
5884         freq_range->start_freq_khz =
5885                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
5886         freq_range->end_freq_khz =
5887                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
5888         freq_range->max_bandwidth_khz =
5889                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
5890
5891         power_rule->max_eirp =
5892                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
5893
5894         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
5895                 power_rule->max_antenna_gain =
5896                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
5897
5898         if (tb[NL80211_ATTR_DFS_CAC_TIME])
5899                 reg_rule->dfs_cac_ms =
5900                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
5901
5902         return 0;
5903 }
5904
5905 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5906 {
5907         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5908         struct nlattr *nl_reg_rule;
5909         char *alpha2;
5910         int rem_reg_rules, r;
5911         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5912         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5913         struct ieee80211_regdomain *rd;
5914
5915         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5916                 return -EINVAL;
5917
5918         if (!info->attrs[NL80211_ATTR_REG_RULES])
5919                 return -EINVAL;
5920
5921         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5922
5923         if (info->attrs[NL80211_ATTR_DFS_REGION])
5924                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5925
5926         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5927                             rem_reg_rules) {
5928                 num_rules++;
5929                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5930                         return -EINVAL;
5931         }
5932
5933         if (!reg_is_valid_request(alpha2))
5934                 return -EINVAL;
5935
5936         size_of_regd = sizeof(struct ieee80211_regdomain) +
5937                        num_rules * sizeof(struct ieee80211_reg_rule);
5938
5939         rd = kzalloc(size_of_regd, GFP_KERNEL);
5940         if (!rd)
5941                 return -ENOMEM;
5942
5943         rd->n_reg_rules = num_rules;
5944         rd->alpha2[0] = alpha2[0];
5945         rd->alpha2[1] = alpha2[1];
5946
5947         /*
5948          * Disable DFS master mode if the DFS region was
5949          * not supported or known on this kernel.
5950          */
5951         if (reg_supported_dfs_region(dfs_region))
5952                 rd->dfs_region = dfs_region;
5953
5954         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5955                             rem_reg_rules) {
5956                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5957                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5958                               reg_rule_policy);
5959                 if (r)
5960                         goto bad_reg;
5961                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5962                 if (r)
5963                         goto bad_reg;
5964
5965                 rule_idx++;
5966
5967                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5968                         r = -EINVAL;
5969                         goto bad_reg;
5970                 }
5971         }
5972
5973         /* set_regdom takes ownership of rd */
5974         return set_regdom(rd, REGD_SOURCE_CRDA);
5975  bad_reg:
5976         kfree(rd);
5977         return r;
5978 }
5979 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
5980
5981 static int validate_scan_freqs(struct nlattr *freqs)
5982 {
5983         struct nlattr *attr1, *attr2;
5984         int n_channels = 0, tmp1, tmp2;
5985
5986         nla_for_each_nested(attr1, freqs, tmp1) {
5987                 n_channels++;
5988                 /*
5989                  * Some hardware has a limited channel list for
5990                  * scanning, and it is pretty much nonsensical
5991                  * to scan for a channel twice, so disallow that
5992                  * and don't require drivers to check that the
5993                  * channel list they get isn't longer than what
5994                  * they can scan, as long as they can scan all
5995                  * the channels they registered at once.
5996                  */
5997                 nla_for_each_nested(attr2, freqs, tmp2)
5998                         if (attr1 != attr2 &&
5999                             nla_get_u32(attr1) == nla_get_u32(attr2))
6000                                 return 0;
6001         }
6002
6003         return n_channels;
6004 }
6005
6006 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6007 {
6008         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6009 }
6010
6011 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6012                             struct cfg80211_bss_selection *bss_select)
6013 {
6014         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6015         struct nlattr *nest;
6016         int err;
6017         bool found = false;
6018         int i;
6019
6020         /* only process one nested attribute */
6021         nest = nla_data(nla);
6022         if (!nla_ok(nest, nla_len(nest)))
6023                 return -EINVAL;
6024
6025         err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
6026                         nla_len(nest), nl80211_bss_select_policy);
6027         if (err)
6028                 return err;
6029
6030         /* only one attribute may be given */
6031         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6032                 if (attr[i]) {
6033                         if (found)
6034                                 return -EINVAL;
6035                         found = true;
6036                 }
6037         }
6038
6039         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6040
6041         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6042                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6043
6044         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6045                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6046                 bss_select->param.band_pref =
6047                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6048                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6049                         return -EINVAL;
6050         }
6051
6052         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6053                 struct nl80211_bss_select_rssi_adjust *adj_param;
6054
6055                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6056                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6057                 bss_select->param.adjust.band = adj_param->band;
6058                 bss_select->param.adjust.delta = adj_param->delta;
6059                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6060                         return -EINVAL;
6061         }
6062
6063         /* user-space did not provide behaviour attribute */
6064         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6065                 return -EINVAL;
6066
6067         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6068                 return -EINVAL;
6069
6070         return 0;
6071 }
6072
6073 static int nl80211_parse_random_mac(struct nlattr **attrs,
6074                                     u8 *mac_addr, u8 *mac_addr_mask)
6075 {
6076         int i;
6077
6078         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6079                 eth_zero_addr(mac_addr);
6080                 eth_zero_addr(mac_addr_mask);
6081                 mac_addr[0] = 0x2;
6082                 mac_addr_mask[0] = 0x3;
6083
6084                 return 0;
6085         }
6086
6087         /* need both or none */
6088         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6089                 return -EINVAL;
6090
6091         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6092         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6093
6094         /* don't allow or configure an mcast address */
6095         if (!is_multicast_ether_addr(mac_addr_mask) ||
6096             is_multicast_ether_addr(mac_addr))
6097                 return -EINVAL;
6098
6099         /*
6100          * allow users to pass a MAC address that has bits set outside
6101          * of the mask, but don't bother drivers with having to deal
6102          * with such bits
6103          */
6104         for (i = 0; i < ETH_ALEN; i++)
6105                 mac_addr[i] &= mac_addr_mask[i];
6106
6107         return 0;
6108 }
6109
6110 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6111 {
6112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6113         struct wireless_dev *wdev = info->user_ptr[1];
6114         struct cfg80211_scan_request *request;
6115         struct nlattr *attr;
6116         struct wiphy *wiphy;
6117         int err, tmp, n_ssids = 0, n_channels, i;
6118         size_t ie_len;
6119
6120         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6121                 return -EINVAL;
6122
6123         wiphy = &rdev->wiphy;
6124
6125         if (!rdev->ops->scan)
6126                 return -EOPNOTSUPP;
6127
6128         if (rdev->scan_req || rdev->scan_msg) {
6129                 err = -EBUSY;
6130                 goto unlock;
6131         }
6132
6133         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6134                 n_channels = validate_scan_freqs(
6135                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6136                 if (!n_channels) {
6137                         err = -EINVAL;
6138                         goto unlock;
6139                 }
6140         } else {
6141                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6142         }
6143
6144         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6145                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6146                         n_ssids++;
6147
6148         if (n_ssids > wiphy->max_scan_ssids) {
6149                 err = -EINVAL;
6150                 goto unlock;
6151         }
6152
6153         if (info->attrs[NL80211_ATTR_IE])
6154                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6155         else
6156                 ie_len = 0;
6157
6158         if (ie_len > wiphy->max_scan_ie_len) {
6159                 err = -EINVAL;
6160                 goto unlock;
6161         }
6162
6163         request = kzalloc(sizeof(*request)
6164                         + sizeof(*request->ssids) * n_ssids
6165                         + sizeof(*request->channels) * n_channels
6166                         + ie_len, GFP_KERNEL);
6167         if (!request) {
6168                 err = -ENOMEM;
6169                 goto unlock;
6170         }
6171
6172         if (n_ssids)
6173                 request->ssids = (void *)&request->channels[n_channels];
6174         request->n_ssids = n_ssids;
6175         if (ie_len) {
6176                 if (n_ssids)
6177                         request->ie = (void *)(request->ssids + n_ssids);
6178                 else
6179                         request->ie = (void *)(request->channels + n_channels);
6180         }
6181
6182         i = 0;
6183         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6184                 /* user specified, bail out if channel not found */
6185                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6186                         struct ieee80211_channel *chan;
6187
6188                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6189
6190                         if (!chan) {
6191                                 err = -EINVAL;
6192                                 goto out_free;
6193                         }
6194
6195                         /* ignore disabled channels */
6196                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6197                                 continue;
6198
6199                         request->channels[i] = chan;
6200                         i++;
6201                 }
6202         } else {
6203                 enum nl80211_band band;
6204
6205                 /* all channels */
6206                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6207                         int j;
6208
6209                         if (!wiphy->bands[band])
6210                                 continue;
6211                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6212                                 struct ieee80211_channel *chan;
6213
6214                                 chan = &wiphy->bands[band]->channels[j];
6215
6216                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6217                                         continue;
6218
6219                                 request->channels[i] = chan;
6220                                 i++;
6221                         }
6222                 }
6223         }
6224
6225         if (!i) {
6226                 err = -EINVAL;
6227                 goto out_free;
6228         }
6229
6230         request->n_channels = i;
6231
6232         i = 0;
6233         if (n_ssids) {
6234                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6235                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6236                                 err = -EINVAL;
6237                                 goto out_free;
6238                         }
6239                         request->ssids[i].ssid_len = nla_len(attr);
6240                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6241                         i++;
6242                 }
6243         }
6244
6245         if (info->attrs[NL80211_ATTR_IE]) {
6246                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6247                 memcpy((void *)request->ie,
6248                        nla_data(info->attrs[NL80211_ATTR_IE]),
6249                        request->ie_len);
6250         }
6251
6252         for (i = 0; i < NUM_NL80211_BANDS; i++)
6253                 if (wiphy->bands[i])
6254                         request->rates[i] =
6255                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6256
6257         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6258                 nla_for_each_nested(attr,
6259                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6260                                     tmp) {
6261                         enum nl80211_band band = nla_type(attr);
6262
6263                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6264                                 err = -EINVAL;
6265                                 goto out_free;
6266                         }
6267
6268                         if (!wiphy->bands[band])
6269                                 continue;
6270
6271                         err = ieee80211_get_ratemask(wiphy->bands[band],
6272                                                      nla_data(attr),
6273                                                      nla_len(attr),
6274                                                      &request->rates[band]);
6275                         if (err)
6276                                 goto out_free;
6277                 }
6278         }
6279
6280         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6281                 if (!wiphy_ext_feature_isset(wiphy,
6282                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6283                         err = -EOPNOTSUPP;
6284                         goto out_free;
6285                 }
6286
6287                 request->duration =
6288                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6289                 request->duration_mandatory =
6290                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6291         }
6292
6293         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6294                 request->flags = nla_get_u32(
6295                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6296                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6297                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6298                         err = -EOPNOTSUPP;
6299                         goto out_free;
6300                 }
6301
6302                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6303                         if (!(wiphy->features &
6304                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6305                                 err = -EOPNOTSUPP;
6306                                 goto out_free;
6307                         }
6308
6309                         if (wdev->current_bss) {
6310                                 err = -EOPNOTSUPP;
6311                                 goto out_free;
6312                         }
6313
6314                         err = nl80211_parse_random_mac(info->attrs,
6315                                                        request->mac_addr,
6316                                                        request->mac_addr_mask);
6317                         if (err)
6318                                 goto out_free;
6319                 }
6320         }
6321
6322         request->no_cck =
6323                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6324
6325         if (info->attrs[NL80211_ATTR_MAC])
6326                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6327                        ETH_ALEN);
6328         else
6329                 eth_broadcast_addr(request->bssid);
6330
6331         request->wdev = wdev;
6332         request->wiphy = &rdev->wiphy;
6333         request->scan_start = jiffies;
6334
6335         rdev->scan_req = request;
6336         err = rdev_scan(rdev, request);
6337
6338         if (!err) {
6339                 nl80211_send_scan_start(rdev, wdev);
6340                 if (wdev->netdev)
6341                         dev_hold(wdev->netdev);
6342         } else {
6343  out_free:
6344                 rdev->scan_req = NULL;
6345                 kfree(request);
6346         }
6347
6348  unlock:
6349         return err;
6350 }
6351
6352 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6353 {
6354         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6355         struct wireless_dev *wdev = info->user_ptr[1];
6356
6357         if (!rdev->ops->abort_scan)
6358                 return -EOPNOTSUPP;
6359
6360         if (rdev->scan_msg)
6361                 return 0;
6362
6363         if (!rdev->scan_req)
6364                 return -ENOENT;
6365
6366         rdev_abort_scan(rdev, wdev);
6367         return 0;
6368 }
6369
6370 static int
6371 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6372                                struct cfg80211_sched_scan_request *request,
6373                                struct nlattr **attrs)
6374 {
6375         int tmp, err, i = 0;
6376         struct nlattr *attr;
6377
6378         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6379                 u32 interval;
6380
6381                 /*
6382                  * If scan plans are not specified,
6383                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6384                  * case one scan plan will be set with the specified scan
6385                  * interval and infinite number of iterations.
6386                  */
6387                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6388                         return -EINVAL;
6389
6390                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6391                 if (!interval)
6392                         return -EINVAL;
6393
6394                 request->scan_plans[0].interval =
6395                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6396                 if (!request->scan_plans[0].interval)
6397                         return -EINVAL;
6398
6399                 if (request->scan_plans[0].interval >
6400                     wiphy->max_sched_scan_plan_interval)
6401                         request->scan_plans[0].interval =
6402                                 wiphy->max_sched_scan_plan_interval;
6403
6404                 return 0;
6405         }
6406
6407         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6408                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6409
6410                 if (WARN_ON(i >= n_plans))
6411                         return -EINVAL;
6412
6413                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6414                                 nla_data(attr), nla_len(attr),
6415                                 nl80211_plan_policy);
6416                 if (err)
6417                         return err;
6418
6419                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6420                         return -EINVAL;
6421
6422                 request->scan_plans[i].interval =
6423                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6424                 if (!request->scan_plans[i].interval ||
6425                     request->scan_plans[i].interval >
6426                     wiphy->max_sched_scan_plan_interval)
6427                         return -EINVAL;
6428
6429                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6430                         request->scan_plans[i].iterations =
6431                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6432                         if (!request->scan_plans[i].iterations ||
6433                             (request->scan_plans[i].iterations >
6434                              wiphy->max_sched_scan_plan_iterations))
6435                                 return -EINVAL;
6436                 } else if (i < n_plans - 1) {
6437                         /*
6438                          * All scan plans but the last one must specify
6439                          * a finite number of iterations
6440                          */
6441                         return -EINVAL;
6442                 }
6443
6444                 i++;
6445         }
6446
6447         /*
6448          * The last scan plan must not specify the number of
6449          * iterations, it is supposed to run infinitely
6450          */
6451         if (request->scan_plans[n_plans - 1].iterations)
6452                 return  -EINVAL;
6453
6454         return 0;
6455 }
6456
6457 static struct cfg80211_sched_scan_request *
6458 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6459                          struct nlattr **attrs)
6460 {
6461         struct cfg80211_sched_scan_request *request;
6462         struct nlattr *attr;
6463         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6464         enum nl80211_band band;
6465         size_t ie_len;
6466         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6467         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6468
6469         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6470                 return ERR_PTR(-EINVAL);
6471
6472         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6473                 n_channels = validate_scan_freqs(
6474                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6475                 if (!n_channels)
6476                         return ERR_PTR(-EINVAL);
6477         } else {
6478                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6479         }
6480
6481         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6482                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6483                                     tmp)
6484                         n_ssids++;
6485
6486         if (n_ssids > wiphy->max_sched_scan_ssids)
6487                 return ERR_PTR(-EINVAL);
6488
6489         /*
6490          * First, count the number of 'real' matchsets. Due to an issue with
6491          * the old implementation, matchsets containing only the RSSI attribute
6492          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6493          * RSSI for all matchsets, rather than their own matchset for reporting
6494          * all APs with a strong RSSI. This is needed to be compatible with
6495          * older userspace that treated a matchset with only the RSSI as the
6496          * global RSSI for all other matchsets - if there are other matchsets.
6497          */
6498         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6499                 nla_for_each_nested(attr,
6500                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6501                                     tmp) {
6502                         struct nlattr *rssi;
6503
6504                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6505                                         nla_data(attr), nla_len(attr),
6506                                         nl80211_match_policy);
6507                         if (err)
6508                                 return ERR_PTR(err);
6509                         /* add other standalone attributes here */
6510                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6511                                 n_match_sets++;
6512                                 continue;
6513                         }
6514                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6515                         if (rssi)
6516                                 default_match_rssi = nla_get_s32(rssi);
6517                 }
6518         }
6519
6520         /* However, if there's no other matchset, add the RSSI one */
6521         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6522                 n_match_sets = 1;
6523
6524         if (n_match_sets > wiphy->max_match_sets)
6525                 return ERR_PTR(-EINVAL);
6526
6527         if (attrs[NL80211_ATTR_IE])
6528                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6529         else
6530                 ie_len = 0;
6531
6532         if (ie_len > wiphy->max_sched_scan_ie_len)
6533                 return ERR_PTR(-EINVAL);
6534
6535         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6536                 /*
6537                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6538                  * each scan plan already specifies its own interval
6539                  */
6540                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6541                         return ERR_PTR(-EINVAL);
6542
6543                 nla_for_each_nested(attr,
6544                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6545                         n_plans++;
6546         } else {
6547                 /*
6548                  * The scan interval attribute is kept for backward
6549                  * compatibility. If no scan plans are specified and sched scan
6550                  * interval is specified, one scan plan will be set with this
6551                  * scan interval and infinite number of iterations.
6552                  */
6553                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6554                         return ERR_PTR(-EINVAL);
6555
6556                 n_plans = 1;
6557         }
6558
6559         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6560                 return ERR_PTR(-EINVAL);
6561
6562         request = kzalloc(sizeof(*request)
6563                         + sizeof(*request->ssids) * n_ssids
6564                         + sizeof(*request->match_sets) * n_match_sets
6565                         + sizeof(*request->scan_plans) * n_plans
6566                         + sizeof(*request->channels) * n_channels
6567                         + ie_len, GFP_KERNEL);
6568         if (!request)
6569                 return ERR_PTR(-ENOMEM);
6570
6571         if (n_ssids)
6572                 request->ssids = (void *)&request->channels[n_channels];
6573         request->n_ssids = n_ssids;
6574         if (ie_len) {
6575                 if (n_ssids)
6576                         request->ie = (void *)(request->ssids + n_ssids);
6577                 else
6578                         request->ie = (void *)(request->channels + n_channels);
6579         }
6580
6581         if (n_match_sets) {
6582                 if (request->ie)
6583                         request->match_sets = (void *)(request->ie + ie_len);
6584                 else if (n_ssids)
6585                         request->match_sets =
6586                                 (void *)(request->ssids + n_ssids);
6587                 else
6588                         request->match_sets =
6589                                 (void *)(request->channels + n_channels);
6590         }
6591         request->n_match_sets = n_match_sets;
6592
6593         if (n_match_sets)
6594                 request->scan_plans = (void *)(request->match_sets +
6595                                                n_match_sets);
6596         else if (request->ie)
6597                 request->scan_plans = (void *)(request->ie + ie_len);
6598         else if (n_ssids)
6599                 request->scan_plans = (void *)(request->ssids + n_ssids);
6600         else
6601                 request->scan_plans = (void *)(request->channels + n_channels);
6602
6603         request->n_scan_plans = n_plans;
6604
6605         i = 0;
6606         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6607                 /* user specified, bail out if channel not found */
6608                 nla_for_each_nested(attr,
6609                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6610                                     tmp) {
6611                         struct ieee80211_channel *chan;
6612
6613                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6614
6615                         if (!chan) {
6616                                 err = -EINVAL;
6617                                 goto out_free;
6618                         }
6619
6620                         /* ignore disabled channels */
6621                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6622                                 continue;
6623
6624                         request->channels[i] = chan;
6625                         i++;
6626                 }
6627         } else {
6628                 /* all channels */
6629                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6630                         int j;
6631
6632                         if (!wiphy->bands[band])
6633                                 continue;
6634                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6635                                 struct ieee80211_channel *chan;
6636
6637                                 chan = &wiphy->bands[band]->channels[j];
6638
6639                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6640                                         continue;
6641
6642                                 request->channels[i] = chan;
6643                                 i++;
6644                         }
6645                 }
6646         }
6647
6648         if (!i) {
6649                 err = -EINVAL;
6650                 goto out_free;
6651         }
6652
6653         request->n_channels = i;
6654
6655         i = 0;
6656         if (n_ssids) {
6657                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6658                                     tmp) {
6659                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6660                                 err = -EINVAL;
6661                                 goto out_free;
6662                         }
6663                         request->ssids[i].ssid_len = nla_len(attr);
6664                         memcpy(request->ssids[i].ssid, nla_data(attr),
6665                                nla_len(attr));
6666                         i++;
6667                 }
6668         }
6669
6670         i = 0;
6671         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6672                 nla_for_each_nested(attr,
6673                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6674                                     tmp) {
6675                         struct nlattr *ssid, *rssi;
6676
6677                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6678                                         nla_data(attr), nla_len(attr),
6679                                         nl80211_match_policy);
6680                         if (err)
6681                                 goto out_free;
6682                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6683                         if (ssid) {
6684                                 if (WARN_ON(i >= n_match_sets)) {
6685                                         /* this indicates a programming error,
6686                                          * the loop above should have verified
6687                                          * things properly
6688                                          */
6689                                         err = -EINVAL;
6690                                         goto out_free;
6691                                 }
6692
6693                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6694                                         err = -EINVAL;
6695                                         goto out_free;
6696                                 }
6697                                 memcpy(request->match_sets[i].ssid.ssid,
6698                                        nla_data(ssid), nla_len(ssid));
6699                                 request->match_sets[i].ssid.ssid_len =
6700                                         nla_len(ssid);
6701                                 /* special attribute - old implementation w/a */
6702                                 request->match_sets[i].rssi_thold =
6703                                         default_match_rssi;
6704                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6705                                 if (rssi)
6706                                         request->match_sets[i].rssi_thold =
6707                                                 nla_get_s32(rssi);
6708                         }
6709                         i++;
6710                 }
6711
6712                 /* there was no other matchset, so the RSSI one is alone */
6713                 if (i == 0 && n_match_sets)
6714                         request->match_sets[0].rssi_thold = default_match_rssi;
6715
6716                 request->min_rssi_thold = INT_MAX;
6717                 for (i = 0; i < n_match_sets; i++)
6718                         request->min_rssi_thold =
6719                                 min(request->match_sets[i].rssi_thold,
6720                                     request->min_rssi_thold);
6721         } else {
6722                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6723         }
6724
6725         if (ie_len) {
6726                 request->ie_len = ie_len;
6727                 memcpy((void *)request->ie,
6728                        nla_data(attrs[NL80211_ATTR_IE]),
6729                        request->ie_len);
6730         }
6731
6732         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6733                 request->flags = nla_get_u32(
6734                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6735                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6736                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6737                         err = -EOPNOTSUPP;
6738                         goto out_free;
6739                 }
6740
6741                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6742                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6743
6744                         if (!wdev) /* must be net-detect */
6745                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6746
6747                         if (!(wiphy->features & flg)) {
6748                                 err = -EOPNOTSUPP;
6749                                 goto out_free;
6750                         }
6751
6752                         if (wdev && wdev->current_bss) {
6753                                 err = -EOPNOTSUPP;
6754                                 goto out_free;
6755                         }
6756
6757                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6758                                                        request->mac_addr_mask);
6759                         if (err)
6760                                 goto out_free;
6761                 }
6762         }
6763
6764         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6765                 request->delay =
6766                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6767
6768         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6769         if (err)
6770                 goto out_free;
6771
6772         request->scan_start = jiffies;
6773
6774         return request;
6775
6776 out_free:
6777         kfree(request);
6778         return ERR_PTR(err);
6779 }
6780
6781 static int nl80211_start_sched_scan(struct sk_buff *skb,
6782                                     struct genl_info *info)
6783 {
6784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6785         struct net_device *dev = info->user_ptr[1];
6786         struct wireless_dev *wdev = dev->ieee80211_ptr;
6787         struct cfg80211_sched_scan_request *sched_scan_req;
6788         int err;
6789
6790         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6791             !rdev->ops->sched_scan_start)
6792                 return -EOPNOTSUPP;
6793
6794         if (rdev->sched_scan_req)
6795                 return -EINPROGRESS;
6796
6797         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6798                                                   info->attrs);
6799
6800         err = PTR_ERR_OR_ZERO(sched_scan_req);
6801         if (err)
6802                 goto out_err;
6803
6804         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6805         if (err)
6806                 goto out_free;
6807
6808         sched_scan_req->dev = dev;
6809         sched_scan_req->wiphy = &rdev->wiphy;
6810
6811         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6812                 sched_scan_req->owner_nlportid = info->snd_portid;
6813
6814         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6815
6816         nl80211_send_sched_scan(rdev, dev,
6817                                 NL80211_CMD_START_SCHED_SCAN);
6818         return 0;
6819
6820 out_free:
6821         kfree(sched_scan_req);
6822 out_err:
6823         return err;
6824 }
6825
6826 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6827                                    struct genl_info *info)
6828 {
6829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6830
6831         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6832             !rdev->ops->sched_scan_stop)
6833                 return -EOPNOTSUPP;
6834
6835         return __cfg80211_stop_sched_scan(rdev, false);
6836 }
6837
6838 static int nl80211_start_radar_detection(struct sk_buff *skb,
6839                                          struct genl_info *info)
6840 {
6841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6842         struct net_device *dev = info->user_ptr[1];
6843         struct wireless_dev *wdev = dev->ieee80211_ptr;
6844         struct cfg80211_chan_def chandef;
6845         enum nl80211_dfs_regions dfs_region;
6846         unsigned int cac_time_ms;
6847         int err;
6848
6849         dfs_region = reg_get_dfs_region(wdev->wiphy);
6850         if (dfs_region == NL80211_DFS_UNSET)
6851                 return -EINVAL;
6852
6853         err = nl80211_parse_chandef(rdev, info, &chandef);
6854         if (err)
6855                 return err;
6856
6857         if (netif_carrier_ok(dev))
6858                 return -EBUSY;
6859
6860         if (wdev->cac_started)
6861                 return -EBUSY;
6862
6863         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6864                                             wdev->iftype);
6865         if (err < 0)
6866                 return err;
6867
6868         if (err == 0)
6869                 return -EINVAL;
6870
6871         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6872                 return -EINVAL;
6873
6874         if (!rdev->ops->start_radar_detection)
6875                 return -EOPNOTSUPP;
6876
6877         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6878         if (WARN_ON(!cac_time_ms))
6879                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6880
6881         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
6882         if (!err) {
6883                 wdev->chandef = chandef;
6884                 wdev->cac_started = true;
6885                 wdev->cac_start_time = jiffies;
6886                 wdev->cac_time_ms = cac_time_ms;
6887         }
6888         return err;
6889 }
6890
6891 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6892 {
6893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6894         struct net_device *dev = info->user_ptr[1];
6895         struct wireless_dev *wdev = dev->ieee80211_ptr;
6896         struct cfg80211_csa_settings params;
6897         /* csa_attrs is defined static to avoid waste of stack size - this
6898          * function is called under RTNL lock, so this should not be a problem.
6899          */
6900         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6901         int err;
6902         bool need_new_beacon = false;
6903         int len, i;
6904         u32 cs_count;
6905
6906         if (!rdev->ops->channel_switch ||
6907             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6908                 return -EOPNOTSUPP;
6909
6910         switch (dev->ieee80211_ptr->iftype) {
6911         case NL80211_IFTYPE_AP:
6912         case NL80211_IFTYPE_P2P_GO:
6913                 need_new_beacon = true;
6914
6915                 /* useless if AP is not running */
6916                 if (!wdev->beacon_interval)
6917                         return -ENOTCONN;
6918                 break;
6919         case NL80211_IFTYPE_ADHOC:
6920                 if (!wdev->ssid_len)
6921                         return -ENOTCONN;
6922                 break;
6923         case NL80211_IFTYPE_MESH_POINT:
6924                 if (!wdev->mesh_id_len)
6925                         return -ENOTCONN;
6926                 break;
6927         default:
6928                 return -EOPNOTSUPP;
6929         }
6930
6931         memset(&params, 0, sizeof(params));
6932
6933         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6934             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6935                 return -EINVAL;
6936
6937         /* only important for AP, IBSS and mesh create IEs internally */
6938         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6939                 return -EINVAL;
6940
6941         /* Even though the attribute is u32, the specification says
6942          * u8, so let's make sure we don't overflow.
6943          */
6944         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6945         if (cs_count > 255)
6946                 return -EINVAL;
6947
6948         params.count = cs_count;
6949
6950         if (!need_new_beacon)
6951                 goto skip_beacons;
6952
6953         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6954         if (err)
6955                 return err;
6956
6957         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6958                                info->attrs[NL80211_ATTR_CSA_IES],
6959                                nl80211_policy);
6960         if (err)
6961                 return err;
6962
6963         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6964         if (err)
6965                 return err;
6966
6967         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6968                 return -EINVAL;
6969
6970         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6971         if (!len || (len % sizeof(u16)))
6972                 return -EINVAL;
6973
6974         params.n_counter_offsets_beacon = len / sizeof(u16);
6975         if (rdev->wiphy.max_num_csa_counters &&
6976             (params.n_counter_offsets_beacon >
6977              rdev->wiphy.max_num_csa_counters))
6978                 return -EINVAL;
6979
6980         params.counter_offsets_beacon =
6981                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6982
6983         /* sanity checks - counters should fit and be the same */
6984         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6985                 u16 offset = params.counter_offsets_beacon[i];
6986
6987                 if (offset >= params.beacon_csa.tail_len)
6988                         return -EINVAL;
6989
6990                 if (params.beacon_csa.tail[offset] != params.count)
6991                         return -EINVAL;
6992         }
6993
6994         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6995                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6996                 if (!len || (len % sizeof(u16)))
6997                         return -EINVAL;
6998
6999                 params.n_counter_offsets_presp = len / sizeof(u16);
7000                 if (rdev->wiphy.max_num_csa_counters &&
7001                     (params.n_counter_offsets_beacon >
7002                      rdev->wiphy.max_num_csa_counters))
7003                         return -EINVAL;
7004
7005                 params.counter_offsets_presp =
7006                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7007
7008                 /* sanity checks - counters should fit and be the same */
7009                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7010                         u16 offset = params.counter_offsets_presp[i];
7011
7012                         if (offset >= params.beacon_csa.probe_resp_len)
7013                                 return -EINVAL;
7014
7015                         if (params.beacon_csa.probe_resp[offset] !=
7016                             params.count)
7017                                 return -EINVAL;
7018                 }
7019         }
7020
7021 skip_beacons:
7022         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7023         if (err)
7024                 return err;
7025
7026         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7027                                            wdev->iftype))
7028                 return -EINVAL;
7029
7030         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7031                                             &params.chandef,
7032                                             wdev->iftype);
7033         if (err < 0)
7034                 return err;
7035
7036         if (err > 0)
7037                 params.radar_required = true;
7038
7039         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7040                 params.block_tx = true;
7041
7042         wdev_lock(wdev);
7043         err = rdev_channel_switch(rdev, dev, &params);
7044         wdev_unlock(wdev);
7045
7046         return err;
7047 }
7048
7049 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7050                             u32 seq, int flags,
7051                             struct cfg80211_registered_device *rdev,
7052                             struct wireless_dev *wdev,
7053                             struct cfg80211_internal_bss *intbss)
7054 {
7055         struct cfg80211_bss *res = &intbss->pub;
7056         const struct cfg80211_bss_ies *ies;
7057         void *hdr;
7058         struct nlattr *bss;
7059
7060         ASSERT_WDEV_LOCK(wdev);
7061
7062         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7063                              NL80211_CMD_NEW_SCAN_RESULTS);
7064         if (!hdr)
7065                 return -1;
7066
7067         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7068
7069         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7070                 goto nla_put_failure;
7071         if (wdev->netdev &&
7072             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7073                 goto nla_put_failure;
7074         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7075                               NL80211_ATTR_PAD))
7076                 goto nla_put_failure;
7077
7078         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7079         if (!bss)
7080                 goto nla_put_failure;
7081         if ((!is_zero_ether_addr(res->bssid) &&
7082              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7083                 goto nla_put_failure;
7084
7085         rcu_read_lock();
7086         /* indicate whether we have probe response data or not */
7087         if (rcu_access_pointer(res->proberesp_ies) &&
7088             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7089                 goto fail_unlock_rcu;
7090
7091         /* this pointer prefers to be pointed to probe response data
7092          * but is always valid
7093          */
7094         ies = rcu_dereference(res->ies);
7095         if (ies) {
7096                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7097                                       NL80211_BSS_PAD))
7098                         goto fail_unlock_rcu;
7099                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7100                                         ies->len, ies->data))
7101                         goto fail_unlock_rcu;
7102         }
7103
7104         /* and this pointer is always (unless driver didn't know) beacon data */
7105         ies = rcu_dereference(res->beacon_ies);
7106         if (ies && ies->from_beacon) {
7107                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7108                                       NL80211_BSS_PAD))
7109                         goto fail_unlock_rcu;
7110                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7111                                         ies->len, ies->data))
7112                         goto fail_unlock_rcu;
7113         }
7114         rcu_read_unlock();
7115
7116         if (res->beacon_interval &&
7117             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7118                 goto nla_put_failure;
7119         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7120             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7121             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7122             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7123                         jiffies_to_msecs(jiffies - intbss->ts)))
7124                 goto nla_put_failure;
7125
7126         if (intbss->parent_tsf &&
7127             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7128                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7129              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7130                      intbss->parent_bssid)))
7131                 goto nla_put_failure;
7132
7133         if (intbss->ts_boottime &&
7134             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7135                               intbss->ts_boottime, NL80211_BSS_PAD))
7136                 goto nla_put_failure;
7137
7138         switch (rdev->wiphy.signal_type) {
7139         case CFG80211_SIGNAL_TYPE_MBM:
7140                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7141                         goto nla_put_failure;
7142                 break;
7143         case CFG80211_SIGNAL_TYPE_UNSPEC:
7144                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7145                         goto nla_put_failure;
7146                 break;
7147         default:
7148                 break;
7149         }
7150
7151         switch (wdev->iftype) {
7152         case NL80211_IFTYPE_P2P_CLIENT:
7153         case NL80211_IFTYPE_STATION:
7154                 if (intbss == wdev->current_bss &&
7155                     nla_put_u32(msg, NL80211_BSS_STATUS,
7156                                 NL80211_BSS_STATUS_ASSOCIATED))
7157                         goto nla_put_failure;
7158                 break;
7159         case NL80211_IFTYPE_ADHOC:
7160                 if (intbss == wdev->current_bss &&
7161                     nla_put_u32(msg, NL80211_BSS_STATUS,
7162                                 NL80211_BSS_STATUS_IBSS_JOINED))
7163                         goto nla_put_failure;
7164                 break;
7165         default:
7166                 break;
7167         }
7168
7169         nla_nest_end(msg, bss);
7170
7171         genlmsg_end(msg, hdr);
7172         return 0;
7173
7174  fail_unlock_rcu:
7175         rcu_read_unlock();
7176  nla_put_failure:
7177         genlmsg_cancel(msg, hdr);
7178         return -EMSGSIZE;
7179 }
7180
7181 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7182 {
7183         struct cfg80211_registered_device *rdev;
7184         struct cfg80211_internal_bss *scan;
7185         struct wireless_dev *wdev;
7186         int start = cb->args[2], idx = 0;
7187         int err;
7188
7189         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7190         if (err)
7191                 return err;
7192
7193         wdev_lock(wdev);
7194         spin_lock_bh(&rdev->bss_lock);
7195         cfg80211_bss_expire(rdev);
7196
7197         cb->seq = rdev->bss_generation;
7198
7199         list_for_each_entry(scan, &rdev->bss_list, list) {
7200                 if (++idx <= start)
7201                         continue;
7202                 if (nl80211_send_bss(skb, cb,
7203                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7204                                 rdev, wdev, scan) < 0) {
7205                         idx--;
7206                         break;
7207                 }
7208         }
7209
7210         spin_unlock_bh(&rdev->bss_lock);
7211         wdev_unlock(wdev);
7212
7213         cb->args[2] = idx;
7214         nl80211_finish_wdev_dump(rdev);
7215
7216         return skb->len;
7217 }
7218
7219 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7220                                int flags, struct net_device *dev,
7221                                bool allow_radio_stats,
7222                                struct survey_info *survey)
7223 {
7224         void *hdr;
7225         struct nlattr *infoattr;
7226
7227         /* skip radio stats if userspace didn't request them */
7228         if (!survey->channel && !allow_radio_stats)
7229                 return 0;
7230
7231         hdr = nl80211hdr_put(msg, portid, seq, flags,
7232                              NL80211_CMD_NEW_SURVEY_RESULTS);
7233         if (!hdr)
7234                 return -ENOMEM;
7235
7236         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7237                 goto nla_put_failure;
7238
7239         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7240         if (!infoattr)
7241                 goto nla_put_failure;
7242
7243         if (survey->channel &&
7244             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7245                         survey->channel->center_freq))
7246                 goto nla_put_failure;
7247
7248         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7249             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7250                 goto nla_put_failure;
7251         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7252             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7253                 goto nla_put_failure;
7254         if ((survey->filled & SURVEY_INFO_TIME) &&
7255             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7256                         survey->time, NL80211_SURVEY_INFO_PAD))
7257                 goto nla_put_failure;
7258         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7259             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7260                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7261                 goto nla_put_failure;
7262         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7263             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7264                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7265                 goto nla_put_failure;
7266         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7267             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7268                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7269                 goto nla_put_failure;
7270         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7271             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7272                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7273                 goto nla_put_failure;
7274         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7275             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7276                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7277                 goto nla_put_failure;
7278
7279         nla_nest_end(msg, infoattr);
7280
7281         genlmsg_end(msg, hdr);
7282         return 0;
7283
7284  nla_put_failure:
7285         genlmsg_cancel(msg, hdr);
7286         return -EMSGSIZE;
7287 }
7288
7289 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7290 {
7291         struct survey_info survey;
7292         struct cfg80211_registered_device *rdev;
7293         struct wireless_dev *wdev;
7294         int survey_idx = cb->args[2];
7295         int res;
7296         bool radio_stats;
7297
7298         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7299         if (res)
7300                 return res;
7301
7302         /* prepare_wdev_dump parsed the attributes */
7303         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7304
7305         if (!wdev->netdev) {
7306                 res = -EINVAL;
7307                 goto out_err;
7308         }
7309
7310         if (!rdev->ops->dump_survey) {
7311                 res = -EOPNOTSUPP;
7312                 goto out_err;
7313         }
7314
7315         while (1) {
7316                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7317                 if (res == -ENOENT)
7318                         break;
7319                 if (res)
7320                         goto out_err;
7321
7322                 /* don't send disabled channels, but do send non-channel data */
7323                 if (survey.channel &&
7324                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7325                         survey_idx++;
7326                         continue;
7327                 }
7328
7329                 if (nl80211_send_survey(skb,
7330                                 NETLINK_CB(cb->skb).portid,
7331                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7332                                 wdev->netdev, radio_stats, &survey) < 0)
7333                         goto out;
7334                 survey_idx++;
7335         }
7336
7337  out:
7338         cb->args[2] = survey_idx;
7339         res = skb->len;
7340  out_err:
7341         nl80211_finish_wdev_dump(rdev);
7342         return res;
7343 }
7344
7345 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7346 {
7347         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7348                                   NL80211_WPA_VERSION_2));
7349 }
7350
7351 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7352 {
7353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7354         struct net_device *dev = info->user_ptr[1];
7355         struct ieee80211_channel *chan;
7356         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7357         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7358         enum nl80211_auth_type auth_type;
7359         struct key_parse key;
7360         bool local_state_change;
7361
7362         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7363                 return -EINVAL;
7364
7365         if (!info->attrs[NL80211_ATTR_MAC])
7366                 return -EINVAL;
7367
7368         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7369                 return -EINVAL;
7370
7371         if (!info->attrs[NL80211_ATTR_SSID])
7372                 return -EINVAL;
7373
7374         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7375                 return -EINVAL;
7376
7377         err = nl80211_parse_key(info, &key);
7378         if (err)
7379                 return err;
7380
7381         if (key.idx >= 0) {
7382                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7383                         return -EINVAL;
7384                 if (!key.p.key || !key.p.key_len)
7385                         return -EINVAL;
7386                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7387                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7388                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7389                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7390                         return -EINVAL;
7391                 if (key.idx > 3)
7392                         return -EINVAL;
7393         } else {
7394                 key.p.key_len = 0;
7395                 key.p.key = NULL;
7396         }
7397
7398         if (key.idx >= 0) {
7399                 int i;
7400                 bool ok = false;
7401
7402                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7403                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7404                                 ok = true;
7405                                 break;
7406                         }
7407                 }
7408                 if (!ok)
7409                         return -EINVAL;
7410         }
7411
7412         if (!rdev->ops->auth)
7413                 return -EOPNOTSUPP;
7414
7415         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7416             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7417                 return -EOPNOTSUPP;
7418
7419         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7420         chan = nl80211_get_valid_chan(&rdev->wiphy,
7421                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7422         if (!chan)
7423                 return -EINVAL;
7424
7425         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7426         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7427
7428         if (info->attrs[NL80211_ATTR_IE]) {
7429                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7430                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7431         }
7432
7433         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7434         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7435                 return -EINVAL;
7436
7437         if (auth_type == NL80211_AUTHTYPE_SAE &&
7438             !info->attrs[NL80211_ATTR_SAE_DATA])
7439                 return -EINVAL;
7440
7441         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7442                 if (auth_type != NL80211_AUTHTYPE_SAE)
7443                         return -EINVAL;
7444                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7445                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7446                 /* need to include at least Auth Transaction and Status Code */
7447                 if (sae_data_len < 4)
7448                         return -EINVAL;
7449         }
7450
7451         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7452
7453         /*
7454          * Since we no longer track auth state, ignore
7455          * requests to only change local state.
7456          */
7457         if (local_state_change)
7458                 return 0;
7459
7460         wdev_lock(dev->ieee80211_ptr);
7461         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7462                                  ssid, ssid_len, ie, ie_len,
7463                                  key.p.key, key.p.key_len, key.idx,
7464                                  sae_data, sae_data_len);
7465         wdev_unlock(dev->ieee80211_ptr);
7466         return err;
7467 }
7468
7469 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7470                                    struct genl_info *info,
7471                                    struct cfg80211_crypto_settings *settings,
7472                                    int cipher_limit)
7473 {
7474         memset(settings, 0, sizeof(*settings));
7475
7476         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7477
7478         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7479                 u16 proto;
7480
7481                 proto = nla_get_u16(
7482                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7483                 settings->control_port_ethertype = cpu_to_be16(proto);
7484                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7485                     proto != ETH_P_PAE)
7486                         return -EINVAL;
7487                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7488                         settings->control_port_no_encrypt = true;
7489         } else
7490                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7491
7492         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7493                 void *data;
7494                 int len, i;
7495
7496                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7497                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7498                 settings->n_ciphers_pairwise = len / sizeof(u32);
7499
7500                 if (len % sizeof(u32))
7501                         return -EINVAL;
7502
7503                 if (settings->n_ciphers_pairwise > cipher_limit)
7504                         return -EINVAL;
7505
7506                 memcpy(settings->ciphers_pairwise, data, len);
7507
7508                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7509                         if (!cfg80211_supported_cipher_suite(
7510                                         &rdev->wiphy,
7511                                         settings->ciphers_pairwise[i]))
7512                                 return -EINVAL;
7513         }
7514
7515         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7516                 settings->cipher_group =
7517                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7518                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7519                                                      settings->cipher_group))
7520                         return -EINVAL;
7521         }
7522
7523         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7524                 settings->wpa_versions =
7525                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7526                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7527                         return -EINVAL;
7528         }
7529
7530         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7531                 void *data;
7532                 int len;
7533
7534                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7535                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7536                 settings->n_akm_suites = len / sizeof(u32);
7537
7538                 if (len % sizeof(u32))
7539                         return -EINVAL;
7540
7541                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7542                         return -EINVAL;
7543
7544                 memcpy(settings->akm_suites, data, len);
7545         }
7546
7547         return 0;
7548 }
7549
7550 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7551 {
7552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7553         struct net_device *dev = info->user_ptr[1];
7554         struct ieee80211_channel *chan;
7555         struct cfg80211_assoc_request req = {};
7556         const u8 *bssid, *ssid;
7557         int err, ssid_len = 0;
7558
7559         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7560                 return -EINVAL;
7561
7562         if (!info->attrs[NL80211_ATTR_MAC] ||
7563             !info->attrs[NL80211_ATTR_SSID] ||
7564             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7565                 return -EINVAL;
7566
7567         if (!rdev->ops->assoc)
7568                 return -EOPNOTSUPP;
7569
7570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7572                 return -EOPNOTSUPP;
7573
7574         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7575
7576         chan = nl80211_get_valid_chan(&rdev->wiphy,
7577                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7578         if (!chan)
7579                 return -EINVAL;
7580
7581         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7582         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7583
7584         if (info->attrs[NL80211_ATTR_IE]) {
7585                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7586                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7587         }
7588
7589         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7590                 enum nl80211_mfp mfp =
7591                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7592                 if (mfp == NL80211_MFP_REQUIRED)
7593                         req.use_mfp = true;
7594                 else if (mfp != NL80211_MFP_NO)
7595                         return -EINVAL;
7596         }
7597
7598         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7599                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7600
7601         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7602                 req.flags |= ASSOC_REQ_DISABLE_HT;
7603
7604         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7605                 memcpy(&req.ht_capa_mask,
7606                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7607                        sizeof(req.ht_capa_mask));
7608
7609         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7610                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7611                         return -EINVAL;
7612                 memcpy(&req.ht_capa,
7613                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7614                        sizeof(req.ht_capa));
7615         }
7616
7617         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7618                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7619
7620         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7621                 memcpy(&req.vht_capa_mask,
7622                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7623                        sizeof(req.vht_capa_mask));
7624
7625         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7626                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7627                         return -EINVAL;
7628                 memcpy(&req.vht_capa,
7629                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7630                        sizeof(req.vht_capa));
7631         }
7632
7633         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7634                 if (!((rdev->wiphy.features &
7635                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
7636                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
7637                     !wiphy_ext_feature_isset(&rdev->wiphy,
7638                                              NL80211_EXT_FEATURE_RRM))
7639                         return -EINVAL;
7640                 req.flags |= ASSOC_REQ_USE_RRM;
7641         }
7642
7643         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7644         if (!err) {
7645                 wdev_lock(dev->ieee80211_ptr);
7646                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7647                                           ssid, ssid_len, &req);
7648                 wdev_unlock(dev->ieee80211_ptr);
7649         }
7650
7651         return err;
7652 }
7653
7654 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7655 {
7656         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7657         struct net_device *dev = info->user_ptr[1];
7658         const u8 *ie = NULL, *bssid;
7659         int ie_len = 0, err;
7660         u16 reason_code;
7661         bool local_state_change;
7662
7663         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7664                 return -EINVAL;
7665
7666         if (!info->attrs[NL80211_ATTR_MAC])
7667                 return -EINVAL;
7668
7669         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7670                 return -EINVAL;
7671
7672         if (!rdev->ops->deauth)
7673                 return -EOPNOTSUPP;
7674
7675         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7676             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7677                 return -EOPNOTSUPP;
7678
7679         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7680
7681         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7682         if (reason_code == 0) {
7683                 /* Reason Code 0 is reserved */
7684                 return -EINVAL;
7685         }
7686
7687         if (info->attrs[NL80211_ATTR_IE]) {
7688                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7689                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7690         }
7691
7692         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7693
7694         wdev_lock(dev->ieee80211_ptr);
7695         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7696                                    local_state_change);
7697         wdev_unlock(dev->ieee80211_ptr);
7698         return err;
7699 }
7700
7701 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7702 {
7703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7704         struct net_device *dev = info->user_ptr[1];
7705         const u8 *ie = NULL, *bssid;
7706         int ie_len = 0, err;
7707         u16 reason_code;
7708         bool local_state_change;
7709
7710         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7711                 return -EINVAL;
7712
7713         if (!info->attrs[NL80211_ATTR_MAC])
7714                 return -EINVAL;
7715
7716         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7717                 return -EINVAL;
7718
7719         if (!rdev->ops->disassoc)
7720                 return -EOPNOTSUPP;
7721
7722         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7723             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7724                 return -EOPNOTSUPP;
7725
7726         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7727
7728         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7729         if (reason_code == 0) {
7730                 /* Reason Code 0 is reserved */
7731                 return -EINVAL;
7732         }
7733
7734         if (info->attrs[NL80211_ATTR_IE]) {
7735                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7736                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7737         }
7738
7739         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7740
7741         wdev_lock(dev->ieee80211_ptr);
7742         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7743                                      local_state_change);
7744         wdev_unlock(dev->ieee80211_ptr);
7745         return err;
7746 }
7747
7748 static bool
7749 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7750                          int mcast_rate[NUM_NL80211_BANDS],
7751                          int rateval)
7752 {
7753         struct wiphy *wiphy = &rdev->wiphy;
7754         bool found = false;
7755         int band, i;
7756
7757         for (band = 0; band < NUM_NL80211_BANDS; band++) {
7758                 struct ieee80211_supported_band *sband;
7759
7760                 sband = wiphy->bands[band];
7761                 if (!sband)
7762                         continue;
7763
7764                 for (i = 0; i < sband->n_bitrates; i++) {
7765                         if (sband->bitrates[i].bitrate == rateval) {
7766                                 mcast_rate[band] = i + 1;
7767                                 found = true;
7768                                 break;
7769                         }
7770                 }
7771         }
7772
7773         return found;
7774 }
7775
7776 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7777 {
7778         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7779         struct net_device *dev = info->user_ptr[1];
7780         struct cfg80211_ibss_params ibss;
7781         struct wiphy *wiphy;
7782         struct cfg80211_cached_keys *connkeys = NULL;
7783         int err;
7784
7785         memset(&ibss, 0, sizeof(ibss));
7786
7787         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7788                 return -EINVAL;
7789
7790         if (!info->attrs[NL80211_ATTR_SSID] ||
7791             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7792                 return -EINVAL;
7793
7794         ibss.beacon_interval = 100;
7795
7796         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
7797                 ibss.beacon_interval =
7798                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7799
7800         err = cfg80211_validate_beacon_int(rdev, ibss.beacon_interval);
7801         if (err)
7802                 return err;
7803
7804         if (!rdev->ops->join_ibss)
7805                 return -EOPNOTSUPP;
7806
7807         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7808                 return -EOPNOTSUPP;
7809
7810         wiphy = &rdev->wiphy;
7811
7812         if (info->attrs[NL80211_ATTR_MAC]) {
7813                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7814
7815                 if (!is_valid_ether_addr(ibss.bssid))
7816                         return -EINVAL;
7817         }
7818         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7819         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7820
7821         if (info->attrs[NL80211_ATTR_IE]) {
7822                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7823                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7824         }
7825
7826         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7827         if (err)
7828                 return err;
7829
7830         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7831                                      NL80211_IFTYPE_ADHOC))
7832                 return -EINVAL;
7833
7834         switch (ibss.chandef.width) {
7835         case NL80211_CHAN_WIDTH_5:
7836         case NL80211_CHAN_WIDTH_10:
7837         case NL80211_CHAN_WIDTH_20_NOHT:
7838                 break;
7839         case NL80211_CHAN_WIDTH_20:
7840         case NL80211_CHAN_WIDTH_40:
7841                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7842                         return -EINVAL;
7843                 break;
7844         case NL80211_CHAN_WIDTH_80:
7845         case NL80211_CHAN_WIDTH_80P80:
7846         case NL80211_CHAN_WIDTH_160:
7847                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7848                         return -EINVAL;
7849                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7850                                              NL80211_EXT_FEATURE_VHT_IBSS))
7851                         return -EINVAL;
7852                 break;
7853         default:
7854                 return -EINVAL;
7855         }
7856
7857         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7858         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7859
7860         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7861                 u8 *rates =
7862                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7863                 int n_rates =
7864                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7865                 struct ieee80211_supported_band *sband =
7866                         wiphy->bands[ibss.chandef.chan->band];
7867
7868                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7869                                              &ibss.basic_rates);
7870                 if (err)
7871                         return err;
7872         }
7873
7874         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7875                 memcpy(&ibss.ht_capa_mask,
7876                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7877                        sizeof(ibss.ht_capa_mask));
7878
7879         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7880                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7881                         return -EINVAL;
7882                 memcpy(&ibss.ht_capa,
7883                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7884                        sizeof(ibss.ht_capa));
7885         }
7886
7887         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7888             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7889                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7890                 return -EINVAL;
7891
7892         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7893                 bool no_ht = false;
7894
7895                 connkeys = nl80211_parse_connkeys(rdev,
7896                                           info->attrs[NL80211_ATTR_KEYS],
7897                                           &no_ht);
7898                 if (IS_ERR(connkeys))
7899                         return PTR_ERR(connkeys);
7900
7901                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7902                     no_ht) {
7903                         kzfree(connkeys);
7904                         return -EINVAL;
7905                 }
7906         }
7907
7908         ibss.control_port =
7909                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7910
7911         ibss.userspace_handles_dfs =
7912                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7913
7914         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7915         if (err)
7916                 kzfree(connkeys);
7917         return err;
7918 }
7919
7920 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7921 {
7922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7923         struct net_device *dev = info->user_ptr[1];
7924
7925         if (!rdev->ops->leave_ibss)
7926                 return -EOPNOTSUPP;
7927
7928         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7929                 return -EOPNOTSUPP;
7930
7931         return cfg80211_leave_ibss(rdev, dev, false);
7932 }
7933
7934 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7935 {
7936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7937         struct net_device *dev = info->user_ptr[1];
7938         int mcast_rate[NUM_NL80211_BANDS];
7939         u32 nla_rate;
7940         int err;
7941
7942         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7943             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7944             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7945                 return -EOPNOTSUPP;
7946
7947         if (!rdev->ops->set_mcast_rate)
7948                 return -EOPNOTSUPP;
7949
7950         memset(mcast_rate, 0, sizeof(mcast_rate));
7951
7952         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7953                 return -EINVAL;
7954
7955         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7956         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7957                 return -EINVAL;
7958
7959         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
7960
7961         return err;
7962 }
7963
7964 static struct sk_buff *
7965 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7966                             struct wireless_dev *wdev, int approxlen,
7967                             u32 portid, u32 seq, enum nl80211_commands cmd,
7968                             enum nl80211_attrs attr,
7969                             const struct nl80211_vendor_cmd_info *info,
7970                             gfp_t gfp)
7971 {
7972         struct sk_buff *skb;
7973         void *hdr;
7974         struct nlattr *data;
7975
7976         skb = nlmsg_new(approxlen + 100, gfp);
7977         if (!skb)
7978                 return NULL;
7979
7980         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7981         if (!hdr) {
7982                 kfree_skb(skb);
7983                 return NULL;
7984         }
7985
7986         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7987                 goto nla_put_failure;
7988
7989         if (info) {
7990                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7991                                 info->vendor_id))
7992                         goto nla_put_failure;
7993                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7994                                 info->subcmd))
7995                         goto nla_put_failure;
7996         }
7997
7998         if (wdev) {
7999                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8000                                       wdev_id(wdev), NL80211_ATTR_PAD))
8001                         goto nla_put_failure;
8002                 if (wdev->netdev &&
8003                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8004                                 wdev->netdev->ifindex))
8005                         goto nla_put_failure;
8006         }
8007
8008         data = nla_nest_start(skb, attr);
8009
8010         ((void **)skb->cb)[0] = rdev;
8011         ((void **)skb->cb)[1] = hdr;
8012         ((void **)skb->cb)[2] = data;
8013
8014         return skb;
8015
8016  nla_put_failure:
8017         kfree_skb(skb);
8018         return NULL;
8019 }
8020
8021 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8022                                            struct wireless_dev *wdev,
8023                                            enum nl80211_commands cmd,
8024                                            enum nl80211_attrs attr,
8025                                            int vendor_event_idx,
8026                                            int approxlen, gfp_t gfp)
8027 {
8028         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8029         const struct nl80211_vendor_cmd_info *info;
8030
8031         switch (cmd) {
8032         case NL80211_CMD_TESTMODE:
8033                 if (WARN_ON(vendor_event_idx != -1))
8034                         return NULL;
8035                 info = NULL;
8036                 break;
8037         case NL80211_CMD_VENDOR:
8038                 if (WARN_ON(vendor_event_idx < 0 ||
8039                             vendor_event_idx >= wiphy->n_vendor_events))
8040                         return NULL;
8041                 info = &wiphy->vendor_events[vendor_event_idx];
8042                 break;
8043         default:
8044                 WARN_ON(1);
8045                 return NULL;
8046         }
8047
8048         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8049                                            cmd, attr, info, gfp);
8050 }
8051 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8052
8053 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8054 {
8055         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8056         void *hdr = ((void **)skb->cb)[1];
8057         struct nlattr *data = ((void **)skb->cb)[2];
8058         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8059
8060         /* clear CB data for netlink core to own from now on */
8061         memset(skb->cb, 0, sizeof(skb->cb));
8062
8063         nla_nest_end(skb, data);
8064         genlmsg_end(skb, hdr);
8065
8066         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8067                 mcgrp = NL80211_MCGRP_VENDOR;
8068
8069         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8070                                 mcgrp, gfp);
8071 }
8072 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8073
8074 #ifdef CONFIG_NL80211_TESTMODE
8075 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8076 {
8077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8078         struct wireless_dev *wdev =
8079                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8080         int err;
8081
8082         if (!rdev->ops->testmode_cmd)
8083                 return -EOPNOTSUPP;
8084
8085         if (IS_ERR(wdev)) {
8086                 err = PTR_ERR(wdev);
8087                 if (err != -EINVAL)
8088                         return err;
8089                 wdev = NULL;
8090         } else if (wdev->wiphy != &rdev->wiphy) {
8091                 return -EINVAL;
8092         }
8093
8094         if (!info->attrs[NL80211_ATTR_TESTDATA])
8095                 return -EINVAL;
8096
8097         rdev->cur_cmd_info = info;
8098         err = rdev_testmode_cmd(rdev, wdev,
8099                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8100                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8101         rdev->cur_cmd_info = NULL;
8102
8103         return err;
8104 }
8105
8106 static int nl80211_testmode_dump(struct sk_buff *skb,
8107                                  struct netlink_callback *cb)
8108 {
8109         struct cfg80211_registered_device *rdev;
8110         int err;
8111         long phy_idx;
8112         void *data = NULL;
8113         int data_len = 0;
8114
8115         rtnl_lock();
8116
8117         if (cb->args[0]) {
8118                 /*
8119                  * 0 is a valid index, but not valid for args[0],
8120                  * so we need to offset by 1.
8121                  */
8122                 phy_idx = cb->args[0] - 1;
8123         } else {
8124                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8125                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
8126                                   nl80211_policy);
8127                 if (err)
8128                         goto out_err;
8129
8130                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
8131                                                   nl80211_fam.attrbuf);
8132                 if (IS_ERR(rdev)) {
8133                         err = PTR_ERR(rdev);
8134                         goto out_err;
8135                 }
8136                 phy_idx = rdev->wiphy_idx;
8137                 rdev = NULL;
8138
8139                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
8140                         cb->args[1] =
8141                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
8142         }
8143
8144         if (cb->args[1]) {
8145                 data = nla_data((void *)cb->args[1]);
8146                 data_len = nla_len((void *)cb->args[1]);
8147         }
8148
8149         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8150         if (!rdev) {
8151                 err = -ENOENT;
8152                 goto out_err;
8153         }
8154
8155         if (!rdev->ops->testmode_dump) {
8156                 err = -EOPNOTSUPP;
8157                 goto out_err;
8158         }
8159
8160         while (1) {
8161                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8162                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8163                                            NL80211_CMD_TESTMODE);
8164                 struct nlattr *tmdata;
8165
8166                 if (!hdr)
8167                         break;
8168
8169                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8170                         genlmsg_cancel(skb, hdr);
8171                         break;
8172                 }
8173
8174                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8175                 if (!tmdata) {
8176                         genlmsg_cancel(skb, hdr);
8177                         break;
8178                 }
8179                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8180                 nla_nest_end(skb, tmdata);
8181
8182                 if (err == -ENOBUFS || err == -ENOENT) {
8183                         genlmsg_cancel(skb, hdr);
8184                         break;
8185                 } else if (err) {
8186                         genlmsg_cancel(skb, hdr);
8187                         goto out_err;
8188                 }
8189
8190                 genlmsg_end(skb, hdr);
8191         }
8192
8193         err = skb->len;
8194         /* see above */
8195         cb->args[0] = phy_idx + 1;
8196  out_err:
8197         rtnl_unlock();
8198         return err;
8199 }
8200 #endif
8201
8202 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8203 {
8204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8205         struct net_device *dev = info->user_ptr[1];
8206         struct cfg80211_connect_params connect;
8207         struct wiphy *wiphy;
8208         struct cfg80211_cached_keys *connkeys = NULL;
8209         int err;
8210
8211         memset(&connect, 0, sizeof(connect));
8212
8213         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8214                 return -EINVAL;
8215
8216         if (!info->attrs[NL80211_ATTR_SSID] ||
8217             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8218                 return -EINVAL;
8219
8220         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8221                 connect.auth_type =
8222                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8223                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8224                                              NL80211_CMD_CONNECT))
8225                         return -EINVAL;
8226         } else
8227                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8228
8229         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8230
8231         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8232                                       NL80211_MAX_NR_CIPHER_SUITES);
8233         if (err)
8234                 return err;
8235
8236         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8237             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8238                 return -EOPNOTSUPP;
8239
8240         wiphy = &rdev->wiphy;
8241
8242         connect.bg_scan_period = -1;
8243         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8244                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8245                 connect.bg_scan_period =
8246                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8247         }
8248
8249         if (info->attrs[NL80211_ATTR_MAC])
8250                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8251         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8252                 connect.bssid_hint =
8253                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8254         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8255         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8256
8257         if (info->attrs[NL80211_ATTR_IE]) {
8258                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8259                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8260         }
8261
8262         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8263                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8264                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8265                     connect.mfp != NL80211_MFP_NO)
8266                         return -EINVAL;
8267         } else {
8268                 connect.mfp = NL80211_MFP_NO;
8269         }
8270
8271         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8272                 connect.prev_bssid =
8273                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8274
8275         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8276                 connect.channel = nl80211_get_valid_chan(
8277                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8278                 if (!connect.channel)
8279                         return -EINVAL;
8280         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8281                 connect.channel_hint = nl80211_get_valid_chan(
8282                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8283                 if (!connect.channel_hint)
8284                         return -EINVAL;
8285         }
8286
8287         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8288                 connkeys = nl80211_parse_connkeys(rdev,
8289                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8290                 if (IS_ERR(connkeys))
8291                         return PTR_ERR(connkeys);
8292         }
8293
8294         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8295                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8296
8297         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8298                 memcpy(&connect.ht_capa_mask,
8299                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8300                        sizeof(connect.ht_capa_mask));
8301
8302         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8303                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8304                         kzfree(connkeys);
8305                         return -EINVAL;
8306                 }
8307                 memcpy(&connect.ht_capa,
8308                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8309                        sizeof(connect.ht_capa));
8310         }
8311
8312         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8313                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8314
8315         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8316                 memcpy(&connect.vht_capa_mask,
8317                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8318                        sizeof(connect.vht_capa_mask));
8319
8320         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8321                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8322                         kzfree(connkeys);
8323                         return -EINVAL;
8324                 }
8325                 memcpy(&connect.vht_capa,
8326                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8327                        sizeof(connect.vht_capa));
8328         }
8329
8330         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8331                 if (!((rdev->wiphy.features &
8332                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8333                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8334                     !wiphy_ext_feature_isset(&rdev->wiphy,
8335                                              NL80211_EXT_FEATURE_RRM)) {
8336                         kzfree(connkeys);
8337                         return -EINVAL;
8338                 }
8339                 connect.flags |= ASSOC_REQ_USE_RRM;
8340         }
8341
8342         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8343         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8344                 kzfree(connkeys);
8345                 return -EOPNOTSUPP;
8346         }
8347
8348         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8349                 /* bss selection makes no sense if bssid is set */
8350                 if (connect.bssid) {
8351                         kzfree(connkeys);
8352                         return -EINVAL;
8353                 }
8354
8355                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8356                                        wiphy, &connect.bss_select);
8357                 if (err) {
8358                         kzfree(connkeys);
8359                         return err;
8360                 }
8361         }
8362
8363         wdev_lock(dev->ieee80211_ptr);
8364         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8365                                connect.prev_bssid);
8366         wdev_unlock(dev->ieee80211_ptr);
8367         if (err)
8368                 kzfree(connkeys);
8369         return err;
8370 }
8371
8372 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8373 {
8374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8375         struct net_device *dev = info->user_ptr[1];
8376         u16 reason;
8377         int ret;
8378
8379         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8380                 reason = WLAN_REASON_DEAUTH_LEAVING;
8381         else
8382                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8383
8384         if (reason == 0)
8385                 return -EINVAL;
8386
8387         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8388             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8389                 return -EOPNOTSUPP;
8390
8391         wdev_lock(dev->ieee80211_ptr);
8392         ret = cfg80211_disconnect(rdev, dev, reason, true);
8393         wdev_unlock(dev->ieee80211_ptr);
8394         return ret;
8395 }
8396
8397 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8398 {
8399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8400         struct net *net;
8401         int err;
8402
8403         if (info->attrs[NL80211_ATTR_PID]) {
8404                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8405
8406                 net = get_net_ns_by_pid(pid);
8407         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8408                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8409
8410                 net = get_net_ns_by_fd(fd);
8411         } else {
8412                 return -EINVAL;
8413         }
8414
8415         if (IS_ERR(net))
8416                 return PTR_ERR(net);
8417
8418         err = 0;
8419
8420         /* check if anything to do */
8421         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8422                 err = cfg80211_switch_netns(rdev, net);
8423
8424         put_net(net);
8425         return err;
8426 }
8427
8428 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8429 {
8430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8431         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8432                         struct cfg80211_pmksa *pmksa) = NULL;
8433         struct net_device *dev = info->user_ptr[1];
8434         struct cfg80211_pmksa pmksa;
8435
8436         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8437
8438         if (!info->attrs[NL80211_ATTR_MAC])
8439                 return -EINVAL;
8440
8441         if (!info->attrs[NL80211_ATTR_PMKID])
8442                 return -EINVAL;
8443
8444         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8445         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8446
8447         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8448             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8449                 return -EOPNOTSUPP;
8450
8451         switch (info->genlhdr->cmd) {
8452         case NL80211_CMD_SET_PMKSA:
8453                 rdev_ops = rdev->ops->set_pmksa;
8454                 break;
8455         case NL80211_CMD_DEL_PMKSA:
8456                 rdev_ops = rdev->ops->del_pmksa;
8457                 break;
8458         default:
8459                 WARN_ON(1);
8460                 break;
8461         }
8462
8463         if (!rdev_ops)
8464                 return -EOPNOTSUPP;
8465
8466         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8467 }
8468
8469 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8470 {
8471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8472         struct net_device *dev = info->user_ptr[1];
8473
8474         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8475             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8476                 return -EOPNOTSUPP;
8477
8478         if (!rdev->ops->flush_pmksa)
8479                 return -EOPNOTSUPP;
8480
8481         return rdev_flush_pmksa(rdev, dev);
8482 }
8483
8484 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8485 {
8486         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8487         struct net_device *dev = info->user_ptr[1];
8488         u8 action_code, dialog_token;
8489         u32 peer_capability = 0;
8490         u16 status_code;
8491         u8 *peer;
8492         bool initiator;
8493
8494         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8495             !rdev->ops->tdls_mgmt)
8496                 return -EOPNOTSUPP;
8497
8498         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8499             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8500             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8501             !info->attrs[NL80211_ATTR_IE] ||
8502             !info->attrs[NL80211_ATTR_MAC])
8503                 return -EINVAL;
8504
8505         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8506         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8507         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8508         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8509         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8510         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8511                 peer_capability =
8512                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8513
8514         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8515                               dialog_token, status_code, peer_capability,
8516                               initiator,
8517                               nla_data(info->attrs[NL80211_ATTR_IE]),
8518                               nla_len(info->attrs[NL80211_ATTR_IE]));
8519 }
8520
8521 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8522 {
8523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8524         struct net_device *dev = info->user_ptr[1];
8525         enum nl80211_tdls_operation operation;
8526         u8 *peer;
8527
8528         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8529             !rdev->ops->tdls_oper)
8530                 return -EOPNOTSUPP;
8531
8532         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8533             !info->attrs[NL80211_ATTR_MAC])
8534                 return -EINVAL;
8535
8536         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8537         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8538
8539         return rdev_tdls_oper(rdev, dev, peer, operation);
8540 }
8541
8542 static int nl80211_remain_on_channel(struct sk_buff *skb,
8543                                      struct genl_info *info)
8544 {
8545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8546         struct wireless_dev *wdev = info->user_ptr[1];
8547         struct cfg80211_chan_def chandef;
8548         struct sk_buff *msg;
8549         void *hdr;
8550         u64 cookie;
8551         u32 duration;
8552         int err;
8553
8554         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8555             !info->attrs[NL80211_ATTR_DURATION])
8556                 return -EINVAL;
8557
8558         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8559
8560         if (!rdev->ops->remain_on_channel ||
8561             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8562                 return -EOPNOTSUPP;
8563
8564         /*
8565          * We should be on that channel for at least a minimum amount of
8566          * time (10ms) but no longer than the driver supports.
8567          */
8568         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8569             duration > rdev->wiphy.max_remain_on_channel_duration)
8570                 return -EINVAL;
8571
8572         err = nl80211_parse_chandef(rdev, info, &chandef);
8573         if (err)
8574                 return err;
8575
8576         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8577         if (!msg)
8578                 return -ENOMEM;
8579
8580         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8581                              NL80211_CMD_REMAIN_ON_CHANNEL);
8582         if (!hdr) {
8583                 err = -ENOBUFS;
8584                 goto free_msg;
8585         }
8586
8587         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8588                                      duration, &cookie);
8589
8590         if (err)
8591                 goto free_msg;
8592
8593         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
8594                               NL80211_ATTR_PAD))
8595                 goto nla_put_failure;
8596
8597         genlmsg_end(msg, hdr);
8598
8599         return genlmsg_reply(msg, info);
8600
8601  nla_put_failure:
8602         err = -ENOBUFS;
8603  free_msg:
8604         nlmsg_free(msg);
8605         return err;
8606 }
8607
8608 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8609                                             struct genl_info *info)
8610 {
8611         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8612         struct wireless_dev *wdev = info->user_ptr[1];
8613         u64 cookie;
8614
8615         if (!info->attrs[NL80211_ATTR_COOKIE])
8616                 return -EINVAL;
8617
8618         if (!rdev->ops->cancel_remain_on_channel)
8619                 return -EOPNOTSUPP;
8620
8621         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8622
8623         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8624 }
8625
8626 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8627                            u8 *rates, u8 rates_len)
8628 {
8629         u8 i;
8630         u32 mask = 0;
8631
8632         for (i = 0; i < rates_len; i++) {
8633                 int rate = (rates[i] & 0x7f) * 5;
8634                 int ridx;
8635
8636                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8637                         struct ieee80211_rate *srate =
8638                                 &sband->bitrates[ridx];
8639                         if (rate == srate->bitrate) {
8640                                 mask |= 1 << ridx;
8641                                 break;
8642                         }
8643                 }
8644                 if (ridx == sband->n_bitrates)
8645                         return 0; /* rate not found */
8646         }
8647
8648         return mask;
8649 }
8650
8651 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8652                                u8 *rates, u8 rates_len,
8653                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8654 {
8655         u8 i;
8656
8657         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8658
8659         for (i = 0; i < rates_len; i++) {
8660                 int ridx, rbit;
8661
8662                 ridx = rates[i] / 8;
8663                 rbit = BIT(rates[i] % 8);
8664
8665                 /* check validity */
8666                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8667                         return false;
8668
8669                 /* check availability */
8670                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8671                         mcs[ridx] |= rbit;
8672                 else
8673                         return false;
8674         }
8675
8676         return true;
8677 }
8678
8679 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8680 {
8681         u16 mcs_mask = 0;
8682
8683         switch (vht_mcs_map) {
8684         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8685                 break;
8686         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8687                 mcs_mask = 0x00FF;
8688                 break;
8689         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8690                 mcs_mask = 0x01FF;
8691                 break;
8692         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8693                 mcs_mask = 0x03FF;
8694                 break;
8695         default:
8696                 break;
8697         }
8698
8699         return mcs_mask;
8700 }
8701
8702 static void vht_build_mcs_mask(u16 vht_mcs_map,
8703                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8704 {
8705         u8 nss;
8706
8707         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8708                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8709                 vht_mcs_map >>= 2;
8710         }
8711 }
8712
8713 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8714                              struct nl80211_txrate_vht *txrate,
8715                              u16 mcs[NL80211_VHT_NSS_MAX])
8716 {
8717         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8718         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8719         u8 i;
8720
8721         if (!sband->vht_cap.vht_supported)
8722                 return false;
8723
8724         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8725
8726         /* Build vht_mcs_mask from VHT capabilities */
8727         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8728
8729         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8730                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8731                         mcs[i] = txrate->mcs[i];
8732                 else
8733                         return false;
8734         }
8735
8736         return true;
8737 }
8738
8739 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8740         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8741                                     .len = NL80211_MAX_SUPP_RATES },
8742         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8743                                 .len = NL80211_MAX_SUPP_HT_RATES },
8744         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8745         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8746 };
8747
8748 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8749                                        struct genl_info *info)
8750 {
8751         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8752         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8753         struct cfg80211_bitrate_mask mask;
8754         int rem, i;
8755         struct net_device *dev = info->user_ptr[1];
8756         struct nlattr *tx_rates;
8757         struct ieee80211_supported_band *sband;
8758         u16 vht_tx_mcs_map;
8759
8760         if (!rdev->ops->set_bitrate_mask)
8761                 return -EOPNOTSUPP;
8762
8763         memset(&mask, 0, sizeof(mask));
8764         /* Default to all rates enabled */
8765         for (i = 0; i < NUM_NL80211_BANDS; i++) {
8766                 sband = rdev->wiphy.bands[i];
8767
8768                 if (!sband)
8769                         continue;
8770
8771                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8772                 memcpy(mask.control[i].ht_mcs,
8773                        sband->ht_cap.mcs.rx_mask,
8774                        sizeof(mask.control[i].ht_mcs));
8775
8776                 if (!sband->vht_cap.vht_supported)
8777                         continue;
8778
8779                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8780                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8781         }
8782
8783         /* if no rates are given set it back to the defaults */
8784         if (!info->attrs[NL80211_ATTR_TX_RATES])
8785                 goto out;
8786
8787         /*
8788          * The nested attribute uses enum nl80211_band as the index. This maps
8789          * directly to the enum nl80211_band values used in cfg80211.
8790          */
8791         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8792         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8793                 enum nl80211_band band = nla_type(tx_rates);
8794                 int err;
8795
8796                 if (band < 0 || band >= NUM_NL80211_BANDS)
8797                         return -EINVAL;
8798                 sband = rdev->wiphy.bands[band];
8799                 if (sband == NULL)
8800                         return -EINVAL;
8801                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8802                                 nla_len(tx_rates), nl80211_txattr_policy);
8803                 if (err)
8804                         return err;
8805                 if (tb[NL80211_TXRATE_LEGACY]) {
8806                         mask.control[band].legacy = rateset_to_mask(
8807                                 sband,
8808                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8809                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8810                         if ((mask.control[band].legacy == 0) &&
8811                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8812                                 return -EINVAL;
8813                 }
8814                 if (tb[NL80211_TXRATE_HT]) {
8815                         if (!ht_rateset_to_mask(
8816                                         sband,
8817                                         nla_data(tb[NL80211_TXRATE_HT]),
8818                                         nla_len(tb[NL80211_TXRATE_HT]),
8819                                         mask.control[band].ht_mcs))
8820                                 return -EINVAL;
8821                 }
8822                 if (tb[NL80211_TXRATE_VHT]) {
8823                         if (!vht_set_mcs_mask(
8824                                         sband,
8825                                         nla_data(tb[NL80211_TXRATE_VHT]),
8826                                         mask.control[band].vht_mcs))
8827                                 return -EINVAL;
8828                 }
8829                 if (tb[NL80211_TXRATE_GI]) {
8830                         mask.control[band].gi =
8831                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8832                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8833                                 return -EINVAL;
8834                 }
8835
8836                 if (mask.control[band].legacy == 0) {
8837                         /* don't allow empty legacy rates if HT or VHT
8838                          * are not even supported.
8839                          */
8840                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8841                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8842                                 return -EINVAL;
8843
8844                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8845                                 if (mask.control[band].ht_mcs[i])
8846                                         goto out;
8847
8848                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8849                                 if (mask.control[band].vht_mcs[i])
8850                                         goto out;
8851
8852                         /* legacy and mcs rates may not be both empty */
8853                         return -EINVAL;
8854                 }
8855         }
8856
8857 out:
8858         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8859 }
8860
8861 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8862 {
8863         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8864         struct wireless_dev *wdev = info->user_ptr[1];
8865         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8866
8867         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8868                 return -EINVAL;
8869
8870         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8871                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8872
8873         switch (wdev->iftype) {
8874         case NL80211_IFTYPE_STATION:
8875         case NL80211_IFTYPE_ADHOC:
8876         case NL80211_IFTYPE_P2P_CLIENT:
8877         case NL80211_IFTYPE_AP:
8878         case NL80211_IFTYPE_AP_VLAN:
8879         case NL80211_IFTYPE_MESH_POINT:
8880         case NL80211_IFTYPE_P2P_GO:
8881         case NL80211_IFTYPE_P2P_DEVICE:
8882                 break;
8883         default:
8884                 return -EOPNOTSUPP;
8885         }
8886
8887         /* not much point in registering if we can't reply */
8888         if (!rdev->ops->mgmt_tx)
8889                 return -EOPNOTSUPP;
8890
8891         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8892                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8893                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8894 }
8895
8896 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8897 {
8898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8899         struct wireless_dev *wdev = info->user_ptr[1];
8900         struct cfg80211_chan_def chandef;
8901         int err;
8902         void *hdr = NULL;
8903         u64 cookie;
8904         struct sk_buff *msg = NULL;
8905         struct cfg80211_mgmt_tx_params params = {
8906                 .dont_wait_for_ack =
8907                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8908         };
8909
8910         if (!info->attrs[NL80211_ATTR_FRAME])
8911                 return -EINVAL;
8912
8913         if (!rdev->ops->mgmt_tx)
8914                 return -EOPNOTSUPP;
8915
8916         switch (wdev->iftype) {
8917         case NL80211_IFTYPE_P2P_DEVICE:
8918                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8919                         return -EINVAL;
8920         case NL80211_IFTYPE_STATION:
8921         case NL80211_IFTYPE_ADHOC:
8922         case NL80211_IFTYPE_P2P_CLIENT:
8923         case NL80211_IFTYPE_AP:
8924         case NL80211_IFTYPE_AP_VLAN:
8925         case NL80211_IFTYPE_MESH_POINT:
8926         case NL80211_IFTYPE_P2P_GO:
8927                 break;
8928         default:
8929                 return -EOPNOTSUPP;
8930         }
8931
8932         if (info->attrs[NL80211_ATTR_DURATION]) {
8933                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8934                         return -EINVAL;
8935                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8936
8937                 /*
8938                  * We should wait on the channel for at least a minimum amount
8939                  * of time (10ms) but no longer than the driver supports.
8940                  */
8941                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8942                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8943                         return -EINVAL;
8944         }
8945
8946         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8947
8948         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8949                 return -EINVAL;
8950
8951         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8952
8953         /* get the channel if any has been specified, otherwise pass NULL to
8954          * the driver. The latter will use the current one
8955          */
8956         chandef.chan = NULL;
8957         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8958                 err = nl80211_parse_chandef(rdev, info, &chandef);
8959                 if (err)
8960                         return err;
8961         }
8962
8963         if (!chandef.chan && params.offchan)
8964                 return -EINVAL;
8965
8966         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8967         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8968
8969         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8970                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8971                 int i;
8972
8973                 if (len % sizeof(u16))
8974                         return -EINVAL;
8975
8976                 params.n_csa_offsets = len / sizeof(u16);
8977                 params.csa_offsets =
8978                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8979
8980                 /* check that all the offsets fit the frame */
8981                 for (i = 0; i < params.n_csa_offsets; i++) {
8982                         if (params.csa_offsets[i] >= params.len)
8983                                 return -EINVAL;
8984                 }
8985         }
8986
8987         if (!params.dont_wait_for_ack) {
8988                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8989                 if (!msg)
8990                         return -ENOMEM;
8991
8992                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8993                                      NL80211_CMD_FRAME);
8994                 if (!hdr) {
8995                         err = -ENOBUFS;
8996                         goto free_msg;
8997                 }
8998         }
8999
9000         params.chan = chandef.chan;
9001         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9002         if (err)
9003                 goto free_msg;
9004
9005         if (msg) {
9006                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9007                                       NL80211_ATTR_PAD))
9008                         goto nla_put_failure;
9009
9010                 genlmsg_end(msg, hdr);
9011                 return genlmsg_reply(msg, info);
9012         }
9013
9014         return 0;
9015
9016  nla_put_failure:
9017         err = -ENOBUFS;
9018  free_msg:
9019         nlmsg_free(msg);
9020         return err;
9021 }
9022
9023 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9024 {
9025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9026         struct wireless_dev *wdev = info->user_ptr[1];
9027         u64 cookie;
9028
9029         if (!info->attrs[NL80211_ATTR_COOKIE])
9030                 return -EINVAL;
9031
9032         if (!rdev->ops->mgmt_tx_cancel_wait)
9033                 return -EOPNOTSUPP;
9034
9035         switch (wdev->iftype) {
9036         case NL80211_IFTYPE_STATION:
9037         case NL80211_IFTYPE_ADHOC:
9038         case NL80211_IFTYPE_P2P_CLIENT:
9039         case NL80211_IFTYPE_AP:
9040         case NL80211_IFTYPE_AP_VLAN:
9041         case NL80211_IFTYPE_P2P_GO:
9042         case NL80211_IFTYPE_P2P_DEVICE:
9043                 break;
9044         default:
9045                 return -EOPNOTSUPP;
9046         }
9047
9048         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9049
9050         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9051 }
9052
9053 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9054 {
9055         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9056         struct wireless_dev *wdev;
9057         struct net_device *dev = info->user_ptr[1];
9058         u8 ps_state;
9059         bool state;
9060         int err;
9061
9062         if (!info->attrs[NL80211_ATTR_PS_STATE])
9063                 return -EINVAL;
9064
9065         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9066
9067         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9068                 return -EINVAL;
9069
9070         wdev = dev->ieee80211_ptr;
9071
9072         if (!rdev->ops->set_power_mgmt)
9073                 return -EOPNOTSUPP;
9074
9075         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9076
9077         if (state == wdev->ps)
9078                 return 0;
9079
9080         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9081         if (!err)
9082                 wdev->ps = state;
9083         return err;
9084 }
9085
9086 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9087 {
9088         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9089         enum nl80211_ps_state ps_state;
9090         struct wireless_dev *wdev;
9091         struct net_device *dev = info->user_ptr[1];
9092         struct sk_buff *msg;
9093         void *hdr;
9094         int err;
9095
9096         wdev = dev->ieee80211_ptr;
9097
9098         if (!rdev->ops->set_power_mgmt)
9099                 return -EOPNOTSUPP;
9100
9101         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9102         if (!msg)
9103                 return -ENOMEM;
9104
9105         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9106                              NL80211_CMD_GET_POWER_SAVE);
9107         if (!hdr) {
9108                 err = -ENOBUFS;
9109                 goto free_msg;
9110         }
9111
9112         if (wdev->ps)
9113                 ps_state = NL80211_PS_ENABLED;
9114         else
9115                 ps_state = NL80211_PS_DISABLED;
9116
9117         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9118                 goto nla_put_failure;
9119
9120         genlmsg_end(msg, hdr);
9121         return genlmsg_reply(msg, info);
9122
9123  nla_put_failure:
9124         err = -ENOBUFS;
9125  free_msg:
9126         nlmsg_free(msg);
9127         return err;
9128 }
9129
9130 static const struct nla_policy
9131 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9132         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9133         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9134         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9135         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9136         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9137         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9138 };
9139
9140 static int nl80211_set_cqm_txe(struct genl_info *info,
9141                                u32 rate, u32 pkts, u32 intvl)
9142 {
9143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9144         struct net_device *dev = info->user_ptr[1];
9145         struct wireless_dev *wdev = dev->ieee80211_ptr;
9146
9147         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9148                 return -EINVAL;
9149
9150         if (!rdev->ops->set_cqm_txe_config)
9151                 return -EOPNOTSUPP;
9152
9153         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9154             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9155                 return -EOPNOTSUPP;
9156
9157         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9158 }
9159
9160 static int nl80211_set_cqm_rssi(struct genl_info *info,
9161                                 s32 threshold, u32 hysteresis)
9162 {
9163         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9164         struct net_device *dev = info->user_ptr[1];
9165         struct wireless_dev *wdev = dev->ieee80211_ptr;
9166
9167         if (threshold > 0)
9168                 return -EINVAL;
9169
9170         /* disabling - hysteresis should also be zero then */
9171         if (threshold == 0)
9172                 hysteresis = 0;
9173
9174         if (!rdev->ops->set_cqm_rssi_config)
9175                 return -EOPNOTSUPP;
9176
9177         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9178             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9179                 return -EOPNOTSUPP;
9180
9181         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9182 }
9183
9184 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9185 {
9186         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9187         struct nlattr *cqm;
9188         int err;
9189
9190         cqm = info->attrs[NL80211_ATTR_CQM];
9191         if (!cqm)
9192                 return -EINVAL;
9193
9194         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9195                                nl80211_attr_cqm_policy);
9196         if (err)
9197                 return err;
9198
9199         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9200             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9201                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9202                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9203
9204                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9205         }
9206
9207         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9208             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9209             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9210                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9211                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9212                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9213
9214                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9215         }
9216
9217         return -EINVAL;
9218 }
9219
9220 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9221 {
9222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9223         struct net_device *dev = info->user_ptr[1];
9224         struct ocb_setup setup = {};
9225         int err;
9226
9227         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9228         if (err)
9229                 return err;
9230
9231         return cfg80211_join_ocb(rdev, dev, &setup);
9232 }
9233
9234 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9235 {
9236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9237         struct net_device *dev = info->user_ptr[1];
9238
9239         return cfg80211_leave_ocb(rdev, dev);
9240 }
9241
9242 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9243 {
9244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9245         struct net_device *dev = info->user_ptr[1];
9246         struct mesh_config cfg;
9247         struct mesh_setup setup;
9248         int err;
9249
9250         /* start with default */
9251         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9252         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9253
9254         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9255                 /* and parse parameters if given */
9256                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9257                 if (err)
9258                         return err;
9259         }
9260
9261         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9262             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9263                 return -EINVAL;
9264
9265         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9266         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9267
9268         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9269             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9270                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9271                         return -EINVAL;
9272
9273         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9274                 setup.beacon_interval =
9275                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9276
9277                 err = cfg80211_validate_beacon_int(rdev, setup.beacon_interval);
9278                 if (err)
9279                         return err;
9280         }
9281
9282         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9283                 setup.dtim_period =
9284                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9285                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9286                         return -EINVAL;
9287         }
9288
9289         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9290                 /* parse additional setup parameters if given */
9291                 err = nl80211_parse_mesh_setup(info, &setup);
9292                 if (err)
9293                         return err;
9294         }
9295
9296         if (setup.user_mpm)
9297                 cfg.auto_open_plinks = false;
9298
9299         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9300                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9301                 if (err)
9302                         return err;
9303         } else {
9304                 /* cfg80211_join_mesh() will sort it out */
9305                 setup.chandef.chan = NULL;
9306         }
9307
9308         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9309                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9310                 int n_rates =
9311                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9312                 struct ieee80211_supported_band *sband;
9313
9314                 if (!setup.chandef.chan)
9315                         return -EINVAL;
9316
9317                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9318
9319                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9320                                              &setup.basic_rates);
9321                 if (err)
9322                         return err;
9323         }
9324
9325         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9326 }
9327
9328 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9329 {
9330         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9331         struct net_device *dev = info->user_ptr[1];
9332
9333         return cfg80211_leave_mesh(rdev, dev);
9334 }
9335
9336 #ifdef CONFIG_PM
9337 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9338                                         struct cfg80211_registered_device *rdev)
9339 {
9340         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9341         struct nlattr *nl_pats, *nl_pat;
9342         int i, pat_len;
9343
9344         if (!wowlan->n_patterns)
9345                 return 0;
9346
9347         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9348         if (!nl_pats)
9349                 return -ENOBUFS;
9350
9351         for (i = 0; i < wowlan->n_patterns; i++) {
9352                 nl_pat = nla_nest_start(msg, i + 1);
9353                 if (!nl_pat)
9354                         return -ENOBUFS;
9355                 pat_len = wowlan->patterns[i].pattern_len;
9356                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9357                             wowlan->patterns[i].mask) ||
9358                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9359                             wowlan->patterns[i].pattern) ||
9360                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9361                                 wowlan->patterns[i].pkt_offset))
9362                         return -ENOBUFS;
9363                 nla_nest_end(msg, nl_pat);
9364         }
9365         nla_nest_end(msg, nl_pats);
9366
9367         return 0;
9368 }
9369
9370 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9371                                    struct cfg80211_wowlan_tcp *tcp)
9372 {
9373         struct nlattr *nl_tcp;
9374
9375         if (!tcp)
9376                 return 0;
9377
9378         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9379         if (!nl_tcp)
9380                 return -ENOBUFS;
9381
9382         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9383             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9384             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9385             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9386             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9387             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9388                     tcp->payload_len, tcp->payload) ||
9389             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9390                         tcp->data_interval) ||
9391             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9392                     tcp->wake_len, tcp->wake_data) ||
9393             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9394                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9395                 return -ENOBUFS;
9396
9397         if (tcp->payload_seq.len &&
9398             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9399                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9400                 return -ENOBUFS;
9401
9402         if (tcp->payload_tok.len &&
9403             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9404                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9405                     &tcp->payload_tok))
9406                 return -ENOBUFS;
9407
9408         nla_nest_end(msg, nl_tcp);
9409
9410         return 0;
9411 }
9412
9413 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9414                                   struct cfg80211_sched_scan_request *req)
9415 {
9416         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9417         int i;
9418
9419         if (!req)
9420                 return 0;
9421
9422         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9423         if (!nd)
9424                 return -ENOBUFS;
9425
9426         if (req->n_scan_plans == 1 &&
9427             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9428                         req->scan_plans[0].interval * 1000))
9429                 return -ENOBUFS;
9430
9431         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9432                 return -ENOBUFS;
9433
9434         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9435         if (!freqs)
9436                 return -ENOBUFS;
9437
9438         for (i = 0; i < req->n_channels; i++)
9439                 nla_put_u32(msg, i, req->channels[i]->center_freq);
9440
9441         nla_nest_end(msg, freqs);
9442
9443         if (req->n_match_sets) {
9444                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9445                 for (i = 0; i < req->n_match_sets; i++) {
9446                         match = nla_nest_start(msg, i);
9447                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9448                                 req->match_sets[i].ssid.ssid_len,
9449                                 req->match_sets[i].ssid.ssid);
9450                         nla_nest_end(msg, match);
9451                 }
9452                 nla_nest_end(msg, matches);
9453         }
9454
9455         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9456         if (!scan_plans)
9457                 return -ENOBUFS;
9458
9459         for (i = 0; i < req->n_scan_plans; i++) {
9460                 scan_plan = nla_nest_start(msg, i + 1);
9461                 if (!scan_plan ||
9462                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9463                                 req->scan_plans[i].interval) ||
9464                     (req->scan_plans[i].iterations &&
9465                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9466                                  req->scan_plans[i].iterations)))
9467                         return -ENOBUFS;
9468                 nla_nest_end(msg, scan_plan);
9469         }
9470         nla_nest_end(msg, scan_plans);
9471
9472         nla_nest_end(msg, nd);
9473
9474         return 0;
9475 }
9476
9477 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9478 {
9479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9480         struct sk_buff *msg;
9481         void *hdr;
9482         u32 size = NLMSG_DEFAULT_SIZE;
9483
9484         if (!rdev->wiphy.wowlan)
9485                 return -EOPNOTSUPP;
9486
9487         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9488                 /* adjust size to have room for all the data */
9489                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9490                         rdev->wiphy.wowlan_config->tcp->payload_len +
9491                         rdev->wiphy.wowlan_config->tcp->wake_len +
9492                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9493         }
9494
9495         msg = nlmsg_new(size, GFP_KERNEL);
9496         if (!msg)
9497                 return -ENOMEM;
9498
9499         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9500                              NL80211_CMD_GET_WOWLAN);
9501         if (!hdr)
9502                 goto nla_put_failure;
9503
9504         if (rdev->wiphy.wowlan_config) {
9505                 struct nlattr *nl_wowlan;
9506
9507                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9508                 if (!nl_wowlan)
9509                         goto nla_put_failure;
9510
9511                 if ((rdev->wiphy.wowlan_config->any &&
9512                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9513                     (rdev->wiphy.wowlan_config->disconnect &&
9514                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9515                     (rdev->wiphy.wowlan_config->magic_pkt &&
9516                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9517                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9518                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9519                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9520                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9521                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9522                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9523                     (rdev->wiphy.wowlan_config->rfkill_release &&
9524                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9525                         goto nla_put_failure;
9526
9527                 if (nl80211_send_wowlan_patterns(msg, rdev))
9528                         goto nla_put_failure;
9529
9530                 if (nl80211_send_wowlan_tcp(msg,
9531                                             rdev->wiphy.wowlan_config->tcp))
9532                         goto nla_put_failure;
9533
9534                 if (nl80211_send_wowlan_nd(
9535                             msg,
9536                             rdev->wiphy.wowlan_config->nd_config))
9537                         goto nla_put_failure;
9538
9539                 nla_nest_end(msg, nl_wowlan);
9540         }
9541
9542         genlmsg_end(msg, hdr);
9543         return genlmsg_reply(msg, info);
9544
9545 nla_put_failure:
9546         nlmsg_free(msg);
9547         return -ENOBUFS;
9548 }
9549
9550 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9551                                     struct nlattr *attr,
9552                                     struct cfg80211_wowlan *trig)
9553 {
9554         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9555         struct cfg80211_wowlan_tcp *cfg;
9556         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9557         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9558         u32 size;
9559         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9560         int err, port;
9561
9562         if (!rdev->wiphy.wowlan->tcp)
9563                 return -EINVAL;
9564
9565         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9566                         nla_data(attr), nla_len(attr),
9567                         nl80211_wowlan_tcp_policy);
9568         if (err)
9569                 return err;
9570
9571         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9572             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9573             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9574             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9575             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9576             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9577             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9578             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9579                 return -EINVAL;
9580
9581         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9582         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9583                 return -EINVAL;
9584
9585         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9586                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9587             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9588                 return -EINVAL;
9589
9590         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9591         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9592                 return -EINVAL;
9593
9594         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9595         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9596                 return -EINVAL;
9597
9598         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9599                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9600
9601                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9602                 tokens_size = tokln - sizeof(*tok);
9603
9604                 if (!tok->len || tokens_size % tok->len)
9605                         return -EINVAL;
9606                 if (!rdev->wiphy.wowlan->tcp->tok)
9607                         return -EINVAL;
9608                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9609                         return -EINVAL;
9610                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9611                         return -EINVAL;
9612                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9613                         return -EINVAL;
9614                 if (tok->offset + tok->len > data_size)
9615                         return -EINVAL;
9616         }
9617
9618         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9619                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9620                 if (!rdev->wiphy.wowlan->tcp->seq)
9621                         return -EINVAL;
9622                 if (seq->len == 0 || seq->len > 4)
9623                         return -EINVAL;
9624                 if (seq->len + seq->offset > data_size)
9625                         return -EINVAL;
9626         }
9627
9628         size = sizeof(*cfg);
9629         size += data_size;
9630         size += wake_size + wake_mask_size;
9631         size += tokens_size;
9632
9633         cfg = kzalloc(size, GFP_KERNEL);
9634         if (!cfg)
9635                 return -ENOMEM;
9636         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9637         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9638         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9639                ETH_ALEN);
9640         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9641                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9642         else
9643                 port = 0;
9644 #ifdef CONFIG_INET
9645         /* allocate a socket and port for it and use it */
9646         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9647                             IPPROTO_TCP, &cfg->sock, 1);
9648         if (err) {
9649                 kfree(cfg);
9650                 return err;
9651         }
9652         if (inet_csk_get_port(cfg->sock->sk, port)) {
9653                 sock_release(cfg->sock);
9654                 kfree(cfg);
9655                 return -EADDRINUSE;
9656         }
9657         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9658 #else
9659         if (!port) {
9660                 kfree(cfg);
9661                 return -EINVAL;
9662         }
9663         cfg->src_port = port;
9664 #endif
9665
9666         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9667         cfg->payload_len = data_size;
9668         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9669         memcpy((void *)cfg->payload,
9670                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9671                data_size);
9672         if (seq)
9673                 cfg->payload_seq = *seq;
9674         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9675         cfg->wake_len = wake_size;
9676         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9677         memcpy((void *)cfg->wake_data,
9678                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9679                wake_size);
9680         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9681                          data_size + wake_size;
9682         memcpy((void *)cfg->wake_mask,
9683                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9684                wake_mask_size);
9685         if (tok) {
9686                 cfg->tokens_size = tokens_size;
9687                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9688         }
9689
9690         trig->tcp = cfg;
9691
9692         return 0;
9693 }
9694
9695 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9696                                    const struct wiphy_wowlan_support *wowlan,
9697                                    struct nlattr *attr,
9698                                    struct cfg80211_wowlan *trig)
9699 {
9700         struct nlattr **tb;
9701         int err;
9702
9703         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9704         if (!tb)
9705                 return -ENOMEM;
9706
9707         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9708                 err = -EOPNOTSUPP;
9709                 goto out;
9710         }
9711
9712         err = nla_parse(tb, NL80211_ATTR_MAX,
9713                         nla_data(attr), nla_len(attr),
9714                         nl80211_policy);
9715         if (err)
9716                 goto out;
9717
9718         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9719         err = PTR_ERR_OR_ZERO(trig->nd_config);
9720         if (err)
9721                 trig->nd_config = NULL;
9722
9723 out:
9724         kfree(tb);
9725         return err;
9726 }
9727
9728 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9729 {
9730         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9731         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9732         struct cfg80211_wowlan new_triggers = {};
9733         struct cfg80211_wowlan *ntrig;
9734         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9735         int err, i;
9736         bool prev_enabled = rdev->wiphy.wowlan_config;
9737         bool regular = false;
9738
9739         if (!wowlan)
9740                 return -EOPNOTSUPP;
9741
9742         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9743                 cfg80211_rdev_free_wowlan(rdev);
9744                 rdev->wiphy.wowlan_config = NULL;
9745                 goto set_wakeup;
9746         }
9747
9748         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9749                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9750                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9751                         nl80211_wowlan_policy);
9752         if (err)
9753                 return err;
9754
9755         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9756                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9757                         return -EINVAL;
9758                 new_triggers.any = true;
9759         }
9760
9761         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9762                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9763                         return -EINVAL;
9764                 new_triggers.disconnect = true;
9765                 regular = true;
9766         }
9767
9768         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9769                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9770                         return -EINVAL;
9771                 new_triggers.magic_pkt = true;
9772                 regular = true;
9773         }
9774
9775         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9776                 return -EINVAL;
9777
9778         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9779                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9780                         return -EINVAL;
9781                 new_triggers.gtk_rekey_failure = true;
9782                 regular = true;
9783         }
9784
9785         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9786                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9787                         return -EINVAL;
9788                 new_triggers.eap_identity_req = true;
9789                 regular = true;
9790         }
9791
9792         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9793                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9794                         return -EINVAL;
9795                 new_triggers.four_way_handshake = true;
9796                 regular = true;
9797         }
9798
9799         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9800                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9801                         return -EINVAL;
9802                 new_triggers.rfkill_release = true;
9803                 regular = true;
9804         }
9805
9806         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9807                 struct nlattr *pat;
9808                 int n_patterns = 0;
9809                 int rem, pat_len, mask_len, pkt_offset;
9810                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9811
9812                 regular = true;
9813
9814                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9815                                     rem)
9816                         n_patterns++;
9817                 if (n_patterns > wowlan->n_patterns)
9818                         return -EINVAL;
9819
9820                 new_triggers.patterns = kcalloc(n_patterns,
9821                                                 sizeof(new_triggers.patterns[0]),
9822                                                 GFP_KERNEL);
9823                 if (!new_triggers.patterns)
9824                         return -ENOMEM;
9825
9826                 new_triggers.n_patterns = n_patterns;
9827                 i = 0;
9828
9829                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9830                                     rem) {
9831                         u8 *mask_pat;
9832
9833                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9834                                   nla_len(pat), NULL);
9835                         err = -EINVAL;
9836                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9837                             !pat_tb[NL80211_PKTPAT_PATTERN])
9838                                 goto error;
9839                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9840                         mask_len = DIV_ROUND_UP(pat_len, 8);
9841                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9842                                 goto error;
9843                         if (pat_len > wowlan->pattern_max_len ||
9844                             pat_len < wowlan->pattern_min_len)
9845                                 goto error;
9846
9847                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9848                                 pkt_offset = 0;
9849                         else
9850                                 pkt_offset = nla_get_u32(
9851                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9852                         if (pkt_offset > wowlan->max_pkt_offset)
9853                                 goto error;
9854                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9855
9856                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9857                         if (!mask_pat) {
9858                                 err = -ENOMEM;
9859                                 goto error;
9860                         }
9861                         new_triggers.patterns[i].mask = mask_pat;
9862                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9863                                mask_len);
9864                         mask_pat += mask_len;
9865                         new_triggers.patterns[i].pattern = mask_pat;
9866                         new_triggers.patterns[i].pattern_len = pat_len;
9867                         memcpy(mask_pat,
9868                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9869                                pat_len);
9870                         i++;
9871                 }
9872         }
9873
9874         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9875                 regular = true;
9876                 err = nl80211_parse_wowlan_tcp(
9877                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9878                         &new_triggers);
9879                 if (err)
9880                         goto error;
9881         }
9882
9883         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9884                 regular = true;
9885                 err = nl80211_parse_wowlan_nd(
9886                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9887                         &new_triggers);
9888                 if (err)
9889                         goto error;
9890         }
9891
9892         /* The 'any' trigger means the device continues operating more or less
9893          * as in its normal operation mode and wakes up the host on most of the
9894          * normal interrupts (like packet RX, ...)
9895          * It therefore makes little sense to combine with the more constrained
9896          * wakeup trigger modes.
9897          */
9898         if (new_triggers.any && regular) {
9899                 err = -EINVAL;
9900                 goto error;
9901         }
9902
9903         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9904         if (!ntrig) {
9905                 err = -ENOMEM;
9906                 goto error;
9907         }
9908         cfg80211_rdev_free_wowlan(rdev);
9909         rdev->wiphy.wowlan_config = ntrig;
9910
9911  set_wakeup:
9912         if (rdev->ops->set_wakeup &&
9913             prev_enabled != !!rdev->wiphy.wowlan_config)
9914                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9915
9916         return 0;
9917  error:
9918         for (i = 0; i < new_triggers.n_patterns; i++)
9919                 kfree(new_triggers.patterns[i].mask);
9920         kfree(new_triggers.patterns);
9921         if (new_triggers.tcp && new_triggers.tcp->sock)
9922                 sock_release(new_triggers.tcp->sock);
9923         kfree(new_triggers.tcp);
9924         kfree(new_triggers.nd_config);
9925         return err;
9926 }
9927 #endif
9928
9929 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9930                                        struct cfg80211_registered_device *rdev)
9931 {
9932         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9933         int i, j, pat_len;
9934         struct cfg80211_coalesce_rules *rule;
9935
9936         if (!rdev->coalesce->n_rules)
9937                 return 0;
9938
9939         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9940         if (!nl_rules)
9941                 return -ENOBUFS;
9942
9943         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9944                 nl_rule = nla_nest_start(msg, i + 1);
9945                 if (!nl_rule)
9946                         return -ENOBUFS;
9947
9948                 rule = &rdev->coalesce->rules[i];
9949                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9950                                 rule->delay))
9951                         return -ENOBUFS;
9952
9953                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9954                                 rule->condition))
9955                         return -ENOBUFS;
9956
9957                 nl_pats = nla_nest_start(msg,
9958                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9959                 if (!nl_pats)
9960                         return -ENOBUFS;
9961
9962                 for (j = 0; j < rule->n_patterns; j++) {
9963                         nl_pat = nla_nest_start(msg, j + 1);
9964                         if (!nl_pat)
9965                                 return -ENOBUFS;
9966                         pat_len = rule->patterns[j].pattern_len;
9967                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9968                                     DIV_ROUND_UP(pat_len, 8),
9969                                     rule->patterns[j].mask) ||
9970                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9971                                     rule->patterns[j].pattern) ||
9972                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9973                                         rule->patterns[j].pkt_offset))
9974                                 return -ENOBUFS;
9975                         nla_nest_end(msg, nl_pat);
9976                 }
9977                 nla_nest_end(msg, nl_pats);
9978                 nla_nest_end(msg, nl_rule);
9979         }
9980         nla_nest_end(msg, nl_rules);
9981
9982         return 0;
9983 }
9984
9985 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9986 {
9987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9988         struct sk_buff *msg;
9989         void *hdr;
9990
9991         if (!rdev->wiphy.coalesce)
9992                 return -EOPNOTSUPP;
9993
9994         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9995         if (!msg)
9996                 return -ENOMEM;
9997
9998         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9999                              NL80211_CMD_GET_COALESCE);
10000         if (!hdr)
10001                 goto nla_put_failure;
10002
10003         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10004                 goto nla_put_failure;
10005
10006         genlmsg_end(msg, hdr);
10007         return genlmsg_reply(msg, info);
10008
10009 nla_put_failure:
10010         nlmsg_free(msg);
10011         return -ENOBUFS;
10012 }
10013
10014 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10015 {
10016         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10017         int i, j;
10018         struct cfg80211_coalesce_rules *rule;
10019
10020         if (!coalesce)
10021                 return;
10022
10023         for (i = 0; i < coalesce->n_rules; i++) {
10024                 rule = &coalesce->rules[i];
10025                 for (j = 0; j < rule->n_patterns; j++)
10026                         kfree(rule->patterns[j].mask);
10027                 kfree(rule->patterns);
10028         }
10029         kfree(coalesce->rules);
10030         kfree(coalesce);
10031         rdev->coalesce = NULL;
10032 }
10033
10034 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10035                                        struct nlattr *rule,
10036                                        struct cfg80211_coalesce_rules *new_rule)
10037 {
10038         int err, i;
10039         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10040         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10041         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10042         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10043
10044         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
10045                         nla_len(rule), nl80211_coalesce_policy);
10046         if (err)
10047                 return err;
10048
10049         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10050                 new_rule->delay =
10051                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10052         if (new_rule->delay > coalesce->max_delay)
10053                 return -EINVAL;
10054
10055         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10056                 new_rule->condition =
10057                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10058         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10059             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10060                 return -EINVAL;
10061
10062         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10063                 return -EINVAL;
10064
10065         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10066                             rem)
10067                 n_patterns++;
10068         if (n_patterns > coalesce->n_patterns)
10069                 return -EINVAL;
10070
10071         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10072                                      GFP_KERNEL);
10073         if (!new_rule->patterns)
10074                 return -ENOMEM;
10075
10076         new_rule->n_patterns = n_patterns;
10077         i = 0;
10078
10079         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10080                             rem) {
10081                 u8 *mask_pat;
10082
10083                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10084                           nla_len(pat), NULL);
10085                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10086                     !pat_tb[NL80211_PKTPAT_PATTERN])
10087                         return -EINVAL;
10088                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10089                 mask_len = DIV_ROUND_UP(pat_len, 8);
10090                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10091                         return -EINVAL;
10092                 if (pat_len > coalesce->pattern_max_len ||
10093                     pat_len < coalesce->pattern_min_len)
10094                         return -EINVAL;
10095
10096                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10097                         pkt_offset = 0;
10098                 else
10099                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10100                 if (pkt_offset > coalesce->max_pkt_offset)
10101                         return -EINVAL;
10102                 new_rule->patterns[i].pkt_offset = pkt_offset;
10103
10104                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10105                 if (!mask_pat)
10106                         return -ENOMEM;
10107
10108                 new_rule->patterns[i].mask = mask_pat;
10109                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10110                        mask_len);
10111
10112                 mask_pat += mask_len;
10113                 new_rule->patterns[i].pattern = mask_pat;
10114                 new_rule->patterns[i].pattern_len = pat_len;
10115                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10116                        pat_len);
10117                 i++;
10118         }
10119
10120         return 0;
10121 }
10122
10123 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10124 {
10125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10126         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10127         struct cfg80211_coalesce new_coalesce = {};
10128         struct cfg80211_coalesce *n_coalesce;
10129         int err, rem_rule, n_rules = 0, i, j;
10130         struct nlattr *rule;
10131         struct cfg80211_coalesce_rules *tmp_rule;
10132
10133         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10134                 return -EOPNOTSUPP;
10135
10136         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10137                 cfg80211_rdev_free_coalesce(rdev);
10138                 rdev_set_coalesce(rdev, NULL);
10139                 return 0;
10140         }
10141
10142         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10143                             rem_rule)
10144                 n_rules++;
10145         if (n_rules > coalesce->n_rules)
10146                 return -EINVAL;
10147
10148         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10149                                      GFP_KERNEL);
10150         if (!new_coalesce.rules)
10151                 return -ENOMEM;
10152
10153         new_coalesce.n_rules = n_rules;
10154         i = 0;
10155
10156         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10157                             rem_rule) {
10158                 err = nl80211_parse_coalesce_rule(rdev, rule,
10159                                                   &new_coalesce.rules[i]);
10160                 if (err)
10161                         goto error;
10162
10163                 i++;
10164         }
10165
10166         err = rdev_set_coalesce(rdev, &new_coalesce);
10167         if (err)
10168                 goto error;
10169
10170         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10171         if (!n_coalesce) {
10172                 err = -ENOMEM;
10173                 goto error;
10174         }
10175         cfg80211_rdev_free_coalesce(rdev);
10176         rdev->coalesce = n_coalesce;
10177
10178         return 0;
10179 error:
10180         for (i = 0; i < new_coalesce.n_rules; i++) {
10181                 tmp_rule = &new_coalesce.rules[i];
10182                 for (j = 0; j < tmp_rule->n_patterns; j++)
10183                         kfree(tmp_rule->patterns[j].mask);
10184                 kfree(tmp_rule->patterns);
10185         }
10186         kfree(new_coalesce.rules);
10187
10188         return err;
10189 }
10190
10191 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10192 {
10193         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10194         struct net_device *dev = info->user_ptr[1];
10195         struct wireless_dev *wdev = dev->ieee80211_ptr;
10196         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10197         struct cfg80211_gtk_rekey_data rekey_data;
10198         int err;
10199
10200         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10201                 return -EINVAL;
10202
10203         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10204                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10205                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10206                         nl80211_rekey_policy);
10207         if (err)
10208                 return err;
10209
10210         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10211                 return -ERANGE;
10212         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10213                 return -ERANGE;
10214         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10215                 return -ERANGE;
10216
10217         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10218         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10219         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10220
10221         wdev_lock(wdev);
10222         if (!wdev->current_bss) {
10223                 err = -ENOTCONN;
10224                 goto out;
10225         }
10226
10227         if (!rdev->ops->set_rekey_data) {
10228                 err = -EOPNOTSUPP;
10229                 goto out;
10230         }
10231
10232         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10233  out:
10234         wdev_unlock(wdev);
10235         return err;
10236 }
10237
10238 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10239                                              struct genl_info *info)
10240 {
10241         struct net_device *dev = info->user_ptr[1];
10242         struct wireless_dev *wdev = dev->ieee80211_ptr;
10243
10244         if (wdev->iftype != NL80211_IFTYPE_AP &&
10245             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10246                 return -EINVAL;
10247
10248         if (wdev->ap_unexpected_nlportid)
10249                 return -EBUSY;
10250
10251         wdev->ap_unexpected_nlportid = info->snd_portid;
10252         return 0;
10253 }
10254
10255 static int nl80211_probe_client(struct sk_buff *skb,
10256                                 struct genl_info *info)
10257 {
10258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10259         struct net_device *dev = info->user_ptr[1];
10260         struct wireless_dev *wdev = dev->ieee80211_ptr;
10261         struct sk_buff *msg;
10262         void *hdr;
10263         const u8 *addr;
10264         u64 cookie;
10265         int err;
10266
10267         if (wdev->iftype != NL80211_IFTYPE_AP &&
10268             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10269                 return -EOPNOTSUPP;
10270
10271         if (!info->attrs[NL80211_ATTR_MAC])
10272                 return -EINVAL;
10273
10274         if (!rdev->ops->probe_client)
10275                 return -EOPNOTSUPP;
10276
10277         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10278         if (!msg)
10279                 return -ENOMEM;
10280
10281         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10282                              NL80211_CMD_PROBE_CLIENT);
10283         if (!hdr) {
10284                 err = -ENOBUFS;
10285                 goto free_msg;
10286         }
10287
10288         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10289
10290         err = rdev_probe_client(rdev, dev, addr, &cookie);
10291         if (err)
10292                 goto free_msg;
10293
10294         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10295                               NL80211_ATTR_PAD))
10296                 goto nla_put_failure;
10297
10298         genlmsg_end(msg, hdr);
10299
10300         return genlmsg_reply(msg, info);
10301
10302  nla_put_failure:
10303         err = -ENOBUFS;
10304  free_msg:
10305         nlmsg_free(msg);
10306         return err;
10307 }
10308
10309 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10310 {
10311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10312         struct cfg80211_beacon_registration *reg, *nreg;
10313         int rv;
10314
10315         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10316                 return -EOPNOTSUPP;
10317
10318         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10319         if (!nreg)
10320                 return -ENOMEM;
10321
10322         /* First, check if already registered. */
10323         spin_lock_bh(&rdev->beacon_registrations_lock);
10324         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10325                 if (reg->nlportid == info->snd_portid) {
10326                         rv = -EALREADY;
10327                         goto out_err;
10328                 }
10329         }
10330         /* Add it to the list */
10331         nreg->nlportid = info->snd_portid;
10332         list_add(&nreg->list, &rdev->beacon_registrations);
10333
10334         spin_unlock_bh(&rdev->beacon_registrations_lock);
10335
10336         return 0;
10337 out_err:
10338         spin_unlock_bh(&rdev->beacon_registrations_lock);
10339         kfree(nreg);
10340         return rv;
10341 }
10342
10343 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10344 {
10345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10346         struct wireless_dev *wdev = info->user_ptr[1];
10347         int err;
10348
10349         if (!rdev->ops->start_p2p_device)
10350                 return -EOPNOTSUPP;
10351
10352         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10353                 return -EOPNOTSUPP;
10354
10355         if (wdev->p2p_started)
10356                 return 0;
10357
10358         if (rfkill_blocked(rdev->rfkill))
10359                 return -ERFKILL;
10360
10361         err = rdev_start_p2p_device(rdev, wdev);
10362         if (err)
10363                 return err;
10364
10365         wdev->p2p_started = true;
10366         rdev->opencount++;
10367
10368         return 0;
10369 }
10370
10371 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10372 {
10373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10374         struct wireless_dev *wdev = info->user_ptr[1];
10375
10376         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10377                 return -EOPNOTSUPP;
10378
10379         if (!rdev->ops->stop_p2p_device)
10380                 return -EOPNOTSUPP;
10381
10382         cfg80211_stop_p2p_device(rdev, wdev);
10383
10384         return 0;
10385 }
10386
10387 static int nl80211_get_protocol_features(struct sk_buff *skb,
10388                                          struct genl_info *info)
10389 {
10390         void *hdr;
10391         struct sk_buff *msg;
10392
10393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10394         if (!msg)
10395                 return -ENOMEM;
10396
10397         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10398                              NL80211_CMD_GET_PROTOCOL_FEATURES);
10399         if (!hdr)
10400                 goto nla_put_failure;
10401
10402         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
10403                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
10404                 goto nla_put_failure;
10405
10406         genlmsg_end(msg, hdr);
10407         return genlmsg_reply(msg, info);
10408
10409  nla_put_failure:
10410         kfree_skb(msg);
10411         return -ENOBUFS;
10412 }
10413
10414 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
10415 {
10416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10417         struct cfg80211_update_ft_ies_params ft_params;
10418         struct net_device *dev = info->user_ptr[1];
10419
10420         if (!rdev->ops->update_ft_ies)
10421                 return -EOPNOTSUPP;
10422
10423         if (!info->attrs[NL80211_ATTR_MDID] ||
10424             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
10425                 return -EINVAL;
10426
10427         memset(&ft_params, 0, sizeof(ft_params));
10428         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10429         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10430         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10431
10432         return rdev_update_ft_ies(rdev, dev, &ft_params);
10433 }
10434
10435 static int nl80211_crit_protocol_start(struct sk_buff *skb,
10436                                        struct genl_info *info)
10437 {
10438         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10439         struct wireless_dev *wdev = info->user_ptr[1];
10440         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10441         u16 duration;
10442         int ret;
10443
10444         if (!rdev->ops->crit_proto_start)
10445                 return -EOPNOTSUPP;
10446
10447         if (WARN_ON(!rdev->ops->crit_proto_stop))
10448                 return -EINVAL;
10449
10450         if (rdev->crit_proto_nlportid)
10451                 return -EBUSY;
10452
10453         /* determine protocol if provided */
10454         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10455                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10456
10457         if (proto >= NUM_NL80211_CRIT_PROTO)
10458                 return -EINVAL;
10459
10460         /* timeout must be provided */
10461         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10462                 return -EINVAL;
10463
10464         duration =
10465                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10466
10467         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10468                 return -ERANGE;
10469
10470         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10471         if (!ret)
10472                 rdev->crit_proto_nlportid = info->snd_portid;
10473
10474         return ret;
10475 }
10476
10477 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10478                                       struct genl_info *info)
10479 {
10480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10481         struct wireless_dev *wdev = info->user_ptr[1];
10482
10483         if (!rdev->ops->crit_proto_stop)
10484                 return -EOPNOTSUPP;
10485
10486         if (rdev->crit_proto_nlportid) {
10487                 rdev->crit_proto_nlportid = 0;
10488                 rdev_crit_proto_stop(rdev, wdev);
10489         }
10490         return 0;
10491 }
10492
10493 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10494 {
10495         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10496         struct wireless_dev *wdev =
10497                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10498         int i, err;
10499         u32 vid, subcmd;
10500
10501         if (!rdev->wiphy.vendor_commands)
10502                 return -EOPNOTSUPP;
10503
10504         if (IS_ERR(wdev)) {
10505                 err = PTR_ERR(wdev);
10506                 if (err != -EINVAL)
10507                         return err;
10508                 wdev = NULL;
10509         } else if (wdev->wiphy != &rdev->wiphy) {
10510                 return -EINVAL;
10511         }
10512
10513         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10514             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10515                 return -EINVAL;
10516
10517         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10518         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10519         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10520                 const struct wiphy_vendor_command *vcmd;
10521                 void *data = NULL;
10522                 int len = 0;
10523
10524                 vcmd = &rdev->wiphy.vendor_commands[i];
10525
10526                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10527                         continue;
10528
10529                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10530                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10531                         if (!wdev)
10532                                 return -EINVAL;
10533                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10534                             !wdev->netdev)
10535                                 return -EINVAL;
10536
10537                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10538                                 if (wdev->netdev &&
10539                                     !netif_running(wdev->netdev))
10540                                         return -ENETDOWN;
10541                                 if (!wdev->netdev && !wdev->p2p_started)
10542                                         return -ENETDOWN;
10543                         }
10544
10545                         if (!vcmd->doit)
10546                                 return -EOPNOTSUPP;
10547                 } else {
10548                         wdev = NULL;
10549                 }
10550
10551                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10552                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10553                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10554                 }
10555
10556                 rdev->cur_cmd_info = info;
10557                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10558                                                           data, len);
10559                 rdev->cur_cmd_info = NULL;
10560                 return err;
10561         }
10562
10563         return -EOPNOTSUPP;
10564 }
10565
10566 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10567                                        struct netlink_callback *cb,
10568                                        struct cfg80211_registered_device **rdev,
10569                                        struct wireless_dev **wdev)
10570 {
10571         u32 vid, subcmd;
10572         unsigned int i;
10573         int vcmd_idx = -1;
10574         int err;
10575         void *data = NULL;
10576         unsigned int data_len = 0;
10577
10578         rtnl_lock();
10579
10580         if (cb->args[0]) {
10581                 /* subtract the 1 again here */
10582                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10583                 struct wireless_dev *tmp;
10584
10585                 if (!wiphy) {
10586                         err = -ENODEV;
10587                         goto out_unlock;
10588                 }
10589                 *rdev = wiphy_to_rdev(wiphy);
10590                 *wdev = NULL;
10591
10592                 if (cb->args[1]) {
10593                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
10594                                 if (tmp->identifier == cb->args[1] - 1) {
10595                                         *wdev = tmp;
10596                                         break;
10597                                 }
10598                         }
10599                 }
10600
10601                 /* keep rtnl locked in successful case */
10602                 return 0;
10603         }
10604
10605         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10606                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10607                           nl80211_policy);
10608         if (err)
10609                 goto out_unlock;
10610
10611         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10612             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10613                 err = -EINVAL;
10614                 goto out_unlock;
10615         }
10616
10617         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10618                                            nl80211_fam.attrbuf);
10619         if (IS_ERR(*wdev))
10620                 *wdev = NULL;
10621
10622         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10623                                            nl80211_fam.attrbuf);
10624         if (IS_ERR(*rdev)) {
10625                 err = PTR_ERR(*rdev);
10626                 goto out_unlock;
10627         }
10628
10629         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10630         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10631
10632         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10633                 const struct wiphy_vendor_command *vcmd;
10634
10635                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10636
10637                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10638                         continue;
10639
10640                 if (!vcmd->dumpit) {
10641                         err = -EOPNOTSUPP;
10642                         goto out_unlock;
10643                 }
10644
10645                 vcmd_idx = i;
10646                 break;
10647         }
10648
10649         if (vcmd_idx < 0) {
10650                 err = -EOPNOTSUPP;
10651                 goto out_unlock;
10652         }
10653
10654         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10655                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10656                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10657         }
10658
10659         /* 0 is the first index - add 1 to parse only once */
10660         cb->args[0] = (*rdev)->wiphy_idx + 1;
10661         /* add 1 to know if it was NULL */
10662         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10663         cb->args[2] = vcmd_idx;
10664         cb->args[3] = (unsigned long)data;
10665         cb->args[4] = data_len;
10666
10667         /* keep rtnl locked in successful case */
10668         return 0;
10669  out_unlock:
10670         rtnl_unlock();
10671         return err;
10672 }
10673
10674 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10675                                    struct netlink_callback *cb)
10676 {
10677         struct cfg80211_registered_device *rdev;
10678         struct wireless_dev *wdev;
10679         unsigned int vcmd_idx;
10680         const struct wiphy_vendor_command *vcmd;
10681         void *data;
10682         int data_len;
10683         int err;
10684         struct nlattr *vendor_data;
10685
10686         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10687         if (err)
10688                 return err;
10689
10690         vcmd_idx = cb->args[2];
10691         data = (void *)cb->args[3];
10692         data_len = cb->args[4];
10693         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10694
10695         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10696                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10697                 if (!wdev)
10698                         return -EINVAL;
10699                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10700                     !wdev->netdev)
10701                         return -EINVAL;
10702
10703                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10704                         if (wdev->netdev &&
10705                             !netif_running(wdev->netdev))
10706                                 return -ENETDOWN;
10707                         if (!wdev->netdev && !wdev->p2p_started)
10708                                 return -ENETDOWN;
10709                 }
10710         }
10711
10712         while (1) {
10713                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10714                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10715                                            NL80211_CMD_VENDOR);
10716                 if (!hdr)
10717                         break;
10718
10719                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10720                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10721                                                wdev_id(wdev),
10722                                                NL80211_ATTR_PAD))) {
10723                         genlmsg_cancel(skb, hdr);
10724                         break;
10725                 }
10726
10727                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10728                 if (!vendor_data) {
10729                         genlmsg_cancel(skb, hdr);
10730                         break;
10731                 }
10732
10733                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10734                                    (unsigned long *)&cb->args[5]);
10735                 nla_nest_end(skb, vendor_data);
10736
10737                 if (err == -ENOBUFS || err == -ENOENT) {
10738                         genlmsg_cancel(skb, hdr);
10739                         break;
10740                 } else if (err) {
10741                         genlmsg_cancel(skb, hdr);
10742                         goto out;
10743                 }
10744
10745                 genlmsg_end(skb, hdr);
10746         }
10747
10748         err = skb->len;
10749  out:
10750         rtnl_unlock();
10751         return err;
10752 }
10753
10754 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10755                                            enum nl80211_commands cmd,
10756                                            enum nl80211_attrs attr,
10757                                            int approxlen)
10758 {
10759         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10760
10761         if (WARN_ON(!rdev->cur_cmd_info))
10762                 return NULL;
10763
10764         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10765                                            rdev->cur_cmd_info->snd_portid,
10766                                            rdev->cur_cmd_info->snd_seq,
10767                                            cmd, attr, NULL, GFP_KERNEL);
10768 }
10769 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10770
10771 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10772 {
10773         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10774         void *hdr = ((void **)skb->cb)[1];
10775         struct nlattr *data = ((void **)skb->cb)[2];
10776
10777         /* clear CB data for netlink core to own from now on */
10778         memset(skb->cb, 0, sizeof(skb->cb));
10779
10780         if (WARN_ON(!rdev->cur_cmd_info)) {
10781                 kfree_skb(skb);
10782                 return -EINVAL;
10783         }
10784
10785         nla_nest_end(skb, data);
10786         genlmsg_end(skb, hdr);
10787         return genlmsg_reply(skb, rdev->cur_cmd_info);
10788 }
10789 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10790
10791 static int nl80211_set_qos_map(struct sk_buff *skb,
10792                                struct genl_info *info)
10793 {
10794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10795         struct cfg80211_qos_map *qos_map = NULL;
10796         struct net_device *dev = info->user_ptr[1];
10797         u8 *pos, len, num_des, des_len, des;
10798         int ret;
10799
10800         if (!rdev->ops->set_qos_map)
10801                 return -EOPNOTSUPP;
10802
10803         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10804                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10805                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10806
10807                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10808                     len > IEEE80211_QOS_MAP_LEN_MAX)
10809                         return -EINVAL;
10810
10811                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10812                 if (!qos_map)
10813                         return -ENOMEM;
10814
10815                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10816                 if (num_des) {
10817                         des_len = num_des *
10818                                 sizeof(struct cfg80211_dscp_exception);
10819                         memcpy(qos_map->dscp_exception, pos, des_len);
10820                         qos_map->num_des = num_des;
10821                         for (des = 0; des < num_des; des++) {
10822                                 if (qos_map->dscp_exception[des].up > 7) {
10823                                         kfree(qos_map);
10824                                         return -EINVAL;
10825                                 }
10826                         }
10827                         pos += des_len;
10828                 }
10829                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10830         }
10831
10832         wdev_lock(dev->ieee80211_ptr);
10833         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10834         if (!ret)
10835                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10836         wdev_unlock(dev->ieee80211_ptr);
10837
10838         kfree(qos_map);
10839         return ret;
10840 }
10841
10842 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10843 {
10844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10845         struct net_device *dev = info->user_ptr[1];
10846         struct wireless_dev *wdev = dev->ieee80211_ptr;
10847         const u8 *peer;
10848         u8 tsid, up;
10849         u16 admitted_time = 0;
10850         int err;
10851
10852         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10853                 return -EOPNOTSUPP;
10854
10855         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10856             !info->attrs[NL80211_ATTR_USER_PRIO])
10857                 return -EINVAL;
10858
10859         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10860         if (tsid >= IEEE80211_NUM_TIDS)
10861                 return -EINVAL;
10862
10863         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10864         if (up >= IEEE80211_NUM_UPS)
10865                 return -EINVAL;
10866
10867         /* WMM uses TIDs 0-7 even for TSPEC */
10868         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10869                 /* TODO: handle 802.11 TSPEC/admission control
10870                  * need more attributes for that (e.g. BA session requirement);
10871                  * change the WMM adminssion test above to allow both then
10872                  */
10873                 return -EINVAL;
10874         }
10875
10876         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10877
10878         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10879                 admitted_time =
10880                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10881                 if (!admitted_time)
10882                         return -EINVAL;
10883         }
10884
10885         wdev_lock(wdev);
10886         switch (wdev->iftype) {
10887         case NL80211_IFTYPE_STATION:
10888         case NL80211_IFTYPE_P2P_CLIENT:
10889                 if (wdev->current_bss)
10890                         break;
10891                 err = -ENOTCONN;
10892                 goto out;
10893         default:
10894                 err = -EOPNOTSUPP;
10895                 goto out;
10896         }
10897
10898         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10899
10900  out:
10901         wdev_unlock(wdev);
10902         return err;
10903 }
10904
10905 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10906 {
10907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10908         struct net_device *dev = info->user_ptr[1];
10909         struct wireless_dev *wdev = dev->ieee80211_ptr;
10910         const u8 *peer;
10911         u8 tsid;
10912         int err;
10913
10914         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10915                 return -EINVAL;
10916
10917         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10918         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10919
10920         wdev_lock(wdev);
10921         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10922         wdev_unlock(wdev);
10923
10924         return err;
10925 }
10926
10927 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10928                                        struct genl_info *info)
10929 {
10930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10931         struct net_device *dev = info->user_ptr[1];
10932         struct wireless_dev *wdev = dev->ieee80211_ptr;
10933         struct cfg80211_chan_def chandef = {};
10934         const u8 *addr;
10935         u8 oper_class;
10936         int err;
10937
10938         if (!rdev->ops->tdls_channel_switch ||
10939             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10940                 return -EOPNOTSUPP;
10941
10942         switch (dev->ieee80211_ptr->iftype) {
10943         case NL80211_IFTYPE_STATION:
10944         case NL80211_IFTYPE_P2P_CLIENT:
10945                 break;
10946         default:
10947                 return -EOPNOTSUPP;
10948         }
10949
10950         if (!info->attrs[NL80211_ATTR_MAC] ||
10951             !info->attrs[NL80211_ATTR_OPER_CLASS])
10952                 return -EINVAL;
10953
10954         err = nl80211_parse_chandef(rdev, info, &chandef);
10955         if (err)
10956                 return err;
10957
10958         /*
10959          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10960          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10961          * specification is not defined for them.
10962          */
10963         if (chandef.chan->band == NL80211_BAND_2GHZ &&
10964             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10965             chandef.width != NL80211_CHAN_WIDTH_20)
10966                 return -EINVAL;
10967
10968         /* we will be active on the TDLS link */
10969         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10970                                            wdev->iftype))
10971                 return -EINVAL;
10972
10973         /* don't allow switching to DFS channels */
10974         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10975                 return -EINVAL;
10976
10977         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10978         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10979
10980         wdev_lock(wdev);
10981         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10982         wdev_unlock(wdev);
10983
10984         return err;
10985 }
10986
10987 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10988                                               struct genl_info *info)
10989 {
10990         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10991         struct net_device *dev = info->user_ptr[1];
10992         struct wireless_dev *wdev = dev->ieee80211_ptr;
10993         const u8 *addr;
10994
10995         if (!rdev->ops->tdls_channel_switch ||
10996             !rdev->ops->tdls_cancel_channel_switch ||
10997             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10998                 return -EOPNOTSUPP;
10999
11000         switch (dev->ieee80211_ptr->iftype) {
11001         case NL80211_IFTYPE_STATION:
11002         case NL80211_IFTYPE_P2P_CLIENT:
11003                 break;
11004         default:
11005                 return -EOPNOTSUPP;
11006         }
11007
11008         if (!info->attrs[NL80211_ATTR_MAC])
11009                 return -EINVAL;
11010
11011         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11012
11013         wdev_lock(wdev);
11014         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11015         wdev_unlock(wdev);
11016
11017         return 0;
11018 }
11019
11020 #define NL80211_FLAG_NEED_WIPHY         0x01
11021 #define NL80211_FLAG_NEED_NETDEV        0x02
11022 #define NL80211_FLAG_NEED_RTNL          0x04
11023 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
11024 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
11025                                          NL80211_FLAG_CHECK_NETDEV_UP)
11026 #define NL80211_FLAG_NEED_WDEV          0x10
11027 /* If a netdev is associated, it must be UP, P2P must be started */
11028 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
11029                                          NL80211_FLAG_CHECK_NETDEV_UP)
11030 #define NL80211_FLAG_CLEAR_SKB          0x20
11031
11032 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11033                             struct genl_info *info)
11034 {
11035         struct cfg80211_registered_device *rdev;
11036         struct wireless_dev *wdev;
11037         struct net_device *dev;
11038         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11039
11040         if (rtnl)
11041                 rtnl_lock();
11042
11043         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11044                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11045                 if (IS_ERR(rdev)) {
11046                         if (rtnl)
11047                                 rtnl_unlock();
11048                         return PTR_ERR(rdev);
11049                 }
11050                 info->user_ptr[0] = rdev;
11051         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
11052                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11053                 ASSERT_RTNL();
11054
11055                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
11056                                                   info->attrs);
11057                 if (IS_ERR(wdev)) {
11058                         if (rtnl)
11059                                 rtnl_unlock();
11060                         return PTR_ERR(wdev);
11061                 }
11062
11063                 dev = wdev->netdev;
11064                 rdev = wiphy_to_rdev(wdev->wiphy);
11065
11066                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
11067                         if (!dev) {
11068                                 if (rtnl)
11069                                         rtnl_unlock();
11070                                 return -EINVAL;
11071                         }
11072
11073                         info->user_ptr[1] = dev;
11074                 } else {
11075                         info->user_ptr[1] = wdev;
11076                 }
11077
11078                 if (dev) {
11079                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
11080                             !netif_running(dev)) {
11081                                 if (rtnl)
11082                                         rtnl_unlock();
11083                                 return -ENETDOWN;
11084                         }
11085
11086                         dev_hold(dev);
11087                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
11088                         if (!wdev->p2p_started) {
11089                                 if (rtnl)
11090                                         rtnl_unlock();
11091                                 return -ENETDOWN;
11092                         }
11093                 }
11094
11095                 info->user_ptr[0] = rdev;
11096         }
11097
11098         return 0;
11099 }
11100
11101 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
11102                               struct genl_info *info)
11103 {
11104         if (info->user_ptr[1]) {
11105                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11106                         struct wireless_dev *wdev = info->user_ptr[1];
11107
11108                         if (wdev->netdev)
11109                                 dev_put(wdev->netdev);
11110                 } else {
11111                         dev_put(info->user_ptr[1]);
11112                 }
11113         }
11114
11115         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
11116                 rtnl_unlock();
11117
11118         /* If needed, clear the netlink message payload from the SKB
11119          * as it might contain key data that shouldn't stick around on
11120          * the heap after the SKB is freed. The netlink message header
11121          * is still needed for further processing, so leave it intact.
11122          */
11123         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
11124                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
11125
11126                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
11127         }
11128 }
11129
11130 static const struct genl_ops nl80211_ops[] = {
11131         {
11132                 .cmd = NL80211_CMD_GET_WIPHY,
11133                 .doit = nl80211_get_wiphy,
11134                 .dumpit = nl80211_dump_wiphy,
11135                 .done = nl80211_dump_wiphy_done,
11136                 .policy = nl80211_policy,
11137                 /* can be retrieved by unprivileged users */
11138                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11139                                   NL80211_FLAG_NEED_RTNL,
11140         },
11141         {
11142                 .cmd = NL80211_CMD_SET_WIPHY,
11143                 .doit = nl80211_set_wiphy,
11144                 .policy = nl80211_policy,
11145                 .flags = GENL_UNS_ADMIN_PERM,
11146                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11147         },
11148         {
11149                 .cmd = NL80211_CMD_GET_INTERFACE,
11150                 .doit = nl80211_get_interface,
11151                 .dumpit = nl80211_dump_interface,
11152                 .policy = nl80211_policy,
11153                 /* can be retrieved by unprivileged users */
11154                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11155                                   NL80211_FLAG_NEED_RTNL,
11156         },
11157         {
11158                 .cmd = NL80211_CMD_SET_INTERFACE,
11159                 .doit = nl80211_set_interface,
11160                 .policy = nl80211_policy,
11161                 .flags = GENL_UNS_ADMIN_PERM,
11162                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11163                                   NL80211_FLAG_NEED_RTNL,
11164         },
11165         {
11166                 .cmd = NL80211_CMD_NEW_INTERFACE,
11167                 .doit = nl80211_new_interface,
11168                 .policy = nl80211_policy,
11169                 .flags = GENL_UNS_ADMIN_PERM,
11170                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11171                                   NL80211_FLAG_NEED_RTNL,
11172         },
11173         {
11174                 .cmd = NL80211_CMD_DEL_INTERFACE,
11175                 .doit = nl80211_del_interface,
11176                 .policy = nl80211_policy,
11177                 .flags = GENL_UNS_ADMIN_PERM,
11178                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11179                                   NL80211_FLAG_NEED_RTNL,
11180         },
11181         {
11182                 .cmd = NL80211_CMD_GET_KEY,
11183                 .doit = nl80211_get_key,
11184                 .policy = nl80211_policy,
11185                 .flags = GENL_UNS_ADMIN_PERM,
11186                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11187                                   NL80211_FLAG_NEED_RTNL,
11188         },
11189         {
11190                 .cmd = NL80211_CMD_SET_KEY,
11191                 .doit = nl80211_set_key,
11192                 .policy = nl80211_policy,
11193                 .flags = GENL_UNS_ADMIN_PERM,
11194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11195                                   NL80211_FLAG_NEED_RTNL |
11196                                   NL80211_FLAG_CLEAR_SKB,
11197         },
11198         {
11199                 .cmd = NL80211_CMD_NEW_KEY,
11200                 .doit = nl80211_new_key,
11201                 .policy = nl80211_policy,
11202                 .flags = GENL_UNS_ADMIN_PERM,
11203                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11204                                   NL80211_FLAG_NEED_RTNL |
11205                                   NL80211_FLAG_CLEAR_SKB,
11206         },
11207         {
11208                 .cmd = NL80211_CMD_DEL_KEY,
11209                 .doit = nl80211_del_key,
11210                 .policy = nl80211_policy,
11211                 .flags = GENL_UNS_ADMIN_PERM,
11212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11213                                   NL80211_FLAG_NEED_RTNL,
11214         },
11215         {
11216                 .cmd = NL80211_CMD_SET_BEACON,
11217                 .policy = nl80211_policy,
11218                 .flags = GENL_UNS_ADMIN_PERM,
11219                 .doit = nl80211_set_beacon,
11220                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11221                                   NL80211_FLAG_NEED_RTNL,
11222         },
11223         {
11224                 .cmd = NL80211_CMD_START_AP,
11225                 .policy = nl80211_policy,
11226                 .flags = GENL_UNS_ADMIN_PERM,
11227                 .doit = nl80211_start_ap,
11228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11229                                   NL80211_FLAG_NEED_RTNL,
11230         },
11231         {
11232                 .cmd = NL80211_CMD_STOP_AP,
11233                 .policy = nl80211_policy,
11234                 .flags = GENL_UNS_ADMIN_PERM,
11235                 .doit = nl80211_stop_ap,
11236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11237                                   NL80211_FLAG_NEED_RTNL,
11238         },
11239         {
11240                 .cmd = NL80211_CMD_GET_STATION,
11241                 .doit = nl80211_get_station,
11242                 .dumpit = nl80211_dump_station,
11243                 .policy = nl80211_policy,
11244                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11245                                   NL80211_FLAG_NEED_RTNL,
11246         },
11247         {
11248                 .cmd = NL80211_CMD_SET_STATION,
11249                 .doit = nl80211_set_station,
11250                 .policy = nl80211_policy,
11251                 .flags = GENL_UNS_ADMIN_PERM,
11252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11253                                   NL80211_FLAG_NEED_RTNL,
11254         },
11255         {
11256                 .cmd = NL80211_CMD_NEW_STATION,
11257                 .doit = nl80211_new_station,
11258                 .policy = nl80211_policy,
11259                 .flags = GENL_UNS_ADMIN_PERM,
11260                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11261                                   NL80211_FLAG_NEED_RTNL,
11262         },
11263         {
11264                 .cmd = NL80211_CMD_DEL_STATION,
11265                 .doit = nl80211_del_station,
11266                 .policy = nl80211_policy,
11267                 .flags = GENL_UNS_ADMIN_PERM,
11268                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11269                                   NL80211_FLAG_NEED_RTNL,
11270         },
11271         {
11272                 .cmd = NL80211_CMD_GET_MPATH,
11273                 .doit = nl80211_get_mpath,
11274                 .dumpit = nl80211_dump_mpath,
11275                 .policy = nl80211_policy,
11276                 .flags = GENL_UNS_ADMIN_PERM,
11277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11278                                   NL80211_FLAG_NEED_RTNL,
11279         },
11280         {
11281                 .cmd = NL80211_CMD_GET_MPP,
11282                 .doit = nl80211_get_mpp,
11283                 .dumpit = nl80211_dump_mpp,
11284                 .policy = nl80211_policy,
11285                 .flags = GENL_UNS_ADMIN_PERM,
11286                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11287                                   NL80211_FLAG_NEED_RTNL,
11288         },
11289         {
11290                 .cmd = NL80211_CMD_SET_MPATH,
11291                 .doit = nl80211_set_mpath,
11292                 .policy = nl80211_policy,
11293                 .flags = GENL_UNS_ADMIN_PERM,
11294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11295                                   NL80211_FLAG_NEED_RTNL,
11296         },
11297         {
11298                 .cmd = NL80211_CMD_NEW_MPATH,
11299                 .doit = nl80211_new_mpath,
11300                 .policy = nl80211_policy,
11301                 .flags = GENL_UNS_ADMIN_PERM,
11302                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11303                                   NL80211_FLAG_NEED_RTNL,
11304         },
11305         {
11306                 .cmd = NL80211_CMD_DEL_MPATH,
11307                 .doit = nl80211_del_mpath,
11308                 .policy = nl80211_policy,
11309                 .flags = GENL_UNS_ADMIN_PERM,
11310                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11311                                   NL80211_FLAG_NEED_RTNL,
11312         },
11313         {
11314                 .cmd = NL80211_CMD_SET_BSS,
11315                 .doit = nl80211_set_bss,
11316                 .policy = nl80211_policy,
11317                 .flags = GENL_UNS_ADMIN_PERM,
11318                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11319                                   NL80211_FLAG_NEED_RTNL,
11320         },
11321         {
11322                 .cmd = NL80211_CMD_GET_REG,
11323                 .doit = nl80211_get_reg_do,
11324                 .dumpit = nl80211_get_reg_dump,
11325                 .policy = nl80211_policy,
11326                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11327                 /* can be retrieved by unprivileged users */
11328         },
11329 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
11330         {
11331                 .cmd = NL80211_CMD_SET_REG,
11332                 .doit = nl80211_set_reg,
11333                 .policy = nl80211_policy,
11334                 .flags = GENL_ADMIN_PERM,
11335                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11336         },
11337 #endif
11338         {
11339                 .cmd = NL80211_CMD_REQ_SET_REG,
11340                 .doit = nl80211_req_set_reg,
11341                 .policy = nl80211_policy,
11342                 .flags = GENL_ADMIN_PERM,
11343         },
11344         {
11345                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
11346                 .doit = nl80211_get_mesh_config,
11347                 .policy = nl80211_policy,
11348                 /* can be retrieved by unprivileged users */
11349                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11350                                   NL80211_FLAG_NEED_RTNL,
11351         },
11352         {
11353                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
11354                 .doit = nl80211_update_mesh_config,
11355                 .policy = nl80211_policy,
11356                 .flags = GENL_UNS_ADMIN_PERM,
11357                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11358                                   NL80211_FLAG_NEED_RTNL,
11359         },
11360         {
11361                 .cmd = NL80211_CMD_TRIGGER_SCAN,
11362                 .doit = nl80211_trigger_scan,
11363                 .policy = nl80211_policy,
11364                 .flags = GENL_UNS_ADMIN_PERM,
11365                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11366                                   NL80211_FLAG_NEED_RTNL,
11367         },
11368         {
11369                 .cmd = NL80211_CMD_ABORT_SCAN,
11370                 .doit = nl80211_abort_scan,
11371                 .policy = nl80211_policy,
11372                 .flags = GENL_UNS_ADMIN_PERM,
11373                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11374                                   NL80211_FLAG_NEED_RTNL,
11375         },
11376         {
11377                 .cmd = NL80211_CMD_GET_SCAN,
11378                 .policy = nl80211_policy,
11379                 .dumpit = nl80211_dump_scan,
11380         },
11381         {
11382                 .cmd = NL80211_CMD_START_SCHED_SCAN,
11383                 .doit = nl80211_start_sched_scan,
11384                 .policy = nl80211_policy,
11385                 .flags = GENL_UNS_ADMIN_PERM,
11386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11387                                   NL80211_FLAG_NEED_RTNL,
11388         },
11389         {
11390                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
11391                 .doit = nl80211_stop_sched_scan,
11392                 .policy = nl80211_policy,
11393                 .flags = GENL_UNS_ADMIN_PERM,
11394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11395                                   NL80211_FLAG_NEED_RTNL,
11396         },
11397         {
11398                 .cmd = NL80211_CMD_AUTHENTICATE,
11399                 .doit = nl80211_authenticate,
11400                 .policy = nl80211_policy,
11401                 .flags = GENL_UNS_ADMIN_PERM,
11402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11403                                   NL80211_FLAG_NEED_RTNL |
11404                                   NL80211_FLAG_CLEAR_SKB,
11405         },
11406         {
11407                 .cmd = NL80211_CMD_ASSOCIATE,
11408                 .doit = nl80211_associate,
11409                 .policy = nl80211_policy,
11410                 .flags = GENL_UNS_ADMIN_PERM,
11411                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11412                                   NL80211_FLAG_NEED_RTNL,
11413         },
11414         {
11415                 .cmd = NL80211_CMD_DEAUTHENTICATE,
11416                 .doit = nl80211_deauthenticate,
11417                 .policy = nl80211_policy,
11418                 .flags = GENL_UNS_ADMIN_PERM,
11419                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11420                                   NL80211_FLAG_NEED_RTNL,
11421         },
11422         {
11423                 .cmd = NL80211_CMD_DISASSOCIATE,
11424                 .doit = nl80211_disassociate,
11425                 .policy = nl80211_policy,
11426                 .flags = GENL_UNS_ADMIN_PERM,
11427                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11428                                   NL80211_FLAG_NEED_RTNL,
11429         },
11430         {
11431                 .cmd = NL80211_CMD_JOIN_IBSS,
11432                 .doit = nl80211_join_ibss,
11433                 .policy = nl80211_policy,
11434                 .flags = GENL_UNS_ADMIN_PERM,
11435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11436                                   NL80211_FLAG_NEED_RTNL,
11437         },
11438         {
11439                 .cmd = NL80211_CMD_LEAVE_IBSS,
11440                 .doit = nl80211_leave_ibss,
11441                 .policy = nl80211_policy,
11442                 .flags = GENL_UNS_ADMIN_PERM,
11443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11444                                   NL80211_FLAG_NEED_RTNL,
11445         },
11446 #ifdef CONFIG_NL80211_TESTMODE
11447         {
11448                 .cmd = NL80211_CMD_TESTMODE,
11449                 .doit = nl80211_testmode_do,
11450                 .dumpit = nl80211_testmode_dump,
11451                 .policy = nl80211_policy,
11452                 .flags = GENL_UNS_ADMIN_PERM,
11453                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11454                                   NL80211_FLAG_NEED_RTNL,
11455         },
11456 #endif
11457         {
11458                 .cmd = NL80211_CMD_CONNECT,
11459                 .doit = nl80211_connect,
11460                 .policy = nl80211_policy,
11461                 .flags = GENL_UNS_ADMIN_PERM,
11462                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11463                                   NL80211_FLAG_NEED_RTNL,
11464         },
11465         {
11466                 .cmd = NL80211_CMD_DISCONNECT,
11467                 .doit = nl80211_disconnect,
11468                 .policy = nl80211_policy,
11469                 .flags = GENL_UNS_ADMIN_PERM,
11470                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11471                                   NL80211_FLAG_NEED_RTNL,
11472         },
11473         {
11474                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
11475                 .doit = nl80211_wiphy_netns,
11476                 .policy = nl80211_policy,
11477                 .flags = GENL_UNS_ADMIN_PERM,
11478                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11479                                   NL80211_FLAG_NEED_RTNL,
11480         },
11481         {
11482                 .cmd = NL80211_CMD_GET_SURVEY,
11483                 .policy = nl80211_policy,
11484                 .dumpit = nl80211_dump_survey,
11485         },
11486         {
11487                 .cmd = NL80211_CMD_SET_PMKSA,
11488                 .doit = nl80211_setdel_pmksa,
11489                 .policy = nl80211_policy,
11490                 .flags = GENL_UNS_ADMIN_PERM,
11491                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11492                                   NL80211_FLAG_NEED_RTNL,
11493         },
11494         {
11495                 .cmd = NL80211_CMD_DEL_PMKSA,
11496                 .doit = nl80211_setdel_pmksa,
11497                 .policy = nl80211_policy,
11498                 .flags = GENL_UNS_ADMIN_PERM,
11499                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11500                                   NL80211_FLAG_NEED_RTNL,
11501         },
11502         {
11503                 .cmd = NL80211_CMD_FLUSH_PMKSA,
11504                 .doit = nl80211_flush_pmksa,
11505                 .policy = nl80211_policy,
11506                 .flags = GENL_UNS_ADMIN_PERM,
11507                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11508                                   NL80211_FLAG_NEED_RTNL,
11509         },
11510         {
11511                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11512                 .doit = nl80211_remain_on_channel,
11513                 .policy = nl80211_policy,
11514                 .flags = GENL_UNS_ADMIN_PERM,
11515                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11516                                   NL80211_FLAG_NEED_RTNL,
11517         },
11518         {
11519                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11520                 .doit = nl80211_cancel_remain_on_channel,
11521                 .policy = nl80211_policy,
11522                 .flags = GENL_UNS_ADMIN_PERM,
11523                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11524                                   NL80211_FLAG_NEED_RTNL,
11525         },
11526         {
11527                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11528                 .doit = nl80211_set_tx_bitrate_mask,
11529                 .policy = nl80211_policy,
11530                 .flags = GENL_UNS_ADMIN_PERM,
11531                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11532                                   NL80211_FLAG_NEED_RTNL,
11533         },
11534         {
11535                 .cmd = NL80211_CMD_REGISTER_FRAME,
11536                 .doit = nl80211_register_mgmt,
11537                 .policy = nl80211_policy,
11538                 .flags = GENL_UNS_ADMIN_PERM,
11539                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11540                                   NL80211_FLAG_NEED_RTNL,
11541         },
11542         {
11543                 .cmd = NL80211_CMD_FRAME,
11544                 .doit = nl80211_tx_mgmt,
11545                 .policy = nl80211_policy,
11546                 .flags = GENL_UNS_ADMIN_PERM,
11547                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11548                                   NL80211_FLAG_NEED_RTNL,
11549         },
11550         {
11551                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11552                 .doit = nl80211_tx_mgmt_cancel_wait,
11553                 .policy = nl80211_policy,
11554                 .flags = GENL_UNS_ADMIN_PERM,
11555                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11556                                   NL80211_FLAG_NEED_RTNL,
11557         },
11558         {
11559                 .cmd = NL80211_CMD_SET_POWER_SAVE,
11560                 .doit = nl80211_set_power_save,
11561                 .policy = nl80211_policy,
11562                 .flags = GENL_UNS_ADMIN_PERM,
11563                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11564                                   NL80211_FLAG_NEED_RTNL,
11565         },
11566         {
11567                 .cmd = NL80211_CMD_GET_POWER_SAVE,
11568                 .doit = nl80211_get_power_save,
11569                 .policy = nl80211_policy,
11570                 /* can be retrieved by unprivileged users */
11571                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11572                                   NL80211_FLAG_NEED_RTNL,
11573         },
11574         {
11575                 .cmd = NL80211_CMD_SET_CQM,
11576                 .doit = nl80211_set_cqm,
11577                 .policy = nl80211_policy,
11578                 .flags = GENL_UNS_ADMIN_PERM,
11579                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11580                                   NL80211_FLAG_NEED_RTNL,
11581         },
11582         {
11583                 .cmd = NL80211_CMD_SET_CHANNEL,
11584                 .doit = nl80211_set_channel,
11585                 .policy = nl80211_policy,
11586                 .flags = GENL_UNS_ADMIN_PERM,
11587                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11588                                   NL80211_FLAG_NEED_RTNL,
11589         },
11590         {
11591                 .cmd = NL80211_CMD_SET_WDS_PEER,
11592                 .doit = nl80211_set_wds_peer,
11593                 .policy = nl80211_policy,
11594                 .flags = GENL_UNS_ADMIN_PERM,
11595                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11596                                   NL80211_FLAG_NEED_RTNL,
11597         },
11598         {
11599                 .cmd = NL80211_CMD_JOIN_MESH,
11600                 .doit = nl80211_join_mesh,
11601                 .policy = nl80211_policy,
11602                 .flags = GENL_UNS_ADMIN_PERM,
11603                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11604                                   NL80211_FLAG_NEED_RTNL,
11605         },
11606         {
11607                 .cmd = NL80211_CMD_LEAVE_MESH,
11608                 .doit = nl80211_leave_mesh,
11609                 .policy = nl80211_policy,
11610                 .flags = GENL_UNS_ADMIN_PERM,
11611                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11612                                   NL80211_FLAG_NEED_RTNL,
11613         },
11614         {
11615                 .cmd = NL80211_CMD_JOIN_OCB,
11616                 .doit = nl80211_join_ocb,
11617                 .policy = nl80211_policy,
11618                 .flags = GENL_UNS_ADMIN_PERM,
11619                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11620                                   NL80211_FLAG_NEED_RTNL,
11621         },
11622         {
11623                 .cmd = NL80211_CMD_LEAVE_OCB,
11624                 .doit = nl80211_leave_ocb,
11625                 .policy = nl80211_policy,
11626                 .flags = GENL_UNS_ADMIN_PERM,
11627                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11628                                   NL80211_FLAG_NEED_RTNL,
11629         },
11630 #ifdef CONFIG_PM
11631         {
11632                 .cmd = NL80211_CMD_GET_WOWLAN,
11633                 .doit = nl80211_get_wowlan,
11634                 .policy = nl80211_policy,
11635                 /* can be retrieved by unprivileged users */
11636                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11637                                   NL80211_FLAG_NEED_RTNL,
11638         },
11639         {
11640                 .cmd = NL80211_CMD_SET_WOWLAN,
11641                 .doit = nl80211_set_wowlan,
11642                 .policy = nl80211_policy,
11643                 .flags = GENL_UNS_ADMIN_PERM,
11644                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11645                                   NL80211_FLAG_NEED_RTNL,
11646         },
11647 #endif
11648         {
11649                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11650                 .doit = nl80211_set_rekey_data,
11651                 .policy = nl80211_policy,
11652                 .flags = GENL_UNS_ADMIN_PERM,
11653                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11654                                   NL80211_FLAG_NEED_RTNL |
11655                                   NL80211_FLAG_CLEAR_SKB,
11656         },
11657         {
11658                 .cmd = NL80211_CMD_TDLS_MGMT,
11659                 .doit = nl80211_tdls_mgmt,
11660                 .policy = nl80211_policy,
11661                 .flags = GENL_UNS_ADMIN_PERM,
11662                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11663                                   NL80211_FLAG_NEED_RTNL,
11664         },
11665         {
11666                 .cmd = NL80211_CMD_TDLS_OPER,
11667                 .doit = nl80211_tdls_oper,
11668                 .policy = nl80211_policy,
11669                 .flags = GENL_UNS_ADMIN_PERM,
11670                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11671                                   NL80211_FLAG_NEED_RTNL,
11672         },
11673         {
11674                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11675                 .doit = nl80211_register_unexpected_frame,
11676                 .policy = nl80211_policy,
11677                 .flags = GENL_UNS_ADMIN_PERM,
11678                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11679                                   NL80211_FLAG_NEED_RTNL,
11680         },
11681         {
11682                 .cmd = NL80211_CMD_PROBE_CLIENT,
11683                 .doit = nl80211_probe_client,
11684                 .policy = nl80211_policy,
11685                 .flags = GENL_UNS_ADMIN_PERM,
11686                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11687                                   NL80211_FLAG_NEED_RTNL,
11688         },
11689         {
11690                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11691                 .doit = nl80211_register_beacons,
11692                 .policy = nl80211_policy,
11693                 .flags = GENL_UNS_ADMIN_PERM,
11694                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11695                                   NL80211_FLAG_NEED_RTNL,
11696         },
11697         {
11698                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11699                 .doit = nl80211_set_noack_map,
11700                 .policy = nl80211_policy,
11701                 .flags = GENL_UNS_ADMIN_PERM,
11702                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11703                                   NL80211_FLAG_NEED_RTNL,
11704         },
11705         {
11706                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11707                 .doit = nl80211_start_p2p_device,
11708                 .policy = nl80211_policy,
11709                 .flags = GENL_UNS_ADMIN_PERM,
11710                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11711                                   NL80211_FLAG_NEED_RTNL,
11712         },
11713         {
11714                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11715                 .doit = nl80211_stop_p2p_device,
11716                 .policy = nl80211_policy,
11717                 .flags = GENL_UNS_ADMIN_PERM,
11718                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11719                                   NL80211_FLAG_NEED_RTNL,
11720         },
11721         {
11722                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11723                 .doit = nl80211_set_mcast_rate,
11724                 .policy = nl80211_policy,
11725                 .flags = GENL_UNS_ADMIN_PERM,
11726                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11727                                   NL80211_FLAG_NEED_RTNL,
11728         },
11729         {
11730                 .cmd = NL80211_CMD_SET_MAC_ACL,
11731                 .doit = nl80211_set_mac_acl,
11732                 .policy = nl80211_policy,
11733                 .flags = GENL_UNS_ADMIN_PERM,
11734                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11735                                   NL80211_FLAG_NEED_RTNL,
11736         },
11737         {
11738                 .cmd = NL80211_CMD_RADAR_DETECT,
11739                 .doit = nl80211_start_radar_detection,
11740                 .policy = nl80211_policy,
11741                 .flags = GENL_UNS_ADMIN_PERM,
11742                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11743                                   NL80211_FLAG_NEED_RTNL,
11744         },
11745         {
11746                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11747                 .doit = nl80211_get_protocol_features,
11748                 .policy = nl80211_policy,
11749         },
11750         {
11751                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11752                 .doit = nl80211_update_ft_ies,
11753                 .policy = nl80211_policy,
11754                 .flags = GENL_UNS_ADMIN_PERM,
11755                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11756                                   NL80211_FLAG_NEED_RTNL,
11757         },
11758         {
11759                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11760                 .doit = nl80211_crit_protocol_start,
11761                 .policy = nl80211_policy,
11762                 .flags = GENL_UNS_ADMIN_PERM,
11763                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11764                                   NL80211_FLAG_NEED_RTNL,
11765         },
11766         {
11767                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11768                 .doit = nl80211_crit_protocol_stop,
11769                 .policy = nl80211_policy,
11770                 .flags = GENL_UNS_ADMIN_PERM,
11771                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11772                                   NL80211_FLAG_NEED_RTNL,
11773         },
11774         {
11775                 .cmd = NL80211_CMD_GET_COALESCE,
11776                 .doit = nl80211_get_coalesce,
11777                 .policy = nl80211_policy,
11778                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11779                                   NL80211_FLAG_NEED_RTNL,
11780         },
11781         {
11782                 .cmd = NL80211_CMD_SET_COALESCE,
11783                 .doit = nl80211_set_coalesce,
11784                 .policy = nl80211_policy,
11785                 .flags = GENL_UNS_ADMIN_PERM,
11786                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11787                                   NL80211_FLAG_NEED_RTNL,
11788         },
11789         {
11790                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11791                 .doit = nl80211_channel_switch,
11792                 .policy = nl80211_policy,
11793                 .flags = GENL_UNS_ADMIN_PERM,
11794                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11795                                   NL80211_FLAG_NEED_RTNL,
11796         },
11797         {
11798                 .cmd = NL80211_CMD_VENDOR,
11799                 .doit = nl80211_vendor_cmd,
11800                 .dumpit = nl80211_vendor_cmd_dump,
11801                 .policy = nl80211_policy,
11802                 .flags = GENL_UNS_ADMIN_PERM,
11803                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11804                                   NL80211_FLAG_NEED_RTNL,
11805         },
11806         {
11807                 .cmd = NL80211_CMD_SET_QOS_MAP,
11808                 .doit = nl80211_set_qos_map,
11809                 .policy = nl80211_policy,
11810                 .flags = GENL_UNS_ADMIN_PERM,
11811                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11812                                   NL80211_FLAG_NEED_RTNL,
11813         },
11814         {
11815                 .cmd = NL80211_CMD_ADD_TX_TS,
11816                 .doit = nl80211_add_tx_ts,
11817                 .policy = nl80211_policy,
11818                 .flags = GENL_UNS_ADMIN_PERM,
11819                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11820                                   NL80211_FLAG_NEED_RTNL,
11821         },
11822         {
11823                 .cmd = NL80211_CMD_DEL_TX_TS,
11824                 .doit = nl80211_del_tx_ts,
11825                 .policy = nl80211_policy,
11826                 .flags = GENL_UNS_ADMIN_PERM,
11827                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11828                                   NL80211_FLAG_NEED_RTNL,
11829         },
11830         {
11831                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11832                 .doit = nl80211_tdls_channel_switch,
11833                 .policy = nl80211_policy,
11834                 .flags = GENL_UNS_ADMIN_PERM,
11835                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11836                                   NL80211_FLAG_NEED_RTNL,
11837         },
11838         {
11839                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11840                 .doit = nl80211_tdls_cancel_channel_switch,
11841                 .policy = nl80211_policy,
11842                 .flags = GENL_UNS_ADMIN_PERM,
11843                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11844                                   NL80211_FLAG_NEED_RTNL,
11845         },
11846 };
11847
11848 /* notification functions */
11849
11850 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11851                           enum nl80211_commands cmd)
11852 {
11853         struct sk_buff *msg;
11854         struct nl80211_dump_wiphy_state state = {};
11855
11856         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11857                 cmd != NL80211_CMD_DEL_WIPHY);
11858
11859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11860         if (!msg)
11861                 return;
11862
11863         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11864                 nlmsg_free(msg);
11865                 return;
11866         }
11867
11868         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11869                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11870 }
11871
11872 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
11873                                 struct wireless_dev *wdev,
11874                                 enum nl80211_commands cmd)
11875 {
11876         struct sk_buff *msg;
11877
11878         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
11879                 cmd != NL80211_CMD_DEL_INTERFACE);
11880
11881         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11882         if (!msg)
11883                 return;
11884
11885         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
11886                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
11887                 nlmsg_free(msg);
11888                 return;
11889         }
11890
11891         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11892                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11893 }
11894
11895 static int nl80211_add_scan_req(struct sk_buff *msg,
11896                                 struct cfg80211_registered_device *rdev)
11897 {
11898         struct cfg80211_scan_request *req = rdev->scan_req;
11899         struct nlattr *nest;
11900         int i;
11901
11902         if (WARN_ON(!req))
11903                 return 0;
11904
11905         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11906         if (!nest)
11907                 goto nla_put_failure;
11908         for (i = 0; i < req->n_ssids; i++) {
11909                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11910                         goto nla_put_failure;
11911         }
11912         nla_nest_end(msg, nest);
11913
11914         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11915         if (!nest)
11916                 goto nla_put_failure;
11917         for (i = 0; i < req->n_channels; i++) {
11918                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11919                         goto nla_put_failure;
11920         }
11921         nla_nest_end(msg, nest);
11922
11923         if (req->ie &&
11924             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11925                 goto nla_put_failure;
11926
11927         if (req->flags &&
11928             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11929                 goto nla_put_failure;
11930
11931         if (req->info.scan_start_tsf &&
11932             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
11933                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
11934              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
11935                      req->info.tsf_bssid)))
11936                 goto nla_put_failure;
11937
11938         return 0;
11939  nla_put_failure:
11940         return -ENOBUFS;
11941 }
11942
11943 static int nl80211_send_scan_msg(struct sk_buff *msg,
11944                                  struct cfg80211_registered_device *rdev,
11945                                  struct wireless_dev *wdev,
11946                                  u32 portid, u32 seq, int flags,
11947                                  u32 cmd)
11948 {
11949         void *hdr;
11950
11951         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11952         if (!hdr)
11953                 return -1;
11954
11955         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11956             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11957                                          wdev->netdev->ifindex)) ||
11958             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11959                               NL80211_ATTR_PAD))
11960                 goto nla_put_failure;
11961
11962         /* ignore errors and send incomplete event anyway */
11963         nl80211_add_scan_req(msg, rdev);
11964
11965         genlmsg_end(msg, hdr);
11966         return 0;
11967
11968  nla_put_failure:
11969         genlmsg_cancel(msg, hdr);
11970         return -EMSGSIZE;
11971 }
11972
11973 static int
11974 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11975                             struct cfg80211_registered_device *rdev,
11976                             struct net_device *netdev,
11977                             u32 portid, u32 seq, int flags, u32 cmd)
11978 {
11979         void *hdr;
11980
11981         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11982         if (!hdr)
11983                 return -1;
11984
11985         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11986             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11987                 goto nla_put_failure;
11988
11989         genlmsg_end(msg, hdr);
11990         return 0;
11991
11992  nla_put_failure:
11993         genlmsg_cancel(msg, hdr);
11994         return -EMSGSIZE;
11995 }
11996
11997 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11998                              struct wireless_dev *wdev)
11999 {
12000         struct sk_buff *msg;
12001
12002         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12003         if (!msg)
12004                 return;
12005
12006         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12007                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
12008                 nlmsg_free(msg);
12009                 return;
12010         }
12011
12012         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12013                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12014 }
12015
12016 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
12017                                        struct wireless_dev *wdev, bool aborted)
12018 {
12019         struct sk_buff *msg;
12020
12021         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12022         if (!msg)
12023                 return NULL;
12024
12025         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12026                                   aborted ? NL80211_CMD_SCAN_ABORTED :
12027                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
12028                 nlmsg_free(msg);
12029                 return NULL;
12030         }
12031
12032         return msg;
12033 }
12034
12035 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
12036                               struct sk_buff *msg)
12037 {
12038         if (!msg)
12039                 return;
12040
12041         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12042                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12043 }
12044
12045 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
12046                                      struct net_device *netdev)
12047 {
12048         struct sk_buff *msg;
12049
12050         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12051         if (!msg)
12052                 return;
12053
12054         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
12055                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
12056                 nlmsg_free(msg);
12057                 return;
12058         }
12059
12060         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12061                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12062 }
12063
12064 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
12065                              struct net_device *netdev, u32 cmd)
12066 {
12067         struct sk_buff *msg;
12068
12069         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12070         if (!msg)
12071                 return;
12072
12073         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
12074                 nlmsg_free(msg);
12075                 return;
12076         }
12077
12078         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12079                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12080 }
12081
12082 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
12083                                           struct regulatory_request *request)
12084 {
12085         /* Userspace can always count this one always being set */
12086         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
12087                 goto nla_put_failure;
12088
12089         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
12090                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12091                                NL80211_REGDOM_TYPE_WORLD))
12092                         goto nla_put_failure;
12093         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
12094                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12095                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
12096                         goto nla_put_failure;
12097         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
12098                    request->intersect) {
12099                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12100                                NL80211_REGDOM_TYPE_INTERSECTION))
12101                         goto nla_put_failure;
12102         } else {
12103                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12104                                NL80211_REGDOM_TYPE_COUNTRY) ||
12105                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
12106                                    request->alpha2))
12107                         goto nla_put_failure;
12108         }
12109
12110         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
12111                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
12112
12113                 if (wiphy &&
12114                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
12115                         goto nla_put_failure;
12116
12117                 if (wiphy &&
12118                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
12119                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
12120                         goto nla_put_failure;
12121         }
12122
12123         return true;
12124
12125 nla_put_failure:
12126         return false;
12127 }
12128
12129 /*
12130  * This can happen on global regulatory changes or device specific settings
12131  * based on custom regulatory domains.
12132  */
12133 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
12134                                      struct regulatory_request *request)
12135 {
12136         struct sk_buff *msg;
12137         void *hdr;
12138
12139         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12140         if (!msg)
12141                 return;
12142
12143         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
12144         if (!hdr) {
12145                 nlmsg_free(msg);
12146                 return;
12147         }
12148
12149         if (nl80211_reg_change_event_fill(msg, request) == false)
12150                 goto nla_put_failure;
12151
12152         genlmsg_end(msg, hdr);
12153
12154         rcu_read_lock();
12155         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12156                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12157         rcu_read_unlock();
12158
12159         return;
12160
12161 nla_put_failure:
12162         genlmsg_cancel(msg, hdr);
12163         nlmsg_free(msg);
12164 }
12165
12166 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
12167                                     struct net_device *netdev,
12168                                     const u8 *buf, size_t len,
12169                                     enum nl80211_commands cmd, gfp_t gfp,
12170                                     int uapsd_queues)
12171 {
12172         struct sk_buff *msg;
12173         void *hdr;
12174
12175         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12176         if (!msg)
12177                 return;
12178
12179         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12180         if (!hdr) {
12181                 nlmsg_free(msg);
12182                 return;
12183         }
12184
12185         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12186             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12187             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
12188                 goto nla_put_failure;
12189
12190         if (uapsd_queues >= 0) {
12191                 struct nlattr *nla_wmm =
12192                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
12193                 if (!nla_wmm)
12194                         goto nla_put_failure;
12195
12196                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
12197                                uapsd_queues))
12198                         goto nla_put_failure;
12199
12200                 nla_nest_end(msg, nla_wmm);
12201         }
12202
12203         genlmsg_end(msg, hdr);
12204
12205         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12206                                 NL80211_MCGRP_MLME, gfp);
12207         return;
12208
12209  nla_put_failure:
12210         genlmsg_cancel(msg, hdr);
12211         nlmsg_free(msg);
12212 }
12213
12214 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
12215                           struct net_device *netdev, const u8 *buf,
12216                           size_t len, gfp_t gfp)
12217 {
12218         nl80211_send_mlme_event(rdev, netdev, buf, len,
12219                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
12220 }
12221
12222 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
12223                            struct net_device *netdev, const u8 *buf,
12224                            size_t len, gfp_t gfp, int uapsd_queues)
12225 {
12226         nl80211_send_mlme_event(rdev, netdev, buf, len,
12227                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
12228 }
12229
12230 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
12231                          struct net_device *netdev, const u8 *buf,
12232                          size_t len, gfp_t gfp)
12233 {
12234         nl80211_send_mlme_event(rdev, netdev, buf, len,
12235                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
12236 }
12237
12238 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
12239                            struct net_device *netdev, const u8 *buf,
12240                            size_t len, gfp_t gfp)
12241 {
12242         nl80211_send_mlme_event(rdev, netdev, buf, len,
12243                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
12244 }
12245
12246 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
12247                                   size_t len)
12248 {
12249         struct wireless_dev *wdev = dev->ieee80211_ptr;
12250         struct wiphy *wiphy = wdev->wiphy;
12251         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12252         const struct ieee80211_mgmt *mgmt = (void *)buf;
12253         u32 cmd;
12254
12255         if (WARN_ON(len < 2))
12256                 return;
12257
12258         if (ieee80211_is_deauth(mgmt->frame_control))
12259                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
12260         else
12261                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
12262
12263         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
12264         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
12265 }
12266 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
12267
12268 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
12269                                       struct net_device *netdev, int cmd,
12270                                       const u8 *addr, gfp_t gfp)
12271 {
12272         struct sk_buff *msg;
12273         void *hdr;
12274
12275         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12276         if (!msg)
12277                 return;
12278
12279         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12280         if (!hdr) {
12281                 nlmsg_free(msg);
12282                 return;
12283         }
12284
12285         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12286             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12287             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
12288             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12289                 goto nla_put_failure;
12290
12291         genlmsg_end(msg, hdr);
12292
12293         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12294                                 NL80211_MCGRP_MLME, gfp);
12295         return;
12296
12297  nla_put_failure:
12298         genlmsg_cancel(msg, hdr);
12299         nlmsg_free(msg);
12300 }
12301
12302 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
12303                                struct net_device *netdev, const u8 *addr,
12304                                gfp_t gfp)
12305 {
12306         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
12307                                   addr, gfp);
12308 }
12309
12310 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
12311                                 struct net_device *netdev, const u8 *addr,
12312                                 gfp_t gfp)
12313 {
12314         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
12315                                   addr, gfp);
12316 }
12317
12318 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
12319                                  struct net_device *netdev, const u8 *bssid,
12320                                  const u8 *req_ie, size_t req_ie_len,
12321                                  const u8 *resp_ie, size_t resp_ie_len,
12322                                  int status, gfp_t gfp)
12323 {
12324         struct sk_buff *msg;
12325         void *hdr;
12326
12327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12328         if (!msg)
12329                 return;
12330
12331         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
12332         if (!hdr) {
12333                 nlmsg_free(msg);
12334                 return;
12335         }
12336
12337         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12338             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12339             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
12340             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
12341                         status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
12342                         status) ||
12343             (status < 0 && nla_put_flag(msg, NL80211_ATTR_TIMED_OUT)) ||
12344             (req_ie &&
12345              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12346             (resp_ie &&
12347              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12348                 goto nla_put_failure;
12349
12350         genlmsg_end(msg, hdr);
12351
12352         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12353                                 NL80211_MCGRP_MLME, gfp);
12354         return;
12355
12356  nla_put_failure:
12357         genlmsg_cancel(msg, hdr);
12358         nlmsg_free(msg);
12359 }
12360
12361 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
12362                          struct net_device *netdev, const u8 *bssid,
12363                          const u8 *req_ie, size_t req_ie_len,
12364                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
12365 {
12366         struct sk_buff *msg;
12367         void *hdr;
12368
12369         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12370         if (!msg)
12371                 return;
12372
12373         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
12374         if (!hdr) {
12375                 nlmsg_free(msg);
12376                 return;
12377         }
12378
12379         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12380             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12381             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
12382             (req_ie &&
12383              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12384             (resp_ie &&
12385              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12386                 goto nla_put_failure;
12387
12388         genlmsg_end(msg, hdr);
12389
12390         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12391                                 NL80211_MCGRP_MLME, gfp);
12392         return;
12393
12394  nla_put_failure:
12395         genlmsg_cancel(msg, hdr);
12396         nlmsg_free(msg);
12397 }
12398
12399 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
12400                                struct net_device *netdev, u16 reason,
12401                                const u8 *ie, size_t ie_len, bool from_ap)
12402 {
12403         struct sk_buff *msg;
12404         void *hdr;
12405
12406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12407         if (!msg)
12408                 return;
12409
12410         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
12411         if (!hdr) {
12412                 nlmsg_free(msg);
12413                 return;
12414         }
12415
12416         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12417             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12418             (from_ap && reason &&
12419              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
12420             (from_ap &&
12421              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
12422             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
12423                 goto nla_put_failure;
12424
12425         genlmsg_end(msg, hdr);
12426
12427         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12428                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12429         return;
12430
12431  nla_put_failure:
12432         genlmsg_cancel(msg, hdr);
12433         nlmsg_free(msg);
12434 }
12435
12436 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
12437                              struct net_device *netdev, const u8 *bssid,
12438                              gfp_t gfp)
12439 {
12440         struct sk_buff *msg;
12441         void *hdr;
12442
12443         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12444         if (!msg)
12445                 return;
12446
12447         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
12448         if (!hdr) {
12449                 nlmsg_free(msg);
12450                 return;
12451         }
12452
12453         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12454             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12455             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12456                 goto nla_put_failure;
12457
12458         genlmsg_end(msg, hdr);
12459
12460         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12461                                 NL80211_MCGRP_MLME, gfp);
12462         return;
12463
12464  nla_put_failure:
12465         genlmsg_cancel(msg, hdr);
12466         nlmsg_free(msg);
12467 }
12468
12469 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12470                                         const u8* ie, u8 ie_len, gfp_t gfp)
12471 {
12472         struct wireless_dev *wdev = dev->ieee80211_ptr;
12473         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12474         struct sk_buff *msg;
12475         void *hdr;
12476
12477         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12478                 return;
12479
12480         trace_cfg80211_notify_new_peer_candidate(dev, addr);
12481
12482         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12483         if (!msg)
12484                 return;
12485
12486         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12487         if (!hdr) {
12488                 nlmsg_free(msg);
12489                 return;
12490         }
12491
12492         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12493             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12494             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12495             (ie_len && ie &&
12496              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12497                 goto nla_put_failure;
12498
12499         genlmsg_end(msg, hdr);
12500
12501         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12502                                 NL80211_MCGRP_MLME, gfp);
12503         return;
12504
12505  nla_put_failure:
12506         genlmsg_cancel(msg, hdr);
12507         nlmsg_free(msg);
12508 }
12509 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12510
12511 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12512                                  struct net_device *netdev, const u8 *addr,
12513                                  enum nl80211_key_type key_type, int key_id,
12514                                  const u8 *tsc, gfp_t gfp)
12515 {
12516         struct sk_buff *msg;
12517         void *hdr;
12518
12519         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12520         if (!msg)
12521                 return;
12522
12523         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12524         if (!hdr) {
12525                 nlmsg_free(msg);
12526                 return;
12527         }
12528
12529         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12530             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12531             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12532             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12533             (key_id != -1 &&
12534              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12535             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12536                 goto nla_put_failure;
12537
12538         genlmsg_end(msg, hdr);
12539
12540         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12541                                 NL80211_MCGRP_MLME, gfp);
12542         return;
12543
12544  nla_put_failure:
12545         genlmsg_cancel(msg, hdr);
12546         nlmsg_free(msg);
12547 }
12548
12549 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12550                                     struct ieee80211_channel *channel_before,
12551                                     struct ieee80211_channel *channel_after)
12552 {
12553         struct sk_buff *msg;
12554         void *hdr;
12555         struct nlattr *nl_freq;
12556
12557         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12558         if (!msg)
12559                 return;
12560
12561         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12562         if (!hdr) {
12563                 nlmsg_free(msg);
12564                 return;
12565         }
12566
12567         /*
12568          * Since we are applying the beacon hint to a wiphy we know its
12569          * wiphy_idx is valid
12570          */
12571         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12572                 goto nla_put_failure;
12573
12574         /* Before */
12575         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12576         if (!nl_freq)
12577                 goto nla_put_failure;
12578         if (nl80211_msg_put_channel(msg, channel_before, false))
12579                 goto nla_put_failure;
12580         nla_nest_end(msg, nl_freq);
12581
12582         /* After */
12583         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12584         if (!nl_freq)
12585                 goto nla_put_failure;
12586         if (nl80211_msg_put_channel(msg, channel_after, false))
12587                 goto nla_put_failure;
12588         nla_nest_end(msg, nl_freq);
12589
12590         genlmsg_end(msg, hdr);
12591
12592         rcu_read_lock();
12593         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12594                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12595         rcu_read_unlock();
12596
12597         return;
12598
12599 nla_put_failure:
12600         genlmsg_cancel(msg, hdr);
12601         nlmsg_free(msg);
12602 }
12603
12604 static void nl80211_send_remain_on_chan_event(
12605         int cmd, struct cfg80211_registered_device *rdev,
12606         struct wireless_dev *wdev, u64 cookie,
12607         struct ieee80211_channel *chan,
12608         unsigned int duration, gfp_t gfp)
12609 {
12610         struct sk_buff *msg;
12611         void *hdr;
12612
12613         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12614         if (!msg)
12615                 return;
12616
12617         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12618         if (!hdr) {
12619                 nlmsg_free(msg);
12620                 return;
12621         }
12622
12623         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12624             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12625                                          wdev->netdev->ifindex)) ||
12626             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12627                               NL80211_ATTR_PAD) ||
12628             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12629             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12630                         NL80211_CHAN_NO_HT) ||
12631             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12632                               NL80211_ATTR_PAD))
12633                 goto nla_put_failure;
12634
12635         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12636             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12637                 goto nla_put_failure;
12638
12639         genlmsg_end(msg, hdr);
12640
12641         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12642                                 NL80211_MCGRP_MLME, gfp);
12643         return;
12644
12645  nla_put_failure:
12646         genlmsg_cancel(msg, hdr);
12647         nlmsg_free(msg);
12648 }
12649
12650 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12651                                struct ieee80211_channel *chan,
12652                                unsigned int duration, gfp_t gfp)
12653 {
12654         struct wiphy *wiphy = wdev->wiphy;
12655         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12656
12657         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12658         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12659                                           rdev, wdev, cookie, chan,
12660                                           duration, gfp);
12661 }
12662 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12663
12664 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12665                                         struct ieee80211_channel *chan,
12666                                         gfp_t gfp)
12667 {
12668         struct wiphy *wiphy = wdev->wiphy;
12669         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12670
12671         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12672         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12673                                           rdev, wdev, cookie, chan, 0, gfp);
12674 }
12675 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12676
12677 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12678                       struct station_info *sinfo, gfp_t gfp)
12679 {
12680         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12681         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12682         struct sk_buff *msg;
12683
12684         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12685
12686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12687         if (!msg)
12688                 return;
12689
12690         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12691                                  rdev, dev, mac_addr, sinfo) < 0) {
12692                 nlmsg_free(msg);
12693                 return;
12694         }
12695
12696         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12697                                 NL80211_MCGRP_MLME, gfp);
12698 }
12699 EXPORT_SYMBOL(cfg80211_new_sta);
12700
12701 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12702                             struct station_info *sinfo, gfp_t gfp)
12703 {
12704         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12705         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12706         struct sk_buff *msg;
12707         struct station_info empty_sinfo = {};
12708
12709         if (!sinfo)
12710                 sinfo = &empty_sinfo;
12711
12712         trace_cfg80211_del_sta(dev, mac_addr);
12713
12714         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12715         if (!msg)
12716                 return;
12717
12718         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12719                                  rdev, dev, mac_addr, sinfo) < 0) {
12720                 nlmsg_free(msg);
12721                 return;
12722         }
12723
12724         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12725                                 NL80211_MCGRP_MLME, gfp);
12726 }
12727 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12728
12729 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12730                           enum nl80211_connect_failed_reason reason,
12731                           gfp_t gfp)
12732 {
12733         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12734         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12735         struct sk_buff *msg;
12736         void *hdr;
12737
12738         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12739         if (!msg)
12740                 return;
12741
12742         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12743         if (!hdr) {
12744                 nlmsg_free(msg);
12745                 return;
12746         }
12747
12748         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12749             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12750             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12751                 goto nla_put_failure;
12752
12753         genlmsg_end(msg, hdr);
12754
12755         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12756                                 NL80211_MCGRP_MLME, gfp);
12757         return;
12758
12759  nla_put_failure:
12760         genlmsg_cancel(msg, hdr);
12761         nlmsg_free(msg);
12762 }
12763 EXPORT_SYMBOL(cfg80211_conn_failed);
12764
12765 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12766                                        const u8 *addr, gfp_t gfp)
12767 {
12768         struct wireless_dev *wdev = dev->ieee80211_ptr;
12769         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12770         struct sk_buff *msg;
12771         void *hdr;
12772         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12773
12774         if (!nlportid)
12775                 return false;
12776
12777         msg = nlmsg_new(100, gfp);
12778         if (!msg)
12779                 return true;
12780
12781         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12782         if (!hdr) {
12783                 nlmsg_free(msg);
12784                 return true;
12785         }
12786
12787         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12788             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12789             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12790                 goto nla_put_failure;
12791
12792         genlmsg_end(msg, hdr);
12793         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12794         return true;
12795
12796  nla_put_failure:
12797         genlmsg_cancel(msg, hdr);
12798         nlmsg_free(msg);
12799         return true;
12800 }
12801
12802 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12803                                 const u8 *addr, gfp_t gfp)
12804 {
12805         struct wireless_dev *wdev = dev->ieee80211_ptr;
12806         bool ret;
12807
12808         trace_cfg80211_rx_spurious_frame(dev, addr);
12809
12810         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12811                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12812                 trace_cfg80211_return_bool(false);
12813                 return false;
12814         }
12815         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12816                                          addr, gfp);
12817         trace_cfg80211_return_bool(ret);
12818         return ret;
12819 }
12820 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12821
12822 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12823                                         const u8 *addr, gfp_t gfp)
12824 {
12825         struct wireless_dev *wdev = dev->ieee80211_ptr;
12826         bool ret;
12827
12828         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12829
12830         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12831                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12832                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12833                 trace_cfg80211_return_bool(false);
12834                 return false;
12835         }
12836         ret = __nl80211_unexpected_frame(dev,
12837                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12838                                          addr, gfp);
12839         trace_cfg80211_return_bool(ret);
12840         return ret;
12841 }
12842 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12843
12844 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12845                       struct wireless_dev *wdev, u32 nlportid,
12846                       int freq, int sig_dbm,
12847                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12848 {
12849         struct net_device *netdev = wdev->netdev;
12850         struct sk_buff *msg;
12851         void *hdr;
12852
12853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12854         if (!msg)
12855                 return -ENOMEM;
12856
12857         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12858         if (!hdr) {
12859                 nlmsg_free(msg);
12860                 return -ENOMEM;
12861         }
12862
12863         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12864             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12865                                         netdev->ifindex)) ||
12866             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12867                               NL80211_ATTR_PAD) ||
12868             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12869             (sig_dbm &&
12870              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12871             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12872             (flags &&
12873              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12874                 goto nla_put_failure;
12875
12876         genlmsg_end(msg, hdr);
12877
12878         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12879
12880  nla_put_failure:
12881         genlmsg_cancel(msg, hdr);
12882         nlmsg_free(msg);
12883         return -ENOBUFS;
12884 }
12885
12886 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12887                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12888 {
12889         struct wiphy *wiphy = wdev->wiphy;
12890         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12891         struct net_device *netdev = wdev->netdev;
12892         struct sk_buff *msg;
12893         void *hdr;
12894
12895         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12896
12897         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12898         if (!msg)
12899                 return;
12900
12901         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12902         if (!hdr) {
12903                 nlmsg_free(msg);
12904                 return;
12905         }
12906
12907         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12908             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12909                                    netdev->ifindex)) ||
12910             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12911                               NL80211_ATTR_PAD) ||
12912             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12913             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12914                               NL80211_ATTR_PAD) ||
12915             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12916                 goto nla_put_failure;
12917
12918         genlmsg_end(msg, hdr);
12919
12920         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12921                                 NL80211_MCGRP_MLME, gfp);
12922         return;
12923
12924  nla_put_failure:
12925         genlmsg_cancel(msg, hdr);
12926         nlmsg_free(msg);
12927 }
12928 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12929
12930 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12931                                             const char *mac, gfp_t gfp)
12932 {
12933         struct wireless_dev *wdev = dev->ieee80211_ptr;
12934         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12935         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12936         void **cb;
12937
12938         if (!msg)
12939                 return NULL;
12940
12941         cb = (void **)msg->cb;
12942
12943         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12944         if (!cb[0]) {
12945                 nlmsg_free(msg);
12946                 return NULL;
12947         }
12948
12949         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12950             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12951                 goto nla_put_failure;
12952
12953         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12954                 goto nla_put_failure;
12955
12956         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12957         if (!cb[1])
12958                 goto nla_put_failure;
12959
12960         cb[2] = rdev;
12961
12962         return msg;
12963  nla_put_failure:
12964         nlmsg_free(msg);
12965         return NULL;
12966 }
12967
12968 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12969 {
12970         void **cb = (void **)msg->cb;
12971         struct cfg80211_registered_device *rdev = cb[2];
12972
12973         nla_nest_end(msg, cb[1]);
12974         genlmsg_end(msg, cb[0]);
12975
12976         memset(msg->cb, 0, sizeof(msg->cb));
12977
12978         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12979                                 NL80211_MCGRP_MLME, gfp);
12980 }
12981
12982 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12983                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12984                               gfp_t gfp)
12985 {
12986         struct sk_buff *msg;
12987
12988         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12989
12990         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12991                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12992                 return;
12993
12994         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12995         if (!msg)
12996                 return;
12997
12998         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12999                         rssi_event))
13000                 goto nla_put_failure;
13001
13002         cfg80211_send_cqm(msg, gfp);
13003
13004         return;
13005
13006  nla_put_failure:
13007         nlmsg_free(msg);
13008 }
13009 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
13010
13011 void cfg80211_cqm_txe_notify(struct net_device *dev,
13012                              const u8 *peer, u32 num_packets,
13013                              u32 rate, u32 intvl, gfp_t gfp)
13014 {
13015         struct sk_buff *msg;
13016
13017         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13018         if (!msg)
13019                 return;
13020
13021         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
13022                 goto nla_put_failure;
13023
13024         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
13025                 goto nla_put_failure;
13026
13027         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
13028                 goto nla_put_failure;
13029
13030         cfg80211_send_cqm(msg, gfp);
13031         return;
13032
13033  nla_put_failure:
13034         nlmsg_free(msg);
13035 }
13036 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
13037
13038 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
13039                                  const u8 *peer, u32 num_packets, gfp_t gfp)
13040 {
13041         struct sk_buff *msg;
13042
13043         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
13044
13045         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13046         if (!msg)
13047                 return;
13048
13049         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
13050                 goto nla_put_failure;
13051
13052         cfg80211_send_cqm(msg, gfp);
13053         return;
13054
13055  nla_put_failure:
13056         nlmsg_free(msg);
13057 }
13058 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
13059
13060 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
13061 {
13062         struct sk_buff *msg;
13063
13064         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13065         if (!msg)
13066                 return;
13067
13068         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
13069                 goto nla_put_failure;
13070
13071         cfg80211_send_cqm(msg, gfp);
13072         return;
13073
13074  nla_put_failure:
13075         nlmsg_free(msg);
13076 }
13077 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
13078
13079 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
13080                                      struct net_device *netdev, const u8 *bssid,
13081                                      const u8 *replay_ctr, gfp_t gfp)
13082 {
13083         struct sk_buff *msg;
13084         struct nlattr *rekey_attr;
13085         void *hdr;
13086
13087         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13088         if (!msg)
13089                 return;
13090
13091         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
13092         if (!hdr) {
13093                 nlmsg_free(msg);
13094                 return;
13095         }
13096
13097         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13098             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13099             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13100                 goto nla_put_failure;
13101
13102         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
13103         if (!rekey_attr)
13104                 goto nla_put_failure;
13105
13106         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
13107                     NL80211_REPLAY_CTR_LEN, replay_ctr))
13108                 goto nla_put_failure;
13109
13110         nla_nest_end(msg, rekey_attr);
13111
13112         genlmsg_end(msg, hdr);
13113
13114         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13115                                 NL80211_MCGRP_MLME, gfp);
13116         return;
13117
13118  nla_put_failure:
13119         genlmsg_cancel(msg, hdr);
13120         nlmsg_free(msg);
13121 }
13122
13123 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
13124                                const u8 *replay_ctr, gfp_t gfp)
13125 {
13126         struct wireless_dev *wdev = dev->ieee80211_ptr;
13127         struct wiphy *wiphy = wdev->wiphy;
13128         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13129
13130         trace_cfg80211_gtk_rekey_notify(dev, bssid);
13131         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
13132 }
13133 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
13134
13135 static void
13136 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
13137                                struct net_device *netdev, int index,
13138                                const u8 *bssid, bool preauth, gfp_t gfp)
13139 {
13140         struct sk_buff *msg;
13141         struct nlattr *attr;
13142         void *hdr;
13143
13144         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13145         if (!msg)
13146                 return;
13147
13148         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
13149         if (!hdr) {
13150                 nlmsg_free(msg);
13151                 return;
13152         }
13153
13154         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13155             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13156                 goto nla_put_failure;
13157
13158         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
13159         if (!attr)
13160                 goto nla_put_failure;
13161
13162         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
13163             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
13164             (preauth &&
13165              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
13166                 goto nla_put_failure;
13167
13168         nla_nest_end(msg, attr);
13169
13170         genlmsg_end(msg, hdr);
13171
13172         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13173                                 NL80211_MCGRP_MLME, gfp);
13174         return;
13175
13176  nla_put_failure:
13177         genlmsg_cancel(msg, hdr);
13178         nlmsg_free(msg);
13179 }
13180
13181 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
13182                                      const u8 *bssid, bool preauth, gfp_t gfp)
13183 {
13184         struct wireless_dev *wdev = dev->ieee80211_ptr;
13185         struct wiphy *wiphy = wdev->wiphy;
13186         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13187
13188         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
13189         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
13190 }
13191 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
13192
13193 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
13194                                      struct net_device *netdev,
13195                                      struct cfg80211_chan_def *chandef,
13196                                      gfp_t gfp,
13197                                      enum nl80211_commands notif,
13198                                      u8 count)
13199 {
13200         struct sk_buff *msg;
13201         void *hdr;
13202
13203         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13204         if (!msg)
13205                 return;
13206
13207         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
13208         if (!hdr) {
13209                 nlmsg_free(msg);
13210                 return;
13211         }
13212
13213         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13214                 goto nla_put_failure;
13215
13216         if (nl80211_send_chandef(msg, chandef))
13217                 goto nla_put_failure;
13218
13219         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
13220             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
13221                         goto nla_put_failure;
13222
13223         genlmsg_end(msg, hdr);
13224
13225         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13226                                 NL80211_MCGRP_MLME, gfp);
13227         return;
13228
13229  nla_put_failure:
13230         genlmsg_cancel(msg, hdr);
13231         nlmsg_free(msg);
13232 }
13233
13234 void cfg80211_ch_switch_notify(struct net_device *dev,
13235                                struct cfg80211_chan_def *chandef)
13236 {
13237         struct wireless_dev *wdev = dev->ieee80211_ptr;
13238         struct wiphy *wiphy = wdev->wiphy;
13239         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13240
13241         ASSERT_WDEV_LOCK(wdev);
13242
13243         trace_cfg80211_ch_switch_notify(dev, chandef);
13244
13245         wdev->chandef = *chandef;
13246         wdev->preset_chandef = *chandef;
13247         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13248                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
13249 }
13250 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
13251
13252 void cfg80211_ch_switch_started_notify(struct net_device *dev,
13253                                        struct cfg80211_chan_def *chandef,
13254                                        u8 count)
13255 {
13256         struct wireless_dev *wdev = dev->ieee80211_ptr;
13257         struct wiphy *wiphy = wdev->wiphy;
13258         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13259
13260         trace_cfg80211_ch_switch_started_notify(dev, chandef);
13261
13262         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13263                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
13264 }
13265 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
13266
13267 void
13268 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
13269                      const struct cfg80211_chan_def *chandef,
13270                      enum nl80211_radar_event event,
13271                      struct net_device *netdev, gfp_t gfp)
13272 {
13273         struct sk_buff *msg;
13274         void *hdr;
13275
13276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13277         if (!msg)
13278                 return;
13279
13280         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
13281         if (!hdr) {
13282                 nlmsg_free(msg);
13283                 return;
13284         }
13285
13286         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
13287                 goto nla_put_failure;
13288
13289         /* NOP and radar events don't need a netdev parameter */
13290         if (netdev) {
13291                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
13292
13293                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13294                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13295                                       NL80211_ATTR_PAD))
13296                         goto nla_put_failure;
13297         }
13298
13299         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
13300                 goto nla_put_failure;
13301
13302         if (nl80211_send_chandef(msg, chandef))
13303                 goto nla_put_failure;
13304
13305         genlmsg_end(msg, hdr);
13306
13307         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13308                                 NL80211_MCGRP_MLME, gfp);
13309         return;
13310
13311  nla_put_failure:
13312         genlmsg_cancel(msg, hdr);
13313         nlmsg_free(msg);
13314 }
13315
13316 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
13317                            u64 cookie, bool acked, gfp_t gfp)
13318 {
13319         struct wireless_dev *wdev = dev->ieee80211_ptr;
13320         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13321         struct sk_buff *msg;
13322         void *hdr;
13323
13324         trace_cfg80211_probe_status(dev, addr, cookie, acked);
13325
13326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13327
13328         if (!msg)
13329                 return;
13330
13331         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
13332         if (!hdr) {
13333                 nlmsg_free(msg);
13334                 return;
13335         }
13336
13337         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13338             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13339             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13340             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13341                               NL80211_ATTR_PAD) ||
13342             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
13343                 goto nla_put_failure;
13344
13345         genlmsg_end(msg, hdr);
13346
13347         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13348                                 NL80211_MCGRP_MLME, gfp);
13349         return;
13350
13351  nla_put_failure:
13352         genlmsg_cancel(msg, hdr);
13353         nlmsg_free(msg);
13354 }
13355 EXPORT_SYMBOL(cfg80211_probe_status);
13356
13357 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
13358                                  const u8 *frame, size_t len,
13359                                  int freq, int sig_dbm)
13360 {
13361         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13362         struct sk_buff *msg;
13363         void *hdr;
13364         struct cfg80211_beacon_registration *reg;
13365
13366         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
13367
13368         spin_lock_bh(&rdev->beacon_registrations_lock);
13369         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13370                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
13371                 if (!msg) {
13372                         spin_unlock_bh(&rdev->beacon_registrations_lock);
13373                         return;
13374                 }
13375
13376                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13377                 if (!hdr)
13378                         goto nla_put_failure;
13379
13380                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13381                     (freq &&
13382                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
13383                     (sig_dbm &&
13384                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13385                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
13386                         goto nla_put_failure;
13387
13388                 genlmsg_end(msg, hdr);
13389
13390                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
13391         }
13392         spin_unlock_bh(&rdev->beacon_registrations_lock);
13393         return;
13394
13395  nla_put_failure:
13396         spin_unlock_bh(&rdev->beacon_registrations_lock);
13397         if (hdr)
13398                 genlmsg_cancel(msg, hdr);
13399         nlmsg_free(msg);
13400 }
13401 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
13402
13403 #ifdef CONFIG_PM
13404 static int cfg80211_net_detect_results(struct sk_buff *msg,
13405                                        struct cfg80211_wowlan_wakeup *wakeup)
13406 {
13407         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
13408         struct nlattr *nl_results, *nl_match, *nl_freqs;
13409         int i, j;
13410
13411         nl_results = nla_nest_start(
13412                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
13413         if (!nl_results)
13414                 return -EMSGSIZE;
13415
13416         for (i = 0; i < nd->n_matches; i++) {
13417                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
13418
13419                 nl_match = nla_nest_start(msg, i);
13420                 if (!nl_match)
13421                         break;
13422
13423                 /* The SSID attribute is optional in nl80211, but for
13424                  * simplicity reasons it's always present in the
13425                  * cfg80211 structure.  If a driver can't pass the
13426                  * SSID, that needs to be changed.  A zero length SSID
13427                  * is still a valid SSID (wildcard), so it cannot be
13428                  * used for this purpose.
13429                  */
13430                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
13431                             match->ssid.ssid)) {
13432                         nla_nest_cancel(msg, nl_match);
13433                         goto out;
13434                 }
13435
13436                 if (match->n_channels) {
13437                         nl_freqs = nla_nest_start(
13438                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
13439                         if (!nl_freqs) {
13440                                 nla_nest_cancel(msg, nl_match);
13441                                 goto out;
13442                         }
13443
13444                         for (j = 0; j < match->n_channels; j++) {
13445                                 if (nla_put_u32(msg, j, match->channels[j])) {
13446                                         nla_nest_cancel(msg, nl_freqs);
13447                                         nla_nest_cancel(msg, nl_match);
13448                                         goto out;
13449                                 }
13450                         }
13451
13452                         nla_nest_end(msg, nl_freqs);
13453                 }
13454
13455                 nla_nest_end(msg, nl_match);
13456         }
13457
13458 out:
13459         nla_nest_end(msg, nl_results);
13460         return 0;
13461 }
13462
13463 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
13464                                    struct cfg80211_wowlan_wakeup *wakeup,
13465                                    gfp_t gfp)
13466 {
13467         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13468         struct sk_buff *msg;
13469         void *hdr;
13470         int size = 200;
13471
13472         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
13473
13474         if (wakeup)
13475                 size += wakeup->packet_present_len;
13476
13477         msg = nlmsg_new(size, gfp);
13478         if (!msg)
13479                 return;
13480
13481         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13482         if (!hdr)
13483                 goto free_msg;
13484
13485         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13486             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13487                               NL80211_ATTR_PAD))
13488                 goto free_msg;
13489
13490         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13491                                         wdev->netdev->ifindex))
13492                 goto free_msg;
13493
13494         if (wakeup) {
13495                 struct nlattr *reasons;
13496
13497                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13498                 if (!reasons)
13499                         goto free_msg;
13500
13501                 if (wakeup->disconnect &&
13502                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13503                         goto free_msg;
13504                 if (wakeup->magic_pkt &&
13505                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13506                         goto free_msg;
13507                 if (wakeup->gtk_rekey_failure &&
13508                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13509                         goto free_msg;
13510                 if (wakeup->eap_identity_req &&
13511                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13512                         goto free_msg;
13513                 if (wakeup->four_way_handshake &&
13514                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13515                         goto free_msg;
13516                 if (wakeup->rfkill_release &&
13517                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13518                         goto free_msg;
13519
13520                 if (wakeup->pattern_idx >= 0 &&
13521                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13522                                 wakeup->pattern_idx))
13523                         goto free_msg;
13524
13525                 if (wakeup->tcp_match &&
13526                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13527                         goto free_msg;
13528
13529                 if (wakeup->tcp_connlost &&
13530                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13531                         goto free_msg;
13532
13533                 if (wakeup->tcp_nomoretokens &&
13534                     nla_put_flag(msg,
13535                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13536                         goto free_msg;
13537
13538                 if (wakeup->packet) {
13539                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13540                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13541
13542                         if (!wakeup->packet_80211) {
13543                                 pkt_attr =
13544                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13545                                 len_attr =
13546                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13547                         }
13548
13549                         if (wakeup->packet_len &&
13550                             nla_put_u32(msg, len_attr, wakeup->packet_len))
13551                                 goto free_msg;
13552
13553                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13554                                     wakeup->packet))
13555                                 goto free_msg;
13556                 }
13557
13558                 if (wakeup->net_detect &&
13559                     cfg80211_net_detect_results(msg, wakeup))
13560                                 goto free_msg;
13561
13562                 nla_nest_end(msg, reasons);
13563         }
13564
13565         genlmsg_end(msg, hdr);
13566
13567         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13568                                 NL80211_MCGRP_MLME, gfp);
13569         return;
13570
13571  free_msg:
13572         nlmsg_free(msg);
13573 }
13574 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13575 #endif
13576
13577 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13578                                 enum nl80211_tdls_operation oper,
13579                                 u16 reason_code, gfp_t gfp)
13580 {
13581         struct wireless_dev *wdev = dev->ieee80211_ptr;
13582         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13583         struct sk_buff *msg;
13584         void *hdr;
13585
13586         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13587                                          reason_code);
13588
13589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13590         if (!msg)
13591                 return;
13592
13593         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13594         if (!hdr) {
13595                 nlmsg_free(msg);
13596                 return;
13597         }
13598
13599         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13600             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13601             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13602             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13603             (reason_code > 0 &&
13604              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13605                 goto nla_put_failure;
13606
13607         genlmsg_end(msg, hdr);
13608
13609         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13610                                 NL80211_MCGRP_MLME, gfp);
13611         return;
13612
13613  nla_put_failure:
13614         genlmsg_cancel(msg, hdr);
13615         nlmsg_free(msg);
13616 }
13617 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13618
13619 static int nl80211_netlink_notify(struct notifier_block * nb,
13620                                   unsigned long state,
13621                                   void *_notify)
13622 {
13623         struct netlink_notify *notify = _notify;
13624         struct cfg80211_registered_device *rdev;
13625         struct wireless_dev *wdev;
13626         struct cfg80211_beacon_registration *reg, *tmp;
13627
13628         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
13629                 return NOTIFY_DONE;
13630
13631         rcu_read_lock();
13632
13633         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13634                 bool schedule_destroy_work = false;
13635                 bool schedule_scan_stop = false;
13636                 struct cfg80211_sched_scan_request *sched_scan_req =
13637                         rcu_dereference(rdev->sched_scan_req);
13638
13639                 if (sched_scan_req && notify->portid &&
13640                     sched_scan_req->owner_nlportid == notify->portid)
13641                         schedule_scan_stop = true;
13642
13643                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
13644                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13645
13646                         if (wdev->owner_nlportid == notify->portid)
13647                                 schedule_destroy_work = true;
13648                 }
13649
13650                 spin_lock_bh(&rdev->beacon_registrations_lock);
13651                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13652                                          list) {
13653                         if (reg->nlportid == notify->portid) {
13654                                 list_del(&reg->list);
13655                                 kfree(reg);
13656                                 break;
13657                         }
13658                 }
13659                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13660
13661                 if (schedule_destroy_work) {
13662                         struct cfg80211_iface_destroy *destroy;
13663
13664                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13665                         if (destroy) {
13666                                 destroy->nlportid = notify->portid;
13667                                 spin_lock(&rdev->destroy_list_lock);
13668                                 list_add(&destroy->list, &rdev->destroy_list);
13669                                 spin_unlock(&rdev->destroy_list_lock);
13670                                 schedule_work(&rdev->destroy_work);
13671                         }
13672                 } else if (schedule_scan_stop) {
13673                         sched_scan_req->owner_nlportid = 0;
13674
13675                         if (rdev->ops->sched_scan_stop &&
13676                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13677                                 schedule_work(&rdev->sched_scan_stop_wk);
13678                 }
13679         }
13680
13681         rcu_read_unlock();
13682
13683         /*
13684          * It is possible that the user space process that is controlling the
13685          * indoor setting disappeared, so notify the regulatory core.
13686          */
13687         regulatory_netlink_notify(notify->portid);
13688         return NOTIFY_OK;
13689 }
13690
13691 static struct notifier_block nl80211_netlink_notifier = {
13692         .notifier_call = nl80211_netlink_notify,
13693 };
13694
13695 void cfg80211_ft_event(struct net_device *netdev,
13696                        struct cfg80211_ft_event_params *ft_event)
13697 {
13698         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13699         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13700         struct sk_buff *msg;
13701         void *hdr;
13702
13703         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13704
13705         if (!ft_event->target_ap)
13706                 return;
13707
13708         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13709         if (!msg)
13710                 return;
13711
13712         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13713         if (!hdr)
13714                 goto out;
13715
13716         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13717             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13718             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13719                 goto out;
13720
13721         if (ft_event->ies &&
13722             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13723                 goto out;
13724         if (ft_event->ric_ies &&
13725             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13726                     ft_event->ric_ies))
13727                 goto out;
13728
13729         genlmsg_end(msg, hdr);
13730
13731         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13732                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13733         return;
13734  out:
13735         nlmsg_free(msg);
13736 }
13737 EXPORT_SYMBOL(cfg80211_ft_event);
13738
13739 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13740 {
13741         struct cfg80211_registered_device *rdev;
13742         struct sk_buff *msg;
13743         void *hdr;
13744         u32 nlportid;
13745
13746         rdev = wiphy_to_rdev(wdev->wiphy);
13747         if (!rdev->crit_proto_nlportid)
13748                 return;
13749
13750         nlportid = rdev->crit_proto_nlportid;
13751         rdev->crit_proto_nlportid = 0;
13752
13753         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13754         if (!msg)
13755                 return;
13756
13757         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13758         if (!hdr)
13759                 goto nla_put_failure;
13760
13761         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13762             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13763                               NL80211_ATTR_PAD))
13764                 goto nla_put_failure;
13765
13766         genlmsg_end(msg, hdr);
13767
13768         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13769         return;
13770
13771  nla_put_failure:
13772         if (hdr)
13773                 genlmsg_cancel(msg, hdr);
13774         nlmsg_free(msg);
13775 }
13776 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13777
13778 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13779 {
13780         struct wiphy *wiphy = wdev->wiphy;
13781         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13782         struct sk_buff *msg;
13783         void *hdr;
13784
13785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13786         if (!msg)
13787                 return;
13788
13789         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13790         if (!hdr)
13791                 goto out;
13792
13793         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13794             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13795             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13796                               NL80211_ATTR_PAD))
13797                 goto out;
13798
13799         genlmsg_end(msg, hdr);
13800
13801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13802                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13803         return;
13804  out:
13805         nlmsg_free(msg);
13806 }
13807
13808 /* initialisation/exit functions */
13809
13810 int nl80211_init(void)
13811 {
13812         int err;
13813
13814         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13815                                                    nl80211_mcgrps);
13816         if (err)
13817                 return err;
13818
13819         err = netlink_register_notifier(&nl80211_netlink_notifier);
13820         if (err)
13821                 goto err_out;
13822
13823         return 0;
13824  err_out:
13825         genl_unregister_family(&nl80211_fam);
13826         return err;
13827 }
13828
13829 void nl80211_exit(void)
13830 {
13831         netlink_unregister_notifier(&nl80211_netlink_notifier);
13832         genl_unregister_family(&nl80211_fam);
13833 }