net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         ASSERT_RTNL();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         ASSERT_RTNL();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 130                                 if (wdev->identifier != (u32)wdev_id)
 131                                         continue;
 132                                 found = true;
 133                                 break;
 134                         }
 135
 136                         if (!found)
 137                                 tmp = NULL;
 138
 139                         if (rdev && tmp != rdev)
 140                                 return ERR_PTR(-EINVAL);
 141                         rdev = tmp;
 142                 }
 143         }
 144
 145         if (attrs[NL80211_ATTR_IFINDEX]) {
 146                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 147                 netdev = dev_get_by_index(netns, ifindex);
 148                 if (netdev) {
 149                         if (netdev->ieee80211_ptr)
 150                                 tmp = wiphy_to_dev(
 151                                                 netdev->ieee80211_ptr->wiphy);
 152                         else
 153                                 tmp = NULL;
 154
 155                         dev_put(netdev);
 156
 157                         /* not wireless device -- return error */
 158                         if (!tmp)
 159                                 return ERR_PTR(-EINVAL);
 160
 161                         /* mismatch -- return error */
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         rdev = tmp;
 166                 }
 167         }
 168
 169         if (!rdev)
 170                 return ERR_PTR(-ENODEV);
 171
 172         if (netns != wiphy_net(&rdev->wiphy))
 173                 return ERR_PTR(-ENODEV);
 174
 175         return rdev;
 176 }
 177
 178 /*
 179  * This function returns a pointer to the driver
 180  * that the genl_info item that is passed refers to.
 181  *
 182  * The result of this can be a PTR_ERR and hence must
 183  * be checked with IS_ERR() for errors.
 184  */
 185 static struct cfg80211_registered_device *
 186 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 187 {
 188         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 189 }
 190
 191 /* policy for the attributes */
 192 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 193         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 194         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 195                                       .len = 20-1 },
 196         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 197
 198         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 199         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 200         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 201         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 202         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 203
 204         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 205         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 206         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 207         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 208         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 209
 210         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 211         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 212         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 213
 214         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 215         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 216
 217         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 218         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 219                                     .len = WLAN_MAX_KEY_LEN },
 220         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 221         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 222         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 223         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 224         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 227         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 229                                        .len = IEEE80211_MAX_DATA_LEN },
 230         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 231                                        .len = IEEE80211_MAX_DATA_LEN },
 232         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 233         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 234         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 235         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 236                                                .len = NL80211_MAX_SUPP_RATES },
 237         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 238         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 239         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 240         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 241                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 242         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 243
 244         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 245         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 246
 247         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 248         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 249         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 250         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 251                                            .len = NL80211_MAX_SUPP_RATES },
 252         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 253
 254         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 256
 257         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 258
 259         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 261                               .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 263         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 264
 265         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 266                                 .len = IEEE80211_MAX_SSID_LEN },
 267         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 268         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 269         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 270         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 271         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 272         [NL80211_ATTR_STA_FLAGS2] = {
 273                 .len = sizeof(struct nl80211_sta_flag_update),
 274         },
 275         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 276         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 277         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 278         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 280         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 281         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 282         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 283         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 284                                  .len = WLAN_PMKID_LEN },
 285         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 286         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 287         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 289                                  .len = IEEE80211_MAX_DATA_LEN },
 290         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 291         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 293         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 296         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 297         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 300         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 301         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 303         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 304         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 306         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 308         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 309         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 310                                          .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 312                                          .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 314         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 317         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 318         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 319         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 320         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 323                                       .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 325         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 327                 .len = NL80211_HT_CAPABILITY_LEN
 328         },
 329         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 330         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 331         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 332         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 333         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 335         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 336         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 337         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 338         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 339         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 340         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 341         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 342         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 343         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 344         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 346                 .len = NL80211_VHT_CAPABILITY_LEN,
 347         },
 348         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 349         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 350                                   .len = IEEE80211_MAX_DATA_LEN },
 351         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 352 };
 353
 354 /* policy for the key attributes */
 355 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 356         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 357         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 358         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 359         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 360         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 361         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 362         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 363         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364 };
 365
 366 /* policy for the key default flags */
 367 static const struct nla_policy
 368 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 369         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 371 };
 372
 373 /* policy for WoWLAN attributes */
 374 static const struct nla_policy
 375 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 376         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 377         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 378         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 379         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 380         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 381         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 382         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 383         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 384         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 385 };
 386
 387 static const struct nla_policy
 388 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 389         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 390         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 391         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 392         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 393         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 394         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 395         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 396                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 397         },
 398         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 399                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 400         },
 401         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 402         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 403         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 404 };
 405
 406 /* policy for GTK rekey offload attributes */
 407 static const struct nla_policy
 408 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 409         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 410         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 411         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 412 };
 413
 414 static const struct nla_policy
 415 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 416         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 417                                                  .len = IEEE80211_MAX_SSID_LEN },
 418         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 419 };
 420
 421 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 422                                      struct netlink_callback *cb,
 423                                      struct cfg80211_registered_device **rdev,
 424                                      struct wireless_dev **wdev)
 425 {
 426         int err;
 427
 428         rtnl_lock();
 429
 430         if (!cb->args[0]) {
 431                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 432                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 433                                   nl80211_policy);
 434                 if (err)
 435                         goto out_unlock;
 436
 437                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 438                                                    nl80211_fam.attrbuf);
 439                 if (IS_ERR(*wdev)) {
 440                         err = PTR_ERR(*wdev);
 441                         goto out_unlock;
 442                 }
 443                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 444                 cb->args[0] = (*rdev)->wiphy_idx;
 445                 cb->args[1] = (*wdev)->identifier;
 446         } else {
 447                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
 448                 struct wireless_dev *tmp;
 449
 450                 if (!wiphy) {
 451                         err = -ENODEV;
 452                         goto out_unlock;
 453                 }
 454                 *rdev = wiphy_to_dev(wiphy);
 455                 *wdev = NULL;
 456
 457                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 458                         if (tmp->identifier == cb->args[1]) {
 459                                 *wdev = tmp;
 460                                 break;
 461                         }
 462                 }
 463
 464                 if (!*wdev) {
 465                         err = -ENODEV;
 466                         goto out_unlock;
 467                 }
 468         }
 469
 470         return 0;
 471  out_unlock:
 472         rtnl_unlock();
 473         return err;
 474 }
 475
 476 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 477 {
 478         rtnl_unlock();
 479 }
 480
 481 /* IE validation */
 482 static bool is_valid_ie_attr(const struct nlattr *attr)
 483 {
 484         const u8 *pos;
 485         int len;
 486
 487         if (!attr)
 488                 return true;
 489
 490         pos = nla_data(attr);
 491         len = nla_len(attr);
 492
 493         while (len) {
 494                 u8 elemlen;
 495
 496                 if (len < 2)
 497                         return false;
 498                 len -= 2;
 499
 500                 elemlen = pos[1];
 501                 if (elemlen > len)
 502                         return false;
 503
 504                 len -= elemlen;
 505                 pos += 2 + elemlen;
 506         }
 507
 508         return true;
 509 }
 510
 511 /* message building helper */
 512 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 513                                    int flags, u8 cmd)
 514 {
 515         /* since there is no private header just add the generic one */
 516         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 517 }
 518
 519 static int nl80211_msg_put_channel(struct sk_buff *msg,
 520                                    struct ieee80211_channel *chan,
 521                                    bool large)
 522 {
 523         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 524                         chan->center_freq))
 525                 goto nla_put_failure;
 526
 527         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 528             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 529                 goto nla_put_failure;
 530         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 531             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 532                 goto nla_put_failure;
 533         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 534             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 535                 goto nla_put_failure;
 536         if (chan->flags & IEEE80211_CHAN_RADAR) {
 537                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 538                         goto nla_put_failure;
 539                 if (large) {
 540                         u32 time;
 541
 542                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 543
 544                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 545                                         chan->dfs_state))
 546                                 goto nla_put_failure;
 547                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 548                                         time))
 549                                 goto nla_put_failure;
 550                 }
 551         }
 552
 553         if (large) {
 554                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 555                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 556                         goto nla_put_failure;
 557                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 558                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 559                         goto nla_put_failure;
 560                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 561                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 562                         goto nla_put_failure;
 563                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 564                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 565                         goto nla_put_failure;
 566         }
 567
 568         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 569                         DBM_TO_MBM(chan->max_power)))
 570                 goto nla_put_failure;
 571
 572         return 0;
 573
 574  nla_put_failure:
 575         return -ENOBUFS;
 576 }
 577
 578 /* netlink command implementations */
 579
 580 struct key_parse {
 581         struct key_params p;
 582         int idx;
 583         int type;
 584         bool def, defmgmt;
 585         bool def_uni, def_multi;
 586 };
 587
 588 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 589 {
 590         struct nlattr *tb[NL80211_KEY_MAX + 1];
 591         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 592                                    nl80211_key_policy);
 593         if (err)
 594                 return err;
 595
 596         k->def = !!tb[NL80211_KEY_DEFAULT];
 597         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 598
 599         if (k->def) {
 600                 k->def_uni = true;
 601                 k->def_multi = true;
 602         }
 603         if (k->defmgmt)
 604                 k->def_multi = true;
 605
 606         if (tb[NL80211_KEY_IDX])
 607                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 608
 609         if (tb[NL80211_KEY_DATA]) {
 610                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 611                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 612         }
 613
 614         if (tb[NL80211_KEY_SEQ]) {
 615                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 616                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 617         }
 618
 619         if (tb[NL80211_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 621
 622         if (tb[NL80211_KEY_TYPE]) {
 623                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 624                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 625                         return -EINVAL;
 626         }
 627
 628         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 629                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 630                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 631                                        tb[NL80211_KEY_DEFAULT_TYPES],
 632                                        nl80211_key_default_policy);
 633                 if (err)
 634                         return err;
 635
 636                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 637                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 638         }
 639
 640         return 0;
 641 }
 642
 643 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 644 {
 645         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 646                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 647                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 648         }
 649
 650         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 651                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 652                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 653         }
 654
 655         if (info->attrs[NL80211_ATTR_KEY_IDX])
 656                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 657
 658         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 659                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 660
 661         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 662         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 663
 664         if (k->def) {
 665                 k->def_uni = true;
 666                 k->def_multi = true;
 667         }
 668         if (k->defmgmt)
 669                 k->def_multi = true;
 670
 671         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 672                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 673                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 674                         return -EINVAL;
 675         }
 676
 677         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 678                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 679                 int err = nla_parse_nested(
 680                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 681                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 682                                 nl80211_key_default_policy);
 683                 if (err)
 684                         return err;
 685
 686                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 687                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 688         }
 689
 690         return 0;
 691 }
 692
 693 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 694 {
 695         int err;
 696
 697         memset(k, 0, sizeof(*k));
 698         k->idx = -1;
 699         k->type = -1;
 700
 701         if (info->attrs[NL80211_ATTR_KEY])
 702                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 703         else
 704                 err = nl80211_parse_key_old(info, k);
 705
 706         if (err)
 707                 return err;
 708
 709         if (k->def && k->defmgmt)
 710                 return -EINVAL;
 711
 712         if (k->defmgmt) {
 713                 if (k->def_uni || !k->def_multi)
 714                         return -EINVAL;
 715         }
 716
 717         if (k->idx != -1) {
 718                 if (k->defmgmt) {
 719                         if (k->idx < 4 || k->idx > 5)
 720                                 return -EINVAL;
 721                 } else if (k->def) {
 722                         if (k->idx < 0 || k->idx > 3)
 723                                 return -EINVAL;
 724                 } else {
 725                         if (k->idx < 0 || k->idx > 5)
 726                                 return -EINVAL;
 727                 }
 728         }
 729
 730         return 0;
 731 }
 732
 733 static struct cfg80211_cached_keys *
 734 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 735                        struct nlattr *keys, bool *no_ht)
 736 {
 737         struct key_parse parse;
 738         struct nlattr *key;
 739         struct cfg80211_cached_keys *result;
 740         int rem, err, def = 0;
 741
 742         result = kzalloc(sizeof(*result), GFP_KERNEL);
 743         if (!result)
 744                 return ERR_PTR(-ENOMEM);
 745
 746         result->def = -1;
 747         result->defmgmt = -1;
 748
 749         nla_for_each_nested(key, keys, rem) {
 750                 memset(&parse, 0, sizeof(parse));
 751                 parse.idx = -1;
 752
 753                 err = nl80211_parse_key_new(key, &parse);
 754                 if (err)
 755                         goto error;
 756                 err = -EINVAL;
 757                 if (!parse.p.key)
 758                         goto error;
 759                 if (parse.idx < 0 || parse.idx > 4)
 760                         goto error;
 761                 if (parse.def) {
 762                         if (def)
 763                                 goto error;
 764                         def = 1;
 765                         result->def = parse.idx;
 766                         if (!parse.def_uni || !parse.def_multi)
 767                                 goto error;
 768                 } else if (parse.defmgmt)
 769                         goto error;
 770                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 771                                                      parse.idx, false, NULL);
 772                 if (err)
 773                         goto error;
 774                 result->params[parse.idx].cipher = parse.p.cipher;
 775                 result->params[parse.idx].key_len = parse.p.key_len;
 776                 result->params[parse.idx].key = result->data[parse.idx];
 777                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 778
 779                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 780                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 781                         if (no_ht)
 782                                 *no_ht = true;
 783                 }
 784         }
 785
 786         return result;
 787  error:
 788         kfree(result);
 789         return ERR_PTR(err);
 790 }
 791
 792 static int nl80211_key_allowed(struct wireless_dev *wdev)
 793 {
 794         ASSERT_WDEV_LOCK(wdev);
 795
 796         switch (wdev->iftype) {
 797         case NL80211_IFTYPE_AP:
 798         case NL80211_IFTYPE_AP_VLAN:
 799         case NL80211_IFTYPE_P2P_GO:
 800         case NL80211_IFTYPE_MESH_POINT:
 801                 break;
 802         case NL80211_IFTYPE_ADHOC:
 803         case NL80211_IFTYPE_STATION:
 804         case NL80211_IFTYPE_P2P_CLIENT:
 805                 if (!wdev->current_bss)
 806                         return -ENOLINK;
 807                 break;
 808         default:
 809                 return -EINVAL;
 810         }
 811
 812         return 0;
 813 }
 814
 815 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 816 {
 817         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 818         int i;
 819
 820         if (!nl_modes)
 821                 goto nla_put_failure;
 822
 823         i = 0;
 824         while (ifmodes) {
 825                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 826                         goto nla_put_failure;
 827                 ifmodes >>= 1;
 828                 i++;
 829         }
 830
 831         nla_nest_end(msg, nl_modes);
 832         return 0;
 833
 834 nla_put_failure:
 835         return -ENOBUFS;
 836 }
 837
 838 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 839                                           struct sk_buff *msg,
 840                                           bool large)
 841 {
 842         struct nlattr *nl_combis;
 843         int i, j;
 844
 845         nl_combis = nla_nest_start(msg,
 846                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 847         if (!nl_combis)
 848                 goto nla_put_failure;
 849
 850         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 851                 const struct ieee80211_iface_combination *c;
 852                 struct nlattr *nl_combi, *nl_limits;
 853
 854                 c = &wiphy->iface_combinations[i];
 855
 856                 nl_combi = nla_nest_start(msg, i + 1);
 857                 if (!nl_combi)
 858                         goto nla_put_failure;
 859
 860                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 861                 if (!nl_limits)
 862                         goto nla_put_failure;
 863
 864                 for (j = 0; j < c->n_limits; j++) {
 865                         struct nlattr *nl_limit;
 866
 867                         nl_limit = nla_nest_start(msg, j + 1);
 868                         if (!nl_limit)
 869                                 goto nla_put_failure;
 870                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 871                                         c->limits[j].max))
 872                                 goto nla_put_failure;
 873                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 874                                                 c->limits[j].types))
 875                                 goto nla_put_failure;
 876                         nla_nest_end(msg, nl_limit);
 877                 }
 878
 879                 nla_nest_end(msg, nl_limits);
 880
 881                 if (c->beacon_int_infra_match &&
 882                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 883                         goto nla_put_failure;
 884                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 885                                 c->num_different_channels) ||
 886                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 887                                 c->max_interfaces))
 888                         goto nla_put_failure;
 889                 if (large &&
 890                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 891                                 c->radar_detect_widths))
 892                         goto nla_put_failure;
 893
 894                 nla_nest_end(msg, nl_combi);
 895         }
 896
 897         nla_nest_end(msg, nl_combis);
 898
 899         return 0;
 900 nla_put_failure:
 901         return -ENOBUFS;
 902 }
 903
 904 #ifdef CONFIG_PM
 905 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 906                                         struct sk_buff *msg)
 907 {
 908         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 909         struct nlattr *nl_tcp;
 910
 911         if (!tcp)
 912                 return 0;
 913
 914         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 915         if (!nl_tcp)
 916                 return -ENOBUFS;
 917
 918         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 919                         tcp->data_payload_max))
 920                 return -ENOBUFS;
 921
 922         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 923                         tcp->data_payload_max))
 924                 return -ENOBUFS;
 925
 926         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 927                 return -ENOBUFS;
 928
 929         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 930                                 sizeof(*tcp->tok), tcp->tok))
 931                 return -ENOBUFS;
 932
 933         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 934                         tcp->data_interval_max))
 935                 return -ENOBUFS;
 936
 937         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 938                         tcp->wake_payload_max))
 939                 return -ENOBUFS;
 940
 941         nla_nest_end(msg, nl_tcp);
 942         return 0;
 943 }
 944
 945 static int nl80211_send_wowlan(struct sk_buff *msg,
 946                                struct cfg80211_registered_device *dev,
 947                                bool large)
 948 {
 949         struct nlattr *nl_wowlan;
 950
 951         if (!dev->wiphy.wowlan)
 952                 return 0;
 953
 954         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 955         if (!nl_wowlan)
 956                 return -ENOBUFS;
 957
 958         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 959              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 960             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 961              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 962             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 963              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 964             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 965              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 966             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 967              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 968             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 969              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 970             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 971              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 972             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 973              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 974                 return -ENOBUFS;
 975
 976         if (dev->wiphy.wowlan->n_patterns) {
 977                 struct nl80211_wowlan_pattern_support pat = {
 978                         .max_patterns = dev->wiphy.wowlan->n_patterns,
 979                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
 980                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
 981                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
 982                 };
 983
 984                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 985                             sizeof(pat), &pat))
 986                         return -ENOBUFS;
 987         }
 988
 989         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
 990                 return -ENOBUFS;
 991
 992         nla_nest_end(msg, nl_wowlan);
 993
 994         return 0;
 995 }
 996 #endif
 997
 998 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
 999                                       struct ieee80211_supported_band *sband)
1000 {
1001         struct nlattr *nl_rates, *nl_rate;
1002         struct ieee80211_rate *rate;
1003         int i;
1004
1005         /* add HT info */
1006         if (sband->ht_cap.ht_supported &&
1007             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1008                      sizeof(sband->ht_cap.mcs),
1009                      &sband->ht_cap.mcs) ||
1010              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1011                          sband->ht_cap.cap) ||
1012              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1013                         sband->ht_cap.ampdu_factor) ||
1014              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1015                         sband->ht_cap.ampdu_density)))
1016                 return -ENOBUFS;
1017
1018         /* add VHT info */
1019         if (sband->vht_cap.vht_supported &&
1020             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1021                      sizeof(sband->vht_cap.vht_mcs),
1022                      &sband->vht_cap.vht_mcs) ||
1023              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1024                          sband->vht_cap.cap)))
1025                 return -ENOBUFS;
1026
1027         /* add bitrates */
1028         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1029         if (!nl_rates)
1030                 return -ENOBUFS;
1031
1032         for (i = 0; i < sband->n_bitrates; i++) {
1033                 nl_rate = nla_nest_start(msg, i);
1034                 if (!nl_rate)
1035                         return -ENOBUFS;
1036
1037                 rate = &sband->bitrates[i];
1038                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1039                                 rate->bitrate))
1040                         return -ENOBUFS;
1041                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1042                     nla_put_flag(msg,
1043                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1044                         return -ENOBUFS;
1045
1046                 nla_nest_end(msg, nl_rate);
1047         }
1048
1049         nla_nest_end(msg, nl_rates);
1050
1051         return 0;
1052 }
1053
1054 static int
1055 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1056                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1057 {
1058         u16 stypes;
1059         struct nlattr *nl_ftypes, *nl_ifs;
1060         enum nl80211_iftype ift;
1061         int i;
1062
1063         if (!mgmt_stypes)
1064                 return 0;
1065
1066         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1067         if (!nl_ifs)
1068                 return -ENOBUFS;
1069
1070         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1071                 nl_ftypes = nla_nest_start(msg, ift);
1072                 if (!nl_ftypes)
1073                         return -ENOBUFS;
1074                 i = 0;
1075                 stypes = mgmt_stypes[ift].tx;
1076                 while (stypes) {
1077                         if ((stypes & 1) &&
1078                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1079                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1080                                 return -ENOBUFS;
1081                         stypes >>= 1;
1082                         i++;
1083                 }
1084                 nla_nest_end(msg, nl_ftypes);
1085         }
1086
1087         nla_nest_end(msg, nl_ifs);
1088
1089         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1090         if (!nl_ifs)
1091                 return -ENOBUFS;
1092
1093         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1094                 nl_ftypes = nla_nest_start(msg, ift);
1095                 if (!nl_ftypes)
1096                         return -ENOBUFS;
1097                 i = 0;
1098                 stypes = mgmt_stypes[ift].rx;
1099                 while (stypes) {
1100                         if ((stypes & 1) &&
1101                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1102                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1103                                 return -ENOBUFS;
1104                         stypes >>= 1;
1105                         i++;
1106                 }
1107                 nla_nest_end(msg, nl_ftypes);
1108         }
1109         nla_nest_end(msg, nl_ifs);
1110
1111         return 0;
1112 }
1113
1114 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1115                               struct sk_buff *msg, u32 portid, u32 seq,
1116                               int flags, bool split, long *split_start,
1117                               long *band_start, long *chan_start)
1118 {
1119         void *hdr;
1120         struct nlattr *nl_bands, *nl_band;
1121         struct nlattr *nl_freqs, *nl_freq;
1122         struct nlattr *nl_cmds;
1123         enum ieee80211_band band;
1124         struct ieee80211_channel *chan;
1125         int i;
1126         const struct ieee80211_txrx_stypes *mgmt_stypes =
1127                                 dev->wiphy.mgmt_stypes;
1128         long start = 0, start_chan = 0, start_band = 0;
1129         u32 features;
1130
1131         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1132         if (!hdr)
1133                 return -ENOBUFS;
1134
1135         /* allow always using the variables */
1136         if (!split) {
1137                 split_start = &start;
1138                 band_start = &start_band;
1139                 chan_start = &start_chan;
1140         }
1141
1142         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1143             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1144                            wiphy_name(&dev->wiphy)) ||
1145             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1146                         cfg80211_rdev_list_generation))
1147                 goto nla_put_failure;
1148
1149         switch (*split_start) {
1150         case 0:
1151                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1152                                dev->wiphy.retry_short) ||
1153                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1154                                dev->wiphy.retry_long) ||
1155                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1156                                 dev->wiphy.frag_threshold) ||
1157                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1158                                 dev->wiphy.rts_threshold) ||
1159                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1160                                dev->wiphy.coverage_class) ||
1161                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1162                                dev->wiphy.max_scan_ssids) ||
1163                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1164                                dev->wiphy.max_sched_scan_ssids) ||
1165                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1166                                 dev->wiphy.max_scan_ie_len) ||
1167                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1168                                 dev->wiphy.max_sched_scan_ie_len) ||
1169                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1170                                dev->wiphy.max_match_sets))
1171                         goto nla_put_failure;
1172
1173                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1174                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1175                         goto nla_put_failure;
1176                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1177                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1178                         goto nla_put_failure;
1179                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1180                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1181                         goto nla_put_failure;
1182                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1183                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1184                         goto nla_put_failure;
1185                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1186                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1187                         goto nla_put_failure;
1188                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1189                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1190                         goto nla_put_failure;
1191
1192                 (*split_start)++;
1193                 if (split)
1194                         break;
1195         case 1:
1196                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1197                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1198                             dev->wiphy.cipher_suites))
1199                         goto nla_put_failure;
1200
1201                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1202                                dev->wiphy.max_num_pmkids))
1203                         goto nla_put_failure;
1204
1205                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1206                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1207                         goto nla_put_failure;
1208
1209                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1210                                 dev->wiphy.available_antennas_tx) ||
1211                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1212                                 dev->wiphy.available_antennas_rx))
1213                         goto nla_put_failure;
1214
1215                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1216                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1217                                 dev->wiphy.probe_resp_offload))
1218                         goto nla_put_failure;
1219
1220                 if ((dev->wiphy.available_antennas_tx ||
1221                      dev->wiphy.available_antennas_rx) &&
1222                     dev->ops->get_antenna) {
1223                         u32 tx_ant = 0, rx_ant = 0;
1224                         int res;
1225                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1226                         if (!res) {
1227                                 if (nla_put_u32(msg,
1228                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1229                                                 tx_ant) ||
1230                                     nla_put_u32(msg,
1231                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1232                                                 rx_ant))
1233                                         goto nla_put_failure;
1234                         }
1235                 }
1236
1237                 (*split_start)++;
1238                 if (split)
1239                         break;
1240         case 2:
1241                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1242                                         dev->wiphy.interface_modes))
1243                                 goto nla_put_failure;
1244                 (*split_start)++;
1245                 if (split)
1246                         break;
1247         case 3:
1248                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1249                 if (!nl_bands)
1250                         goto nla_put_failure;
1251
1252                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1253                         struct ieee80211_supported_band *sband;
1254
1255                         sband = dev->wiphy.bands[band];
1256
1257                         if (!sband)
1258                                 continue;
1259
1260                         nl_band = nla_nest_start(msg, band);
1261                         if (!nl_band)
1262                                 goto nla_put_failure;
1263
1264                         switch (*chan_start) {
1265                         case 0:
1266                                 if (nl80211_send_band_rateinfo(msg, sband))
1267                                         goto nla_put_failure;
1268                                 (*chan_start)++;
1269                                 if (split)
1270                                         break;
1271                         default:
1272                                 /* add frequencies */
1273                                 nl_freqs = nla_nest_start(
1274                                         msg, NL80211_BAND_ATTR_FREQS);
1275                                 if (!nl_freqs)
1276                                         goto nla_put_failure;
1277
1278                                 for (i = *chan_start - 1;
1279                                      i < sband->n_channels;
1280                                      i++) {
1281                                         nl_freq = nla_nest_start(msg, i);
1282                                         if (!nl_freq)
1283                                                 goto nla_put_failure;
1284
1285                                         chan = &sband->channels[i];
1286
1287                                         if (nl80211_msg_put_channel(msg, chan,
1288                                                                     split))
1289                                                 goto nla_put_failure;
1290
1291                                         nla_nest_end(msg, nl_freq);
1292                                         if (split)
1293                                                 break;
1294                                 }
1295                                 if (i < sband->n_channels)
1296                                         *chan_start = i + 2;
1297                                 else
1298                                         *chan_start = 0;
1299                                 nla_nest_end(msg, nl_freqs);
1300                         }
1301
1302                         nla_nest_end(msg, nl_band);
1303
1304                         if (split) {
1305                                 /* start again here */
1306                                 if (*chan_start)
1307                                         band--;
1308                                 break;
1309                         }
1310                 }
1311                 nla_nest_end(msg, nl_bands);
1312
1313                 if (band < IEEE80211_NUM_BANDS)
1314                         *band_start = band + 1;
1315                 else
1316                         *band_start = 0;
1317
1318                 /* if bands & channels are done, continue outside */
1319                 if (*band_start == 0 && *chan_start == 0)
1320                         (*split_start)++;
1321                 if (split)
1322                         break;
1323         case 4:
1324                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1325                 if (!nl_cmds)
1326                         goto nla_put_failure;
1327
1328                 i = 0;
1329 #define CMD(op, n)                                                      \
1330                  do {                                                   \
1331                         if (dev->ops->op) {                             \
1332                                 i++;                                    \
1333                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1334                                         goto nla_put_failure;           \
1335                         }                                               \
1336                 } while (0)
1337
1338                 CMD(add_virtual_intf, NEW_INTERFACE);
1339                 CMD(change_virtual_intf, SET_INTERFACE);
1340                 CMD(add_key, NEW_KEY);
1341                 CMD(start_ap, START_AP);
1342                 CMD(add_station, NEW_STATION);
1343                 CMD(add_mpath, NEW_MPATH);
1344                 CMD(update_mesh_config, SET_MESH_CONFIG);
1345                 CMD(change_bss, SET_BSS);
1346                 CMD(auth, AUTHENTICATE);
1347                 CMD(assoc, ASSOCIATE);
1348                 CMD(deauth, DEAUTHENTICATE);
1349                 CMD(disassoc, DISASSOCIATE);
1350                 CMD(join_ibss, JOIN_IBSS);
1351                 CMD(join_mesh, JOIN_MESH);
1352                 CMD(set_pmksa, SET_PMKSA);
1353                 CMD(del_pmksa, DEL_PMKSA);
1354                 CMD(flush_pmksa, FLUSH_PMKSA);
1355                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1356                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1357                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1358                 CMD(mgmt_tx, FRAME);
1359                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1360                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1361                         i++;
1362                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1363                                 goto nla_put_failure;
1364                 }
1365                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1366                     dev->ops->join_mesh) {
1367                         i++;
1368                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1369                                 goto nla_put_failure;
1370                 }
1371                 CMD(set_wds_peer, SET_WDS_PEER);
1372                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1373                         CMD(tdls_mgmt, TDLS_MGMT);
1374                         CMD(tdls_oper, TDLS_OPER);
1375                 }
1376                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1377                         CMD(sched_scan_start, START_SCHED_SCAN);
1378                 CMD(probe_client, PROBE_CLIENT);
1379                 CMD(set_noack_map, SET_NOACK_MAP);
1380                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1381                         i++;
1382                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1383                                 goto nla_put_failure;
1384                 }
1385                 CMD(start_p2p_device, START_P2P_DEVICE);
1386                 CMD(set_mcast_rate, SET_MCAST_RATE);
1387                 if (split) {
1388                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1389                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1390                 }
1391
1392 #ifdef CONFIG_NL80211_TESTMODE
1393                 CMD(testmode_cmd, TESTMODE);
1394 #endif
1395
1396 #undef CMD
1397
1398                 if (dev->ops->connect || dev->ops->auth) {
1399                         i++;
1400                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1401                                 goto nla_put_failure;
1402                 }
1403
1404                 if (dev->ops->disconnect || dev->ops->deauth) {
1405                         i++;
1406                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1407                                 goto nla_put_failure;
1408                 }
1409
1410                 nla_nest_end(msg, nl_cmds);
1411                 (*split_start)++;
1412                 if (split)
1413                         break;
1414         case 5:
1415                 if (dev->ops->remain_on_channel &&
1416                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1417                     nla_put_u32(msg,
1418                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1419                                 dev->wiphy.max_remain_on_channel_duration))
1420                         goto nla_put_failure;
1421
1422                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1423                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1424                         goto nla_put_failure;
1425
1426                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1427                         goto nla_put_failure;
1428                 (*split_start)++;
1429                 if (split)
1430                         break;
1431         case 6:
1432 #ifdef CONFIG_PM
1433                 if (nl80211_send_wowlan(msg, dev, split))
1434                         goto nla_put_failure;
1435                 (*split_start)++;
1436                 if (split)
1437                         break;
1438 #else
1439                 (*split_start)++;
1440 #endif
1441         case 7:
1442                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1443                                         dev->wiphy.software_iftypes))
1444                         goto nla_put_failure;
1445
1446                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1447                         goto nla_put_failure;
1448
1449                 (*split_start)++;
1450                 if (split)
1451                         break;
1452         case 8:
1453                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1454                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1455                                 dev->wiphy.ap_sme_capa))
1456                         goto nla_put_failure;
1457
1458                 features = dev->wiphy.features;
1459                 /*
1460                  * We can only add the per-channel limit information if the
1461                  * dump is split, otherwise it makes it too big. Therefore
1462                  * only advertise it in that case.
1463                  */
1464                 if (split)
1465                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1466                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1467                         goto nla_put_failure;
1468
1469                 if (dev->wiphy.ht_capa_mod_mask &&
1470                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1471                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1472                             dev->wiphy.ht_capa_mod_mask))
1473                         goto nla_put_failure;
1474
1475                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1476                     dev->wiphy.max_acl_mac_addrs &&
1477                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1478                                 dev->wiphy.max_acl_mac_addrs))
1479                         goto nla_put_failure;
1480
1481                 /*
1482                  * Any information below this point is only available to
1483                  * applications that can deal with it being split. This
1484                  * helps ensure that newly added capabilities don't break
1485                  * older tools by overrunning their buffers.
1486                  *
1487                  * We still increment split_start so that in the split
1488                  * case we'll continue with more data in the next round,
1489                  * but break unconditionally so unsplit data stops here.
1490                  */
1491                 (*split_start)++;
1492                 break;
1493         case 9:
1494                 if (dev->wiphy.extended_capabilities &&
1495                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1496                              dev->wiphy.extended_capabilities_len,
1497                              dev->wiphy.extended_capabilities) ||
1498                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1499                              dev->wiphy.extended_capabilities_len,
1500                              dev->wiphy.extended_capabilities_mask)))
1501                         goto nla_put_failure;
1502
1503                 if (dev->wiphy.vht_capa_mod_mask &&
1504                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1505                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1506                             dev->wiphy.vht_capa_mod_mask))
1507                         goto nla_put_failure;
1508
1509                 /* done */
1510                 *split_start = 0;
1511                 break;
1512         }
1513         return genlmsg_end(msg, hdr);
1514
1515  nla_put_failure:
1516         genlmsg_cancel(msg, hdr);
1517         return -EMSGSIZE;
1518 }
1519
1520 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1521 {
1522         int idx = 0, ret;
1523         int start = cb->args[0];
1524         struct cfg80211_registered_device *dev;
1525         s64 filter_wiphy = -1;
1526         bool split = false;
1527         struct nlattr **tb;
1528         int res;
1529
1530         /* will be zeroed in nlmsg_parse() */
1531         tb = kmalloc(sizeof(*tb) * (NL80211_ATTR_MAX + 1), GFP_KERNEL);
1532         if (!tb)
1533                 return -ENOMEM;
1534
1535         rtnl_lock();
1536
1537         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1538                           tb, NL80211_ATTR_MAX, nl80211_policy);
1539         if (res == 0) {
1540                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1541                 if (tb[NL80211_ATTR_WIPHY])
1542                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1543                 if (tb[NL80211_ATTR_WDEV])
1544                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1545                 if (tb[NL80211_ATTR_IFINDEX]) {
1546                         struct net_device *netdev;
1547                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1548
1549                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1550                         if (!netdev) {
1551                                 rtnl_unlock();
1552                                 kfree(tb);
1553                                 return -ENODEV;
1554                         }
1555                         if (netdev->ieee80211_ptr) {
1556                                 dev = wiphy_to_dev(
1557                                         netdev->ieee80211_ptr->wiphy);
1558                                 filter_wiphy = dev->wiphy_idx;
1559                         }
1560                         dev_put(netdev);
1561                 }
1562         }
1563         kfree(tb);
1564
1565         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1566                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1567                         continue;
1568                 if (++idx <= start)
1569                         continue;
1570                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1571                         continue;
1572                 /* attempt to fit multiple wiphy data chunks into the skb */
1573                 do {
1574                         ret = nl80211_send_wiphy(dev, skb,
1575                                                  NETLINK_CB(cb->skb).portid,
1576                                                  cb->nlh->nlmsg_seq,
1577                                                  NLM_F_MULTI,
1578                                                  split, &cb->args[1],
1579                                                  &cb->args[2],
1580                                                  &cb->args[3]);
1581                         if (ret < 0) {
1582                                 /*
1583                                  * If sending the wiphy data didn't fit (ENOBUFS
1584                                  * or EMSGSIZE returned), this SKB is still
1585                                  * empty (so it's not too big because another
1586                                  * wiphy dataset is already in the skb) and
1587                                  * we've not tried to adjust the dump allocation
1588                                  * yet ... then adjust the alloc size to be
1589                                  * bigger, and return 1 but with the empty skb.
1590                                  * This results in an empty message being RX'ed
1591                                  * in userspace, but that is ignored.
1592                                  *
1593                                  * We can then retry with the larger buffer.
1594                                  */
1595                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1596                                     !skb->len &&
1597                                     cb->min_dump_alloc < 4096) {
1598                                         cb->min_dump_alloc = 4096;
1599                                         rtnl_unlock();
1600                                         return 1;
1601                                 }
1602                                 idx--;
1603                                 break;
1604                         }
1605                 } while (cb->args[1] > 0);
1606                 break;
1607         }
1608         rtnl_unlock();
1609
1610         cb->args[0] = idx;
1611
1612         return skb->len;
1613 }
1614
1615 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1616 {
1617         struct sk_buff *msg;
1618         struct cfg80211_registered_device *dev = info->user_ptr[0];
1619
1620         msg = nlmsg_new(4096, GFP_KERNEL);
1621         if (!msg)
1622                 return -ENOMEM;
1623
1624         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1625                                false, NULL, NULL, NULL) < 0) {
1626                 nlmsg_free(msg);
1627                 return -ENOBUFS;
1628         }
1629
1630         return genlmsg_reply(msg, info);
1631 }
1632
1633 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1634         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1635         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1636         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1637         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1638         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1639 };
1640
1641 static int parse_txq_params(struct nlattr *tb[],
1642                             struct ieee80211_txq_params *txq_params)
1643 {
1644         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1645             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1646             !tb[NL80211_TXQ_ATTR_AIFS])
1647                 return -EINVAL;
1648
1649         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1650         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1651         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1652         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1653         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1654
1655         if (txq_params->ac >= NL80211_NUM_ACS)
1656                 return -EINVAL;
1657
1658         return 0;
1659 }
1660
1661 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1662 {
1663         /*
1664          * You can only set the channel explicitly for WDS interfaces,
1665          * all others have their channel managed via their respective
1666          * "establish a connection" command (connect, join, ...)
1667          *
1668          * For AP/GO and mesh mode, the channel can be set with the
1669          * channel userspace API, but is only stored and passed to the
1670          * low-level driver when the AP starts or the mesh is joined.
1671          * This is for backward compatibility, userspace can also give
1672          * the channel in the start-ap or join-mesh commands instead.
1673          *
1674          * Monitors are special as they are normally slaved to
1675          * whatever else is going on, so they have their own special
1676          * operation to set the monitor channel if possible.
1677          */
1678         return !wdev ||
1679                 wdev->iftype == NL80211_IFTYPE_AP ||
1680                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1681                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1682                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1683 }
1684
1685 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1686                                  struct genl_info *info,
1687                                  struct cfg80211_chan_def *chandef)
1688 {
1689         u32 control_freq;
1690
1691         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1692                 return -EINVAL;
1693
1694         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1695
1696         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1697         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1698         chandef->center_freq1 = control_freq;
1699         chandef->center_freq2 = 0;
1700
1701         /* Primary channel not allowed */
1702         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1703                 return -EINVAL;
1704
1705         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1706                 enum nl80211_channel_type chantype;
1707
1708                 chantype = nla_get_u32(
1709                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1710
1711                 switch (chantype) {
1712                 case NL80211_CHAN_NO_HT:
1713                 case NL80211_CHAN_HT20:
1714                 case NL80211_CHAN_HT40PLUS:
1715                 case NL80211_CHAN_HT40MINUS:
1716                         cfg80211_chandef_create(chandef, chandef->chan,
1717                                                 chantype);
1718                         break;
1719                 default:
1720                         return -EINVAL;
1721                 }
1722         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1723                 chandef->width =
1724                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1725                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1726                         chandef->center_freq1 =
1727                                 nla_get_u32(
1728                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1729                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1730                         chandef->center_freq2 =
1731                                 nla_get_u32(
1732                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1733         }
1734
1735         if (!cfg80211_chandef_valid(chandef))
1736                 return -EINVAL;
1737
1738         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1739                                      IEEE80211_CHAN_DISABLED))
1740                 return -EINVAL;
1741
1742         return 0;
1743 }
1744
1745 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1746                                  struct wireless_dev *wdev,
1747                                  struct genl_info *info)
1748 {
1749         struct cfg80211_chan_def chandef;
1750         int result;
1751         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1752
1753         if (wdev)
1754                 iftype = wdev->iftype;
1755
1756         if (!nl80211_can_set_dev_channel(wdev))
1757                 return -EOPNOTSUPP;
1758
1759         result = nl80211_parse_chandef(rdev, info, &chandef);
1760         if (result)
1761                 return result;
1762
1763         switch (iftype) {
1764         case NL80211_IFTYPE_AP:
1765         case NL80211_IFTYPE_P2P_GO:
1766                 if (wdev->beacon_interval) {
1767                         result = -EBUSY;
1768                         break;
1769                 }
1770                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1771                         result = -EINVAL;
1772                         break;
1773                 }
1774                 wdev->preset_chandef = chandef;
1775                 result = 0;
1776                 break;
1777         case NL80211_IFTYPE_MESH_POINT:
1778                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1779                 break;
1780         case NL80211_IFTYPE_MONITOR:
1781                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1782                 break;
1783         default:
1784                 result = -EINVAL;
1785         }
1786
1787         return result;
1788 }
1789
1790 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1791 {
1792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1793         struct net_device *netdev = info->user_ptr[1];
1794
1795         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1796 }
1797
1798 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1799 {
1800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1801         struct net_device *dev = info->user_ptr[1];
1802         struct wireless_dev *wdev = dev->ieee80211_ptr;
1803         const u8 *bssid;
1804
1805         if (!info->attrs[NL80211_ATTR_MAC])
1806                 return -EINVAL;
1807
1808         if (netif_running(dev))
1809                 return -EBUSY;
1810
1811         if (!rdev->ops->set_wds_peer)
1812                 return -EOPNOTSUPP;
1813
1814         if (wdev->iftype != NL80211_IFTYPE_WDS)
1815                 return -EOPNOTSUPP;
1816
1817         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1818         return rdev_set_wds_peer(rdev, dev, bssid);
1819 }
1820
1821
1822 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1823 {
1824         struct cfg80211_registered_device *rdev;
1825         struct net_device *netdev = NULL;
1826         struct wireless_dev *wdev;
1827         int result = 0, rem_txq_params = 0;
1828         struct nlattr *nl_txq_params;
1829         u32 changed;
1830         u8 retry_short = 0, retry_long = 0;
1831         u32 frag_threshold = 0, rts_threshold = 0;
1832         u8 coverage_class = 0;
1833
1834         ASSERT_RTNL();
1835
1836         /*
1837          * Try to find the wiphy and netdev. Normally this
1838          * function shouldn't need the netdev, but this is
1839          * done for backward compatibility -- previously
1840          * setting the channel was done per wiphy, but now
1841          * it is per netdev. Previous userland like hostapd
1842          * also passed a netdev to set_wiphy, so that it is
1843          * possible to let that go to the right netdev!
1844          */
1845
1846         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1847                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1848
1849                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1850                 if (netdev && netdev->ieee80211_ptr)
1851                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1852                 else
1853                         netdev = NULL;
1854         }
1855
1856         if (!netdev) {
1857                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1858                                                   info->attrs);
1859                 if (IS_ERR(rdev))
1860                         return PTR_ERR(rdev);
1861                 wdev = NULL;
1862                 netdev = NULL;
1863                 result = 0;
1864         } else
1865                 wdev = netdev->ieee80211_ptr;
1866
1867         /*
1868          * end workaround code, by now the rdev is available
1869          * and locked, and wdev may or may not be NULL.
1870          */
1871
1872         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1873                 result = cfg80211_dev_rename(
1874                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1875
1876         if (result)
1877                 goto bad_res;
1878
1879         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1880                 struct ieee80211_txq_params txq_params;
1881                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1882
1883                 if (!rdev->ops->set_txq_params) {
1884                         result = -EOPNOTSUPP;
1885                         goto bad_res;
1886                 }
1887
1888                 if (!netdev) {
1889                         result = -EINVAL;
1890                         goto bad_res;
1891                 }
1892
1893                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1894                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1895                         result = -EINVAL;
1896                         goto bad_res;
1897                 }
1898
1899                 if (!netif_running(netdev)) {
1900                         result = -ENETDOWN;
1901                         goto bad_res;
1902                 }
1903
1904                 nla_for_each_nested(nl_txq_params,
1905                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1906                                     rem_txq_params) {
1907                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1908                                   nla_data(nl_txq_params),
1909                                   nla_len(nl_txq_params),
1910                                   txq_params_policy);
1911                         result = parse_txq_params(tb, &txq_params);
1912                         if (result)
1913                                 goto bad_res;
1914
1915                         result = rdev_set_txq_params(rdev, netdev,
1916                                                      &txq_params);
1917                         if (result)
1918                                 goto bad_res;
1919                 }
1920         }
1921
1922         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1923                 result = __nl80211_set_channel(rdev,
1924                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1925                                 info);
1926                 if (result)
1927                         goto bad_res;
1928         }
1929
1930         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1931                 struct wireless_dev *txp_wdev = wdev;
1932                 enum nl80211_tx_power_setting type;
1933                 int idx, mbm = 0;
1934
1935                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1936                         txp_wdev = NULL;
1937
1938                 if (!rdev->ops->set_tx_power) {
1939                         result = -EOPNOTSUPP;
1940                         goto bad_res;
1941                 }
1942
1943                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1944                 type = nla_get_u32(info->attrs[idx]);
1945
1946                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1947                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1948                         result = -EINVAL;
1949                         goto bad_res;
1950                 }
1951
1952                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1953                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1954                         mbm = nla_get_u32(info->attrs[idx]);
1955                 }
1956
1957                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1958                 if (result)
1959                         goto bad_res;
1960         }
1961
1962         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1963             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1964                 u32 tx_ant, rx_ant;
1965                 if ((!rdev->wiphy.available_antennas_tx &&
1966                      !rdev->wiphy.available_antennas_rx) ||
1967                     !rdev->ops->set_antenna) {
1968                         result = -EOPNOTSUPP;
1969                         goto bad_res;
1970                 }
1971
1972                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1973                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1974
1975                 /* reject antenna configurations which don't match the
1976                  * available antenna masks, except for the "all" mask */
1977                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1978                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1979                         result = -EINVAL;
1980                         goto bad_res;
1981                 }
1982
1983                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1984                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1985
1986                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1987                 if (result)
1988                         goto bad_res;
1989         }
1990
1991         changed = 0;
1992
1993         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1994                 retry_short = nla_get_u8(
1995                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1996                 if (retry_short == 0) {
1997                         result = -EINVAL;
1998                         goto bad_res;
1999                 }
2000                 changed |= WIPHY_PARAM_RETRY_SHORT;
2001         }
2002
2003         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2004                 retry_long = nla_get_u8(
2005                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2006                 if (retry_long == 0) {
2007                         result = -EINVAL;
2008                         goto bad_res;
2009                 }
2010                 changed |= WIPHY_PARAM_RETRY_LONG;
2011         }
2012
2013         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2014                 frag_threshold = nla_get_u32(
2015                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2016                 if (frag_threshold < 256) {
2017                         result = -EINVAL;
2018                         goto bad_res;
2019                 }
2020                 if (frag_threshold != (u32) -1) {
2021                         /*
2022                          * Fragments (apart from the last one) are required to
2023                          * have even length. Make the fragmentation code
2024                          * simpler by stripping LSB should someone try to use
2025                          * odd threshold value.
2026                          */
2027                         frag_threshold &= ~0x1;
2028                 }
2029                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2030         }
2031
2032         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2033                 rts_threshold = nla_get_u32(
2034                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2035                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2036         }
2037
2038         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2039                 coverage_class = nla_get_u8(
2040                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2041                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2042         }
2043
2044         if (changed) {
2045                 u8 old_retry_short, old_retry_long;
2046                 u32 old_frag_threshold, old_rts_threshold;
2047                 u8 old_coverage_class;
2048
2049                 if (!rdev->ops->set_wiphy_params) {
2050                         result = -EOPNOTSUPP;
2051                         goto bad_res;
2052                 }
2053
2054                 old_retry_short = rdev->wiphy.retry_short;
2055                 old_retry_long = rdev->wiphy.retry_long;
2056                 old_frag_threshold = rdev->wiphy.frag_threshold;
2057                 old_rts_threshold = rdev->wiphy.rts_threshold;
2058                 old_coverage_class = rdev->wiphy.coverage_class;
2059
2060                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2061                         rdev->wiphy.retry_short = retry_short;
2062                 if (changed & WIPHY_PARAM_RETRY_LONG)
2063                         rdev->wiphy.retry_long = retry_long;
2064                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2065                         rdev->wiphy.frag_threshold = frag_threshold;
2066                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2067                         rdev->wiphy.rts_threshold = rts_threshold;
2068                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2069                         rdev->wiphy.coverage_class = coverage_class;
2070
2071                 result = rdev_set_wiphy_params(rdev, changed);
2072                 if (result) {
2073                         rdev->wiphy.retry_short = old_retry_short;
2074                         rdev->wiphy.retry_long = old_retry_long;
2075                         rdev->wiphy.frag_threshold = old_frag_threshold;
2076                         rdev->wiphy.rts_threshold = old_rts_threshold;
2077                         rdev->wiphy.coverage_class = old_coverage_class;
2078                 }
2079         }
2080
2081  bad_res:
2082         if (netdev)
2083                 dev_put(netdev);
2084         return result;
2085 }
2086
2087 static inline u64 wdev_id(struct wireless_dev *wdev)
2088 {
2089         return (u64)wdev->identifier |
2090                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2091 }
2092
2093 static int nl80211_send_chandef(struct sk_buff *msg,
2094                                  struct cfg80211_chan_def *chandef)
2095 {
2096         WARN_ON(!cfg80211_chandef_valid(chandef));
2097
2098         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2099                         chandef->chan->center_freq))
2100                 return -ENOBUFS;
2101         switch (chandef->width) {
2102         case NL80211_CHAN_WIDTH_20_NOHT:
2103         case NL80211_CHAN_WIDTH_20:
2104         case NL80211_CHAN_WIDTH_40:
2105                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2106                                 cfg80211_get_chandef_type(chandef)))
2107                         return -ENOBUFS;
2108                 break;
2109         default:
2110                 break;
2111         }
2112         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2113                 return -ENOBUFS;
2114         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2115                 return -ENOBUFS;
2116         if (chandef->center_freq2 &&
2117             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2118                 return -ENOBUFS;
2119         return 0;
2120 }
2121
2122 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2123                               struct cfg80211_registered_device *rdev,
2124                               struct wireless_dev *wdev)
2125 {
2126         struct net_device *dev = wdev->netdev;
2127         void *hdr;
2128
2129         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2130         if (!hdr)
2131                 return -1;
2132
2133         if (dev &&
2134             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2135              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2136                 goto nla_put_failure;
2137
2138         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2139             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2140             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2141             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2142             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2143                         rdev->devlist_generation ^
2144                         (cfg80211_rdev_list_generation << 2)))
2145                 goto nla_put_failure;
2146
2147         if (rdev->ops->get_channel) {
2148                 int ret;
2149                 struct cfg80211_chan_def chandef;
2150
2151                 ret = rdev_get_channel(rdev, wdev, &chandef);
2152                 if (ret == 0) {
2153                         if (nl80211_send_chandef(msg, &chandef))
2154                                 goto nla_put_failure;
2155                 }
2156         }
2157
2158         if (wdev->ssid_len) {
2159                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2160                         goto nla_put_failure;
2161         }
2162
2163         return genlmsg_end(msg, hdr);
2164
2165  nla_put_failure:
2166         genlmsg_cancel(msg, hdr);
2167         return -EMSGSIZE;
2168 }
2169
2170 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2171 {
2172         int wp_idx = 0;
2173         int if_idx = 0;
2174         int wp_start = cb->args[0];
2175         int if_start = cb->args[1];
2176         struct cfg80211_registered_device *rdev;
2177         struct wireless_dev *wdev;
2178
2179         rtnl_lock();
2180         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2181                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2182                         continue;
2183                 if (wp_idx < wp_start) {
2184                         wp_idx++;
2185                         continue;
2186                 }
2187                 if_idx = 0;
2188
2189                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2190                         if (if_idx < if_start) {
2191                                 if_idx++;
2192                                 continue;
2193                         }
2194                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2195                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2196                                                rdev, wdev) < 0) {
2197                                 goto out;
2198                         }
2199                         if_idx++;
2200                 }
2201
2202                 wp_idx++;
2203         }
2204  out:
2205         rtnl_unlock();
2206
2207         cb->args[0] = wp_idx;
2208         cb->args[1] = if_idx;
2209
2210         return skb->len;
2211 }
2212
2213 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2214 {
2215         struct sk_buff *msg;
2216         struct cfg80211_registered_device *dev = info->user_ptr[0];
2217         struct wireless_dev *wdev = info->user_ptr[1];
2218
2219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2220         if (!msg)
2221                 return -ENOMEM;
2222
2223         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2224                                dev, wdev) < 0) {
2225                 nlmsg_free(msg);
2226                 return -ENOBUFS;
2227         }
2228
2229         return genlmsg_reply(msg, info);
2230 }
2231
2232 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2233         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2234         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2235         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2236         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2237         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2238         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2239 };
2240
2241 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2242 {
2243         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2244         int flag;
2245
2246         *mntrflags = 0;
2247
2248         if (!nla)
2249                 return -EINVAL;
2250
2251         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2252                              nla, mntr_flags_policy))
2253                 return -EINVAL;
2254
2255         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2256                 if (flags[flag])
2257                         *mntrflags |= (1<<flag);
2258
2259         return 0;
2260 }
2261
2262 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2263                                struct net_device *netdev, u8 use_4addr,
2264                                enum nl80211_iftype iftype)
2265 {
2266         if (!use_4addr) {
2267                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2268                         return -EBUSY;
2269                 return 0;
2270         }
2271
2272         switch (iftype) {
2273         case NL80211_IFTYPE_AP_VLAN:
2274                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2275                         return 0;
2276                 break;
2277         case NL80211_IFTYPE_STATION:
2278                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2279                         return 0;
2280                 break;
2281         default:
2282                 break;
2283         }
2284
2285         return -EOPNOTSUPP;
2286 }
2287
2288 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2289 {
2290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2291         struct vif_params params;
2292         int err;
2293         enum nl80211_iftype otype, ntype;
2294         struct net_device *dev = info->user_ptr[1];
2295         u32 _flags, *flags = NULL;
2296         bool change = false;
2297
2298         memset(&params, 0, sizeof(params));
2299
2300         otype = ntype = dev->ieee80211_ptr->iftype;
2301
2302         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2303                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2304                 if (otype != ntype)
2305                         change = true;
2306                 if (ntype > NL80211_IFTYPE_MAX)
2307                         return -EINVAL;
2308         }
2309
2310         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2311                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2312
2313                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2314                         return -EINVAL;
2315                 if (netif_running(dev))
2316                         return -EBUSY;
2317
2318                 wdev_lock(wdev);
2319                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2320                              IEEE80211_MAX_MESH_ID_LEN);
2321                 wdev->mesh_id_up_len =
2322                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2323                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2324                        wdev->mesh_id_up_len);
2325                 wdev_unlock(wdev);
2326         }
2327
2328         if (info->attrs[NL80211_ATTR_4ADDR]) {
2329                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2330                 change = true;
2331                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2332                 if (err)
2333                         return err;
2334         } else {
2335                 params.use_4addr = -1;
2336         }
2337
2338         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2339                 if (ntype != NL80211_IFTYPE_MONITOR)
2340                         return -EINVAL;
2341                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2342                                           &_flags);
2343                 if (err)
2344                         return err;
2345
2346                 flags = &_flags;
2347                 change = true;
2348         }
2349
2350         if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
2351             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2352                 return -EOPNOTSUPP;
2353
2354         if (change)
2355                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2356         else
2357                 err = 0;
2358
2359         if (!err && params.use_4addr != -1)
2360                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2361
2362         return err;
2363 }
2364
2365 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2366 {
2367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2368         struct vif_params params;
2369         struct wireless_dev *wdev;
2370         struct sk_buff *msg;
2371         int err;
2372         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2373         u32 flags;
2374
2375         memset(&params, 0, sizeof(params));
2376
2377         if (!info->attrs[NL80211_ATTR_IFNAME])
2378                 return -EINVAL;
2379
2380         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2381                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2382                 if (type > NL80211_IFTYPE_MAX)
2383                         return -EINVAL;
2384         }
2385
2386         if (!rdev->ops->add_virtual_intf ||
2387             !(rdev->wiphy.interface_modes & (1 << type)))
2388                 return -EOPNOTSUPP;
2389
2390         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2391                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2392                            ETH_ALEN);
2393                 if (!is_valid_ether_addr(params.macaddr))
2394                         return -EADDRNOTAVAIL;
2395         }
2396
2397         if (info->attrs[NL80211_ATTR_4ADDR]) {
2398                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2399                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2400                 if (err)
2401                         return err;
2402         }
2403
2404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2405         if (!msg)
2406                 return -ENOMEM;
2407
2408         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2409                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2410                                   &flags);
2411
2412         if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
2413             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2414                 return -EOPNOTSUPP;
2415
2416         wdev = rdev_add_virtual_intf(rdev,
2417                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2418                                 type, err ? NULL : &flags, &params);
2419         if (IS_ERR(wdev)) {
2420                 nlmsg_free(msg);
2421                 return PTR_ERR(wdev);
2422         }
2423
2424         switch (type) {
2425         case NL80211_IFTYPE_MESH_POINT:
2426                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2427                         break;
2428                 wdev_lock(wdev);
2429                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2430                              IEEE80211_MAX_MESH_ID_LEN);
2431                 wdev->mesh_id_up_len =
2432                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2433                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2434                        wdev->mesh_id_up_len);
2435                 wdev_unlock(wdev);
2436                 break;
2437         case NL80211_IFTYPE_P2P_DEVICE:
2438                 /*
2439                  * P2P Device doesn't have a netdev, so doesn't go
2440                  * through the netdev notifier and must be added here
2441                  */
2442                 mutex_init(&wdev->mtx);
2443                 INIT_LIST_HEAD(&wdev->event_list);
2444                 spin_lock_init(&wdev->event_lock);
2445                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2446                 spin_lock_init(&wdev->mgmt_registrations_lock);
2447
2448                 wdev->identifier = ++rdev->wdev_id;
2449                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2450                 rdev->devlist_generation++;
2451                 break;
2452         default:
2453                 break;
2454         }
2455
2456         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2457                                rdev, wdev) < 0) {
2458                 nlmsg_free(msg);
2459                 return -ENOBUFS;
2460         }
2461
2462         return genlmsg_reply(msg, info);
2463 }
2464
2465 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2466 {
2467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2468         struct wireless_dev *wdev = info->user_ptr[1];
2469
2470         if (!rdev->ops->del_virtual_intf)
2471                 return -EOPNOTSUPP;
2472
2473         /*
2474          * If we remove a wireless device without a netdev then clear
2475          * user_ptr[1] so that nl80211_post_doit won't dereference it
2476          * to check if it needs to do dev_put(). Otherwise it crashes
2477          * since the wdev has been freed, unlike with a netdev where
2478          * we need the dev_put() for the netdev to really be freed.
2479          */
2480         if (!wdev->netdev)
2481                 info->user_ptr[1] = NULL;
2482
2483         return rdev_del_virtual_intf(rdev, wdev);
2484 }
2485
2486 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2487 {
2488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2489         struct net_device *dev = info->user_ptr[1];
2490         u16 noack_map;
2491
2492         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2493                 return -EINVAL;
2494
2495         if (!rdev->ops->set_noack_map)
2496                 return -EOPNOTSUPP;
2497
2498         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2499
2500         return rdev_set_noack_map(rdev, dev, noack_map);
2501 }
2502
2503 struct get_key_cookie {
2504         struct sk_buff *msg;
2505         int error;
2506         int idx;
2507 };
2508
2509 static void get_key_callback(void *c, struct key_params *params)
2510 {
2511         struct nlattr *key;
2512         struct get_key_cookie *cookie = c;
2513
2514         if ((params->key &&
2515              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2516                      params->key_len, params->key)) ||
2517             (params->seq &&
2518              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2519                      params->seq_len, params->seq)) ||
2520             (params->cipher &&
2521              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2522                          params->cipher)))
2523                 goto nla_put_failure;
2524
2525         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2526         if (!key)
2527                 goto nla_put_failure;
2528
2529         if ((params->key &&
2530              nla_put(cookie->msg, NL80211_KEY_DATA,
2531                      params->key_len, params->key)) ||
2532             (params->seq &&
2533              nla_put(cookie->msg, NL80211_KEY_SEQ,
2534                      params->seq_len, params->seq)) ||
2535             (params->cipher &&
2536              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2537                          params->cipher)))
2538                 goto nla_put_failure;
2539
2540         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2541                 goto nla_put_failure;
2542
2543         nla_nest_end(cookie->msg, key);
2544
2545         return;
2546  nla_put_failure:
2547         cookie->error = 1;
2548 }
2549
2550 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2551 {
2552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2553         int err;
2554         struct net_device *dev = info->user_ptr[1];
2555         u8 key_idx = 0;
2556         const u8 *mac_addr = NULL;
2557         bool pairwise;
2558         struct get_key_cookie cookie = {
2559                 .error = 0,
2560         };
2561         void *hdr;
2562         struct sk_buff *msg;
2563
2564         if (info->attrs[NL80211_ATTR_KEY_IDX])
2565                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2566
2567         if (key_idx > 5)
2568                 return -EINVAL;
2569
2570         if (info->attrs[NL80211_ATTR_MAC])
2571                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2572
2573         pairwise = !!mac_addr;
2574         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2575                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2576                 if (kt >= NUM_NL80211_KEYTYPES)
2577                         return -EINVAL;
2578                 if (kt != NL80211_KEYTYPE_GROUP &&
2579                     kt != NL80211_KEYTYPE_PAIRWISE)
2580                         return -EINVAL;
2581                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2582         }
2583
2584         if (!rdev->ops->get_key)
2585                 return -EOPNOTSUPP;
2586
2587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2588         if (!msg)
2589                 return -ENOMEM;
2590
2591         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2592                              NL80211_CMD_NEW_KEY);
2593         if (IS_ERR(hdr))
2594                 return PTR_ERR(hdr);
2595
2596         cookie.msg = msg;
2597         cookie.idx = key_idx;
2598
2599         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2600             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2601                 goto nla_put_failure;
2602         if (mac_addr &&
2603             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2604                 goto nla_put_failure;
2605
2606         if (pairwise && mac_addr &&
2607             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2608                 return -ENOENT;
2609
2610         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2611                            get_key_callback);
2612
2613         if (err)
2614                 goto free_msg;
2615
2616         if (cookie.error)
2617                 goto nla_put_failure;
2618
2619         genlmsg_end(msg, hdr);
2620         return genlmsg_reply(msg, info);
2621
2622  nla_put_failure:
2623         err = -ENOBUFS;
2624  free_msg:
2625         nlmsg_free(msg);
2626         return err;
2627 }
2628
2629 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2630 {
2631         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2632         struct key_parse key;
2633         int err;
2634         struct net_device *dev = info->user_ptr[1];
2635
2636         err = nl80211_parse_key(info, &key);
2637         if (err)
2638                 return err;
2639
2640         if (key.idx < 0)
2641                 return -EINVAL;
2642
2643         /* only support setting default key */
2644         if (!key.def && !key.defmgmt)
2645                 return -EINVAL;
2646
2647         wdev_lock(dev->ieee80211_ptr);
2648
2649         if (key.def) {
2650                 if (!rdev->ops->set_default_key) {
2651                         err = -EOPNOTSUPP;
2652                         goto out;
2653                 }
2654
2655                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2656                 if (err)
2657                         goto out;
2658
2659                 err = rdev_set_default_key(rdev, dev, key.idx,
2660                                                  key.def_uni, key.def_multi);
2661
2662                 if (err)
2663                         goto out;
2664
2665 #ifdef CONFIG_CFG80211_WEXT
2666                 dev->ieee80211_ptr->wext.default_key = key.idx;
2667 #endif
2668         } else {
2669                 if (key.def_uni || !key.def_multi) {
2670                         err = -EINVAL;
2671                         goto out;
2672                 }
2673
2674                 if (!rdev->ops->set_default_mgmt_key) {
2675                         err = -EOPNOTSUPP;
2676                         goto out;
2677                 }
2678
2679                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2680                 if (err)
2681                         goto out;
2682
2683                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2684                 if (err)
2685                         goto out;
2686
2687 #ifdef CONFIG_CFG80211_WEXT
2688                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2689 #endif
2690         }
2691
2692  out:
2693         wdev_unlock(dev->ieee80211_ptr);
2694
2695         return err;
2696 }
2697
2698 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2699 {
2700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2701         int err;
2702         struct net_device *dev = info->user_ptr[1];
2703         struct key_parse key;
2704         const u8 *mac_addr = NULL;
2705
2706         err = nl80211_parse_key(info, &key);
2707         if (err)
2708                 return err;
2709
2710         if (!key.p.key)
2711                 return -EINVAL;
2712
2713         if (info->attrs[NL80211_ATTR_MAC])
2714                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2715
2716         if (key.type == -1) {
2717                 if (mac_addr)
2718                         key.type = NL80211_KEYTYPE_PAIRWISE;
2719                 else
2720                         key.type = NL80211_KEYTYPE_GROUP;
2721         }
2722
2723         /* for now */
2724         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2725             key.type != NL80211_KEYTYPE_GROUP)
2726                 return -EINVAL;
2727
2728         if (!rdev->ops->add_key)
2729                 return -EOPNOTSUPP;
2730
2731         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2732                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2733                                            mac_addr))
2734                 return -EINVAL;
2735
2736         wdev_lock(dev->ieee80211_ptr);
2737         err = nl80211_key_allowed(dev->ieee80211_ptr);
2738         if (!err)
2739                 err = rdev_add_key(rdev, dev, key.idx,
2740                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2741                                     mac_addr, &key.p);
2742         wdev_unlock(dev->ieee80211_ptr);
2743
2744         return err;
2745 }
2746
2747 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2748 {
2749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2750         int err;
2751         struct net_device *dev = info->user_ptr[1];
2752         u8 *mac_addr = NULL;
2753         struct key_parse key;
2754
2755         err = nl80211_parse_key(info, &key);
2756         if (err)
2757                 return err;
2758
2759         if (info->attrs[NL80211_ATTR_MAC])
2760                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2761
2762         if (key.type == -1) {
2763                 if (mac_addr)
2764                         key.type = NL80211_KEYTYPE_PAIRWISE;
2765                 else
2766                         key.type = NL80211_KEYTYPE_GROUP;
2767         }
2768
2769         /* for now */
2770         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2771             key.type != NL80211_KEYTYPE_GROUP)
2772                 return -EINVAL;
2773
2774         if (!rdev->ops->del_key)
2775                 return -EOPNOTSUPP;
2776
2777         wdev_lock(dev->ieee80211_ptr);
2778         err = nl80211_key_allowed(dev->ieee80211_ptr);
2779
2780         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2781             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2782                 err = -ENOENT;
2783
2784         if (!err)
2785                 err = rdev_del_key(rdev, dev, key.idx,
2786                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2787                                    mac_addr);
2788
2789 #ifdef CONFIG_CFG80211_WEXT
2790         if (!err) {
2791                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2792                         dev->ieee80211_ptr->wext.default_key = -1;
2793                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2794                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2795         }
2796 #endif
2797         wdev_unlock(dev->ieee80211_ptr);
2798
2799         return err;
2800 }
2801
2802 /* This function returns an error or the number of nested attributes */
2803 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2804 {
2805         struct nlattr *attr;
2806         int n_entries = 0, tmp;
2807
2808         nla_for_each_nested(attr, nl_attr, tmp) {
2809                 if (nla_len(attr) != ETH_ALEN)
2810                         return -EINVAL;
2811
2812                 n_entries++;
2813         }
2814
2815         return n_entries;
2816 }
2817
2818 /*
2819  * This function parses ACL information and allocates memory for ACL data.
2820  * On successful return, the calling function is responsible to free the
2821  * ACL buffer returned by this function.
2822  */
2823 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2824                                                 struct genl_info *info)
2825 {
2826         enum nl80211_acl_policy acl_policy;
2827         struct nlattr *attr;
2828         struct cfg80211_acl_data *acl;
2829         int i = 0, n_entries, tmp;
2830
2831         if (!wiphy->max_acl_mac_addrs)
2832                 return ERR_PTR(-EOPNOTSUPP);
2833
2834         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2835                 return ERR_PTR(-EINVAL);
2836
2837         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2838         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2839             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2840                 return ERR_PTR(-EINVAL);
2841
2842         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2843                 return ERR_PTR(-EINVAL);
2844
2845         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2846         if (n_entries < 0)
2847                 return ERR_PTR(n_entries);
2848
2849         if (n_entries > wiphy->max_acl_mac_addrs)
2850                 return ERR_PTR(-ENOTSUPP);
2851
2852         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2853                       GFP_KERNEL);
2854         if (!acl)
2855                 return ERR_PTR(-ENOMEM);
2856
2857         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2858                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2859                 i++;
2860         }
2861
2862         acl->n_acl_entries = n_entries;
2863         acl->acl_policy = acl_policy;
2864
2865         return acl;
2866 }
2867
2868 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2869 {
2870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2871         struct net_device *dev = info->user_ptr[1];
2872         struct cfg80211_acl_data *acl;
2873         int err;
2874
2875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2876             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2877                 return -EOPNOTSUPP;
2878
2879         if (!dev->ieee80211_ptr->beacon_interval)
2880                 return -EINVAL;
2881
2882         acl = parse_acl_data(&rdev->wiphy, info);
2883         if (IS_ERR(acl))
2884                 return PTR_ERR(acl);
2885
2886         err = rdev_set_mac_acl(rdev, dev, acl);
2887
2888         kfree(acl);
2889
2890         return err;
2891 }
2892
2893 static int nl80211_parse_beacon(struct genl_info *info,
2894                                 struct cfg80211_beacon_data *bcn)
2895 {
2896         bool haveinfo = false;
2897
2898         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2899             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2900             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2901             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2902                 return -EINVAL;
2903
2904         memset(bcn, 0, sizeof(*bcn));
2905
2906         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2907                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2908                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2909                 if (!bcn->head_len)
2910                         return -EINVAL;
2911                 haveinfo = true;
2912         }
2913
2914         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2915                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2916                 bcn->tail_len =
2917                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2918                 haveinfo = true;
2919         }
2920
2921         if (!haveinfo)
2922                 return -EINVAL;
2923
2924         if (info->attrs[NL80211_ATTR_IE]) {
2925                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2926                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2927         }
2928
2929         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2930                 bcn->proberesp_ies =
2931                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2932                 bcn->proberesp_ies_len =
2933                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2934         }
2935
2936         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2937                 bcn->assocresp_ies =
2938                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2939                 bcn->assocresp_ies_len =
2940                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2941         }
2942
2943         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2944                 bcn->probe_resp =
2945                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2946                 bcn->probe_resp_len =
2947                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2948         }
2949
2950         return 0;
2951 }
2952
2953 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2954                                    struct cfg80211_ap_settings *params)
2955 {
2956         struct wireless_dev *wdev;
2957         bool ret = false;
2958
2959         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2960                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2961                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2962                         continue;
2963
2964                 if (!wdev->preset_chandef.chan)
2965                         continue;
2966
2967                 params->chandef = wdev->preset_chandef;
2968                 ret = true;
2969                 break;
2970         }
2971
2972         return ret;
2973 }
2974
2975 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2976                                     enum nl80211_auth_type auth_type,
2977                                     enum nl80211_commands cmd)
2978 {
2979         if (auth_type > NL80211_AUTHTYPE_MAX)
2980                 return false;
2981
2982         switch (cmd) {
2983         case NL80211_CMD_AUTHENTICATE:
2984                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2985                     auth_type == NL80211_AUTHTYPE_SAE)
2986                         return false;
2987                 return true;
2988         case NL80211_CMD_CONNECT:
2989         case NL80211_CMD_START_AP:
2990                 /* SAE not supported yet */
2991                 if (auth_type == NL80211_AUTHTYPE_SAE)
2992                         return false;
2993                 return true;
2994         default:
2995                 return false;
2996         }
2997 }
2998
2999 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3000 {
3001         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3002         struct net_device *dev = info->user_ptr[1];
3003         struct wireless_dev *wdev = dev->ieee80211_ptr;
3004         struct cfg80211_ap_settings params;
3005         int err;
3006         u8 radar_detect_width = 0;
3007
3008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3009             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3010                 return -EOPNOTSUPP;
3011
3012         if (!rdev->ops->start_ap)
3013                 return -EOPNOTSUPP;
3014
3015         if (wdev->beacon_interval)
3016                 return -EALREADY;
3017
3018         memset(&params, 0, sizeof(params));
3019
3020         /* these are required for START_AP */
3021         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3022             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3023             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3024                 return -EINVAL;
3025
3026         err = nl80211_parse_beacon(info, &params.beacon);
3027         if (err)
3028                 return err;
3029
3030         params.beacon_interval =
3031                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3032         params.dtim_period =
3033                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3034
3035         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3036         if (err)
3037                 return err;
3038
3039         /*
3040          * In theory, some of these attributes should be required here
3041          * but since they were not used when the command was originally
3042          * added, keep them optional for old user space programs to let
3043          * them continue to work with drivers that do not need the
3044          * additional information -- drivers must check!
3045          */
3046         if (info->attrs[NL80211_ATTR_SSID]) {
3047                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3048                 params.ssid_len =
3049                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3050                 if (params.ssid_len == 0 ||
3051                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3052                         return -EINVAL;
3053         }
3054
3055         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3056                 params.hidden_ssid = nla_get_u32(
3057                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3058                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3059                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3060                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3061                         return -EINVAL;
3062         }
3063
3064         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3065
3066         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3067                 params.auth_type = nla_get_u32(
3068                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3069                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3070                                              NL80211_CMD_START_AP))
3071                         return -EINVAL;
3072         } else
3073                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3074
3075         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3076                                       NL80211_MAX_NR_CIPHER_SUITES);
3077         if (err)
3078                 return err;
3079
3080         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3081                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3082                         return -EOPNOTSUPP;
3083                 params.inactivity_timeout = nla_get_u16(
3084                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3085         }
3086
3087         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3088                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3089                         return -EINVAL;
3090                 params.p2p_ctwindow =
3091                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3092                 if (params.p2p_ctwindow > 127)
3093                         return -EINVAL;
3094                 if (params.p2p_ctwindow != 0 &&
3095                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3096                         return -EINVAL;
3097         }
3098
3099         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3100                 u8 tmp;
3101
3102                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3103                         return -EINVAL;
3104                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3105                 if (tmp > 1)
3106                         return -EINVAL;
3107                 params.p2p_opp_ps = tmp;
3108                 if (params.p2p_opp_ps != 0 &&
3109                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3110                         return -EINVAL;
3111         }
3112
3113         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3114                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3115                 if (err)
3116                         return err;
3117         } else if (wdev->preset_chandef.chan) {
3118                 params.chandef = wdev->preset_chandef;
3119         } else if (!nl80211_get_ap_channel(rdev, &params))
3120                 return -EINVAL;
3121
3122         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3123                 return -EINVAL;
3124
3125         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3126         if (err < 0)
3127                 return err;
3128         if (err) {
3129                 radar_detect_width = BIT(params.chandef.width);
3130                 params.radar_required = true;
3131         }
3132
3133         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3134                                            params.chandef.chan,
3135                                            CHAN_MODE_SHARED,
3136                                            radar_detect_width);
3137         if (err)
3138                 return err;
3139
3140         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3141                 params.acl = parse_acl_data(&rdev->wiphy, info);
3142                 if (IS_ERR(params.acl))
3143                         return PTR_ERR(params.acl);
3144         }
3145
3146         err = rdev_start_ap(rdev, dev, &params);
3147         if (!err) {
3148                 wdev->preset_chandef = params.chandef;
3149                 wdev->beacon_interval = params.beacon_interval;
3150                 wdev->channel = params.chandef.chan;
3151                 wdev->ssid_len = params.ssid_len;
3152                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3153         }
3154
3155         kfree(params.acl);
3156
3157         return err;
3158 }
3159
3160 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3161 {
3162         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3163         struct net_device *dev = info->user_ptr[1];
3164         struct wireless_dev *wdev = dev->ieee80211_ptr;
3165         struct cfg80211_beacon_data params;
3166         int err;
3167
3168         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3169             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3170                 return -EOPNOTSUPP;
3171
3172         if (!rdev->ops->change_beacon)
3173                 return -EOPNOTSUPP;
3174
3175         if (!wdev->beacon_interval)
3176                 return -EINVAL;
3177
3178         err = nl80211_parse_beacon(info, &params);
3179         if (err)
3180                 return err;
3181
3182         return rdev_change_beacon(rdev, dev, &params);
3183 }
3184
3185 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3186 {
3187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3188         struct net_device *dev = info->user_ptr[1];
3189
3190         return cfg80211_stop_ap(rdev, dev);
3191 }
3192
3193 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3194         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3195         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3196         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3197         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3198         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3199         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3200 };
3201
3202 static int parse_station_flags(struct genl_info *info,
3203                                enum nl80211_iftype iftype,
3204                                struct station_parameters *params)
3205 {
3206         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3207         struct nlattr *nla;
3208         int flag;
3209
3210         /*
3211          * Try parsing the new attribute first so userspace
3212          * can specify both for older kernels.
3213          */
3214         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3215         if (nla) {
3216                 struct nl80211_sta_flag_update *sta_flags;
3217
3218                 sta_flags = nla_data(nla);
3219                 params->sta_flags_mask = sta_flags->mask;
3220                 params->sta_flags_set = sta_flags->set;
3221                 params->sta_flags_set &= params->sta_flags_mask;
3222                 if ((params->sta_flags_mask |
3223                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3224                         return -EINVAL;
3225                 return 0;
3226         }
3227
3228         /* if present, parse the old attribute */
3229
3230         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3231         if (!nla)
3232                 return 0;
3233
3234         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3235                              nla, sta_flags_policy))
3236                 return -EINVAL;
3237
3238         /*
3239          * Only allow certain flags for interface types so that
3240          * other attributes are silently ignored. Remember that
3241          * this is backward compatibility code with old userspace
3242          * and shouldn't be hit in other cases anyway.
3243          */
3244         switch (iftype) {
3245         case NL80211_IFTYPE_AP:
3246         case NL80211_IFTYPE_AP_VLAN:
3247         case NL80211_IFTYPE_P2P_GO:
3248                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3249                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3250                                          BIT(NL80211_STA_FLAG_WME) |
3251                                          BIT(NL80211_STA_FLAG_MFP);
3252                 break;
3253         case NL80211_IFTYPE_P2P_CLIENT:
3254         case NL80211_IFTYPE_STATION:
3255                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3256                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3257                 break;
3258         case NL80211_IFTYPE_MESH_POINT:
3259                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3260                                          BIT(NL80211_STA_FLAG_MFP) |
3261                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3262         default:
3263                 return -EINVAL;
3264         }
3265
3266         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3267                 if (flags[flag]) {
3268                         params->sta_flags_set |= (1<<flag);
3269
3270                         /* no longer support new API additions in old API */
3271                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3272                                 return -EINVAL;
3273                 }
3274         }
3275
3276         return 0;
3277 }
3278
3279 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3280                                  int attr)
3281 {
3282         struct nlattr *rate;
3283         u32 bitrate;
3284         u16 bitrate_compat;
3285
3286         rate = nla_nest_start(msg, attr);
3287         if (!rate)
3288                 return false;
3289
3290         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3291         bitrate = cfg80211_calculate_bitrate(info);
3292         /* report 16-bit bitrate only if we can */
3293         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3294         if (bitrate > 0 &&
3295             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3296                 return false;
3297         if (bitrate_compat > 0 &&
3298             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3299                 return false;
3300
3301         if (info->flags & RATE_INFO_FLAGS_MCS) {
3302                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3303                         return false;
3304                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3305                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3306                         return false;
3307                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3308                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3309                         return false;
3310         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3311                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3312                         return false;
3313                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3314                         return false;
3315                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3316                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3317                         return false;
3318                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3319                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3320                         return false;
3321                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3322                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3323                         return false;
3324                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3325                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3326                         return false;
3327                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3328                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3329                         return false;
3330         }
3331
3332         nla_nest_end(msg, rate);
3333         return true;
3334 }
3335
3336 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3337                                int id)
3338 {
3339         void *attr;
3340         int i = 0;
3341
3342         if (!mask)
3343                 return true;
3344
3345         attr = nla_nest_start(msg, id);
3346         if (!attr)
3347                 return false;
3348
3349         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3350                 if (!(mask & BIT(i)))
3351                         continue;
3352
3353                 if (nla_put_u8(msg, i, signal[i]))
3354                         return false;
3355         }
3356
3357         nla_nest_end(msg, attr);
3358
3359         return true;
3360 }
3361
3362 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3363                                 int flags,
3364                                 struct cfg80211_registered_device *rdev,
3365                                 struct net_device *dev,
3366                                 const u8 *mac_addr, struct station_info *sinfo)
3367 {
3368         void *hdr;
3369         struct nlattr *sinfoattr, *bss_param;
3370
3371         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3372         if (!hdr)
3373                 return -1;
3374
3375         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3376             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3377             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3378                 goto nla_put_failure;
3379
3380         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3381         if (!sinfoattr)
3382                 goto nla_put_failure;
3383         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3384             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3385                         sinfo->connected_time))
3386                 goto nla_put_failure;
3387         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3388             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3389                         sinfo->inactive_time))
3390                 goto nla_put_failure;
3391         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3392                               STATION_INFO_RX_BYTES64)) &&
3393             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3394                         (u32)sinfo->rx_bytes))
3395                 goto nla_put_failure;
3396         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3397                               STATION_INFO_TX_BYTES64)) &&
3398             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3399                         (u32)sinfo->tx_bytes))
3400                 goto nla_put_failure;
3401         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3402             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3403                         sinfo->rx_bytes))
3404                 goto nla_put_failure;
3405         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3406             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3407                         sinfo->tx_bytes))
3408                 goto nla_put_failure;
3409         if ((sinfo->filled & STATION_INFO_LLID) &&
3410             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3411                 goto nla_put_failure;
3412         if ((sinfo->filled & STATION_INFO_PLID) &&
3413             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3414                 goto nla_put_failure;
3415         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3416             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3417                        sinfo->plink_state))
3418                 goto nla_put_failure;
3419         switch (rdev->wiphy.signal_type) {
3420         case CFG80211_SIGNAL_TYPE_MBM:
3421                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3422                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3423                                sinfo->signal))
3424                         goto nla_put_failure;
3425                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3426                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3427                                sinfo->signal_avg))
3428                         goto nla_put_failure;
3429                 break;
3430         default:
3431                 break;
3432         }
3433         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3434                 if (!nl80211_put_signal(msg, sinfo->chains,
3435                                         sinfo->chain_signal,
3436                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3437                         goto nla_put_failure;
3438         }
3439         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3440                 if (!nl80211_put_signal(msg, sinfo->chains,
3441                                         sinfo->chain_signal_avg,
3442                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3443                         goto nla_put_failure;
3444         }
3445         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3446                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3447                                           NL80211_STA_INFO_TX_BITRATE))
3448                         goto nla_put_failure;
3449         }
3450         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3451                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3452                                           NL80211_STA_INFO_RX_BITRATE))
3453                         goto nla_put_failure;
3454         }
3455         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3456             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3457                         sinfo->rx_packets))
3458                 goto nla_put_failure;
3459         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3460             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3461                         sinfo->tx_packets))
3462                 goto nla_put_failure;
3463         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3464             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3465                         sinfo->tx_retries))
3466                 goto nla_put_failure;
3467         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3468             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3469                         sinfo->tx_failed))
3470                 goto nla_put_failure;
3471         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3472             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3473                         sinfo->beacon_loss_count))
3474                 goto nla_put_failure;
3475         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3476             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3477                         sinfo->local_pm))
3478                 goto nla_put_failure;
3479         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3480             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3481                         sinfo->peer_pm))
3482                 goto nla_put_failure;
3483         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3484             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3485                         sinfo->nonpeer_pm))
3486                 goto nla_put_failure;
3487         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3488                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3489                 if (!bss_param)
3490                         goto nla_put_failure;
3491
3492                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3493                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3494                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3495                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3496                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3497                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3498                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3499                                sinfo->bss_param.dtim_period) ||
3500                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3501                                 sinfo->bss_param.beacon_interval))
3502                         goto nla_put_failure;
3503
3504                 nla_nest_end(msg, bss_param);
3505         }
3506         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3507             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3508                     sizeof(struct nl80211_sta_flag_update),
3509                     &sinfo->sta_flags))
3510                 goto nla_put_failure;
3511         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3512                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3513                             sinfo->t_offset))
3514                 goto nla_put_failure;
3515         nla_nest_end(msg, sinfoattr);
3516
3517         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3518             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3519                     sinfo->assoc_req_ies))
3520                 goto nla_put_failure;
3521
3522         return genlmsg_end(msg, hdr);
3523
3524  nla_put_failure:
3525         genlmsg_cancel(msg, hdr);
3526         return -EMSGSIZE;
3527 }
3528
3529 static int nl80211_dump_station(struct sk_buff *skb,
3530                                 struct netlink_callback *cb)
3531 {
3532         struct station_info sinfo;
3533         struct cfg80211_registered_device *dev;
3534         struct wireless_dev *wdev;
3535         u8 mac_addr[ETH_ALEN];
3536         int sta_idx = cb->args[2];
3537         int err;
3538
3539         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3540         if (err)
3541                 return err;
3542
3543         if (!wdev->netdev) {
3544                 err = -EINVAL;
3545                 goto out_err;
3546         }
3547
3548         if (!dev->ops->dump_station) {
3549                 err = -EOPNOTSUPP;
3550                 goto out_err;
3551         }
3552
3553         while (1) {
3554                 memset(&sinfo, 0, sizeof(sinfo));
3555                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3556                                         mac_addr, &sinfo);
3557                 if (err == -ENOENT)
3558                         break;
3559                 if (err)
3560                         goto out_err;
3561
3562                 if (nl80211_send_station(skb,
3563                                 NETLINK_CB(cb->skb).portid,
3564                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3565                                 dev, wdev->netdev, mac_addr,
3566                                 &sinfo) < 0)
3567                         goto out;
3568
3569                 sta_idx++;
3570         }
3571
3572
3573  out:
3574         cb->args[2] = sta_idx;
3575         err = skb->len;
3576  out_err:
3577         nl80211_finish_wdev_dump(dev);
3578
3579         return err;
3580 }
3581
3582 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3583 {
3584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3585         struct net_device *dev = info->user_ptr[1];
3586         struct station_info sinfo;
3587         struct sk_buff *msg;
3588         u8 *mac_addr = NULL;
3589         int err;
3590
3591         memset(&sinfo, 0, sizeof(sinfo));
3592
3593         if (!info->attrs[NL80211_ATTR_MAC])
3594                 return -EINVAL;
3595
3596         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3597
3598         if (!rdev->ops->get_station)
3599                 return -EOPNOTSUPP;
3600
3601         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3602         if (err)
3603                 return err;
3604
3605         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3606         if (!msg)
3607                 return -ENOMEM;
3608
3609         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3610                                  rdev, dev, mac_addr, &sinfo) < 0) {
3611                 nlmsg_free(msg);
3612                 return -ENOBUFS;
3613         }
3614
3615         return genlmsg_reply(msg, info);
3616 }
3617
3618 int cfg80211_check_station_change(struct wiphy *wiphy,
3619                                   struct station_parameters *params,
3620                                   enum cfg80211_station_type statype)
3621 {
3622         if (params->listen_interval != -1)
3623                 return -EINVAL;
3624         if (params->aid)
3625                 return -EINVAL;
3626
3627         /* When you run into this, adjust the code below for the new flag */
3628         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3629
3630         switch (statype) {
3631         case CFG80211_STA_MESH_PEER_KERNEL:
3632         case CFG80211_STA_MESH_PEER_USER:
3633                 /*
3634                  * No ignoring the TDLS flag here -- the userspace mesh
3635                  * code doesn't have the bug of including TDLS in the
3636                  * mask everywhere.
3637                  */
3638                 if (params->sta_flags_mask &
3639                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3640                                   BIT(NL80211_STA_FLAG_MFP) |
3641                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3642                         return -EINVAL;
3643                 break;
3644         case CFG80211_STA_TDLS_PEER_SETUP:
3645         case CFG80211_STA_TDLS_PEER_ACTIVE:
3646                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3647                         return -EINVAL;
3648                 /* ignore since it can't change */
3649                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3650                 break;
3651         default:
3652                 /* disallow mesh-specific things */
3653                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3654                         return -EINVAL;
3655                 if (params->local_pm)
3656                         return -EINVAL;
3657                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3658                         return -EINVAL;
3659         }
3660
3661         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3662             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3663                 /* TDLS can't be set, ... */
3664                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3665                         return -EINVAL;
3666                 /*
3667                  * ... but don't bother the driver with it. This works around
3668                  * a hostapd/wpa_supplicant issue -- it always includes the
3669                  * TLDS_PEER flag in the mask even for AP mode.
3670                  */
3671                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3672         }
3673
3674         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3675                 /* reject other things that can't change */
3676                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3677                         return -EINVAL;
3678                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3679                         return -EINVAL;
3680                 if (params->supported_rates)
3681                         return -EINVAL;
3682                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3683                         return -EINVAL;
3684         }
3685
3686         if (statype != CFG80211_STA_AP_CLIENT) {
3687                 if (params->vlan)
3688                         return -EINVAL;
3689         }
3690
3691         switch (statype) {
3692         case CFG80211_STA_AP_MLME_CLIENT:
3693                 /* Use this only for authorizing/unauthorizing a station */
3694                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3695                         return -EOPNOTSUPP;
3696                 break;
3697         case CFG80211_STA_AP_CLIENT:
3698                 /* accept only the listed bits */
3699                 if (params->sta_flags_mask &
3700                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3701                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3702                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3703                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3704                                   BIT(NL80211_STA_FLAG_WME) |
3705                                   BIT(NL80211_STA_FLAG_MFP)))
3706                         return -EINVAL;
3707
3708                 /* but authenticated/associated only if driver handles it */
3709                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3710                     params->sta_flags_mask &
3711                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3712                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3713                         return -EINVAL;
3714                 break;
3715         case CFG80211_STA_IBSS:
3716         case CFG80211_STA_AP_STA:
3717                 /* reject any changes other than AUTHORIZED */
3718                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3719                         return -EINVAL;
3720                 break;
3721         case CFG80211_STA_TDLS_PEER_SETUP:
3722                 /* reject any changes other than AUTHORIZED or WME */
3723                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3724                                                BIT(NL80211_STA_FLAG_WME)))
3725                         return -EINVAL;
3726                 /* force (at least) rates when authorizing */
3727                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3728                     !params->supported_rates)
3729                         return -EINVAL;
3730                 break;
3731         case CFG80211_STA_TDLS_PEER_ACTIVE:
3732                 /* reject any changes */
3733                 return -EINVAL;
3734         case CFG80211_STA_MESH_PEER_KERNEL:
3735                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3736                         return -EINVAL;
3737                 break;
3738         case CFG80211_STA_MESH_PEER_USER:
3739                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3740                         return -EINVAL;
3741                 break;
3742         }
3743
3744         return 0;
3745 }
3746 EXPORT_SYMBOL(cfg80211_check_station_change);
3747
3748 /*
3749  * Get vlan interface making sure it is running and on the right wiphy.
3750  */
3751 static struct net_device *get_vlan(struct genl_info *info,
3752                                    struct cfg80211_registered_device *rdev)
3753 {
3754         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3755         struct net_device *v;
3756         int ret;
3757
3758         if (!vlanattr)
3759                 return NULL;
3760
3761         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3762         if (!v)
3763                 return ERR_PTR(-ENODEV);
3764
3765         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3766                 ret = -EINVAL;
3767                 goto error;
3768         }
3769
3770         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3771             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3772             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3773                 ret = -EINVAL;
3774                 goto error;
3775         }
3776
3777         if (!netif_running(v)) {
3778                 ret = -ENETDOWN;
3779                 goto error;
3780         }
3781
3782         return v;
3783  error:
3784         dev_put(v);
3785         return ERR_PTR(ret);
3786 }
3787
3788 static struct nla_policy
3789 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3790         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3791         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3792 };
3793
3794 static int nl80211_parse_sta_wme(struct genl_info *info,
3795                                  struct station_parameters *params)
3796 {
3797         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3798         struct nlattr *nla;
3799         int err;
3800
3801         /* parse WME attributes if present */
3802         if (!info->attrs[NL80211_ATTR_STA_WME])
3803                 return 0;
3804
3805         nla = info->attrs[NL80211_ATTR_STA_WME];
3806         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3807                                nl80211_sta_wme_policy);
3808         if (err)
3809                 return err;
3810
3811         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3812                 params->uapsd_queues = nla_get_u8(
3813                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3814         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3815                 return -EINVAL;
3816
3817         if (tb[NL80211_STA_WME_MAX_SP])
3818                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3819
3820         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3821                 return -EINVAL;
3822
3823         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3824
3825         return 0;
3826 }
3827
3828 static int nl80211_set_station_tdls(struct genl_info *info,
3829                                     struct station_parameters *params)
3830 {
3831         /* Dummy STA entry gets updated once the peer capabilities are known */
3832         if (info->attrs[NL80211_ATTR_PEER_AID])
3833                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3834         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3835                 params->ht_capa =
3836                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3837         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3838                 params->vht_capa =
3839                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3840
3841         return nl80211_parse_sta_wme(info, params);
3842 }
3843
3844 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3845 {
3846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3847         struct net_device *dev = info->user_ptr[1];
3848         struct station_parameters params;
3849         u8 *mac_addr;
3850         int err;
3851
3852         memset(&params, 0, sizeof(params));
3853
3854         params.listen_interval = -1;
3855
3856         if (!rdev->ops->change_station)
3857                 return -EOPNOTSUPP;
3858
3859         if (info->attrs[NL80211_ATTR_STA_AID])
3860                 return -EINVAL;
3861
3862         if (!info->attrs[NL80211_ATTR_MAC])
3863                 return -EINVAL;
3864
3865         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3866
3867         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3868                 params.supported_rates =
3869                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3870                 params.supported_rates_len =
3871                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3872         }
3873
3874         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3875                 params.capability =
3876                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3877                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3878         }
3879
3880         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3881                 params.ext_capab =
3882                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3883                 params.ext_capab_len =
3884                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3885         }
3886
3887         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3888                 return -EINVAL;
3889
3890         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3891                 return -EINVAL;
3892
3893         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3894                 params.plink_action =
3895                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3896                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3897                         return -EINVAL;
3898         }
3899
3900         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3901                 params.plink_state =
3902                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3903                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3904                         return -EINVAL;
3905                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3906         }
3907
3908         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3909                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3910                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3911
3912                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3913                     pm > NL80211_MESH_POWER_MAX)
3914                         return -EINVAL;
3915
3916                 params.local_pm = pm;
3917         }
3918
3919         /* Include parameters for TDLS peer (will check later) */
3920         err = nl80211_set_station_tdls(info, &params);
3921         if (err)
3922                 return err;
3923
3924         params.vlan = get_vlan(info, rdev);
3925         if (IS_ERR(params.vlan))
3926                 return PTR_ERR(params.vlan);
3927
3928         switch (dev->ieee80211_ptr->iftype) {
3929         case NL80211_IFTYPE_AP:
3930         case NL80211_IFTYPE_AP_VLAN:
3931         case NL80211_IFTYPE_P2P_GO:
3932         case NL80211_IFTYPE_P2P_CLIENT:
3933         case NL80211_IFTYPE_STATION:
3934         case NL80211_IFTYPE_ADHOC:
3935         case NL80211_IFTYPE_MESH_POINT:
3936                 break;
3937         default:
3938                 err = -EOPNOTSUPP;
3939                 goto out_put_vlan;
3940         }
3941
3942         /* driver will call cfg80211_check_station_change() */
3943         err = rdev_change_station(rdev, dev, mac_addr, &params);
3944
3945  out_put_vlan:
3946         if (params.vlan)
3947                 dev_put(params.vlan);
3948
3949         return err;
3950 }
3951
3952 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3953 {
3954         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3955         int err;
3956         struct net_device *dev = info->user_ptr[1];
3957         struct station_parameters params;
3958         u8 *mac_addr = NULL;
3959
3960         memset(&params, 0, sizeof(params));
3961
3962         if (!rdev->ops->add_station)
3963                 return -EOPNOTSUPP;
3964
3965         if (!info->attrs[NL80211_ATTR_MAC])
3966                 return -EINVAL;
3967
3968         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3969                 return -EINVAL;
3970
3971         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3972                 return -EINVAL;
3973
3974         if (!info->attrs[NL80211_ATTR_STA_AID] &&
3975             !info->attrs[NL80211_ATTR_PEER_AID])
3976                 return -EINVAL;
3977
3978         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3979         params.supported_rates =
3980                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3981         params.supported_rates_len =
3982                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3983         params.listen_interval =
3984                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3985
3986         if (info->attrs[NL80211_ATTR_PEER_AID])
3987                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3988         else
3989                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3990         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3991                 return -EINVAL;
3992
3993         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3994                 params.capability =
3995                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3996                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3997         }
3998
3999         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4000                 params.ext_capab =
4001                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4002                 params.ext_capab_len =
4003                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4004         }
4005
4006         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4007                 params.ht_capa =
4008                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4009
4010         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4011                 params.vht_capa =
4012                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4013
4014         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4015                 params.plink_action =
4016                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4017                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4018                         return -EINVAL;
4019         }
4020
4021         err = nl80211_parse_sta_wme(info, &params);
4022         if (err)
4023                 return err;
4024
4025         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4026                 return -EINVAL;
4027
4028         /* When you run into this, adjust the code below for the new flag */
4029         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4030
4031         switch (dev->ieee80211_ptr->iftype) {
4032         case NL80211_IFTYPE_AP:
4033         case NL80211_IFTYPE_AP_VLAN:
4034         case NL80211_IFTYPE_P2P_GO:
4035                 /* ignore WME attributes if iface/sta is not capable */
4036                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4037                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4038                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4039
4040                 /* TDLS peers cannot be added */
4041                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4042                     info->attrs[NL80211_ATTR_PEER_AID])
4043                         return -EINVAL;
4044                 /* but don't bother the driver with it */
4045                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4046
4047                 /* allow authenticated/associated only if driver handles it */
4048                 if (!(rdev->wiphy.features &
4049                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4050                     params.sta_flags_mask &
4051                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4052                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4053                         return -EINVAL;
4054
4055                 /* must be last in here for error handling */
4056                 params.vlan = get_vlan(info, rdev);
4057                 if (IS_ERR(params.vlan))
4058                         return PTR_ERR(params.vlan);
4059                 break;
4060         case NL80211_IFTYPE_MESH_POINT:
4061                 /* ignore uAPSD data */
4062                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4063
4064                 /* associated is disallowed */
4065                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4066                         return -EINVAL;
4067                 /* TDLS peers cannot be added */
4068                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4069                     info->attrs[NL80211_ATTR_PEER_AID])
4070                         return -EINVAL;
4071                 break;
4072         case NL80211_IFTYPE_STATION:
4073         case NL80211_IFTYPE_P2P_CLIENT:
4074                 /* ignore uAPSD data */
4075                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4076
4077                 /* these are disallowed */
4078                 if (params.sta_flags_mask &
4079                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4080                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4081                         return -EINVAL;
4082                 /* Only TDLS peers can be added */
4083                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4084                         return -EINVAL;
4085                 /* Can only add if TDLS ... */
4086                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4087                         return -EOPNOTSUPP;
4088                 /* ... with external setup is supported */
4089                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4090                         return -EOPNOTSUPP;
4091                 /*
4092                  * Older wpa_supplicant versions always mark the TDLS peer
4093                  * as authorized, but it shouldn't yet be.
4094                  */
4095                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4096                 break;
4097         default:
4098                 return -EOPNOTSUPP;
4099         }
4100
4101         /* be aware of params.vlan when changing code here */
4102
4103         err = rdev_add_station(rdev, dev, mac_addr, &params);
4104
4105         if (params.vlan)
4106                 dev_put(params.vlan);
4107         return err;
4108 }
4109
4110 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4111 {
4112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4113         struct net_device *dev = info->user_ptr[1];
4114         u8 *mac_addr = NULL;
4115
4116         if (info->attrs[NL80211_ATTR_MAC])
4117                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4118
4119         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4120             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4121             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4122             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4123                 return -EINVAL;
4124
4125         if (!rdev->ops->del_station)
4126                 return -EOPNOTSUPP;
4127
4128         return rdev_del_station(rdev, dev, mac_addr);
4129 }
4130
4131 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4132                                 int flags, struct net_device *dev,
4133                                 u8 *dst, u8 *next_hop,
4134                                 struct mpath_info *pinfo)
4135 {
4136         void *hdr;
4137         struct nlattr *pinfoattr;
4138
4139         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4140         if (!hdr)
4141                 return -1;
4142
4143         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4144             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4145             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4146             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4147                 goto nla_put_failure;
4148
4149         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4150         if (!pinfoattr)
4151                 goto nla_put_failure;
4152         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4153             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4154                         pinfo->frame_qlen))
4155                 goto nla_put_failure;
4156         if (((pinfo->filled & MPATH_INFO_SN) &&
4157              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4158             ((pinfo->filled & MPATH_INFO_METRIC) &&
4159              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4160                          pinfo->metric)) ||
4161             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4162              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4163                          pinfo->exptime)) ||
4164             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4165              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4166                         pinfo->flags)) ||
4167             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4168              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4169                          pinfo->discovery_timeout)) ||
4170             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4171              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4172                         pinfo->discovery_retries)))
4173                 goto nla_put_failure;
4174
4175         nla_nest_end(msg, pinfoattr);
4176
4177         return genlmsg_end(msg, hdr);
4178
4179  nla_put_failure:
4180         genlmsg_cancel(msg, hdr);
4181         return -EMSGSIZE;
4182 }
4183
4184 static int nl80211_dump_mpath(struct sk_buff *skb,
4185                               struct netlink_callback *cb)
4186 {
4187         struct mpath_info pinfo;
4188         struct cfg80211_registered_device *dev;
4189         struct wireless_dev *wdev;
4190         u8 dst[ETH_ALEN];
4191         u8 next_hop[ETH_ALEN];
4192         int path_idx = cb->args[2];
4193         int err;
4194
4195         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4196         if (err)
4197                 return err;
4198
4199         if (!dev->ops->dump_mpath) {
4200                 err = -EOPNOTSUPP;
4201                 goto out_err;
4202         }
4203
4204         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4205                 err = -EOPNOTSUPP;
4206                 goto out_err;
4207         }
4208
4209         while (1) {
4210                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4211                                       next_hop, &pinfo);
4212                 if (err == -ENOENT)
4213                         break;
4214                 if (err)
4215                         goto out_err;
4216
4217                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4218                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4219                                        wdev->netdev, dst, next_hop,
4220                                        &pinfo) < 0)
4221                         goto out;
4222
4223                 path_idx++;
4224         }
4225
4226
4227  out:
4228         cb->args[2] = path_idx;
4229         err = skb->len;
4230  out_err:
4231         nl80211_finish_wdev_dump(dev);
4232         return err;
4233 }
4234
4235 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4236 {
4237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4238         int err;
4239         struct net_device *dev = info->user_ptr[1];
4240         struct mpath_info pinfo;
4241         struct sk_buff *msg;
4242         u8 *dst = NULL;
4243         u8 next_hop[ETH_ALEN];
4244
4245         memset(&pinfo, 0, sizeof(pinfo));
4246
4247         if (!info->attrs[NL80211_ATTR_MAC])
4248                 return -EINVAL;
4249
4250         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4251
4252         if (!rdev->ops->get_mpath)
4253                 return -EOPNOTSUPP;
4254
4255         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4256                 return -EOPNOTSUPP;
4257
4258         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4259         if (err)
4260                 return err;
4261
4262         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4263         if (!msg)
4264                 return -ENOMEM;
4265
4266         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4267                                  dev, dst, next_hop, &pinfo) < 0) {
4268                 nlmsg_free(msg);
4269                 return -ENOBUFS;
4270         }
4271
4272         return genlmsg_reply(msg, info);
4273 }
4274
4275 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4276 {
4277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4278         struct net_device *dev = info->user_ptr[1];
4279         u8 *dst = NULL;
4280         u8 *next_hop = NULL;
4281
4282         if (!info->attrs[NL80211_ATTR_MAC])
4283                 return -EINVAL;
4284
4285         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4286                 return -EINVAL;
4287
4288         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4289         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4290
4291         if (!rdev->ops->change_mpath)
4292                 return -EOPNOTSUPP;
4293
4294         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4295                 return -EOPNOTSUPP;
4296
4297         return rdev_change_mpath(rdev, dev, dst, next_hop);
4298 }
4299
4300 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4301 {
4302         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4303         struct net_device *dev = info->user_ptr[1];
4304         u8 *dst = NULL;
4305         u8 *next_hop = NULL;
4306
4307         if (!info->attrs[NL80211_ATTR_MAC])
4308                 return -EINVAL;
4309
4310         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4311                 return -EINVAL;
4312
4313         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4314         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4315
4316         if (!rdev->ops->add_mpath)
4317                 return -EOPNOTSUPP;
4318
4319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4320                 return -EOPNOTSUPP;
4321
4322         return rdev_add_mpath(rdev, dev, dst, next_hop);
4323 }
4324
4325 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4326 {
4327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4328         struct net_device *dev = info->user_ptr[1];
4329         u8 *dst = NULL;
4330
4331         if (info->attrs[NL80211_ATTR_MAC])
4332                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4333
4334         if (!rdev->ops->del_mpath)
4335                 return -EOPNOTSUPP;
4336
4337         return rdev_del_mpath(rdev, dev, dst);
4338 }
4339
4340 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4341 {
4342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4343         struct net_device *dev = info->user_ptr[1];
4344         struct bss_parameters params;
4345
4346         memset(&params, 0, sizeof(params));
4347         /* default to not changing parameters */
4348         params.use_cts_prot = -1;
4349         params.use_short_preamble = -1;
4350         params.use_short_slot_time = -1;
4351         params.ap_isolate = -1;
4352         params.ht_opmode = -1;
4353         params.p2p_ctwindow = -1;
4354         params.p2p_opp_ps = -1;
4355
4356         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4357                 params.use_cts_prot =
4358                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4359         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4360                 params.use_short_preamble =
4361                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4362         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4363                 params.use_short_slot_time =
4364                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4365         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4366                 params.basic_rates =
4367                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4368                 params.basic_rates_len =
4369                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4370         }
4371         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4372                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4373         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4374                 params.ht_opmode =
4375                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4376
4377         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4378                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4379                         return -EINVAL;
4380                 params.p2p_ctwindow =
4381                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4382                 if (params.p2p_ctwindow < 0)
4383                         return -EINVAL;
4384                 if (params.p2p_ctwindow != 0 &&
4385                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4386                         return -EINVAL;
4387         }
4388
4389         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4390                 u8 tmp;
4391
4392                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4393                         return -EINVAL;
4394                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4395                 if (tmp > 1)
4396                         return -EINVAL;
4397                 params.p2p_opp_ps = tmp;
4398                 if (params.p2p_opp_ps &&
4399                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4400                         return -EINVAL;
4401         }
4402
4403         if (!rdev->ops->change_bss)
4404                 return -EOPNOTSUPP;
4405
4406         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4407             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4408                 return -EOPNOTSUPP;
4409
4410         return rdev_change_bss(rdev, dev, &params);
4411 }
4412
4413 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4414         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4415         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4416         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4417         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4418         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4419         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4420 };
4421
4422 static int parse_reg_rule(struct nlattr *tb[],
4423         struct ieee80211_reg_rule *reg_rule)
4424 {
4425         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4426         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4427
4428         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4429                 return -EINVAL;
4430         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4431                 return -EINVAL;
4432         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4433                 return -EINVAL;
4434         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4435                 return -EINVAL;
4436         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4437                 return -EINVAL;
4438
4439         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4440
4441         freq_range->start_freq_khz =
4442                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4443         freq_range->end_freq_khz =
4444                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4445         freq_range->max_bandwidth_khz =
4446                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4447
4448         power_rule->max_eirp =
4449                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4450
4451         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4452                 power_rule->max_antenna_gain =
4453                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4454
4455         return 0;
4456 }
4457
4458 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4459 {
4460         int r;
4461         char *data = NULL;
4462         enum nl80211_user_reg_hint_type user_reg_hint_type;
4463
4464         /*
4465          * You should only get this when cfg80211 hasn't yet initialized
4466          * completely when built-in to the kernel right between the time
4467          * window between nl80211_init() and regulatory_init(), if that is
4468          * even possible.
4469          */
4470         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4471                 return -EINPROGRESS;
4472
4473         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4474                 return -EINVAL;
4475
4476         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4477
4478         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4479                 user_reg_hint_type =
4480                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4481         else
4482                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4483
4484         switch (user_reg_hint_type) {
4485         case NL80211_USER_REG_HINT_USER:
4486         case NL80211_USER_REG_HINT_CELL_BASE:
4487                 break;
4488         default:
4489                 return -EINVAL;
4490         }
4491
4492         r = regulatory_hint_user(data, user_reg_hint_type);
4493
4494         return r;
4495 }
4496
4497 static int nl80211_get_mesh_config(struct sk_buff *skb,
4498                                    struct genl_info *info)
4499 {
4500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4501         struct net_device *dev = info->user_ptr[1];
4502         struct wireless_dev *wdev = dev->ieee80211_ptr;
4503         struct mesh_config cur_params;
4504         int err = 0;
4505         void *hdr;
4506         struct nlattr *pinfoattr;
4507         struct sk_buff *msg;
4508
4509         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4510                 return -EOPNOTSUPP;
4511
4512         if (!rdev->ops->get_mesh_config)
4513                 return -EOPNOTSUPP;
4514
4515         wdev_lock(wdev);
4516         /* If not connected, get default parameters */
4517         if (!wdev->mesh_id_len)
4518                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4519         else
4520                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4521         wdev_unlock(wdev);
4522
4523         if (err)
4524                 return err;
4525
4526         /* Draw up a netlink message to send back */
4527         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4528         if (!msg)
4529                 return -ENOMEM;
4530         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4531                              NL80211_CMD_GET_MESH_CONFIG);
4532         if (!hdr)
4533                 goto out;
4534         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4535         if (!pinfoattr)
4536                 goto nla_put_failure;
4537         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4538             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4539                         cur_params.dot11MeshRetryTimeout) ||
4540             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4541                         cur_params.dot11MeshConfirmTimeout) ||
4542             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4543                         cur_params.dot11MeshHoldingTimeout) ||
4544             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4545                         cur_params.dot11MeshMaxPeerLinks) ||
4546             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4547                        cur_params.dot11MeshMaxRetries) ||
4548             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4549                        cur_params.dot11MeshTTL) ||
4550             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4551                        cur_params.element_ttl) ||
4552             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4553                        cur_params.auto_open_plinks) ||
4554             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4555                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4556             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4557                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4558             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4559                         cur_params.path_refresh_time) ||
4560             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4561                         cur_params.min_discovery_timeout) ||
4562             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4563                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4564             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4565                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4566             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4567                         cur_params.dot11MeshHWMPperrMinInterval) ||
4568             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4569                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4570             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4571                        cur_params.dot11MeshHWMPRootMode) ||
4572             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4573                         cur_params.dot11MeshHWMPRannInterval) ||
4574             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4575                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4576             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4577                        cur_params.dot11MeshForwarding) ||
4578             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4579                         cur_params.rssi_threshold) ||
4580             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4581                         cur_params.ht_opmode) ||
4582             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4583                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4584             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4585                         cur_params.dot11MeshHWMProotInterval) ||
4586             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4587                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4588             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4589                         cur_params.power_mode) ||
4590             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4591                         cur_params.dot11MeshAwakeWindowDuration) ||
4592             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4593                         cur_params.plink_timeout))
4594                 goto nla_put_failure;
4595         nla_nest_end(msg, pinfoattr);
4596         genlmsg_end(msg, hdr);
4597         return genlmsg_reply(msg, info);
4598
4599  nla_put_failure:
4600         genlmsg_cancel(msg, hdr);
4601  out:
4602         nlmsg_free(msg);
4603         return -ENOBUFS;
4604 }
4605
4606 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4607         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4608         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4609         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4610         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4611         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4612         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4613         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4614         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4615         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4616         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4617         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4618         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4619         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4620         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4621         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4622         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4623         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4624         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4625         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4626         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4627         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4628         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4629         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4630         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4631         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4632         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4633         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4634         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4635 };
4636
4637 static const struct nla_policy
4638         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4639         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4640         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4641         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4642         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4643         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4644         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4645         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4646                                     .len = IEEE80211_MAX_DATA_LEN },
4647         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4648 };
4649
4650 static int nl80211_parse_mesh_config(struct genl_info *info,
4651                                      struct mesh_config *cfg,
4652                                      u32 *mask_out)
4653 {
4654         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4655         u32 mask = 0;
4656
4657 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4658 do {                                                                        \
4659         if (tb[attr]) {                                                     \
4660                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4661                         return -EINVAL;                                     \
4662                 cfg->param = fn(tb[attr]);                                  \
4663                 mask |= (1 << (attr - 1));                                  \
4664         }                                                                   \
4665 } while (0)
4666
4667
4668         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4669                 return -EINVAL;
4670         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4671                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4672                              nl80211_meshconf_params_policy))
4673                 return -EINVAL;
4674
4675         /* This makes sure that there aren't more than 32 mesh config
4676          * parameters (otherwise our bitfield scheme would not work.) */
4677         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4678
4679         /* Fill in the params struct */
4680         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4681                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4682                                   nla_get_u16);
4683         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4684                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4685                                   nla_get_u16);
4686         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4687                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4688                                   nla_get_u16);
4689         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4690                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4691                                   nla_get_u16);
4692         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4693                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4694                                   nla_get_u8);
4695         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4696                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4697         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4698                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4699                                   nla_get_u8);
4700         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4701                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4702                                   nla_get_u8);
4703         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4704                                   1, 255, mask,
4705                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4706                                   nla_get_u32);
4707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4708                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4709                                   nla_get_u8);
4710         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4711                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4712                                   nla_get_u32);
4713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4714                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4715                                   nla_get_u16);
4716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4717                                   1, 65535, mask,
4718                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4719                                   nla_get_u32);
4720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4721                                   1, 65535, mask,
4722                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4723                                   nla_get_u16);
4724         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4725                                   1, 65535, mask,
4726                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4727                                   nla_get_u16);
4728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4729                                   dot11MeshHWMPnetDiameterTraversalTime,
4730                                   1, 65535, mask,
4731                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4732                                   nla_get_u16);
4733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4734                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4735                                   nla_get_u8);
4736         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4737                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4738                                   nla_get_u16);
4739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4740                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4741                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4742                                   nla_get_u8);
4743         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4744                                   mask, NL80211_MESHCONF_FORWARDING,
4745                                   nla_get_u8);
4746         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4747                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4748                                   nla_get_u32);
4749         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4750                                   mask, NL80211_MESHCONF_HT_OPMODE,
4751                                   nla_get_u16);
4752         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4753                                   1, 65535, mask,
4754                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4755                                   nla_get_u32);
4756         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4757                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4758                                   nla_get_u16);
4759         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4760                                   dot11MeshHWMPconfirmationInterval,
4761                                   1, 65535, mask,
4762                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4763                                   nla_get_u16);
4764         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4765                                   NL80211_MESH_POWER_ACTIVE,
4766                                   NL80211_MESH_POWER_MAX,
4767                                   mask, NL80211_MESHCONF_POWER_MODE,
4768                                   nla_get_u32);
4769         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4770                                   0, 65535, mask,
4771                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4772         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4773                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4774                                   nla_get_u32);
4775         if (mask_out)
4776                 *mask_out = mask;
4777
4778         return 0;
4779
4780 #undef FILL_IN_MESH_PARAM_IF_SET
4781 }
4782
4783 static int nl80211_parse_mesh_setup(struct genl_info *info,
4784                                      struct mesh_setup *setup)
4785 {
4786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4787         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4788
4789         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4790                 return -EINVAL;
4791         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4792                              info->attrs[NL80211_ATTR_MESH_SETUP],
4793                              nl80211_mesh_setup_params_policy))
4794                 return -EINVAL;
4795
4796         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4797                 setup->sync_method =
4798                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4799                  IEEE80211_SYNC_METHOD_VENDOR :
4800                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4801
4802         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4803                 setup->path_sel_proto =
4804                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4805                  IEEE80211_PATH_PROTOCOL_VENDOR :
4806                  IEEE80211_PATH_PROTOCOL_HWMP;
4807
4808         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4809                 setup->path_metric =
4810                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4811                  IEEE80211_PATH_METRIC_VENDOR :
4812                  IEEE80211_PATH_METRIC_AIRTIME;
4813
4814
4815         if (tb[NL80211_MESH_SETUP_IE]) {
4816                 struct nlattr *ieattr =
4817                         tb[NL80211_MESH_SETUP_IE];
4818                 if (!is_valid_ie_attr(ieattr))
4819                         return -EINVAL;
4820                 setup->ie = nla_data(ieattr);
4821                 setup->ie_len = nla_len(ieattr);
4822         }
4823         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4824             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4825                 return -EINVAL;
4826         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4827         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4828         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4829         if (setup->is_secure)
4830                 setup->user_mpm = true;
4831
4832         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4833                 if (!setup->user_mpm)
4834                         return -EINVAL;
4835                 setup->auth_id =
4836                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4837         }
4838
4839         return 0;
4840 }
4841
4842 static int nl80211_update_mesh_config(struct sk_buff *skb,
4843                                       struct genl_info *info)
4844 {
4845         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4846         struct net_device *dev = info->user_ptr[1];
4847         struct wireless_dev *wdev = dev->ieee80211_ptr;
4848         struct mesh_config cfg;
4849         u32 mask;
4850         int err;
4851
4852         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4853                 return -EOPNOTSUPP;
4854
4855         if (!rdev->ops->update_mesh_config)
4856                 return -EOPNOTSUPP;
4857
4858         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4859         if (err)
4860                 return err;
4861
4862         wdev_lock(wdev);
4863         if (!wdev->mesh_id_len)
4864                 err = -ENOLINK;
4865
4866         if (!err)
4867                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4868
4869         wdev_unlock(wdev);
4870
4871         return err;
4872 }
4873
4874 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4875 {
4876         const struct ieee80211_regdomain *regdom;
4877         struct sk_buff *msg;
4878         void *hdr = NULL;
4879         struct nlattr *nl_reg_rules;
4880         unsigned int i;
4881
4882         if (!cfg80211_regdomain)
4883                 return -EINVAL;
4884
4885         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4886         if (!msg)
4887                 return -ENOBUFS;
4888
4889         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4890                              NL80211_CMD_GET_REG);
4891         if (!hdr)
4892                 goto put_failure;
4893
4894         if (reg_last_request_cell_base() &&
4895             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4896                         NL80211_USER_REG_HINT_CELL_BASE))
4897                 goto nla_put_failure;
4898
4899         rcu_read_lock();
4900         regdom = rcu_dereference(cfg80211_regdomain);
4901
4902         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4903             (regdom->dfs_region &&
4904              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4905                 goto nla_put_failure_rcu;
4906
4907         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4908         if (!nl_reg_rules)
4909                 goto nla_put_failure_rcu;
4910
4911         for (i = 0; i < regdom->n_reg_rules; i++) {
4912                 struct nlattr *nl_reg_rule;
4913                 const struct ieee80211_reg_rule *reg_rule;
4914                 const struct ieee80211_freq_range *freq_range;
4915                 const struct ieee80211_power_rule *power_rule;
4916
4917                 reg_rule = &regdom->reg_rules[i];
4918                 freq_range = &reg_rule->freq_range;
4919                 power_rule = &reg_rule->power_rule;
4920
4921                 nl_reg_rule = nla_nest_start(msg, i);
4922                 if (!nl_reg_rule)
4923                         goto nla_put_failure_rcu;
4924
4925                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4926                                 reg_rule->flags) ||
4927                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4928                                 freq_range->start_freq_khz) ||
4929                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4930                                 freq_range->end_freq_khz) ||
4931                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4932                                 freq_range->max_bandwidth_khz) ||
4933                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4934                                 power_rule->max_antenna_gain) ||
4935                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4936                                 power_rule->max_eirp))
4937                         goto nla_put_failure_rcu;
4938
4939                 nla_nest_end(msg, nl_reg_rule);
4940         }
4941         rcu_read_unlock();
4942
4943         nla_nest_end(msg, nl_reg_rules);
4944
4945         genlmsg_end(msg, hdr);
4946         return genlmsg_reply(msg, info);
4947
4948 nla_put_failure_rcu:
4949         rcu_read_unlock();
4950 nla_put_failure:
4951         genlmsg_cancel(msg, hdr);
4952 put_failure:
4953         nlmsg_free(msg);
4954         return -EMSGSIZE;
4955 }
4956
4957 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4958 {
4959         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4960         struct nlattr *nl_reg_rule;
4961         char *alpha2 = NULL;
4962         int rem_reg_rules = 0, r = 0;
4963         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4964         u8 dfs_region = 0;
4965         struct ieee80211_regdomain *rd = NULL;
4966
4967         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4968                 return -EINVAL;
4969
4970         if (!info->attrs[NL80211_ATTR_REG_RULES])
4971                 return -EINVAL;
4972
4973         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4974
4975         if (info->attrs[NL80211_ATTR_DFS_REGION])
4976                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4977
4978         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4979                             rem_reg_rules) {
4980                 num_rules++;
4981                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4982                         return -EINVAL;
4983         }
4984
4985         size_of_regd = sizeof(struct ieee80211_regdomain) +
4986                        num_rules * sizeof(struct ieee80211_reg_rule);
4987
4988         rd = kzalloc(size_of_regd, GFP_KERNEL);
4989         if (!rd)
4990                 return -ENOMEM;
4991
4992         rd->n_reg_rules = num_rules;
4993         rd->alpha2[0] = alpha2[0];
4994         rd->alpha2[1] = alpha2[1];
4995
4996         /*
4997          * Disable DFS master mode if the DFS region was
4998          * not supported or known on this kernel.
4999          */
5000         if (reg_supported_dfs_region(dfs_region))
5001                 rd->dfs_region = dfs_region;
5002
5003         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5004                             rem_reg_rules) {
5005                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5006                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5007                           reg_rule_policy);
5008                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5009                 if (r)
5010                         goto bad_reg;
5011
5012                 rule_idx++;
5013
5014                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5015                         r = -EINVAL;
5016                         goto bad_reg;
5017                 }
5018         }
5019
5020         r = set_regdom(rd);
5021         /* set_regdom took ownership */
5022         rd = NULL;
5023
5024  bad_reg:
5025         kfree(rd);
5026         return r;
5027 }
5028
5029 static int validate_scan_freqs(struct nlattr *freqs)
5030 {
5031         struct nlattr *attr1, *attr2;
5032         int n_channels = 0, tmp1, tmp2;
5033
5034         nla_for_each_nested(attr1, freqs, tmp1) {
5035                 n_channels++;
5036                 /*
5037                  * Some hardware has a limited channel list for
5038                  * scanning, and it is pretty much nonsensical
5039                  * to scan for a channel twice, so disallow that
5040                  * and don't require drivers to check that the
5041                  * channel list they get isn't longer than what
5042                  * they can scan, as long as they can scan all
5043                  * the channels they registered at once.
5044                  */
5045                 nla_for_each_nested(attr2, freqs, tmp2)
5046                         if (attr1 != attr2 &&
5047                             nla_get_u32(attr1) == nla_get_u32(attr2))
5048                                 return 0;
5049         }
5050
5051         return n_channels;
5052 }
5053
5054 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5055 {
5056         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5057         struct wireless_dev *wdev = info->user_ptr[1];
5058         struct cfg80211_scan_request *request;
5059         struct nlattr *attr;
5060         struct wiphy *wiphy;
5061         int err, tmp, n_ssids = 0, n_channels, i;
5062         size_t ie_len;
5063
5064         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5065                 return -EINVAL;
5066
5067         wiphy = &rdev->wiphy;
5068
5069         if (!rdev->ops->scan)
5070                 return -EOPNOTSUPP;
5071
5072         if (rdev->scan_req) {
5073                 err = -EBUSY;
5074                 goto unlock;
5075         }
5076
5077         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5078                 n_channels = validate_scan_freqs(
5079                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5080                 if (!n_channels) {
5081                         err = -EINVAL;
5082                         goto unlock;
5083                 }
5084         } else {
5085                 enum ieee80211_band band;
5086                 n_channels = 0;
5087
5088                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5089                         if (wiphy->bands[band])
5090                                 n_channels += wiphy->bands[band]->n_channels;
5091         }
5092
5093         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5094                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5095                         n_ssids++;
5096
5097         if (n_ssids > wiphy->max_scan_ssids) {
5098                 err = -EINVAL;
5099                 goto unlock;
5100         }
5101
5102         if (info->attrs[NL80211_ATTR_IE])
5103                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5104         else
5105                 ie_len = 0;
5106
5107         if (ie_len > wiphy->max_scan_ie_len) {
5108                 err = -EINVAL;
5109                 goto unlock;
5110         }
5111
5112         request = kzalloc(sizeof(*request)
5113                         + sizeof(*request->ssids) * n_ssids
5114                         + sizeof(*request->channels) * n_channels
5115                         + ie_len, GFP_KERNEL);
5116         if (!request) {
5117                 err = -ENOMEM;
5118                 goto unlock;
5119         }
5120
5121         if (n_ssids)
5122                 request->ssids = (void *)&request->channels[n_channels];
5123         request->n_ssids = n_ssids;
5124         if (ie_len) {
5125                 if (request->ssids)
5126                         request->ie = (void *)(request->ssids + n_ssids);
5127                 else
5128                         request->ie = (void *)(request->channels + n_channels);
5129         }
5130
5131         i = 0;
5132         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5133                 /* user specified, bail out if channel not found */
5134                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5135                         struct ieee80211_channel *chan;
5136
5137                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5138
5139                         if (!chan) {
5140                                 err = -EINVAL;
5141                                 goto out_free;
5142                         }
5143
5144                         /* ignore disabled channels */
5145                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5146                                 continue;
5147
5148                         request->channels[i] = chan;
5149                         i++;
5150                 }
5151         } else {
5152                 enum ieee80211_band band;
5153
5154                 /* all channels */
5155                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5156                         int j;
5157                         if (!wiphy->bands[band])
5158                                 continue;
5159                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5160                                 struct ieee80211_channel *chan;
5161
5162                                 chan = &wiphy->bands[band]->channels[j];
5163
5164                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5165                                         continue;
5166
5167                                 request->channels[i] = chan;
5168                                 i++;
5169                         }
5170                 }
5171         }
5172
5173         if (!i) {
5174                 err = -EINVAL;
5175                 goto out_free;
5176         }
5177
5178         request->n_channels = i;
5179
5180         i = 0;
5181         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5182                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5183                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5184                                 err = -EINVAL;
5185                                 goto out_free;
5186                         }
5187                         request->ssids[i].ssid_len = nla_len(attr);
5188                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5189                         i++;
5190                 }
5191         }
5192
5193         if (info->attrs[NL80211_ATTR_IE]) {
5194                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5195                 memcpy((void *)request->ie,
5196                        nla_data(info->attrs[NL80211_ATTR_IE]),
5197                        request->ie_len);
5198         }
5199
5200         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5201                 if (wiphy->bands[i])
5202                         request->rates[i] =
5203                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5204
5205         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5206                 nla_for_each_nested(attr,
5207                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5208                                     tmp) {
5209                         enum ieee80211_band band = nla_type(attr);
5210
5211                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5212                                 err = -EINVAL;
5213                                 goto out_free;
5214                         }
5215                         err = ieee80211_get_ratemask(wiphy->bands[band],
5216                                                      nla_data(attr),
5217                                                      nla_len(attr),
5218                                                      &request->rates[band]);
5219                         if (err)
5220                                 goto out_free;
5221                 }
5222         }
5223
5224         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5225                 request->flags = nla_get_u32(
5226                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5227                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5228                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5229                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5230                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5231                         err = -EOPNOTSUPP;
5232                         goto out_free;
5233                 }
5234         }
5235
5236         request->no_cck =
5237                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5238
5239         request->wdev = wdev;
5240         request->wiphy = &rdev->wiphy;
5241         request->scan_start = jiffies;
5242
5243         rdev->scan_req = request;
5244         err = rdev_scan(rdev, request);
5245
5246         if (!err) {
5247                 nl80211_send_scan_start(rdev, wdev);
5248                 if (wdev->netdev)
5249                         dev_hold(wdev->netdev);
5250         } else {
5251  out_free:
5252                 rdev->scan_req = NULL;
5253                 kfree(request);
5254         }
5255
5256  unlock:
5257         return err;
5258 }
5259
5260 static int nl80211_start_sched_scan(struct sk_buff *skb,
5261                                     struct genl_info *info)
5262 {
5263         struct cfg80211_sched_scan_request *request;
5264         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5265         struct net_device *dev = info->user_ptr[1];
5266         struct nlattr *attr;
5267         struct wiphy *wiphy;
5268         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5269         u32 interval;
5270         enum ieee80211_band band;
5271         size_t ie_len;
5272         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5273
5274         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5275             !rdev->ops->sched_scan_start)
5276                 return -EOPNOTSUPP;
5277
5278         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5279                 return -EINVAL;
5280
5281         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5282                 return -EINVAL;
5283
5284         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5285         if (interval == 0)
5286                 return -EINVAL;
5287
5288         wiphy = &rdev->wiphy;
5289
5290         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5291                 n_channels = validate_scan_freqs(
5292                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5293                 if (!n_channels)
5294                         return -EINVAL;
5295         } else {
5296                 n_channels = 0;
5297
5298                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5299                         if (wiphy->bands[band])
5300                                 n_channels += wiphy->bands[band]->n_channels;
5301         }
5302
5303         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5304                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5305                                     tmp)
5306                         n_ssids++;
5307
5308         if (n_ssids > wiphy->max_sched_scan_ssids)
5309                 return -EINVAL;
5310
5311         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5312                 nla_for_each_nested(attr,
5313                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5314                                     tmp)
5315                         n_match_sets++;
5316
5317         if (n_match_sets > wiphy->max_match_sets)
5318                 return -EINVAL;
5319
5320         if (info->attrs[NL80211_ATTR_IE])
5321                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5322         else
5323                 ie_len = 0;
5324
5325         if (ie_len > wiphy->max_sched_scan_ie_len)
5326                 return -EINVAL;
5327
5328         if (rdev->sched_scan_req) {
5329                 err = -EINPROGRESS;
5330                 goto out;
5331         }
5332
5333         request = kzalloc(sizeof(*request)
5334                         + sizeof(*request->ssids) * n_ssids
5335                         + sizeof(*request->match_sets) * n_match_sets
5336                         + sizeof(*request->channels) * n_channels
5337                         + ie_len, GFP_KERNEL);
5338         if (!request) {
5339                 err = -ENOMEM;
5340                 goto out;
5341         }
5342
5343         if (n_ssids)
5344                 request->ssids = (void *)&request->channels[n_channels];
5345         request->n_ssids = n_ssids;
5346         if (ie_len) {
5347                 if (request->ssids)
5348                         request->ie = (void *)(request->ssids + n_ssids);
5349                 else
5350                         request->ie = (void *)(request->channels + n_channels);
5351         }
5352
5353         if (n_match_sets) {
5354                 if (request->ie)
5355                         request->match_sets = (void *)(request->ie + ie_len);
5356                 else if (request->ssids)
5357                         request->match_sets =
5358                                 (void *)(request->ssids + n_ssids);
5359                 else
5360                         request->match_sets =
5361                                 (void *)(request->channels + n_channels);
5362         }
5363         request->n_match_sets = n_match_sets;
5364
5365         i = 0;
5366         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5367                 /* user specified, bail out if channel not found */
5368                 nla_for_each_nested(attr,
5369                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5370                                     tmp) {
5371                         struct ieee80211_channel *chan;
5372
5373                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5374
5375                         if (!chan) {
5376                                 err = -EINVAL;
5377                                 goto out_free;
5378                         }
5379
5380                         /* ignore disabled channels */
5381                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5382                                 continue;
5383
5384                         request->channels[i] = chan;
5385                         i++;
5386                 }
5387         } else {
5388                 /* all channels */
5389                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5390                         int j;
5391                         if (!wiphy->bands[band])
5392                                 continue;
5393                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5394                                 struct ieee80211_channel *chan;
5395
5396                                 chan = &wiphy->bands[band]->channels[j];
5397
5398                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5399                                         continue;
5400
5401                                 request->channels[i] = chan;
5402                                 i++;
5403                         }
5404                 }
5405         }
5406
5407         if (!i) {
5408                 err = -EINVAL;
5409                 goto out_free;
5410         }
5411
5412         request->n_channels = i;
5413
5414         i = 0;
5415         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5416                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5417                                     tmp) {
5418                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5419                                 err = -EINVAL;
5420                                 goto out_free;
5421                         }
5422                         request->ssids[i].ssid_len = nla_len(attr);
5423                         memcpy(request->ssids[i].ssid, nla_data(attr),
5424                                nla_len(attr));
5425                         i++;
5426                 }
5427         }
5428
5429         i = 0;
5430         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5431                 nla_for_each_nested(attr,
5432                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5433                                     tmp) {
5434                         struct nlattr *ssid, *rssi;
5435
5436                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5437                                   nla_data(attr), nla_len(attr),
5438                                   nl80211_match_policy);
5439                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5440                         if (ssid) {
5441                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5442                                         err = -EINVAL;
5443                                         goto out_free;
5444                                 }
5445                                 memcpy(request->match_sets[i].ssid.ssid,
5446                                        nla_data(ssid), nla_len(ssid));
5447                                 request->match_sets[i].ssid.ssid_len =
5448                                         nla_len(ssid);
5449                         }
5450                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5451                         if (rssi)
5452                                 request->rssi_thold = nla_get_u32(rssi);
5453                         else
5454                                 request->rssi_thold =
5455                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5456                         i++;
5457                 }
5458         }
5459
5460         if (info->attrs[NL80211_ATTR_IE]) {
5461                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5462                 memcpy((void *)request->ie,
5463                        nla_data(info->attrs[NL80211_ATTR_IE]),
5464                        request->ie_len);
5465         }
5466
5467         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5468                 request->flags = nla_get_u32(
5469                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5470                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5471                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5472                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5473                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5474                         err = -EOPNOTSUPP;
5475                         goto out_free;
5476                 }
5477         }
5478
5479         request->dev = dev;
5480         request->wiphy = &rdev->wiphy;
5481         request->interval = interval;
5482         request->scan_start = jiffies;
5483
5484         err = rdev_sched_scan_start(rdev, dev, request);
5485         if (!err) {
5486                 rdev->sched_scan_req = request;
5487                 nl80211_send_sched_scan(rdev, dev,
5488                                         NL80211_CMD_START_SCHED_SCAN);
5489                 goto out;
5490         }
5491
5492 out_free:
5493         kfree(request);
5494 out:
5495         return err;
5496 }
5497
5498 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5499                                    struct genl_info *info)
5500 {
5501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5502
5503         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5504             !rdev->ops->sched_scan_stop)
5505                 return -EOPNOTSUPP;
5506
5507         return __cfg80211_stop_sched_scan(rdev, false);
5508 }
5509
5510 static int nl80211_start_radar_detection(struct sk_buff *skb,
5511                                          struct genl_info *info)
5512 {
5513         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5514         struct net_device *dev = info->user_ptr[1];
5515         struct wireless_dev *wdev = dev->ieee80211_ptr;
5516         struct cfg80211_chan_def chandef;
5517         int err;
5518
5519         err = nl80211_parse_chandef(rdev, info, &chandef);
5520         if (err)
5521                 return err;
5522
5523         if (wdev->cac_started)
5524                 return -EBUSY;
5525
5526         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5527         if (err < 0)
5528                 return err;
5529
5530         if (err == 0)
5531                 return -EINVAL;
5532
5533         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5534                 return -EINVAL;
5535
5536         if (!rdev->ops->start_radar_detection)
5537                 return -EOPNOTSUPP;
5538
5539         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5540                                            chandef.chan, CHAN_MODE_SHARED,
5541                                            BIT(chandef.width));
5542         if (err)
5543                 return err;
5544
5545         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5546         if (!err) {
5547                 wdev->channel = chandef.chan;
5548                 wdev->cac_started = true;
5549                 wdev->cac_start_time = jiffies;
5550         }
5551         return err;
5552 }
5553
5554 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5555                             u32 seq, int flags,
5556                             struct cfg80211_registered_device *rdev,
5557                             struct wireless_dev *wdev,
5558                             struct cfg80211_internal_bss *intbss)
5559 {
5560         struct cfg80211_bss *res = &intbss->pub;
5561         const struct cfg80211_bss_ies *ies;
5562         void *hdr;
5563         struct nlattr *bss;
5564         bool tsf = false;
5565
5566         ASSERT_WDEV_LOCK(wdev);
5567
5568         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5569                              NL80211_CMD_NEW_SCAN_RESULTS);
5570         if (!hdr)
5571                 return -1;
5572
5573         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5574
5575         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5576                 goto nla_put_failure;
5577         if (wdev->netdev &&
5578             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5579                 goto nla_put_failure;
5580         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5581                 goto nla_put_failure;
5582
5583         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5584         if (!bss)
5585                 goto nla_put_failure;
5586         if ((!is_zero_ether_addr(res->bssid) &&
5587              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5588                 goto nla_put_failure;
5589
5590         rcu_read_lock();
5591         ies = rcu_dereference(res->ies);
5592         if (ies) {
5593                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5594                         goto fail_unlock_rcu;
5595                 tsf = true;
5596                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5597                                         ies->len, ies->data))
5598                         goto fail_unlock_rcu;
5599         }
5600         ies = rcu_dereference(res->beacon_ies);
5601         if (ies) {
5602                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5603                         goto fail_unlock_rcu;
5604                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5605                                         ies->len, ies->data))
5606                         goto fail_unlock_rcu;
5607         }
5608         rcu_read_unlock();
5609
5610         if (res->beacon_interval &&
5611             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5612                 goto nla_put_failure;
5613         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5614             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5615             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5616                         jiffies_to_msecs(jiffies - intbss->ts)))
5617                 goto nla_put_failure;
5618
5619         switch (rdev->wiphy.signal_type) {
5620         case CFG80211_SIGNAL_TYPE_MBM:
5621                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5622                         goto nla_put_failure;
5623                 break;
5624         case CFG80211_SIGNAL_TYPE_UNSPEC:
5625                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5626                         goto nla_put_failure;
5627                 break;
5628         default:
5629                 break;
5630         }
5631
5632         switch (wdev->iftype) {
5633         case NL80211_IFTYPE_P2P_CLIENT:
5634         case NL80211_IFTYPE_STATION:
5635                 if (intbss == wdev->current_bss &&
5636                     nla_put_u32(msg, NL80211_BSS_STATUS,
5637                                 NL80211_BSS_STATUS_ASSOCIATED))
5638                         goto nla_put_failure;
5639                 break;
5640         case NL80211_IFTYPE_ADHOC:
5641                 if (intbss == wdev->current_bss &&
5642                     nla_put_u32(msg, NL80211_BSS_STATUS,
5643                                 NL80211_BSS_STATUS_IBSS_JOINED))
5644                         goto nla_put_failure;
5645                 break;
5646         default:
5647                 break;
5648         }
5649
5650         nla_nest_end(msg, bss);
5651
5652         return genlmsg_end(msg, hdr);
5653
5654  fail_unlock_rcu:
5655         rcu_read_unlock();
5656  nla_put_failure:
5657         genlmsg_cancel(msg, hdr);
5658         return -EMSGSIZE;
5659 }
5660
5661 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5662 {
5663         struct cfg80211_registered_device *rdev;
5664         struct cfg80211_internal_bss *scan;
5665         struct wireless_dev *wdev;
5666         int start = cb->args[2], idx = 0;
5667         int err;
5668
5669         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5670         if (err)
5671                 return err;
5672
5673         wdev_lock(wdev);
5674         spin_lock_bh(&rdev->bss_lock);
5675         cfg80211_bss_expire(rdev);
5676
5677         cb->seq = rdev->bss_generation;
5678
5679         list_for_each_entry(scan, &rdev->bss_list, list) {
5680                 if (++idx <= start)
5681                         continue;
5682                 if (nl80211_send_bss(skb, cb,
5683                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5684                                 rdev, wdev, scan) < 0) {
5685                         idx--;
5686                         break;
5687                 }
5688         }
5689
5690         spin_unlock_bh(&rdev->bss_lock);
5691         wdev_unlock(wdev);
5692
5693         cb->args[2] = idx;
5694         nl80211_finish_wdev_dump(rdev);
5695
5696         return skb->len;
5697 }
5698
5699 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5700                                 int flags, struct net_device *dev,
5701                                 struct survey_info *survey)
5702 {
5703         void *hdr;
5704         struct nlattr *infoattr;
5705
5706         hdr = nl80211hdr_put(msg, portid, seq, flags,
5707                              NL80211_CMD_NEW_SURVEY_RESULTS);
5708         if (!hdr)
5709                 return -ENOMEM;
5710
5711         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5712                 goto nla_put_failure;
5713
5714         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5715         if (!infoattr)
5716                 goto nla_put_failure;
5717
5718         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5719                         survey->channel->center_freq))
5720                 goto nla_put_failure;
5721
5722         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5723             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5724                 goto nla_put_failure;
5725         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5726             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5727                 goto nla_put_failure;
5728         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5729             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5730                         survey->channel_time))
5731                 goto nla_put_failure;
5732         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5733             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5734                         survey->channel_time_busy))
5735                 goto nla_put_failure;
5736         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5737             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5738                         survey->channel_time_ext_busy))
5739                 goto nla_put_failure;
5740         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5741             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5742                         survey->channel_time_rx))
5743                 goto nla_put_failure;
5744         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5745             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5746                         survey->channel_time_tx))
5747                 goto nla_put_failure;
5748
5749         nla_nest_end(msg, infoattr);
5750
5751         return genlmsg_end(msg, hdr);
5752
5753  nla_put_failure:
5754         genlmsg_cancel(msg, hdr);
5755         return -EMSGSIZE;
5756 }
5757
5758 static int nl80211_dump_survey(struct sk_buff *skb,
5759                         struct netlink_callback *cb)
5760 {
5761         struct survey_info survey;
5762         struct cfg80211_registered_device *dev;
5763         struct wireless_dev *wdev;
5764         int survey_idx = cb->args[2];
5765         int res;
5766
5767         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5768         if (res)
5769                 return res;
5770
5771         if (!wdev->netdev) {
5772                 res = -EINVAL;
5773                 goto out_err;
5774         }
5775
5776         if (!dev->ops->dump_survey) {
5777                 res = -EOPNOTSUPP;
5778                 goto out_err;
5779         }
5780
5781         while (1) {
5782                 struct ieee80211_channel *chan;
5783
5784                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5785                 if (res == -ENOENT)
5786                         break;
5787                 if (res)
5788                         goto out_err;
5789
5790                 /* Survey without a channel doesn't make sense */
5791                 if (!survey.channel) {
5792                         res = -EINVAL;
5793                         goto out;
5794                 }
5795
5796                 chan = ieee80211_get_channel(&dev->wiphy,
5797                                              survey.channel->center_freq);
5798                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5799                         survey_idx++;
5800                         continue;
5801                 }
5802
5803                 if (nl80211_send_survey(skb,
5804                                 NETLINK_CB(cb->skb).portid,
5805                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5806                                 wdev->netdev, &survey) < 0)
5807                         goto out;
5808                 survey_idx++;
5809         }
5810
5811  out:
5812         cb->args[2] = survey_idx;
5813         res = skb->len;
5814  out_err:
5815         nl80211_finish_wdev_dump(dev);
5816         return res;
5817 }
5818
5819 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5820 {
5821         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5822                                   NL80211_WPA_VERSION_2));
5823 }
5824
5825 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5826 {
5827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5828         struct net_device *dev = info->user_ptr[1];
5829         struct ieee80211_channel *chan;
5830         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5831         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5832         enum nl80211_auth_type auth_type;
5833         struct key_parse key;
5834         bool local_state_change;
5835
5836         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5837                 return -EINVAL;
5838
5839         if (!info->attrs[NL80211_ATTR_MAC])
5840                 return -EINVAL;
5841
5842         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5843                 return -EINVAL;
5844
5845         if (!info->attrs[NL80211_ATTR_SSID])
5846                 return -EINVAL;
5847
5848         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5849                 return -EINVAL;
5850
5851         err = nl80211_parse_key(info, &key);
5852         if (err)
5853                 return err;
5854
5855         if (key.idx >= 0) {
5856                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5857                         return -EINVAL;
5858                 if (!key.p.key || !key.p.key_len)
5859                         return -EINVAL;
5860                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5861                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5862                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5863                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5864                         return -EINVAL;
5865                 if (key.idx > 4)
5866                         return -EINVAL;
5867         } else {
5868                 key.p.key_len = 0;
5869                 key.p.key = NULL;
5870         }
5871
5872         if (key.idx >= 0) {
5873                 int i;
5874                 bool ok = false;
5875                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5876                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5877                                 ok = true;
5878                                 break;
5879                         }
5880                 }
5881                 if (!ok)
5882                         return -EINVAL;
5883         }
5884
5885         if (!rdev->ops->auth)
5886                 return -EOPNOTSUPP;
5887
5888         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5889             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5890                 return -EOPNOTSUPP;
5891
5892         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5893         chan = ieee80211_get_channel(&rdev->wiphy,
5894                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5895         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5896                 return -EINVAL;
5897
5898         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5899         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5900
5901         if (info->attrs[NL80211_ATTR_IE]) {
5902                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5903                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5904         }
5905
5906         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5907         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5908                 return -EINVAL;
5909
5910         if (auth_type == NL80211_AUTHTYPE_SAE &&
5911             !info->attrs[NL80211_ATTR_SAE_DATA])
5912                 return -EINVAL;
5913
5914         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5915                 if (auth_type != NL80211_AUTHTYPE_SAE)
5916                         return -EINVAL;
5917                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5918                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5919                 /* need to include at least Auth Transaction and Status Code */
5920                 if (sae_data_len < 4)
5921                         return -EINVAL;
5922         }
5923
5924         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5925
5926         /*
5927          * Since we no longer track auth state, ignore
5928          * requests to only change local state.
5929          */
5930         if (local_state_change)
5931                 return 0;
5932
5933         wdev_lock(dev->ieee80211_ptr);
5934         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5935                                  ssid, ssid_len, ie, ie_len,
5936                                  key.p.key, key.p.key_len, key.idx,
5937                                  sae_data, sae_data_len);
5938         wdev_unlock(dev->ieee80211_ptr);
5939         return err;
5940 }
5941
5942 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5943                                    struct genl_info *info,
5944                                    struct cfg80211_crypto_settings *settings,
5945                                    int cipher_limit)
5946 {
5947         memset(settings, 0, sizeof(*settings));
5948
5949         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5950
5951         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5952                 u16 proto;
5953                 proto = nla_get_u16(
5954                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5955                 settings->control_port_ethertype = cpu_to_be16(proto);
5956                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5957                     proto != ETH_P_PAE)
5958                         return -EINVAL;
5959                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5960                         settings->control_port_no_encrypt = true;
5961         } else
5962                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5963
5964         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5965                 void *data;
5966                 int len, i;
5967
5968                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5969                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5970                 settings->n_ciphers_pairwise = len / sizeof(u32);
5971
5972                 if (len % sizeof(u32))
5973                         return -EINVAL;
5974
5975                 if (settings->n_ciphers_pairwise > cipher_limit)
5976                         return -EINVAL;
5977
5978                 memcpy(settings->ciphers_pairwise, data, len);
5979
5980                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5981                         if (!cfg80211_supported_cipher_suite(
5982                                         &rdev->wiphy,
5983                                         settings->ciphers_pairwise[i]))
5984                                 return -EINVAL;
5985         }
5986
5987         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5988                 settings->cipher_group =
5989                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5990                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5991                                                      settings->cipher_group))
5992                         return -EINVAL;
5993         }
5994
5995         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5996                 settings->wpa_versions =
5997                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5998                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5999                         return -EINVAL;
6000         }
6001
6002         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6003                 void *data;
6004                 int len;
6005
6006                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6007                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6008                 settings->n_akm_suites = len / sizeof(u32);
6009
6010                 if (len % sizeof(u32))
6011                         return -EINVAL;
6012
6013                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6014                         return -EINVAL;
6015
6016                 memcpy(settings->akm_suites, data, len);
6017         }
6018
6019         return 0;
6020 }
6021
6022 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6023 {
6024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6025         struct net_device *dev = info->user_ptr[1];
6026         struct ieee80211_channel *chan;
6027         struct cfg80211_assoc_request req = {};
6028         const u8 *bssid, *ssid;
6029         int err, ssid_len = 0;
6030
6031         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6032                 return -EINVAL;
6033
6034         if (!info->attrs[NL80211_ATTR_MAC] ||
6035             !info->attrs[NL80211_ATTR_SSID] ||
6036             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6037                 return -EINVAL;
6038
6039         if (!rdev->ops->assoc)
6040                 return -EOPNOTSUPP;
6041
6042         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6043             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6044                 return -EOPNOTSUPP;
6045
6046         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6047
6048         chan = ieee80211_get_channel(&rdev->wiphy,
6049                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6050         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6051                 return -EINVAL;
6052
6053         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6054         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6055
6056         if (info->attrs[NL80211_ATTR_IE]) {
6057                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6058                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6059         }
6060
6061         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6062                 enum nl80211_mfp mfp =
6063                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6064                 if (mfp == NL80211_MFP_REQUIRED)
6065                         req.use_mfp = true;
6066                 else if (mfp != NL80211_MFP_NO)
6067                         return -EINVAL;
6068         }
6069
6070         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6071                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6072
6073         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6074                 req.flags |= ASSOC_REQ_DISABLE_HT;
6075
6076         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6077                 memcpy(&req.ht_capa_mask,
6078                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6079                        sizeof(req.ht_capa_mask));
6080
6081         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6082                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6083                         return -EINVAL;
6084                 memcpy(&req.ht_capa,
6085                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6086                        sizeof(req.ht_capa));
6087         }
6088
6089         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6090                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6091
6092         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6093                 memcpy(&req.vht_capa_mask,
6094                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6095                        sizeof(req.vht_capa_mask));
6096
6097         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6098                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6099                         return -EINVAL;
6100                 memcpy(&req.vht_capa,
6101                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6102                        sizeof(req.vht_capa));
6103         }
6104
6105         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6106         if (!err) {
6107                 wdev_lock(dev->ieee80211_ptr);
6108                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6109                                           ssid, ssid_len, &req);
6110                 wdev_unlock(dev->ieee80211_ptr);
6111         }
6112
6113         return err;
6114 }
6115
6116 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6117 {
6118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6119         struct net_device *dev = info->user_ptr[1];
6120         const u8 *ie = NULL, *bssid;
6121         int ie_len = 0, err;
6122         u16 reason_code;
6123         bool local_state_change;
6124
6125         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6126                 return -EINVAL;
6127
6128         if (!info->attrs[NL80211_ATTR_MAC])
6129                 return -EINVAL;
6130
6131         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6132                 return -EINVAL;
6133
6134         if (!rdev->ops->deauth)
6135                 return -EOPNOTSUPP;
6136
6137         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6138             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6139                 return -EOPNOTSUPP;
6140
6141         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6142
6143         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6144         if (reason_code == 0) {
6145                 /* Reason Code 0 is reserved */
6146                 return -EINVAL;
6147         }
6148
6149         if (info->attrs[NL80211_ATTR_IE]) {
6150                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6151                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6152         }
6153
6154         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6155
6156         wdev_lock(dev->ieee80211_ptr);
6157         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6158                                    local_state_change);
6159         wdev_unlock(dev->ieee80211_ptr);
6160         return err;
6161 }
6162
6163 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6164 {
6165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6166         struct net_device *dev = info->user_ptr[1];
6167         const u8 *ie = NULL, *bssid;
6168         int ie_len = 0, err;
6169         u16 reason_code;
6170         bool local_state_change;
6171
6172         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6173                 return -EINVAL;
6174
6175         if (!info->attrs[NL80211_ATTR_MAC])
6176                 return -EINVAL;
6177
6178         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6179                 return -EINVAL;
6180
6181         if (!rdev->ops->disassoc)
6182                 return -EOPNOTSUPP;
6183
6184         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6185             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6186                 return -EOPNOTSUPP;
6187
6188         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6189
6190         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6191         if (reason_code == 0) {
6192                 /* Reason Code 0 is reserved */
6193                 return -EINVAL;
6194         }
6195
6196         if (info->attrs[NL80211_ATTR_IE]) {
6197                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6198                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6199         }
6200
6201         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6202
6203         wdev_lock(dev->ieee80211_ptr);
6204         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6205                                      local_state_change);
6206         wdev_unlock(dev->ieee80211_ptr);
6207         return err;
6208 }
6209
6210 static bool
6211 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6212                          int mcast_rate[IEEE80211_NUM_BANDS],
6213                          int rateval)
6214 {
6215         struct wiphy *wiphy = &rdev->wiphy;
6216         bool found = false;
6217         int band, i;
6218
6219         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6220                 struct ieee80211_supported_band *sband;
6221
6222                 sband = wiphy->bands[band];
6223                 if (!sband)
6224                         continue;
6225
6226                 for (i = 0; i < sband->n_bitrates; i++) {
6227                         if (sband->bitrates[i].bitrate == rateval) {
6228                                 mcast_rate[band] = i + 1;
6229                                 found = true;
6230                                 break;
6231                         }
6232                 }
6233         }
6234
6235         return found;
6236 }
6237
6238 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6239 {
6240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6241         struct net_device *dev = info->user_ptr[1];
6242         struct cfg80211_ibss_params ibss;
6243         struct wiphy *wiphy;
6244         struct cfg80211_cached_keys *connkeys = NULL;
6245         int err;
6246
6247         memset(&ibss, 0, sizeof(ibss));
6248
6249         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6250                 return -EINVAL;
6251
6252         if (!info->attrs[NL80211_ATTR_SSID] ||
6253             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6254                 return -EINVAL;
6255
6256         ibss.beacon_interval = 100;
6257
6258         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6259                 ibss.beacon_interval =
6260                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6261                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6262                         return -EINVAL;
6263         }
6264
6265         if (!rdev->ops->join_ibss)
6266                 return -EOPNOTSUPP;
6267
6268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6269                 return -EOPNOTSUPP;
6270
6271         wiphy = &rdev->wiphy;
6272
6273         if (info->attrs[NL80211_ATTR_MAC]) {
6274                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6275
6276                 if (!is_valid_ether_addr(ibss.bssid))
6277                         return -EINVAL;
6278         }
6279         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6280         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6281
6282         if (info->attrs[NL80211_ATTR_IE]) {
6283                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6284                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6285         }
6286
6287         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6288         if (err)
6289                 return err;
6290
6291         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6292                 return -EINVAL;
6293
6294         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6295                 return -EINVAL;
6296         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6297             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6298                 return -EINVAL;
6299
6300         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6301         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6302
6303         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6304                 u8 *rates =
6305                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6306                 int n_rates =
6307                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6308                 struct ieee80211_supported_band *sband =
6309                         wiphy->bands[ibss.chandef.chan->band];
6310
6311                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6312                                              &ibss.basic_rates);
6313                 if (err)
6314                         return err;
6315         }
6316
6317         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6318             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6319                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6320                 return -EINVAL;
6321
6322         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6323                 bool no_ht = false;
6324
6325                 connkeys = nl80211_parse_connkeys(rdev,
6326                                           info->attrs[NL80211_ATTR_KEYS],
6327                                           &no_ht);
6328                 if (IS_ERR(connkeys))
6329                         return PTR_ERR(connkeys);
6330
6331                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6332                     no_ht) {
6333                         kfree(connkeys);
6334                         return -EINVAL;
6335                 }
6336         }
6337
6338         ibss.control_port =
6339                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6340
6341         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6342         if (err)
6343                 kfree(connkeys);
6344         return err;
6345 }
6346
6347 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6348 {
6349         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6350         struct net_device *dev = info->user_ptr[1];
6351
6352         if (!rdev->ops->leave_ibss)
6353                 return -EOPNOTSUPP;
6354
6355         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6356                 return -EOPNOTSUPP;
6357
6358         return cfg80211_leave_ibss(rdev, dev, false);
6359 }
6360
6361 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6362 {
6363         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6364         struct net_device *dev = info->user_ptr[1];
6365         int mcast_rate[IEEE80211_NUM_BANDS];
6366         u32 nla_rate;
6367         int err;
6368
6369         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6370             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6371                 return -EOPNOTSUPP;
6372
6373         if (!rdev->ops->set_mcast_rate)
6374                 return -EOPNOTSUPP;
6375
6376         memset(mcast_rate, 0, sizeof(mcast_rate));
6377
6378         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6379                 return -EINVAL;
6380
6381         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6382         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6383                 return -EINVAL;
6384
6385         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6386
6387         return err;
6388 }
6389
6390
6391 #ifdef CONFIG_NL80211_TESTMODE
6392 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6393         .name = "testmode",
6394 };
6395
6396 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6397 {
6398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6399         int err;
6400
6401         if (!info->attrs[NL80211_ATTR_TESTDATA])
6402                 return -EINVAL;
6403
6404         err = -EOPNOTSUPP;
6405         if (rdev->ops->testmode_cmd) {
6406                 rdev->testmode_info = info;
6407                 err = rdev_testmode_cmd(rdev,
6408                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6409                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6410                 rdev->testmode_info = NULL;
6411         }
6412
6413         return err;
6414 }
6415
6416 static int nl80211_testmode_dump(struct sk_buff *skb,
6417                                  struct netlink_callback *cb)
6418 {
6419         struct cfg80211_registered_device *rdev;
6420         int err;
6421         long phy_idx;
6422         void *data = NULL;
6423         int data_len = 0;
6424
6425         rtnl_lock();
6426
6427         if (cb->args[0]) {
6428                 /*
6429                  * 0 is a valid index, but not valid for args[0],
6430                  * so we need to offset by 1.
6431                  */
6432                 phy_idx = cb->args[0] - 1;
6433         } else {
6434                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6435                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6436                                   nl80211_policy);
6437                 if (err)
6438                         goto out_err;
6439
6440                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6441                                                   nl80211_fam.attrbuf);
6442                 if (IS_ERR(rdev)) {
6443                         err = PTR_ERR(rdev);
6444                         goto out_err;
6445                 }
6446                 phy_idx = rdev->wiphy_idx;
6447                 rdev = NULL;
6448
6449                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6450                         cb->args[1] =
6451                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6452         }
6453
6454         if (cb->args[1]) {
6455                 data = nla_data((void *)cb->args[1]);
6456                 data_len = nla_len((void *)cb->args[1]);
6457         }
6458
6459         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6460         if (!rdev) {
6461                 err = -ENOENT;
6462                 goto out_err;
6463         }
6464
6465         if (!rdev->ops->testmode_dump) {
6466                 err = -EOPNOTSUPP;
6467                 goto out_err;
6468         }
6469
6470         while (1) {
6471                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6472                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6473                                            NL80211_CMD_TESTMODE);
6474                 struct nlattr *tmdata;
6475
6476                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6477                         genlmsg_cancel(skb, hdr);
6478                         break;
6479                 }
6480
6481                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6482                 if (!tmdata) {
6483                         genlmsg_cancel(skb, hdr);
6484                         break;
6485                 }
6486                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6487                 nla_nest_end(skb, tmdata);
6488
6489                 if (err == -ENOBUFS || err == -ENOENT) {
6490                         genlmsg_cancel(skb, hdr);
6491                         break;
6492                 } else if (err) {
6493                         genlmsg_cancel(skb, hdr);
6494                         goto out_err;
6495                 }
6496
6497                 genlmsg_end(skb, hdr);
6498         }
6499
6500         err = skb->len;
6501         /* see above */
6502         cb->args[0] = phy_idx + 1;
6503  out_err:
6504         rtnl_unlock();
6505         return err;
6506 }
6507
6508 static struct sk_buff *
6509 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6510                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6511 {
6512         struct sk_buff *skb;
6513         void *hdr;
6514         struct nlattr *data;
6515
6516         skb = nlmsg_new(approxlen + 100, gfp);
6517         if (!skb)
6518                 return NULL;
6519
6520         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6521         if (!hdr) {
6522                 kfree_skb(skb);
6523                 return NULL;
6524         }
6525
6526         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6527                 goto nla_put_failure;
6528         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6529
6530         ((void **)skb->cb)[0] = rdev;
6531         ((void **)skb->cb)[1] = hdr;
6532         ((void **)skb->cb)[2] = data;
6533
6534         return skb;
6535
6536  nla_put_failure:
6537         kfree_skb(skb);
6538         return NULL;
6539 }
6540
6541 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6542                                                   int approxlen)
6543 {
6544         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6545
6546         if (WARN_ON(!rdev->testmode_info))
6547                 return NULL;
6548
6549         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6550                                 rdev->testmode_info->snd_portid,
6551                                 rdev->testmode_info->snd_seq,
6552                                 GFP_KERNEL);
6553 }
6554 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6555
6556 int cfg80211_testmode_reply(struct sk_buff *skb)
6557 {
6558         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6559         void *hdr = ((void **)skb->cb)[1];
6560         struct nlattr *data = ((void **)skb->cb)[2];
6561
6562         if (WARN_ON(!rdev->testmode_info)) {
6563                 kfree_skb(skb);
6564                 return -EINVAL;
6565         }
6566
6567         nla_nest_end(skb, data);
6568         genlmsg_end(skb, hdr);
6569         return genlmsg_reply(skb, rdev->testmode_info);
6570 }
6571 EXPORT_SYMBOL(cfg80211_testmode_reply);
6572
6573 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6574                                                   int approxlen, gfp_t gfp)
6575 {
6576         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6577
6578         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6579 }
6580 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6581
6582 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6583 {
6584         void *hdr = ((void **)skb->cb)[1];
6585         struct nlattr *data = ((void **)skb->cb)[2];
6586
6587         nla_nest_end(skb, data);
6588         genlmsg_end(skb, hdr);
6589         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6590 }
6591 EXPORT_SYMBOL(cfg80211_testmode_event);
6592 #endif
6593
6594 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6595 {
6596         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6597         struct net_device *dev = info->user_ptr[1];
6598         struct cfg80211_connect_params connect;
6599         struct wiphy *wiphy;
6600         struct cfg80211_cached_keys *connkeys = NULL;
6601         int err;
6602
6603         memset(&connect, 0, sizeof(connect));
6604
6605         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6606                 return -EINVAL;
6607
6608         if (!info->attrs[NL80211_ATTR_SSID] ||
6609             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6610                 return -EINVAL;
6611
6612         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6613                 connect.auth_type =
6614                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6615                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6616                                              NL80211_CMD_CONNECT))
6617                         return -EINVAL;
6618         } else
6619                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6620
6621         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6622
6623         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6624                                       NL80211_MAX_NR_CIPHER_SUITES);
6625         if (err)
6626                 return err;
6627
6628         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6629             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6630                 return -EOPNOTSUPP;
6631
6632         wiphy = &rdev->wiphy;
6633
6634         connect.bg_scan_period = -1;
6635         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6636                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6637                 connect.bg_scan_period =
6638                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6639         }
6640
6641         if (info->attrs[NL80211_ATTR_MAC])
6642                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6643         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6644         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6645
6646         if (info->attrs[NL80211_ATTR_IE]) {
6647                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6648                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6649         }
6650
6651         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6652                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6653                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6654                     connect.mfp != NL80211_MFP_NO)
6655                         return -EINVAL;
6656         } else {
6657                 connect.mfp = NL80211_MFP_NO;
6658         }
6659
6660         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6661                 connect.channel =
6662                         ieee80211_get_channel(wiphy,
6663                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6664                 if (!connect.channel ||
6665                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6666                         return -EINVAL;
6667         }
6668
6669         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6670                 connkeys = nl80211_parse_connkeys(rdev,
6671                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6672                 if (IS_ERR(connkeys))
6673                         return PTR_ERR(connkeys);
6674         }
6675
6676         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6677                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6678
6679         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6680                 memcpy(&connect.ht_capa_mask,
6681                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6682                        sizeof(connect.ht_capa_mask));
6683
6684         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6685                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6686                         kfree(connkeys);
6687                         return -EINVAL;
6688                 }
6689                 memcpy(&connect.ht_capa,
6690                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6691                        sizeof(connect.ht_capa));
6692         }
6693
6694         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6695                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6696
6697         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6698                 memcpy(&connect.vht_capa_mask,
6699                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6700                        sizeof(connect.vht_capa_mask));
6701
6702         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6703                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6704                         kfree(connkeys);
6705                         return -EINVAL;
6706                 }
6707                 memcpy(&connect.vht_capa,
6708                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6709                        sizeof(connect.vht_capa));
6710         }
6711
6712         wdev_lock(dev->ieee80211_ptr);
6713         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
6714         wdev_unlock(dev->ieee80211_ptr);
6715         if (err)
6716                 kfree(connkeys);
6717         return err;
6718 }
6719
6720 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6721 {
6722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6723         struct net_device *dev = info->user_ptr[1];
6724         u16 reason;
6725         int ret;
6726
6727         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6728                 reason = WLAN_REASON_DEAUTH_LEAVING;
6729         else
6730                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6731
6732         if (reason == 0)
6733                 return -EINVAL;
6734
6735         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6736             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6737                 return -EOPNOTSUPP;
6738
6739         wdev_lock(dev->ieee80211_ptr);
6740         ret = cfg80211_disconnect(rdev, dev, reason, true);
6741         wdev_unlock(dev->ieee80211_ptr);
6742         return ret;
6743 }
6744
6745 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6746 {
6747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6748         struct net *net;
6749         int err;
6750         u32 pid;
6751
6752         if (!info->attrs[NL80211_ATTR_PID])
6753                 return -EINVAL;
6754
6755         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6756
6757         net = get_net_ns_by_pid(pid);
6758         if (IS_ERR(net))
6759                 return PTR_ERR(net);
6760
6761         err = 0;
6762
6763         /* check if anything to do */
6764         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6765                 err = cfg80211_switch_netns(rdev, net);
6766
6767         put_net(net);
6768         return err;
6769 }
6770
6771 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6772 {
6773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6774         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6775                         struct cfg80211_pmksa *pmksa) = NULL;
6776         struct net_device *dev = info->user_ptr[1];
6777         struct cfg80211_pmksa pmksa;
6778
6779         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6780
6781         if (!info->attrs[NL80211_ATTR_MAC])
6782                 return -EINVAL;
6783
6784         if (!info->attrs[NL80211_ATTR_PMKID])
6785                 return -EINVAL;
6786
6787         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6788         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6789
6790         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6791             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6792                 return -EOPNOTSUPP;
6793
6794         switch (info->genlhdr->cmd) {
6795         case NL80211_CMD_SET_PMKSA:
6796                 rdev_ops = rdev->ops->set_pmksa;
6797                 break;
6798         case NL80211_CMD_DEL_PMKSA:
6799                 rdev_ops = rdev->ops->del_pmksa;
6800                 break;
6801         default:
6802                 WARN_ON(1);
6803                 break;
6804         }
6805
6806         if (!rdev_ops)
6807                 return -EOPNOTSUPP;
6808
6809         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6810 }
6811
6812 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6813 {
6814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6815         struct net_device *dev = info->user_ptr[1];
6816
6817         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6818             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6819                 return -EOPNOTSUPP;
6820
6821         if (!rdev->ops->flush_pmksa)
6822                 return -EOPNOTSUPP;
6823
6824         return rdev_flush_pmksa(rdev, dev);
6825 }
6826
6827 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6828 {
6829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6830         struct net_device *dev = info->user_ptr[1];
6831         u8 action_code, dialog_token;
6832         u16 status_code;
6833         u8 *peer;
6834
6835         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6836             !rdev->ops->tdls_mgmt)
6837                 return -EOPNOTSUPP;
6838
6839         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6840             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6841             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6842             !info->attrs[NL80211_ATTR_IE] ||
6843             !info->attrs[NL80211_ATTR_MAC])
6844                 return -EINVAL;
6845
6846         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6847         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6848         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6849         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6850
6851         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6852                               dialog_token, status_code,
6853                               nla_data(info->attrs[NL80211_ATTR_IE]),
6854                               nla_len(info->attrs[NL80211_ATTR_IE]));
6855 }
6856
6857 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6858 {
6859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6860         struct net_device *dev = info->user_ptr[1];
6861         enum nl80211_tdls_operation operation;
6862         u8 *peer;
6863
6864         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6865             !rdev->ops->tdls_oper)
6866                 return -EOPNOTSUPP;
6867
6868         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6869             !info->attrs[NL80211_ATTR_MAC])
6870                 return -EINVAL;
6871
6872         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6873         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6874
6875         return rdev_tdls_oper(rdev, dev, peer, operation);
6876 }
6877
6878 static int nl80211_remain_on_channel(struct sk_buff *skb,
6879                                      struct genl_info *info)
6880 {
6881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6882         struct wireless_dev *wdev = info->user_ptr[1];
6883         struct cfg80211_chan_def chandef;
6884         struct sk_buff *msg;
6885         void *hdr;
6886         u64 cookie;
6887         u32 duration;
6888         int err;
6889
6890         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6891             !info->attrs[NL80211_ATTR_DURATION])
6892                 return -EINVAL;
6893
6894         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6895
6896         if (!rdev->ops->remain_on_channel ||
6897             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6898                 return -EOPNOTSUPP;
6899
6900         /*
6901          * We should be on that channel for at least a minimum amount of
6902          * time (10ms) but no longer than the driver supports.
6903          */
6904         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6905             duration > rdev->wiphy.max_remain_on_channel_duration)
6906                 return -EINVAL;
6907
6908         err = nl80211_parse_chandef(rdev, info, &chandef);
6909         if (err)
6910                 return err;
6911
6912         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6913         if (!msg)
6914                 return -ENOMEM;
6915
6916         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6917                              NL80211_CMD_REMAIN_ON_CHANNEL);
6918
6919         if (IS_ERR(hdr)) {
6920                 err = PTR_ERR(hdr);
6921                 goto free_msg;
6922         }
6923
6924         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6925                                      duration, &cookie);
6926
6927         if (err)
6928                 goto free_msg;
6929
6930         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6931                 goto nla_put_failure;
6932
6933         genlmsg_end(msg, hdr);
6934
6935         return genlmsg_reply(msg, info);
6936
6937  nla_put_failure:
6938         err = -ENOBUFS;
6939  free_msg:
6940         nlmsg_free(msg);
6941         return err;
6942 }
6943
6944 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6945                                             struct genl_info *info)
6946 {
6947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6948         struct wireless_dev *wdev = info->user_ptr[1];
6949         u64 cookie;
6950
6951         if (!info->attrs[NL80211_ATTR_COOKIE])
6952                 return -EINVAL;
6953
6954         if (!rdev->ops->cancel_remain_on_channel)
6955                 return -EOPNOTSUPP;
6956
6957         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6958
6959         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6960 }
6961
6962 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6963                            u8 *rates, u8 rates_len)
6964 {
6965         u8 i;
6966         u32 mask = 0;
6967
6968         for (i = 0; i < rates_len; i++) {
6969                 int rate = (rates[i] & 0x7f) * 5;
6970                 int ridx;
6971                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6972                         struct ieee80211_rate *srate =
6973                                 &sband->bitrates[ridx];
6974                         if (rate == srate->bitrate) {
6975                                 mask |= 1 << ridx;
6976                                 break;
6977                         }
6978                 }
6979                 if (ridx == sband->n_bitrates)
6980                         return 0; /* rate not found */
6981         }
6982
6983         return mask;
6984 }
6985
6986 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6987                                u8 *rates, u8 rates_len,
6988                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6989 {
6990         u8 i;
6991
6992         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6993
6994         for (i = 0; i < rates_len; i++) {
6995                 int ridx, rbit;
6996
6997                 ridx = rates[i] / 8;
6998                 rbit = BIT(rates[i] % 8);
6999
7000                 /* check validity */
7001                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7002                         return false;
7003
7004                 /* check availability */
7005                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7006                         mcs[ridx] |= rbit;
7007                 else
7008                         return false;
7009         }
7010
7011         return true;
7012 }
7013
7014 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7015         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7016                                     .len = NL80211_MAX_SUPP_RATES },
7017         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7018                                  .len = NL80211_MAX_SUPP_HT_RATES },
7019 };
7020
7021 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7022                                        struct genl_info *info)
7023 {
7024         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7026         struct cfg80211_bitrate_mask mask;
7027         int rem, i;
7028         struct net_device *dev = info->user_ptr[1];
7029         struct nlattr *tx_rates;
7030         struct ieee80211_supported_band *sband;
7031
7032         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7033                 return -EINVAL;
7034
7035         if (!rdev->ops->set_bitrate_mask)
7036                 return -EOPNOTSUPP;
7037
7038         memset(&mask, 0, sizeof(mask));
7039         /* Default to all rates enabled */
7040         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7041                 sband = rdev->wiphy.bands[i];
7042                 mask.control[i].legacy =
7043                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7044                 if (sband)
7045                         memcpy(mask.control[i].mcs,
7046                                sband->ht_cap.mcs.rx_mask,
7047                                sizeof(mask.control[i].mcs));
7048                 else
7049                         memset(mask.control[i].mcs, 0,
7050                                sizeof(mask.control[i].mcs));
7051         }
7052
7053         /*
7054          * The nested attribute uses enum nl80211_band as the index. This maps
7055          * directly to the enum ieee80211_band values used in cfg80211.
7056          */
7057         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7058         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7059         {
7060                 enum ieee80211_band band = nla_type(tx_rates);
7061                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7062                         return -EINVAL;
7063                 sband = rdev->wiphy.bands[band];
7064                 if (sband == NULL)
7065                         return -EINVAL;
7066                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7067                           nla_len(tx_rates), nl80211_txattr_policy);
7068                 if (tb[NL80211_TXRATE_LEGACY]) {
7069                         mask.control[band].legacy = rateset_to_mask(
7070                                 sband,
7071                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7072                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7073                         if ((mask.control[band].legacy == 0) &&
7074                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7075                                 return -EINVAL;
7076                 }
7077                 if (tb[NL80211_TXRATE_MCS]) {
7078                         if (!ht_rateset_to_mask(
7079                                         sband,
7080                                         nla_data(tb[NL80211_TXRATE_MCS]),
7081                                         nla_len(tb[NL80211_TXRATE_MCS]),
7082                                         mask.control[band].mcs))
7083                                 return -EINVAL;
7084                 }
7085
7086                 if (mask.control[band].legacy == 0) {
7087                         /* don't allow empty legacy rates if HT
7088                          * is not even supported. */
7089                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7090                                 return -EINVAL;
7091
7092                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7093                                 if (mask.control[band].mcs[i])
7094                                         break;
7095
7096                         /* legacy and mcs rates may not be both empty */
7097                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7098                                 return -EINVAL;
7099                 }
7100         }
7101
7102         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7103 }
7104
7105 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7106 {
7107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7108         struct wireless_dev *wdev = info->user_ptr[1];
7109         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7110
7111         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7112                 return -EINVAL;
7113
7114         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7115                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7116
7117         switch (wdev->iftype) {
7118         case NL80211_IFTYPE_STATION:
7119         case NL80211_IFTYPE_ADHOC:
7120         case NL80211_IFTYPE_P2P_CLIENT:
7121         case NL80211_IFTYPE_AP:
7122         case NL80211_IFTYPE_AP_VLAN:
7123         case NL80211_IFTYPE_MESH_POINT:
7124         case NL80211_IFTYPE_P2P_GO:
7125         case NL80211_IFTYPE_P2P_DEVICE:
7126                 break;
7127         default:
7128                 return -EOPNOTSUPP;
7129         }
7130
7131         /* not much point in registering if we can't reply */
7132         if (!rdev->ops->mgmt_tx)
7133                 return -EOPNOTSUPP;
7134
7135         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7136                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7137                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7138 }
7139
7140 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7141 {
7142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7143         struct wireless_dev *wdev = info->user_ptr[1];
7144         struct cfg80211_chan_def chandef;
7145         int err;
7146         void *hdr = NULL;
7147         u64 cookie;
7148         struct sk_buff *msg = NULL;
7149         unsigned int wait = 0;
7150         bool offchan, no_cck, dont_wait_for_ack;
7151
7152         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7153
7154         if (!info->attrs[NL80211_ATTR_FRAME])
7155                 return -EINVAL;
7156
7157         if (!rdev->ops->mgmt_tx)
7158                 return -EOPNOTSUPP;
7159
7160         switch (wdev->iftype) {
7161         case NL80211_IFTYPE_P2P_DEVICE:
7162                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7163                         return -EINVAL;
7164         case NL80211_IFTYPE_STATION:
7165         case NL80211_IFTYPE_ADHOC:
7166         case NL80211_IFTYPE_P2P_CLIENT:
7167         case NL80211_IFTYPE_AP:
7168         case NL80211_IFTYPE_AP_VLAN:
7169         case NL80211_IFTYPE_MESH_POINT:
7170         case NL80211_IFTYPE_P2P_GO:
7171                 break;
7172         default:
7173                 return -EOPNOTSUPP;
7174         }
7175
7176         if (info->attrs[NL80211_ATTR_DURATION]) {
7177                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7178                         return -EINVAL;
7179                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7180
7181                 /*
7182                  * We should wait on the channel for at least a minimum amount
7183                  * of time (10ms) but no longer than the driver supports.
7184                  */
7185                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7186                     wait > rdev->wiphy.max_remain_on_channel_duration)
7187                         return -EINVAL;
7188
7189         }
7190
7191         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7192
7193         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7194                 return -EINVAL;
7195
7196         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7197
7198         /* get the channel if any has been specified, otherwise pass NULL to
7199          * the driver. The latter will use the current one
7200          */
7201         chandef.chan = NULL;
7202         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7203                 err = nl80211_parse_chandef(rdev, info, &chandef);
7204                 if (err)
7205                         return err;
7206         }
7207
7208         if (!chandef.chan && offchan)
7209                 return -EINVAL;
7210
7211         if (!dont_wait_for_ack) {
7212                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7213                 if (!msg)
7214                         return -ENOMEM;
7215
7216                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7217                                      NL80211_CMD_FRAME);
7218
7219                 if (IS_ERR(hdr)) {
7220                         err = PTR_ERR(hdr);
7221                         goto free_msg;
7222                 }
7223         }
7224
7225         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7226                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7227                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7228                                     no_cck, dont_wait_for_ack, &cookie);
7229         if (err)
7230                 goto free_msg;
7231
7232         if (msg) {
7233                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7234                         goto nla_put_failure;
7235
7236                 genlmsg_end(msg, hdr);
7237                 return genlmsg_reply(msg, info);
7238         }
7239
7240         return 0;
7241
7242  nla_put_failure:
7243         err = -ENOBUFS;
7244  free_msg:
7245         nlmsg_free(msg);
7246         return err;
7247 }
7248
7249 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7250 {
7251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7252         struct wireless_dev *wdev = info->user_ptr[1];
7253         u64 cookie;
7254
7255         if (!info->attrs[NL80211_ATTR_COOKIE])
7256                 return -EINVAL;
7257
7258         if (!rdev->ops->mgmt_tx_cancel_wait)
7259                 return -EOPNOTSUPP;
7260
7261         switch (wdev->iftype) {
7262         case NL80211_IFTYPE_STATION:
7263         case NL80211_IFTYPE_ADHOC:
7264         case NL80211_IFTYPE_P2P_CLIENT:
7265         case NL80211_IFTYPE_AP:
7266         case NL80211_IFTYPE_AP_VLAN:
7267         case NL80211_IFTYPE_P2P_GO:
7268         case NL80211_IFTYPE_P2P_DEVICE:
7269                 break;
7270         default:
7271                 return -EOPNOTSUPP;
7272         }
7273
7274         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7275
7276         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7277 }
7278
7279 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7280 {
7281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7282         struct wireless_dev *wdev;
7283         struct net_device *dev = info->user_ptr[1];
7284         u8 ps_state;
7285         bool state;
7286         int err;
7287
7288         if (!info->attrs[NL80211_ATTR_PS_STATE])
7289                 return -EINVAL;
7290
7291         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7292
7293         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7294                 return -EINVAL;
7295
7296         wdev = dev->ieee80211_ptr;
7297
7298         if (!rdev->ops->set_power_mgmt)
7299                 return -EOPNOTSUPP;
7300
7301         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7302
7303         if (state == wdev->ps)
7304                 return 0;
7305
7306         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7307         if (!err)
7308                 wdev->ps = state;
7309         return err;
7310 }
7311
7312 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7313 {
7314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7315         enum nl80211_ps_state ps_state;
7316         struct wireless_dev *wdev;
7317         struct net_device *dev = info->user_ptr[1];
7318         struct sk_buff *msg;
7319         void *hdr;
7320         int err;
7321
7322         wdev = dev->ieee80211_ptr;
7323
7324         if (!rdev->ops->set_power_mgmt)
7325                 return -EOPNOTSUPP;
7326
7327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7328         if (!msg)
7329                 return -ENOMEM;
7330
7331         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7332                              NL80211_CMD_GET_POWER_SAVE);
7333         if (!hdr) {
7334                 err = -ENOBUFS;
7335                 goto free_msg;
7336         }
7337
7338         if (wdev->ps)
7339                 ps_state = NL80211_PS_ENABLED;
7340         else
7341                 ps_state = NL80211_PS_DISABLED;
7342
7343         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7344                 goto nla_put_failure;
7345
7346         genlmsg_end(msg, hdr);
7347         return genlmsg_reply(msg, info);
7348
7349  nla_put_failure:
7350         err = -ENOBUFS;
7351  free_msg:
7352         nlmsg_free(msg);
7353         return err;
7354 }
7355
7356 static struct nla_policy
7357 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7358         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7359         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7360         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7361         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7362         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7363         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7364 };
7365
7366 static int nl80211_set_cqm_txe(struct genl_info *info,
7367                                u32 rate, u32 pkts, u32 intvl)
7368 {
7369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7370         struct wireless_dev *wdev;
7371         struct net_device *dev = info->user_ptr[1];
7372
7373         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7374                 return -EINVAL;
7375
7376         wdev = dev->ieee80211_ptr;
7377
7378         if (!rdev->ops->set_cqm_txe_config)
7379                 return -EOPNOTSUPP;
7380
7381         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7382             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7383                 return -EOPNOTSUPP;
7384
7385         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7386 }
7387
7388 static int nl80211_set_cqm_rssi(struct genl_info *info,
7389                                 s32 threshold, u32 hysteresis)
7390 {
7391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7392         struct wireless_dev *wdev;
7393         struct net_device *dev = info->user_ptr[1];
7394
7395         if (threshold > 0)
7396                 return -EINVAL;
7397
7398         wdev = dev->ieee80211_ptr;
7399
7400         if (!rdev->ops->set_cqm_rssi_config)
7401                 return -EOPNOTSUPP;
7402
7403         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7404             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7405                 return -EOPNOTSUPP;
7406
7407         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7408 }
7409
7410 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7411 {
7412         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7413         struct nlattr *cqm;
7414         int err;
7415
7416         cqm = info->attrs[NL80211_ATTR_CQM];
7417         if (!cqm) {
7418                 err = -EINVAL;
7419                 goto out;
7420         }
7421
7422         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7423                                nl80211_attr_cqm_policy);
7424         if (err)
7425                 goto out;
7426
7427         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7428             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7429                 s32 threshold;
7430                 u32 hysteresis;
7431                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7432                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7433                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7434         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7435                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7436                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7437                 u32 rate, pkts, intvl;
7438                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7439                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7440                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7441                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7442         } else
7443                 err = -EINVAL;
7444
7445 out:
7446         return err;
7447 }
7448
7449 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7450 {
7451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7452         struct net_device *dev = info->user_ptr[1];
7453         struct mesh_config cfg;
7454         struct mesh_setup setup;
7455         int err;
7456
7457         /* start with default */
7458         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7459         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7460
7461         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7462                 /* and parse parameters if given */
7463                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7464                 if (err)
7465                         return err;
7466         }
7467
7468         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7469             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7470                 return -EINVAL;
7471
7472         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7473         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7474
7475         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7476             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7477                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7478                         return -EINVAL;
7479
7480         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7481                 setup.beacon_interval =
7482                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7483                 if (setup.beacon_interval < 10 ||
7484                     setup.beacon_interval > 10000)
7485                         return -EINVAL;
7486         }
7487
7488         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7489                 setup.dtim_period =
7490                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7491                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7492                         return -EINVAL;
7493         }
7494
7495         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7496                 /* parse additional setup parameters if given */
7497                 err = nl80211_parse_mesh_setup(info, &setup);
7498                 if (err)
7499                         return err;
7500         }
7501
7502         if (setup.user_mpm)
7503                 cfg.auto_open_plinks = false;
7504
7505         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7506                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7507                 if (err)
7508                         return err;
7509         } else {
7510                 /* cfg80211_join_mesh() will sort it out */
7511                 setup.chandef.chan = NULL;
7512         }
7513
7514         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7515                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7516                 int n_rates =
7517                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7518                 struct ieee80211_supported_band *sband;
7519
7520                 if (!setup.chandef.chan)
7521                         return -EINVAL;
7522
7523                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7524
7525                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7526                                              &setup.basic_rates);
7527                 if (err)
7528                         return err;
7529         }
7530
7531         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7532 }
7533
7534 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7535 {
7536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7537         struct net_device *dev = info->user_ptr[1];
7538
7539         return cfg80211_leave_mesh(rdev, dev);
7540 }
7541
7542 #ifdef CONFIG_PM
7543 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7544                                         struct cfg80211_registered_device *rdev)
7545 {
7546         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7547         struct nlattr *nl_pats, *nl_pat;
7548         int i, pat_len;
7549
7550         if (!wowlan->n_patterns)
7551                 return 0;
7552
7553         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7554         if (!nl_pats)
7555                 return -ENOBUFS;
7556
7557         for (i = 0; i < wowlan->n_patterns; i++) {
7558                 nl_pat = nla_nest_start(msg, i + 1);
7559                 if (!nl_pat)
7560                         return -ENOBUFS;
7561                 pat_len = wowlan->patterns[i].pattern_len;
7562                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7563                             DIV_ROUND_UP(pat_len, 8),
7564                             wowlan->patterns[i].mask) ||
7565                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7566                             pat_len, wowlan->patterns[i].pattern) ||
7567                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7568                                 wowlan->patterns[i].pkt_offset))
7569                         return -ENOBUFS;
7570                 nla_nest_end(msg, nl_pat);
7571         }
7572         nla_nest_end(msg, nl_pats);
7573
7574         return 0;
7575 }
7576
7577 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7578                                    struct cfg80211_wowlan_tcp *tcp)
7579 {
7580         struct nlattr *nl_tcp;
7581
7582         if (!tcp)
7583                 return 0;
7584
7585         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7586         if (!nl_tcp)
7587                 return -ENOBUFS;
7588
7589         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7590             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7591             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7592             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7593             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7594             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7595                     tcp->payload_len, tcp->payload) ||
7596             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7597                         tcp->data_interval) ||
7598             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7599                     tcp->wake_len, tcp->wake_data) ||
7600             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7601                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7602                 return -ENOBUFS;
7603
7604         if (tcp->payload_seq.len &&
7605             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7606                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7607                 return -ENOBUFS;
7608
7609         if (tcp->payload_tok.len &&
7610             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7611                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7612                     &tcp->payload_tok))
7613                 return -ENOBUFS;
7614
7615         nla_nest_end(msg, nl_tcp);
7616
7617         return 0;
7618 }
7619
7620 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7621 {
7622         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7623         struct sk_buff *msg;
7624         void *hdr;
7625         u32 size = NLMSG_DEFAULT_SIZE;
7626
7627         if (!rdev->wiphy.wowlan)
7628                 return -EOPNOTSUPP;
7629
7630         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7631                 /* adjust size to have room for all the data */
7632                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7633                         rdev->wiphy.wowlan_config->tcp->payload_len +
7634                         rdev->wiphy.wowlan_config->tcp->wake_len +
7635                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7636         }
7637
7638         msg = nlmsg_new(size, GFP_KERNEL);
7639         if (!msg)
7640                 return -ENOMEM;
7641
7642         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7643                              NL80211_CMD_GET_WOWLAN);
7644         if (!hdr)
7645                 goto nla_put_failure;
7646
7647         if (rdev->wiphy.wowlan_config) {
7648                 struct nlattr *nl_wowlan;
7649
7650                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7651                 if (!nl_wowlan)
7652                         goto nla_put_failure;
7653
7654                 if ((rdev->wiphy.wowlan_config->any &&
7655                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7656                     (rdev->wiphy.wowlan_config->disconnect &&
7657                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7658                     (rdev->wiphy.wowlan_config->magic_pkt &&
7659                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7660                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7661                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7662                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7663                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7664                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7665                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7666                     (rdev->wiphy.wowlan_config->rfkill_release &&
7667                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7668                         goto nla_put_failure;
7669
7670                 if (nl80211_send_wowlan_patterns(msg, rdev))
7671                         goto nla_put_failure;
7672
7673                 if (nl80211_send_wowlan_tcp(msg,
7674                                             rdev->wiphy.wowlan_config->tcp))
7675                         goto nla_put_failure;
7676
7677                 nla_nest_end(msg, nl_wowlan);
7678         }
7679
7680         genlmsg_end(msg, hdr);
7681         return genlmsg_reply(msg, info);
7682
7683 nla_put_failure:
7684         nlmsg_free(msg);
7685         return -ENOBUFS;
7686 }
7687
7688 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7689                                     struct nlattr *attr,
7690                                     struct cfg80211_wowlan *trig)
7691 {
7692         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7693         struct cfg80211_wowlan_tcp *cfg;
7694         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7695         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7696         u32 size;
7697         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7698         int err, port;
7699
7700         if (!rdev->wiphy.wowlan->tcp)
7701                 return -EINVAL;
7702
7703         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7704                         nla_data(attr), nla_len(attr),
7705                         nl80211_wowlan_tcp_policy);
7706         if (err)
7707                 return err;
7708
7709         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7710             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7711             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7712             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7713             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7714             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7715             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7716             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7717                 return -EINVAL;
7718
7719         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7720         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
7721                 return -EINVAL;
7722
7723         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7724                         rdev->wiphy.wowlan->tcp->data_interval_max ||
7725             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7726                 return -EINVAL;
7727
7728         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7729         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
7730                 return -EINVAL;
7731
7732         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7733         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7734                 return -EINVAL;
7735
7736         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7737                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7738
7739                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7740                 tokens_size = tokln - sizeof(*tok);
7741
7742                 if (!tok->len || tokens_size % tok->len)
7743                         return -EINVAL;
7744                 if (!rdev->wiphy.wowlan->tcp->tok)
7745                         return -EINVAL;
7746                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
7747                         return -EINVAL;
7748                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
7749                         return -EINVAL;
7750                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
7751                         return -EINVAL;
7752                 if (tok->offset + tok->len > data_size)
7753                         return -EINVAL;
7754         }
7755
7756         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7757                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7758                 if (!rdev->wiphy.wowlan->tcp->seq)
7759                         return -EINVAL;
7760                 if (seq->len == 0 || seq->len > 4)
7761                         return -EINVAL;
7762                 if (seq->len + seq->offset > data_size)
7763                         return -EINVAL;
7764         }
7765
7766         size = sizeof(*cfg);
7767         size += data_size;
7768         size += wake_size + wake_mask_size;
7769         size += tokens_size;
7770
7771         cfg = kzalloc(size, GFP_KERNEL);
7772         if (!cfg)
7773                 return -ENOMEM;
7774         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7775         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7776         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7777                ETH_ALEN);
7778         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7779                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7780         else
7781                 port = 0;
7782 #ifdef CONFIG_INET
7783         /* allocate a socket and port for it and use it */
7784         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7785                             IPPROTO_TCP, &cfg->sock, 1);
7786         if (err) {
7787                 kfree(cfg);
7788                 return err;
7789         }
7790         if (inet_csk_get_port(cfg->sock->sk, port)) {
7791                 sock_release(cfg->sock);
7792                 kfree(cfg);
7793                 return -EADDRINUSE;
7794         }
7795         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7796 #else
7797         if (!port) {
7798                 kfree(cfg);
7799                 return -EINVAL;
7800         }
7801         cfg->src_port = port;
7802 #endif
7803
7804         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7805         cfg->payload_len = data_size;
7806         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7807         memcpy((void *)cfg->payload,
7808                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7809                data_size);
7810         if (seq)
7811                 cfg->payload_seq = *seq;
7812         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7813         cfg->wake_len = wake_size;
7814         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7815         memcpy((void *)cfg->wake_data,
7816                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7817                wake_size);
7818         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7819                          data_size + wake_size;
7820         memcpy((void *)cfg->wake_mask,
7821                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7822                wake_mask_size);
7823         if (tok) {
7824                 cfg->tokens_size = tokens_size;
7825                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7826         }
7827
7828         trig->tcp = cfg;
7829
7830         return 0;
7831 }
7832
7833 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7834 {
7835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7836         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7837         struct cfg80211_wowlan new_triggers = {};
7838         struct cfg80211_wowlan *ntrig;
7839         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
7840         int err, i;
7841         bool prev_enabled = rdev->wiphy.wowlan_config;
7842
7843         if (!wowlan)
7844                 return -EOPNOTSUPP;
7845
7846         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7847                 cfg80211_rdev_free_wowlan(rdev);
7848                 rdev->wiphy.wowlan_config = NULL;
7849                 goto set_wakeup;
7850         }
7851
7852         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7853                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7854                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7855                         nl80211_wowlan_policy);
7856         if (err)
7857                 return err;
7858
7859         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7860                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7861                         return -EINVAL;
7862                 new_triggers.any = true;
7863         }
7864
7865         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7866                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7867                         return -EINVAL;
7868                 new_triggers.disconnect = true;
7869         }
7870
7871         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7872                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7873                         return -EINVAL;
7874                 new_triggers.magic_pkt = true;
7875         }
7876
7877         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7878                 return -EINVAL;
7879
7880         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7881                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7882                         return -EINVAL;
7883                 new_triggers.gtk_rekey_failure = true;
7884         }
7885
7886         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7887                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7888                         return -EINVAL;
7889                 new_triggers.eap_identity_req = true;
7890         }
7891
7892         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7893                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7894                         return -EINVAL;
7895                 new_triggers.four_way_handshake = true;
7896         }
7897
7898         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7899                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7900                         return -EINVAL;
7901                 new_triggers.rfkill_release = true;
7902         }
7903
7904         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7905                 struct nlattr *pat;
7906                 int n_patterns = 0;
7907                 int rem, pat_len, mask_len, pkt_offset;
7908                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7909
7910                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7911                                     rem)
7912                         n_patterns++;
7913                 if (n_patterns > wowlan->n_patterns)
7914                         return -EINVAL;
7915
7916                 new_triggers.patterns = kcalloc(n_patterns,
7917                                                 sizeof(new_triggers.patterns[0]),
7918                                                 GFP_KERNEL);
7919                 if (!new_triggers.patterns)
7920                         return -ENOMEM;
7921
7922                 new_triggers.n_patterns = n_patterns;
7923                 i = 0;
7924
7925                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7926                                     rem) {
7927                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7928                                   nla_data(pat), nla_len(pat), NULL);
7929                         err = -EINVAL;
7930                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7931                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7932                                 goto error;
7933                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7934                         mask_len = DIV_ROUND_UP(pat_len, 8);
7935                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7936                             mask_len)
7937                                 goto error;
7938                         if (pat_len > wowlan->pattern_max_len ||
7939                             pat_len < wowlan->pattern_min_len)
7940                                 goto error;
7941
7942                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7943                                 pkt_offset = 0;
7944                         else
7945                                 pkt_offset = nla_get_u32(
7946                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7947                         if (pkt_offset > wowlan->max_pkt_offset)
7948                                 goto error;
7949                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7950
7951                         new_triggers.patterns[i].mask =
7952                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7953                         if (!new_triggers.patterns[i].mask) {
7954                                 err = -ENOMEM;
7955                                 goto error;
7956                         }
7957                         new_triggers.patterns[i].pattern =
7958                                 new_triggers.patterns[i].mask + mask_len;
7959                         memcpy(new_triggers.patterns[i].mask,
7960                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7961                                mask_len);
7962                         new_triggers.patterns[i].pattern_len = pat_len;
7963                         memcpy(new_triggers.patterns[i].pattern,
7964                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7965                                pat_len);
7966                         i++;
7967                 }
7968         }
7969
7970         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7971                 err = nl80211_parse_wowlan_tcp(
7972                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7973                         &new_triggers);
7974                 if (err)
7975                         goto error;
7976         }
7977
7978         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7979         if (!ntrig) {
7980                 err = -ENOMEM;
7981                 goto error;
7982         }
7983         cfg80211_rdev_free_wowlan(rdev);
7984         rdev->wiphy.wowlan_config = ntrig;
7985
7986  set_wakeup:
7987         if (rdev->ops->set_wakeup &&
7988             prev_enabled != !!rdev->wiphy.wowlan_config)
7989                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
7990
7991         return 0;
7992  error:
7993         for (i = 0; i < new_triggers.n_patterns; i++)
7994                 kfree(new_triggers.patterns[i].mask);
7995         kfree(new_triggers.patterns);
7996         if (new_triggers.tcp && new_triggers.tcp->sock)
7997                 sock_release(new_triggers.tcp->sock);
7998         kfree(new_triggers.tcp);
7999         return err;
8000 }
8001 #endif
8002
8003 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8004 {
8005         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8006         struct net_device *dev = info->user_ptr[1];
8007         struct wireless_dev *wdev = dev->ieee80211_ptr;
8008         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8009         struct cfg80211_gtk_rekey_data rekey_data;
8010         int err;
8011
8012         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8013                 return -EINVAL;
8014
8015         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8016                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8017                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8018                         nl80211_rekey_policy);
8019         if (err)
8020                 return err;
8021
8022         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8023                 return -ERANGE;
8024         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8025                 return -ERANGE;
8026         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8027                 return -ERANGE;
8028
8029         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8030                NL80211_KEK_LEN);
8031         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8032                NL80211_KCK_LEN);
8033         memcpy(rekey_data.replay_ctr,
8034                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8035                NL80211_REPLAY_CTR_LEN);
8036
8037         wdev_lock(wdev);
8038         if (!wdev->current_bss) {
8039                 err = -ENOTCONN;
8040                 goto out;
8041         }
8042
8043         if (!rdev->ops->set_rekey_data) {
8044                 err = -EOPNOTSUPP;
8045                 goto out;
8046         }
8047
8048         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8049  out:
8050         wdev_unlock(wdev);
8051         return err;
8052 }
8053
8054 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8055                                              struct genl_info *info)
8056 {
8057         struct net_device *dev = info->user_ptr[1];
8058         struct wireless_dev *wdev = dev->ieee80211_ptr;
8059
8060         if (wdev->iftype != NL80211_IFTYPE_AP &&
8061             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8062                 return -EINVAL;
8063
8064         if (wdev->ap_unexpected_nlportid)
8065                 return -EBUSY;
8066
8067         wdev->ap_unexpected_nlportid = info->snd_portid;
8068         return 0;
8069 }
8070
8071 static int nl80211_probe_client(struct sk_buff *skb,
8072                                 struct genl_info *info)
8073 {
8074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8075         struct net_device *dev = info->user_ptr[1];
8076         struct wireless_dev *wdev = dev->ieee80211_ptr;
8077         struct sk_buff *msg;
8078         void *hdr;
8079         const u8 *addr;
8080         u64 cookie;
8081         int err;
8082
8083         if (wdev->iftype != NL80211_IFTYPE_AP &&
8084             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8085                 return -EOPNOTSUPP;
8086
8087         if (!info->attrs[NL80211_ATTR_MAC])
8088                 return -EINVAL;
8089
8090         if (!rdev->ops->probe_client)
8091                 return -EOPNOTSUPP;
8092
8093         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8094         if (!msg)
8095                 return -ENOMEM;
8096
8097         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8098                              NL80211_CMD_PROBE_CLIENT);
8099
8100         if (IS_ERR(hdr)) {
8101                 err = PTR_ERR(hdr);
8102                 goto free_msg;
8103         }
8104
8105         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8106
8107         err = rdev_probe_client(rdev, dev, addr, &cookie);
8108         if (err)
8109                 goto free_msg;
8110
8111         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8112                 goto nla_put_failure;
8113
8114         genlmsg_end(msg, hdr);
8115
8116         return genlmsg_reply(msg, info);
8117
8118  nla_put_failure:
8119         err = -ENOBUFS;
8120  free_msg:
8121         nlmsg_free(msg);
8122         return err;
8123 }
8124
8125 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8126 {
8127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8128         struct cfg80211_beacon_registration *reg, *nreg;
8129         int rv;
8130
8131         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8132                 return -EOPNOTSUPP;
8133
8134         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8135         if (!nreg)
8136                 return -ENOMEM;
8137
8138         /* First, check if already registered. */
8139         spin_lock_bh(&rdev->beacon_registrations_lock);
8140         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8141                 if (reg->nlportid == info->snd_portid) {
8142                         rv = -EALREADY;
8143                         goto out_err;
8144                 }
8145         }
8146         /* Add it to the list */
8147         nreg->nlportid = info->snd_portid;
8148         list_add(&nreg->list, &rdev->beacon_registrations);
8149
8150         spin_unlock_bh(&rdev->beacon_registrations_lock);
8151
8152         return 0;
8153 out_err:
8154         spin_unlock_bh(&rdev->beacon_registrations_lock);
8155         kfree(nreg);
8156         return rv;
8157 }
8158
8159 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8160 {
8161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8162         struct wireless_dev *wdev = info->user_ptr[1];
8163         int err;
8164
8165         if (!rdev->ops->start_p2p_device)
8166                 return -EOPNOTSUPP;
8167
8168         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8169                 return -EOPNOTSUPP;
8170
8171         if (wdev->p2p_started)
8172                 return 0;
8173
8174         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8175         if (err)
8176                 return err;
8177
8178         err = rdev_start_p2p_device(rdev, wdev);
8179         if (err)
8180                 return err;
8181
8182         wdev->p2p_started = true;
8183         rdev->opencount++;
8184
8185         return 0;
8186 }
8187
8188 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8189 {
8190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8191         struct wireless_dev *wdev = info->user_ptr[1];
8192
8193         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8194                 return -EOPNOTSUPP;
8195
8196         if (!rdev->ops->stop_p2p_device)
8197                 return -EOPNOTSUPP;
8198
8199         cfg80211_stop_p2p_device(rdev, wdev);
8200
8201         return 0;
8202 }
8203
8204 static int nl80211_get_protocol_features(struct sk_buff *skb,
8205                                          struct genl_info *info)
8206 {
8207         void *hdr;
8208         struct sk_buff *msg;
8209
8210         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8211         if (!msg)
8212                 return -ENOMEM;
8213
8214         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8215                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8216         if (!hdr)
8217                 goto nla_put_failure;
8218
8219         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8220                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8221                 goto nla_put_failure;
8222
8223         genlmsg_end(msg, hdr);
8224         return genlmsg_reply(msg, info);
8225
8226  nla_put_failure:
8227         kfree_skb(msg);
8228         return -ENOBUFS;
8229 }
8230
8231 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8232 {
8233         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8234         struct cfg80211_update_ft_ies_params ft_params;
8235         struct net_device *dev = info->user_ptr[1];
8236
8237         if (!rdev->ops->update_ft_ies)
8238                 return -EOPNOTSUPP;
8239
8240         if (!info->attrs[NL80211_ATTR_MDID] ||
8241             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8242                 return -EINVAL;
8243
8244         memset(&ft_params, 0, sizeof(ft_params));
8245         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8246         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8247         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8248
8249         return rdev_update_ft_ies(rdev, dev, &ft_params);
8250 }
8251
8252 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8253                                        struct genl_info *info)
8254 {
8255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8256         struct wireless_dev *wdev = info->user_ptr[1];
8257         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8258         u16 duration;
8259         int ret;
8260
8261         if (!rdev->ops->crit_proto_start)
8262                 return -EOPNOTSUPP;
8263
8264         if (WARN_ON(!rdev->ops->crit_proto_stop))
8265                 return -EINVAL;
8266
8267         if (rdev->crit_proto_nlportid)
8268                 return -EBUSY;
8269
8270         /* determine protocol if provided */
8271         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8272                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8273
8274         if (proto >= NUM_NL80211_CRIT_PROTO)
8275                 return -EINVAL;
8276
8277         /* timeout must be provided */
8278         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8279                 return -EINVAL;
8280
8281         duration =
8282                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8283
8284         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8285                 return -ERANGE;
8286
8287         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8288         if (!ret)
8289                 rdev->crit_proto_nlportid = info->snd_portid;
8290
8291         return ret;
8292 }
8293
8294 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8295                                       struct genl_info *info)
8296 {
8297         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8298         struct wireless_dev *wdev = info->user_ptr[1];
8299
8300         if (!rdev->ops->crit_proto_stop)
8301                 return -EOPNOTSUPP;
8302
8303         if (rdev->crit_proto_nlportid) {
8304                 rdev->crit_proto_nlportid = 0;
8305                 rdev_crit_proto_stop(rdev, wdev);
8306         }
8307         return 0;
8308 }
8309
8310 #define NL80211_FLAG_NEED_WIPHY         0x01
8311 #define NL80211_FLAG_NEED_NETDEV        0x02
8312 #define NL80211_FLAG_NEED_RTNL          0x04
8313 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8314 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8315                                          NL80211_FLAG_CHECK_NETDEV_UP)
8316 #define NL80211_FLAG_NEED_WDEV          0x10
8317 /* If a netdev is associated, it must be UP, P2P must be started */
8318 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8319                                          NL80211_FLAG_CHECK_NETDEV_UP)
8320
8321 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8322                             struct genl_info *info)
8323 {
8324         struct cfg80211_registered_device *rdev;
8325         struct wireless_dev *wdev;
8326         struct net_device *dev;
8327         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8328
8329         if (rtnl)
8330                 rtnl_lock();
8331
8332         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8333                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8334                 if (IS_ERR(rdev)) {
8335                         if (rtnl)
8336                                 rtnl_unlock();
8337                         return PTR_ERR(rdev);
8338                 }
8339                 info->user_ptr[0] = rdev;
8340         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8341                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8342                 ASSERT_RTNL();
8343
8344                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8345                                                   info->attrs);
8346                 if (IS_ERR(wdev)) {
8347                         if (rtnl)
8348                                 rtnl_unlock();
8349                         return PTR_ERR(wdev);
8350                 }
8351
8352                 dev = wdev->netdev;
8353                 rdev = wiphy_to_dev(wdev->wiphy);
8354
8355                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8356                         if (!dev) {
8357                                 if (rtnl)
8358                                         rtnl_unlock();
8359                                 return -EINVAL;
8360                         }
8361
8362                         info->user_ptr[1] = dev;
8363                 } else {
8364                         info->user_ptr[1] = wdev;
8365                 }
8366
8367                 if (dev) {
8368                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8369                             !netif_running(dev)) {
8370                                 if (rtnl)
8371                                         rtnl_unlock();
8372                                 return -ENETDOWN;
8373                         }
8374
8375                         dev_hold(dev);
8376                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8377                         if (!wdev->p2p_started) {
8378                                 if (rtnl)
8379                                         rtnl_unlock();
8380                                 return -ENETDOWN;
8381                         }
8382                 }
8383
8384                 info->user_ptr[0] = rdev;
8385         }
8386
8387         return 0;
8388 }
8389
8390 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8391                               struct genl_info *info)
8392 {
8393         if (info->user_ptr[1]) {
8394                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8395                         struct wireless_dev *wdev = info->user_ptr[1];
8396
8397                         if (wdev->netdev)
8398                                 dev_put(wdev->netdev);
8399                 } else {
8400                         dev_put(info->user_ptr[1]);
8401                 }
8402         }
8403         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8404                 rtnl_unlock();
8405 }
8406
8407 static struct genl_ops nl80211_ops[] = {
8408         {
8409                 .cmd = NL80211_CMD_GET_WIPHY,
8410                 .doit = nl80211_get_wiphy,
8411                 .dumpit = nl80211_dump_wiphy,
8412                 .policy = nl80211_policy,
8413                 /* can be retrieved by unprivileged users */
8414                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8415                                   NL80211_FLAG_NEED_RTNL,
8416         },
8417         {
8418                 .cmd = NL80211_CMD_SET_WIPHY,
8419                 .doit = nl80211_set_wiphy,
8420                 .policy = nl80211_policy,
8421                 .flags = GENL_ADMIN_PERM,
8422                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8423         },
8424         {
8425                 .cmd = NL80211_CMD_GET_INTERFACE,
8426                 .doit = nl80211_get_interface,
8427                 .dumpit = nl80211_dump_interface,
8428                 .policy = nl80211_policy,
8429                 /* can be retrieved by unprivileged users */
8430                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8431                                   NL80211_FLAG_NEED_RTNL,
8432         },
8433         {
8434                 .cmd = NL80211_CMD_SET_INTERFACE,
8435                 .doit = nl80211_set_interface,
8436                 .policy = nl80211_policy,
8437                 .flags = GENL_ADMIN_PERM,
8438                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8439                                   NL80211_FLAG_NEED_RTNL,
8440         },
8441         {
8442                 .cmd = NL80211_CMD_NEW_INTERFACE,
8443                 .doit = nl80211_new_interface,
8444                 .policy = nl80211_policy,
8445                 .flags = GENL_ADMIN_PERM,
8446                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8447                                   NL80211_FLAG_NEED_RTNL,
8448         },
8449         {
8450                 .cmd = NL80211_CMD_DEL_INTERFACE,
8451                 .doit = nl80211_del_interface,
8452                 .policy = nl80211_policy,
8453                 .flags = GENL_ADMIN_PERM,
8454                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8455                                   NL80211_FLAG_NEED_RTNL,
8456         },
8457         {
8458                 .cmd = NL80211_CMD_GET_KEY,
8459                 .doit = nl80211_get_key,
8460                 .policy = nl80211_policy,
8461                 .flags = GENL_ADMIN_PERM,
8462                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8463                                   NL80211_FLAG_NEED_RTNL,
8464         },
8465         {
8466                 .cmd = NL80211_CMD_SET_KEY,
8467                 .doit = nl80211_set_key,
8468                 .policy = nl80211_policy,
8469                 .flags = GENL_ADMIN_PERM,
8470                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8471                                   NL80211_FLAG_NEED_RTNL,
8472         },
8473         {
8474                 .cmd = NL80211_CMD_NEW_KEY,
8475                 .doit = nl80211_new_key,
8476                 .policy = nl80211_policy,
8477                 .flags = GENL_ADMIN_PERM,
8478                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8479                                   NL80211_FLAG_NEED_RTNL,
8480         },
8481         {
8482                 .cmd = NL80211_CMD_DEL_KEY,
8483                 .doit = nl80211_del_key,
8484                 .policy = nl80211_policy,
8485                 .flags = GENL_ADMIN_PERM,
8486                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8487                                   NL80211_FLAG_NEED_RTNL,
8488         },
8489         {
8490                 .cmd = NL80211_CMD_SET_BEACON,
8491                 .policy = nl80211_policy,
8492                 .flags = GENL_ADMIN_PERM,
8493                 .doit = nl80211_set_beacon,
8494                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8495                                   NL80211_FLAG_NEED_RTNL,
8496         },
8497         {
8498                 .cmd = NL80211_CMD_START_AP,
8499                 .policy = nl80211_policy,
8500                 .flags = GENL_ADMIN_PERM,
8501                 .doit = nl80211_start_ap,
8502                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8503                                   NL80211_FLAG_NEED_RTNL,
8504         },
8505         {
8506                 .cmd = NL80211_CMD_STOP_AP,
8507                 .policy = nl80211_policy,
8508                 .flags = GENL_ADMIN_PERM,
8509                 .doit = nl80211_stop_ap,
8510                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8511                                   NL80211_FLAG_NEED_RTNL,
8512         },
8513         {
8514                 .cmd = NL80211_CMD_GET_STATION,
8515                 .doit = nl80211_get_station,
8516                 .dumpit = nl80211_dump_station,
8517                 .policy = nl80211_policy,
8518                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8519                                   NL80211_FLAG_NEED_RTNL,
8520         },
8521         {
8522                 .cmd = NL80211_CMD_SET_STATION,
8523                 .doit = nl80211_set_station,
8524                 .policy = nl80211_policy,
8525                 .flags = GENL_ADMIN_PERM,
8526                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8527                                   NL80211_FLAG_NEED_RTNL,
8528         },
8529         {
8530                 .cmd = NL80211_CMD_NEW_STATION,
8531                 .doit = nl80211_new_station,
8532                 .policy = nl80211_policy,
8533                 .flags = GENL_ADMIN_PERM,
8534                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8535                                   NL80211_FLAG_NEED_RTNL,
8536         },
8537         {
8538                 .cmd = NL80211_CMD_DEL_STATION,
8539                 .doit = nl80211_del_station,
8540                 .policy = nl80211_policy,
8541                 .flags = GENL_ADMIN_PERM,
8542                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8543                                   NL80211_FLAG_NEED_RTNL,
8544         },
8545         {
8546                 .cmd = NL80211_CMD_GET_MPATH,
8547                 .doit = nl80211_get_mpath,
8548                 .dumpit = nl80211_dump_mpath,
8549                 .policy = nl80211_policy,
8550                 .flags = GENL_ADMIN_PERM,
8551                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8552                                   NL80211_FLAG_NEED_RTNL,
8553         },
8554         {
8555                 .cmd = NL80211_CMD_SET_MPATH,
8556                 .doit = nl80211_set_mpath,
8557                 .policy = nl80211_policy,
8558                 .flags = GENL_ADMIN_PERM,
8559                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8560                                   NL80211_FLAG_NEED_RTNL,
8561         },
8562         {
8563                 .cmd = NL80211_CMD_NEW_MPATH,
8564                 .doit = nl80211_new_mpath,
8565                 .policy = nl80211_policy,
8566                 .flags = GENL_ADMIN_PERM,
8567                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8568                                   NL80211_FLAG_NEED_RTNL,
8569         },
8570         {
8571                 .cmd = NL80211_CMD_DEL_MPATH,
8572                 .doit = nl80211_del_mpath,
8573                 .policy = nl80211_policy,
8574                 .flags = GENL_ADMIN_PERM,
8575                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8576                                   NL80211_FLAG_NEED_RTNL,
8577         },
8578         {
8579                 .cmd = NL80211_CMD_SET_BSS,
8580                 .doit = nl80211_set_bss,
8581                 .policy = nl80211_policy,
8582                 .flags = GENL_ADMIN_PERM,
8583                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8584                                   NL80211_FLAG_NEED_RTNL,
8585         },
8586         {
8587                 .cmd = NL80211_CMD_GET_REG,
8588                 .doit = nl80211_get_reg,
8589                 .policy = nl80211_policy,
8590                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8591                 /* can be retrieved by unprivileged users */
8592         },
8593         {
8594                 .cmd = NL80211_CMD_SET_REG,
8595                 .doit = nl80211_set_reg,
8596                 .policy = nl80211_policy,
8597                 .flags = GENL_ADMIN_PERM,
8598                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8599         },
8600         {
8601                 .cmd = NL80211_CMD_REQ_SET_REG,
8602                 .doit = nl80211_req_set_reg,
8603                 .policy = nl80211_policy,
8604                 .flags = GENL_ADMIN_PERM,
8605         },
8606         {
8607                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8608                 .doit = nl80211_get_mesh_config,
8609                 .policy = nl80211_policy,
8610                 /* can be retrieved by unprivileged users */
8611                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8612                                   NL80211_FLAG_NEED_RTNL,
8613         },
8614         {
8615                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8616                 .doit = nl80211_update_mesh_config,
8617                 .policy = nl80211_policy,
8618                 .flags = GENL_ADMIN_PERM,
8619                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8620                                   NL80211_FLAG_NEED_RTNL,
8621         },
8622         {
8623                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8624                 .doit = nl80211_trigger_scan,
8625                 .policy = nl80211_policy,
8626                 .flags = GENL_ADMIN_PERM,
8627                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8628                                   NL80211_FLAG_NEED_RTNL,
8629         },
8630         {
8631                 .cmd = NL80211_CMD_GET_SCAN,
8632                 .policy = nl80211_policy,
8633                 .dumpit = nl80211_dump_scan,
8634         },
8635         {
8636                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8637                 .doit = nl80211_start_sched_scan,
8638                 .policy = nl80211_policy,
8639                 .flags = GENL_ADMIN_PERM,
8640                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8641                                   NL80211_FLAG_NEED_RTNL,
8642         },
8643         {
8644                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8645                 .doit = nl80211_stop_sched_scan,
8646                 .policy = nl80211_policy,
8647                 .flags = GENL_ADMIN_PERM,
8648                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8649                                   NL80211_FLAG_NEED_RTNL,
8650         },
8651         {
8652                 .cmd = NL80211_CMD_AUTHENTICATE,
8653                 .doit = nl80211_authenticate,
8654                 .policy = nl80211_policy,
8655                 .flags = GENL_ADMIN_PERM,
8656                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8657                                   NL80211_FLAG_NEED_RTNL,
8658         },
8659         {
8660                 .cmd = NL80211_CMD_ASSOCIATE,
8661                 .doit = nl80211_associate,
8662                 .policy = nl80211_policy,
8663                 .flags = GENL_ADMIN_PERM,
8664                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8665                                   NL80211_FLAG_NEED_RTNL,
8666         },
8667         {
8668                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8669                 .doit = nl80211_deauthenticate,
8670                 .policy = nl80211_policy,
8671                 .flags = GENL_ADMIN_PERM,
8672                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8673                                   NL80211_FLAG_NEED_RTNL,
8674         },
8675         {
8676                 .cmd = NL80211_CMD_DISASSOCIATE,
8677                 .doit = nl80211_disassociate,
8678                 .policy = nl80211_policy,
8679                 .flags = GENL_ADMIN_PERM,
8680                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8681                                   NL80211_FLAG_NEED_RTNL,
8682         },
8683         {
8684                 .cmd = NL80211_CMD_JOIN_IBSS,
8685                 .doit = nl80211_join_ibss,
8686                 .policy = nl80211_policy,
8687                 .flags = GENL_ADMIN_PERM,
8688                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8689                                   NL80211_FLAG_NEED_RTNL,
8690         },
8691         {
8692                 .cmd = NL80211_CMD_LEAVE_IBSS,
8693                 .doit = nl80211_leave_ibss,
8694                 .policy = nl80211_policy,
8695                 .flags = GENL_ADMIN_PERM,
8696                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8697                                   NL80211_FLAG_NEED_RTNL,
8698         },
8699 #ifdef CONFIG_NL80211_TESTMODE
8700         {
8701                 .cmd = NL80211_CMD_TESTMODE,
8702                 .doit = nl80211_testmode_do,
8703                 .dumpit = nl80211_testmode_dump,
8704                 .policy = nl80211_policy,
8705                 .flags = GENL_ADMIN_PERM,
8706                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8707                                   NL80211_FLAG_NEED_RTNL,
8708         },
8709 #endif
8710         {
8711                 .cmd = NL80211_CMD_CONNECT,
8712                 .doit = nl80211_connect,
8713                 .policy = nl80211_policy,
8714                 .flags = GENL_ADMIN_PERM,
8715                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8716                                   NL80211_FLAG_NEED_RTNL,
8717         },
8718         {
8719                 .cmd = NL80211_CMD_DISCONNECT,
8720                 .doit = nl80211_disconnect,
8721                 .policy = nl80211_policy,
8722                 .flags = GENL_ADMIN_PERM,
8723                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8724                                   NL80211_FLAG_NEED_RTNL,
8725         },
8726         {
8727                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8728                 .doit = nl80211_wiphy_netns,
8729                 .policy = nl80211_policy,
8730                 .flags = GENL_ADMIN_PERM,
8731                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8732                                   NL80211_FLAG_NEED_RTNL,
8733         },
8734         {
8735                 .cmd = NL80211_CMD_GET_SURVEY,
8736                 .policy = nl80211_policy,
8737                 .dumpit = nl80211_dump_survey,
8738         },
8739         {
8740                 .cmd = NL80211_CMD_SET_PMKSA,
8741                 .doit = nl80211_setdel_pmksa,
8742                 .policy = nl80211_policy,
8743                 .flags = GENL_ADMIN_PERM,
8744                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8745                                   NL80211_FLAG_NEED_RTNL,
8746         },
8747         {
8748                 .cmd = NL80211_CMD_DEL_PMKSA,
8749                 .doit = nl80211_setdel_pmksa,
8750                 .policy = nl80211_policy,
8751                 .flags = GENL_ADMIN_PERM,
8752                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8753                                   NL80211_FLAG_NEED_RTNL,
8754         },
8755         {
8756                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8757                 .doit = nl80211_flush_pmksa,
8758                 .policy = nl80211_policy,
8759                 .flags = GENL_ADMIN_PERM,
8760                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8761                                   NL80211_FLAG_NEED_RTNL,
8762         },
8763         {
8764                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8765                 .doit = nl80211_remain_on_channel,
8766                 .policy = nl80211_policy,
8767                 .flags = GENL_ADMIN_PERM,
8768                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8769                                   NL80211_FLAG_NEED_RTNL,
8770         },
8771         {
8772                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8773                 .doit = nl80211_cancel_remain_on_channel,
8774                 .policy = nl80211_policy,
8775                 .flags = GENL_ADMIN_PERM,
8776                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8777                                   NL80211_FLAG_NEED_RTNL,
8778         },
8779         {
8780                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8781                 .doit = nl80211_set_tx_bitrate_mask,
8782                 .policy = nl80211_policy,
8783                 .flags = GENL_ADMIN_PERM,
8784                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8785                                   NL80211_FLAG_NEED_RTNL,
8786         },
8787         {
8788                 .cmd = NL80211_CMD_REGISTER_FRAME,
8789                 .doit = nl80211_register_mgmt,
8790                 .policy = nl80211_policy,
8791                 .flags = GENL_ADMIN_PERM,
8792                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8793                                   NL80211_FLAG_NEED_RTNL,
8794         },
8795         {
8796                 .cmd = NL80211_CMD_FRAME,
8797                 .doit = nl80211_tx_mgmt,
8798                 .policy = nl80211_policy,
8799                 .flags = GENL_ADMIN_PERM,
8800                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8801                                   NL80211_FLAG_NEED_RTNL,
8802         },
8803         {
8804                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8805                 .doit = nl80211_tx_mgmt_cancel_wait,
8806                 .policy = nl80211_policy,
8807                 .flags = GENL_ADMIN_PERM,
8808                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8809                                   NL80211_FLAG_NEED_RTNL,
8810         },
8811         {
8812                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8813                 .doit = nl80211_set_power_save,
8814                 .policy = nl80211_policy,
8815                 .flags = GENL_ADMIN_PERM,
8816                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8817                                   NL80211_FLAG_NEED_RTNL,
8818         },
8819         {
8820                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8821                 .doit = nl80211_get_power_save,
8822                 .policy = nl80211_policy,
8823                 /* can be retrieved by unprivileged users */
8824                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8825                                   NL80211_FLAG_NEED_RTNL,
8826         },
8827         {
8828                 .cmd = NL80211_CMD_SET_CQM,
8829                 .doit = nl80211_set_cqm,
8830                 .policy = nl80211_policy,
8831                 .flags = GENL_ADMIN_PERM,
8832                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8833                                   NL80211_FLAG_NEED_RTNL,
8834         },
8835         {
8836                 .cmd = NL80211_CMD_SET_CHANNEL,
8837                 .doit = nl80211_set_channel,
8838                 .policy = nl80211_policy,
8839                 .flags = GENL_ADMIN_PERM,
8840                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8841                                   NL80211_FLAG_NEED_RTNL,
8842         },
8843         {
8844                 .cmd = NL80211_CMD_SET_WDS_PEER,
8845                 .doit = nl80211_set_wds_peer,
8846                 .policy = nl80211_policy,
8847                 .flags = GENL_ADMIN_PERM,
8848                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8849                                   NL80211_FLAG_NEED_RTNL,
8850         },
8851         {
8852                 .cmd = NL80211_CMD_JOIN_MESH,
8853                 .doit = nl80211_join_mesh,
8854                 .policy = nl80211_policy,
8855                 .flags = GENL_ADMIN_PERM,
8856                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8857                                   NL80211_FLAG_NEED_RTNL,
8858         },
8859         {
8860                 .cmd = NL80211_CMD_LEAVE_MESH,
8861                 .doit = nl80211_leave_mesh,
8862                 .policy = nl80211_policy,
8863                 .flags = GENL_ADMIN_PERM,
8864                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8865                                   NL80211_FLAG_NEED_RTNL,
8866         },
8867 #ifdef CONFIG_PM
8868         {
8869                 .cmd = NL80211_CMD_GET_WOWLAN,
8870                 .doit = nl80211_get_wowlan,
8871                 .policy = nl80211_policy,
8872                 /* can be retrieved by unprivileged users */
8873                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8874                                   NL80211_FLAG_NEED_RTNL,
8875         },
8876         {
8877                 .cmd = NL80211_CMD_SET_WOWLAN,
8878                 .doit = nl80211_set_wowlan,
8879                 .policy = nl80211_policy,
8880                 .flags = GENL_ADMIN_PERM,
8881                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8882                                   NL80211_FLAG_NEED_RTNL,
8883         },
8884 #endif
8885         {
8886                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8887                 .doit = nl80211_set_rekey_data,
8888                 .policy = nl80211_policy,
8889                 .flags = GENL_ADMIN_PERM,
8890                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8891                                   NL80211_FLAG_NEED_RTNL,
8892         },
8893         {
8894                 .cmd = NL80211_CMD_TDLS_MGMT,
8895                 .doit = nl80211_tdls_mgmt,
8896                 .policy = nl80211_policy,
8897                 .flags = GENL_ADMIN_PERM,
8898                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8899                                   NL80211_FLAG_NEED_RTNL,
8900         },
8901         {
8902                 .cmd = NL80211_CMD_TDLS_OPER,
8903                 .doit = nl80211_tdls_oper,
8904                 .policy = nl80211_policy,
8905                 .flags = GENL_ADMIN_PERM,
8906                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8907                                   NL80211_FLAG_NEED_RTNL,
8908         },
8909         {
8910                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8911                 .doit = nl80211_register_unexpected_frame,
8912                 .policy = nl80211_policy,
8913                 .flags = GENL_ADMIN_PERM,
8914                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8915                                   NL80211_FLAG_NEED_RTNL,
8916         },
8917         {
8918                 .cmd = NL80211_CMD_PROBE_CLIENT,
8919                 .doit = nl80211_probe_client,
8920                 .policy = nl80211_policy,
8921                 .flags = GENL_ADMIN_PERM,
8922                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8923                                   NL80211_FLAG_NEED_RTNL,
8924         },
8925         {
8926                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8927                 .doit = nl80211_register_beacons,
8928                 .policy = nl80211_policy,
8929                 .flags = GENL_ADMIN_PERM,
8930                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8931                                   NL80211_FLAG_NEED_RTNL,
8932         },
8933         {
8934                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8935                 .doit = nl80211_set_noack_map,
8936                 .policy = nl80211_policy,
8937                 .flags = GENL_ADMIN_PERM,
8938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8939                                   NL80211_FLAG_NEED_RTNL,
8940         },
8941         {
8942                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8943                 .doit = nl80211_start_p2p_device,
8944                 .policy = nl80211_policy,
8945                 .flags = GENL_ADMIN_PERM,
8946                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8947                                   NL80211_FLAG_NEED_RTNL,
8948         },
8949         {
8950                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8951                 .doit = nl80211_stop_p2p_device,
8952                 .policy = nl80211_policy,
8953                 .flags = GENL_ADMIN_PERM,
8954                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8955                                   NL80211_FLAG_NEED_RTNL,
8956         },
8957         {
8958                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8959                 .doit = nl80211_set_mcast_rate,
8960                 .policy = nl80211_policy,
8961                 .flags = GENL_ADMIN_PERM,
8962                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8963                                   NL80211_FLAG_NEED_RTNL,
8964         },
8965         {
8966                 .cmd = NL80211_CMD_SET_MAC_ACL,
8967                 .doit = nl80211_set_mac_acl,
8968                 .policy = nl80211_policy,
8969                 .flags = GENL_ADMIN_PERM,
8970                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8971                                   NL80211_FLAG_NEED_RTNL,
8972         },
8973         {
8974                 .cmd = NL80211_CMD_RADAR_DETECT,
8975                 .doit = nl80211_start_radar_detection,
8976                 .policy = nl80211_policy,
8977                 .flags = GENL_ADMIN_PERM,
8978                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8979                                   NL80211_FLAG_NEED_RTNL,
8980         },
8981         {
8982                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8983                 .doit = nl80211_get_protocol_features,
8984                 .policy = nl80211_policy,
8985         },
8986         {
8987                 .cmd = NL80211_CMD_UPDATE_FT_IES,
8988                 .doit = nl80211_update_ft_ies,
8989                 .policy = nl80211_policy,
8990                 .flags = GENL_ADMIN_PERM,
8991                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8992                                   NL80211_FLAG_NEED_RTNL,
8993         },
8994         {
8995                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
8996                 .doit = nl80211_crit_protocol_start,
8997                 .policy = nl80211_policy,
8998                 .flags = GENL_ADMIN_PERM,
8999                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9000                                   NL80211_FLAG_NEED_RTNL,
9001         },
9002         {
9003                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9004                 .doit = nl80211_crit_protocol_stop,
9005                 .policy = nl80211_policy,
9006                 .flags = GENL_ADMIN_PERM,
9007                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9008                                   NL80211_FLAG_NEED_RTNL,
9009         }
9010 };
9011
9012 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9013         .name = "mlme",
9014 };
9015
9016 /* multicast groups */
9017 static struct genl_multicast_group nl80211_config_mcgrp = {
9018         .name = "config",
9019 };
9020 static struct genl_multicast_group nl80211_scan_mcgrp = {
9021         .name = "scan",
9022 };
9023 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9024         .name = "regulatory",
9025 };
9026
9027 /* notification functions */
9028
9029 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9030 {
9031         struct sk_buff *msg;
9032
9033         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9034         if (!msg)
9035                 return;
9036
9037         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
9038                                false, NULL, NULL, NULL) < 0) {
9039                 nlmsg_free(msg);
9040                 return;
9041         }
9042
9043         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9044                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9045 }
9046
9047 static int nl80211_add_scan_req(struct sk_buff *msg,
9048                                 struct cfg80211_registered_device *rdev)
9049 {
9050         struct cfg80211_scan_request *req = rdev->scan_req;
9051         struct nlattr *nest;
9052         int i;
9053
9054         if (WARN_ON(!req))
9055                 return 0;
9056
9057         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9058         if (!nest)
9059                 goto nla_put_failure;
9060         for (i = 0; i < req->n_ssids; i++) {
9061                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9062                         goto nla_put_failure;
9063         }
9064         nla_nest_end(msg, nest);
9065
9066         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9067         if (!nest)
9068                 goto nla_put_failure;
9069         for (i = 0; i < req->n_channels; i++) {
9070                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9071                         goto nla_put_failure;
9072         }
9073         nla_nest_end(msg, nest);
9074
9075         if (req->ie &&
9076             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9077                 goto nla_put_failure;
9078
9079         if (req->flags)
9080                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9081
9082         return 0;
9083  nla_put_failure:
9084         return -ENOBUFS;
9085 }
9086
9087 static int nl80211_send_scan_msg(struct sk_buff *msg,
9088                                  struct cfg80211_registered_device *rdev,
9089                                  struct wireless_dev *wdev,
9090                                  u32 portid, u32 seq, int flags,
9091                                  u32 cmd)
9092 {
9093         void *hdr;
9094
9095         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9096         if (!hdr)
9097                 return -1;
9098
9099         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9100             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9101                                          wdev->netdev->ifindex)) ||
9102             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9103                 goto nla_put_failure;
9104
9105         /* ignore errors and send incomplete event anyway */
9106         nl80211_add_scan_req(msg, rdev);
9107
9108         return genlmsg_end(msg, hdr);
9109
9110  nla_put_failure:
9111         genlmsg_cancel(msg, hdr);
9112         return -EMSGSIZE;
9113 }
9114
9115 static int
9116 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9117                             struct cfg80211_registered_device *rdev,
9118                             struct net_device *netdev,
9119                             u32 portid, u32 seq, int flags, u32 cmd)
9120 {
9121         void *hdr;
9122
9123         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9124         if (!hdr)
9125                 return -1;
9126
9127         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9128             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9129                 goto nla_put_failure;
9130
9131         return genlmsg_end(msg, hdr);
9132
9133  nla_put_failure:
9134         genlmsg_cancel(msg, hdr);
9135         return -EMSGSIZE;
9136 }
9137
9138 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9139                              struct wireless_dev *wdev)
9140 {
9141         struct sk_buff *msg;
9142
9143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9144         if (!msg)
9145                 return;
9146
9147         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9148                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9149                 nlmsg_free(msg);
9150                 return;
9151         }
9152
9153         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9154                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9155 }
9156
9157 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9158                             struct wireless_dev *wdev)
9159 {
9160         struct sk_buff *msg;
9161
9162         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9163         if (!msg)
9164                 return;
9165
9166         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9167                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9168                 nlmsg_free(msg);
9169                 return;
9170         }
9171
9172         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9173                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9174 }
9175
9176 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9177                                struct wireless_dev *wdev)
9178 {
9179         struct sk_buff *msg;
9180
9181         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9182         if (!msg)
9183                 return;
9184
9185         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9186                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9187                 nlmsg_free(msg);
9188                 return;
9189         }
9190
9191         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9192                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9193 }
9194
9195 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9196                                      struct net_device *netdev)
9197 {
9198         struct sk_buff *msg;
9199
9200         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9201         if (!msg)
9202                 return;
9203
9204         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9205                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9206                 nlmsg_free(msg);
9207                 return;
9208         }
9209
9210         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9211                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9212 }
9213
9214 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9215                              struct net_device *netdev, u32 cmd)
9216 {
9217         struct sk_buff *msg;
9218
9219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9220         if (!msg)
9221                 return;
9222
9223         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9224                 nlmsg_free(msg);
9225                 return;
9226         }
9227
9228         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9229                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9230 }
9231
9232 /*
9233  * This can happen on global regulatory changes or device specific settings
9234  * based on custom world regulatory domains.
9235  */
9236 void nl80211_send_reg_change_event(struct regulatory_request *request)
9237 {
9238         struct sk_buff *msg;
9239         void *hdr;
9240
9241         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9242         if (!msg)
9243                 return;
9244
9245         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9246         if (!hdr) {
9247                 nlmsg_free(msg);
9248                 return;
9249         }
9250
9251         /* Userspace can always count this one always being set */
9252         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9253                 goto nla_put_failure;
9254
9255         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9256                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9257                                NL80211_REGDOM_TYPE_WORLD))
9258                         goto nla_put_failure;
9259         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9260                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9261                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9262                         goto nla_put_failure;
9263         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9264                    request->intersect) {
9265                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9266                                NL80211_REGDOM_TYPE_INTERSECTION))
9267                         goto nla_put_failure;
9268         } else {
9269                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9270                                NL80211_REGDOM_TYPE_COUNTRY) ||
9271                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9272                                    request->alpha2))
9273                         goto nla_put_failure;
9274         }
9275
9276         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9277             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9278                 goto nla_put_failure;
9279
9280         genlmsg_end(msg, hdr);
9281
9282         rcu_read_lock();
9283         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9284                                 GFP_ATOMIC);
9285         rcu_read_unlock();
9286
9287         return;
9288
9289 nla_put_failure:
9290         genlmsg_cancel(msg, hdr);
9291         nlmsg_free(msg);
9292 }
9293
9294 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9295                                     struct net_device *netdev,
9296                                     const u8 *buf, size_t len,
9297                                     enum nl80211_commands cmd, gfp_t gfp)
9298 {
9299         struct sk_buff *msg;
9300         void *hdr;
9301
9302         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9303         if (!msg)
9304                 return;
9305
9306         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9307         if (!hdr) {
9308                 nlmsg_free(msg);
9309                 return;
9310         }
9311
9312         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9313             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9314             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9315                 goto nla_put_failure;
9316
9317         genlmsg_end(msg, hdr);
9318
9319         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9320                                 nl80211_mlme_mcgrp.id, gfp);
9321         return;
9322
9323  nla_put_failure:
9324         genlmsg_cancel(msg, hdr);
9325         nlmsg_free(msg);
9326 }
9327
9328 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9329                           struct net_device *netdev, const u8 *buf,
9330                           size_t len, gfp_t gfp)
9331 {
9332         nl80211_send_mlme_event(rdev, netdev, buf, len,
9333                                 NL80211_CMD_AUTHENTICATE, gfp);
9334 }
9335
9336 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9337                            struct net_device *netdev, const u8 *buf,
9338                            size_t len, gfp_t gfp)
9339 {
9340         nl80211_send_mlme_event(rdev, netdev, buf, len,
9341                                 NL80211_CMD_ASSOCIATE, gfp);
9342 }
9343
9344 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9345                          struct net_device *netdev, const u8 *buf,
9346                          size_t len, gfp_t gfp)
9347 {
9348         nl80211_send_mlme_event(rdev, netdev, buf, len,
9349                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9350 }
9351
9352 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9353                            struct net_device *netdev, const u8 *buf,
9354                            size_t len, gfp_t gfp)
9355 {
9356         nl80211_send_mlme_event(rdev, netdev, buf, len,
9357                                 NL80211_CMD_DISASSOCIATE, gfp);
9358 }
9359
9360 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9361                                   size_t len)
9362 {
9363         struct wireless_dev *wdev = dev->ieee80211_ptr;
9364         struct wiphy *wiphy = wdev->wiphy;
9365         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9366         const struct ieee80211_mgmt *mgmt = (void *)buf;
9367         u32 cmd;
9368
9369         if (WARN_ON(len < 2))
9370                 return;
9371
9372         if (ieee80211_is_deauth(mgmt->frame_control))
9373                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9374         else
9375                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9376
9377         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9378         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9379 }
9380 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9381
9382 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9383                                       struct net_device *netdev, int cmd,
9384                                       const u8 *addr, gfp_t gfp)
9385 {
9386         struct sk_buff *msg;
9387         void *hdr;
9388
9389         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9390         if (!msg)
9391                 return;
9392
9393         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9394         if (!hdr) {
9395                 nlmsg_free(msg);
9396                 return;
9397         }
9398
9399         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9400             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9401             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9402             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9403                 goto nla_put_failure;
9404
9405         genlmsg_end(msg, hdr);
9406
9407         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9408                                 nl80211_mlme_mcgrp.id, gfp);
9409         return;
9410
9411  nla_put_failure:
9412         genlmsg_cancel(msg, hdr);
9413         nlmsg_free(msg);
9414 }
9415
9416 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9417                                struct net_device *netdev, const u8 *addr,
9418                                gfp_t gfp)
9419 {
9420         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9421                                   addr, gfp);
9422 }
9423
9424 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9425                                 struct net_device *netdev, const u8 *addr,
9426                                 gfp_t gfp)
9427 {
9428         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9429                                   addr, gfp);
9430 }
9431
9432 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9433                                  struct net_device *netdev, const u8 *bssid,
9434                                  const u8 *req_ie, size_t req_ie_len,
9435                                  const u8 *resp_ie, size_t resp_ie_len,
9436                                  u16 status, gfp_t gfp)
9437 {
9438         struct sk_buff *msg;
9439         void *hdr;
9440
9441         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9442         if (!msg)
9443                 return;
9444
9445         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9446         if (!hdr) {
9447                 nlmsg_free(msg);
9448                 return;
9449         }
9450
9451         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9452             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9453             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9454             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9455             (req_ie &&
9456              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9457             (resp_ie &&
9458              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9459                 goto nla_put_failure;
9460
9461         genlmsg_end(msg, hdr);
9462
9463         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9464                                 nl80211_mlme_mcgrp.id, gfp);
9465         return;
9466
9467  nla_put_failure:
9468         genlmsg_cancel(msg, hdr);
9469         nlmsg_free(msg);
9470
9471 }
9472
9473 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9474                          struct net_device *netdev, const u8 *bssid,
9475                          const u8 *req_ie, size_t req_ie_len,
9476                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9477 {
9478         struct sk_buff *msg;
9479         void *hdr;
9480
9481         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9482         if (!msg)
9483                 return;
9484
9485         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9486         if (!hdr) {
9487                 nlmsg_free(msg);
9488                 return;
9489         }
9490
9491         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9494             (req_ie &&
9495              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9496             (resp_ie &&
9497              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9498                 goto nla_put_failure;
9499
9500         genlmsg_end(msg, hdr);
9501
9502         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9503                                 nl80211_mlme_mcgrp.id, gfp);
9504         return;
9505
9506  nla_put_failure:
9507         genlmsg_cancel(msg, hdr);
9508         nlmsg_free(msg);
9509
9510 }
9511
9512 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9513                                struct net_device *netdev, u16 reason,
9514                                const u8 *ie, size_t ie_len, bool from_ap)
9515 {
9516         struct sk_buff *msg;
9517         void *hdr;
9518
9519         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9520         if (!msg)
9521                 return;
9522
9523         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9524         if (!hdr) {
9525                 nlmsg_free(msg);
9526                 return;
9527         }
9528
9529         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9530             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9531             (from_ap && reason &&
9532              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9533             (from_ap &&
9534              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9535             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9536                 goto nla_put_failure;
9537
9538         genlmsg_end(msg, hdr);
9539
9540         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9541                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9542         return;
9543
9544  nla_put_failure:
9545         genlmsg_cancel(msg, hdr);
9546         nlmsg_free(msg);
9547
9548 }
9549
9550 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9551                              struct net_device *netdev, const u8 *bssid,
9552                              gfp_t gfp)
9553 {
9554         struct sk_buff *msg;
9555         void *hdr;
9556
9557         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9558         if (!msg)
9559                 return;
9560
9561         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9562         if (!hdr) {
9563                 nlmsg_free(msg);
9564                 return;
9565         }
9566
9567         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9568             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9569             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9570                 goto nla_put_failure;
9571
9572         genlmsg_end(msg, hdr);
9573
9574         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9575                                 nl80211_mlme_mcgrp.id, gfp);
9576         return;
9577
9578  nla_put_failure:
9579         genlmsg_cancel(msg, hdr);
9580         nlmsg_free(msg);
9581 }
9582
9583 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9584                                         const u8* ie, u8 ie_len, gfp_t gfp)
9585 {
9586         struct wireless_dev *wdev = dev->ieee80211_ptr;
9587         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9588         struct sk_buff *msg;
9589         void *hdr;
9590
9591         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9592                 return;
9593
9594         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9595
9596         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9597         if (!msg)
9598                 return;
9599
9600         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9601         if (!hdr) {
9602                 nlmsg_free(msg);
9603                 return;
9604         }
9605
9606         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9607             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9608             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9609             (ie_len && ie &&
9610              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9611                 goto nla_put_failure;
9612
9613         genlmsg_end(msg, hdr);
9614
9615         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9616                                 nl80211_mlme_mcgrp.id, gfp);
9617         return;
9618
9619  nla_put_failure:
9620         genlmsg_cancel(msg, hdr);
9621         nlmsg_free(msg);
9622 }
9623 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9624
9625 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9626                                  struct net_device *netdev, const u8 *addr,
9627                                  enum nl80211_key_type key_type, int key_id,
9628                                  const u8 *tsc, gfp_t gfp)
9629 {
9630         struct sk_buff *msg;
9631         void *hdr;
9632
9633         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9634         if (!msg)
9635                 return;
9636
9637         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9638         if (!hdr) {
9639                 nlmsg_free(msg);
9640                 return;
9641         }
9642
9643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9644             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9645             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9646             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9647             (key_id != -1 &&
9648              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9649             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9650                 goto nla_put_failure;
9651
9652         genlmsg_end(msg, hdr);
9653
9654         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9655                                 nl80211_mlme_mcgrp.id, gfp);
9656         return;
9657
9658  nla_put_failure:
9659         genlmsg_cancel(msg, hdr);
9660         nlmsg_free(msg);
9661 }
9662
9663 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9664                                     struct ieee80211_channel *channel_before,
9665                                     struct ieee80211_channel *channel_after)
9666 {
9667         struct sk_buff *msg;
9668         void *hdr;
9669         struct nlattr *nl_freq;
9670
9671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9672         if (!msg)
9673                 return;
9674
9675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9676         if (!hdr) {
9677                 nlmsg_free(msg);
9678                 return;
9679         }
9680
9681         /*
9682          * Since we are applying the beacon hint to a wiphy we know its
9683          * wiphy_idx is valid
9684          */
9685         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9686                 goto nla_put_failure;
9687
9688         /* Before */
9689         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9690         if (!nl_freq)
9691                 goto nla_put_failure;
9692         if (nl80211_msg_put_channel(msg, channel_before, false))
9693                 goto nla_put_failure;
9694         nla_nest_end(msg, nl_freq);
9695
9696         /* After */
9697         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9698         if (!nl_freq)
9699                 goto nla_put_failure;
9700         if (nl80211_msg_put_channel(msg, channel_after, false))
9701                 goto nla_put_failure;
9702         nla_nest_end(msg, nl_freq);
9703
9704         genlmsg_end(msg, hdr);
9705
9706         rcu_read_lock();
9707         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9708                                 GFP_ATOMIC);
9709         rcu_read_unlock();
9710
9711         return;
9712
9713 nla_put_failure:
9714         genlmsg_cancel(msg, hdr);
9715         nlmsg_free(msg);
9716 }
9717
9718 static void nl80211_send_remain_on_chan_event(
9719         int cmd, struct cfg80211_registered_device *rdev,
9720         struct wireless_dev *wdev, u64 cookie,
9721         struct ieee80211_channel *chan,
9722         unsigned int duration, gfp_t gfp)
9723 {
9724         struct sk_buff *msg;
9725         void *hdr;
9726
9727         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9728         if (!msg)
9729                 return;
9730
9731         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9732         if (!hdr) {
9733                 nlmsg_free(msg);
9734                 return;
9735         }
9736
9737         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9738             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9739                                          wdev->netdev->ifindex)) ||
9740             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9741             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9742             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9743                         NL80211_CHAN_NO_HT) ||
9744             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9745                 goto nla_put_failure;
9746
9747         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9748             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9749                 goto nla_put_failure;
9750
9751         genlmsg_end(msg, hdr);
9752
9753         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9754                                 nl80211_mlme_mcgrp.id, gfp);
9755         return;
9756
9757  nla_put_failure:
9758         genlmsg_cancel(msg, hdr);
9759         nlmsg_free(msg);
9760 }
9761
9762 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9763                                struct ieee80211_channel *chan,
9764                                unsigned int duration, gfp_t gfp)
9765 {
9766         struct wiphy *wiphy = wdev->wiphy;
9767         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9768
9769         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9770         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9771                                           rdev, wdev, cookie, chan,
9772                                           duration, gfp);
9773 }
9774 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9775
9776 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9777                                         struct ieee80211_channel *chan,
9778                                         gfp_t gfp)
9779 {
9780         struct wiphy *wiphy = wdev->wiphy;
9781         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9782
9783         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9784         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9785                                           rdev, wdev, cookie, chan, 0, gfp);
9786 }
9787 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9788
9789 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9790                       struct station_info *sinfo, gfp_t gfp)
9791 {
9792         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9793         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9794         struct sk_buff *msg;
9795
9796         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9797
9798         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9799         if (!msg)
9800                 return;
9801
9802         if (nl80211_send_station(msg, 0, 0, 0,
9803                                  rdev, dev, mac_addr, sinfo) < 0) {
9804                 nlmsg_free(msg);
9805                 return;
9806         }
9807
9808         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9809                                 nl80211_mlme_mcgrp.id, gfp);
9810 }
9811 EXPORT_SYMBOL(cfg80211_new_sta);
9812
9813 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9814 {
9815         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9816         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9817         struct sk_buff *msg;
9818         void *hdr;
9819
9820         trace_cfg80211_del_sta(dev, mac_addr);
9821
9822         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9823         if (!msg)
9824                 return;
9825
9826         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9827         if (!hdr) {
9828                 nlmsg_free(msg);
9829                 return;
9830         }
9831
9832         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9833             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9834                 goto nla_put_failure;
9835
9836         genlmsg_end(msg, hdr);
9837
9838         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9839                                 nl80211_mlme_mcgrp.id, gfp);
9840         return;
9841
9842  nla_put_failure:
9843         genlmsg_cancel(msg, hdr);
9844         nlmsg_free(msg);
9845 }
9846 EXPORT_SYMBOL(cfg80211_del_sta);
9847
9848 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9849                           enum nl80211_connect_failed_reason reason,
9850                           gfp_t gfp)
9851 {
9852         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9853         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9854         struct sk_buff *msg;
9855         void *hdr;
9856
9857         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9858         if (!msg)
9859                 return;
9860
9861         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9862         if (!hdr) {
9863                 nlmsg_free(msg);
9864                 return;
9865         }
9866
9867         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9868             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9869             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9870                 goto nla_put_failure;
9871
9872         genlmsg_end(msg, hdr);
9873
9874         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9875                                 nl80211_mlme_mcgrp.id, gfp);
9876         return;
9877
9878  nla_put_failure:
9879         genlmsg_cancel(msg, hdr);
9880         nlmsg_free(msg);
9881 }
9882 EXPORT_SYMBOL(cfg80211_conn_failed);
9883
9884 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9885                                        const u8 *addr, gfp_t gfp)
9886 {
9887         struct wireless_dev *wdev = dev->ieee80211_ptr;
9888         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9889         struct sk_buff *msg;
9890         void *hdr;
9891         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9892
9893         if (!nlportid)
9894                 return false;
9895
9896         msg = nlmsg_new(100, gfp);
9897         if (!msg)
9898                 return true;
9899
9900         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9901         if (!hdr) {
9902                 nlmsg_free(msg);
9903                 return true;
9904         }
9905
9906         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9907             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9908             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9909                 goto nla_put_failure;
9910
9911         genlmsg_end(msg, hdr);
9912         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9913         return true;
9914
9915  nla_put_failure:
9916         genlmsg_cancel(msg, hdr);
9917         nlmsg_free(msg);
9918         return true;
9919 }
9920
9921 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9922                                 const u8 *addr, gfp_t gfp)
9923 {
9924         struct wireless_dev *wdev = dev->ieee80211_ptr;
9925         bool ret;
9926
9927         trace_cfg80211_rx_spurious_frame(dev, addr);
9928
9929         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9930                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9931                 trace_cfg80211_return_bool(false);
9932                 return false;
9933         }
9934         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9935                                          addr, gfp);
9936         trace_cfg80211_return_bool(ret);
9937         return ret;
9938 }
9939 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9940
9941 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9942                                         const u8 *addr, gfp_t gfp)
9943 {
9944         struct wireless_dev *wdev = dev->ieee80211_ptr;
9945         bool ret;
9946
9947         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9948
9949         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9950                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9951                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9952                 trace_cfg80211_return_bool(false);
9953                 return false;
9954         }
9955         ret = __nl80211_unexpected_frame(dev,
9956                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9957                                          addr, gfp);
9958         trace_cfg80211_return_bool(ret);
9959         return ret;
9960 }
9961 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9962
9963 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9964                       struct wireless_dev *wdev, u32 nlportid,
9965                       int freq, int sig_dbm,
9966                       const u8 *buf, size_t len, gfp_t gfp)
9967 {
9968         struct net_device *netdev = wdev->netdev;
9969         struct sk_buff *msg;
9970         void *hdr;
9971
9972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9973         if (!msg)
9974                 return -ENOMEM;
9975
9976         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9977         if (!hdr) {
9978                 nlmsg_free(msg);
9979                 return -ENOMEM;
9980         }
9981
9982         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9983             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9984                                         netdev->ifindex)) ||
9985             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9986             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9987             (sig_dbm &&
9988              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9989             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9990                 goto nla_put_failure;
9991
9992         genlmsg_end(msg, hdr);
9993
9994         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9995
9996  nla_put_failure:
9997         genlmsg_cancel(msg, hdr);
9998         nlmsg_free(msg);
9999         return -ENOBUFS;
10000 }
10001
10002 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10003                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10004 {
10005         struct wiphy *wiphy = wdev->wiphy;
10006         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10007         struct net_device *netdev = wdev->netdev;
10008         struct sk_buff *msg;
10009         void *hdr;
10010
10011         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10012
10013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10014         if (!msg)
10015                 return;
10016
10017         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10018         if (!hdr) {
10019                 nlmsg_free(msg);
10020                 return;
10021         }
10022
10023         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10024             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10025                                    netdev->ifindex)) ||
10026             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10027             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10028             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10029             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10030                 goto nla_put_failure;
10031
10032         genlmsg_end(msg, hdr);
10033
10034         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
10035         return;
10036
10037  nla_put_failure:
10038         genlmsg_cancel(msg, hdr);
10039         nlmsg_free(msg);
10040 }
10041 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10042
10043 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10044                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10045                               gfp_t gfp)
10046 {
10047         struct wireless_dev *wdev = dev->ieee80211_ptr;
10048         struct wiphy *wiphy = wdev->wiphy;
10049         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10050         struct sk_buff *msg;
10051         struct nlattr *pinfoattr;
10052         void *hdr;
10053
10054         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10055
10056         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10057         if (!msg)
10058                 return;
10059
10060         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10061         if (!hdr) {
10062                 nlmsg_free(msg);
10063                 return;
10064         }
10065
10066         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10067             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10068                 goto nla_put_failure;
10069
10070         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10071         if (!pinfoattr)
10072                 goto nla_put_failure;
10073
10074         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10075                         rssi_event))
10076                 goto nla_put_failure;
10077
10078         nla_nest_end(msg, pinfoattr);
10079
10080         genlmsg_end(msg, hdr);
10081
10082         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10083                                 nl80211_mlme_mcgrp.id, gfp);
10084         return;
10085
10086  nla_put_failure:
10087         genlmsg_cancel(msg, hdr);
10088         nlmsg_free(msg);
10089 }
10090 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10091
10092 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10093                                      struct net_device *netdev, const u8 *bssid,
10094                                      const u8 *replay_ctr, gfp_t gfp)
10095 {
10096         struct sk_buff *msg;
10097         struct nlattr *rekey_attr;
10098         void *hdr;
10099
10100         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10101         if (!msg)
10102                 return;
10103
10104         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10105         if (!hdr) {
10106                 nlmsg_free(msg);
10107                 return;
10108         }
10109
10110         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10111             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10112             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10113                 goto nla_put_failure;
10114
10115         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10116         if (!rekey_attr)
10117                 goto nla_put_failure;
10118
10119         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10120                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10121                 goto nla_put_failure;
10122
10123         nla_nest_end(msg, rekey_attr);
10124
10125         genlmsg_end(msg, hdr);
10126
10127         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10128                                 nl80211_mlme_mcgrp.id, gfp);
10129         return;
10130
10131  nla_put_failure:
10132         genlmsg_cancel(msg, hdr);
10133         nlmsg_free(msg);
10134 }
10135
10136 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10137                                const u8 *replay_ctr, gfp_t gfp)
10138 {
10139         struct wireless_dev *wdev = dev->ieee80211_ptr;
10140         struct wiphy *wiphy = wdev->wiphy;
10141         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10142
10143         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10144         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10145 }
10146 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10147
10148 static void
10149 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10150                                struct net_device *netdev, int index,
10151                                const u8 *bssid, bool preauth, gfp_t gfp)
10152 {
10153         struct sk_buff *msg;
10154         struct nlattr *attr;
10155         void *hdr;
10156
10157         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10158         if (!msg)
10159                 return;
10160
10161         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10162         if (!hdr) {
10163                 nlmsg_free(msg);
10164                 return;
10165         }
10166
10167         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10168             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10169                 goto nla_put_failure;
10170
10171         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10172         if (!attr)
10173                 goto nla_put_failure;
10174
10175         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10176             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10177             (preauth &&
10178              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10179                 goto nla_put_failure;
10180
10181         nla_nest_end(msg, attr);
10182
10183         genlmsg_end(msg, hdr);
10184
10185         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10186                                 nl80211_mlme_mcgrp.id, gfp);
10187         return;
10188
10189  nla_put_failure:
10190         genlmsg_cancel(msg, hdr);
10191         nlmsg_free(msg);
10192 }
10193
10194 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10195                                      const u8 *bssid, bool preauth, gfp_t gfp)
10196 {
10197         struct wireless_dev *wdev = dev->ieee80211_ptr;
10198         struct wiphy *wiphy = wdev->wiphy;
10199         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10200
10201         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10202         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10203 }
10204 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10205
10206 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10207                                      struct net_device *netdev,
10208                                      struct cfg80211_chan_def *chandef,
10209                                      gfp_t gfp)
10210 {
10211         struct sk_buff *msg;
10212         void *hdr;
10213
10214         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10215         if (!msg)
10216                 return;
10217
10218         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10219         if (!hdr) {
10220                 nlmsg_free(msg);
10221                 return;
10222         }
10223
10224         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10225                 goto nla_put_failure;
10226
10227         if (nl80211_send_chandef(msg, chandef))
10228                 goto nla_put_failure;
10229
10230         genlmsg_end(msg, hdr);
10231
10232         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10233                                 nl80211_mlme_mcgrp.id, gfp);
10234         return;
10235
10236  nla_put_failure:
10237         genlmsg_cancel(msg, hdr);
10238         nlmsg_free(msg);
10239 }
10240
10241 void cfg80211_ch_switch_notify(struct net_device *dev,
10242                                struct cfg80211_chan_def *chandef)
10243 {
10244         struct wireless_dev *wdev = dev->ieee80211_ptr;
10245         struct wiphy *wiphy = wdev->wiphy;
10246         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10247
10248         trace_cfg80211_ch_switch_notify(dev, chandef);
10249
10250         wdev_lock(wdev);
10251
10252         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10253                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10254                 goto out;
10255
10256         wdev->channel = chandef->chan;
10257         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10258 out:
10259         wdev_unlock(wdev);
10260         return;
10261 }
10262 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10263
10264 void cfg80211_cqm_txe_notify(struct net_device *dev,
10265                              const u8 *peer, u32 num_packets,
10266                              u32 rate, u32 intvl, gfp_t gfp)
10267 {
10268         struct wireless_dev *wdev = dev->ieee80211_ptr;
10269         struct wiphy *wiphy = wdev->wiphy;
10270         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10271         struct sk_buff *msg;
10272         struct nlattr *pinfoattr;
10273         void *hdr;
10274
10275         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10276         if (!msg)
10277                 return;
10278
10279         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10280         if (!hdr) {
10281                 nlmsg_free(msg);
10282                 return;
10283         }
10284
10285         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10286             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10287             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10288                 goto nla_put_failure;
10289
10290         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10291         if (!pinfoattr)
10292                 goto nla_put_failure;
10293
10294         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10295                 goto nla_put_failure;
10296
10297         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10298                 goto nla_put_failure;
10299
10300         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10301                 goto nla_put_failure;
10302
10303         nla_nest_end(msg, pinfoattr);
10304
10305         genlmsg_end(msg, hdr);
10306
10307         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10308                                 nl80211_mlme_mcgrp.id, gfp);
10309         return;
10310
10311  nla_put_failure:
10312         genlmsg_cancel(msg, hdr);
10313         nlmsg_free(msg);
10314 }
10315 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10316
10317 void
10318 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10319                      struct cfg80211_chan_def *chandef,
10320                      enum nl80211_radar_event event,
10321                      struct net_device *netdev, gfp_t gfp)
10322 {
10323         struct sk_buff *msg;
10324         void *hdr;
10325
10326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10327         if (!msg)
10328                 return;
10329
10330         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10331         if (!hdr) {
10332                 nlmsg_free(msg);
10333                 return;
10334         }
10335
10336         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10337                 goto nla_put_failure;
10338
10339         /* NOP and radar events don't need a netdev parameter */
10340         if (netdev) {
10341                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10342
10343                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10344                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10345                         goto nla_put_failure;
10346         }
10347
10348         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10349                 goto nla_put_failure;
10350
10351         if (nl80211_send_chandef(msg, chandef))
10352                 goto nla_put_failure;
10353
10354         genlmsg_end(msg, hdr);
10355
10356         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10357                                 nl80211_mlme_mcgrp.id, gfp);
10358         return;
10359
10360  nla_put_failure:
10361         genlmsg_cancel(msg, hdr);
10362         nlmsg_free(msg);
10363 }
10364
10365 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10366                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10367 {
10368         struct wireless_dev *wdev = dev->ieee80211_ptr;
10369         struct wiphy *wiphy = wdev->wiphy;
10370         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10371         struct sk_buff *msg;
10372         struct nlattr *pinfoattr;
10373         void *hdr;
10374
10375         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10376
10377         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10378         if (!msg)
10379                 return;
10380
10381         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10382         if (!hdr) {
10383                 nlmsg_free(msg);
10384                 return;
10385         }
10386
10387         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10388             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10389             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10390                 goto nla_put_failure;
10391
10392         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10393         if (!pinfoattr)
10394                 goto nla_put_failure;
10395
10396         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10397                 goto nla_put_failure;
10398
10399         nla_nest_end(msg, pinfoattr);
10400
10401         genlmsg_end(msg, hdr);
10402
10403         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10404                                 nl80211_mlme_mcgrp.id, gfp);
10405         return;
10406
10407  nla_put_failure:
10408         genlmsg_cancel(msg, hdr);
10409         nlmsg_free(msg);
10410 }
10411 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10412
10413 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10414                            u64 cookie, bool acked, gfp_t gfp)
10415 {
10416         struct wireless_dev *wdev = dev->ieee80211_ptr;
10417         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10418         struct sk_buff *msg;
10419         void *hdr;
10420
10421         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10422
10423         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10424
10425         if (!msg)
10426                 return;
10427
10428         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10429         if (!hdr) {
10430                 nlmsg_free(msg);
10431                 return;
10432         }
10433
10434         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10435             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10436             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10437             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10438             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10439                 goto nla_put_failure;
10440
10441         genlmsg_end(msg, hdr);
10442
10443         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10444                                 nl80211_mlme_mcgrp.id, gfp);
10445         return;
10446
10447  nla_put_failure:
10448         genlmsg_cancel(msg, hdr);
10449         nlmsg_free(msg);
10450 }
10451 EXPORT_SYMBOL(cfg80211_probe_status);
10452
10453 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10454                                  const u8 *frame, size_t len,
10455                                  int freq, int sig_dbm)
10456 {
10457         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10458         struct sk_buff *msg;
10459         void *hdr;
10460         struct cfg80211_beacon_registration *reg;
10461
10462         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10463
10464         spin_lock_bh(&rdev->beacon_registrations_lock);
10465         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10466                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10467                 if (!msg) {
10468                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10469                         return;
10470                 }
10471
10472                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10473                 if (!hdr)
10474                         goto nla_put_failure;
10475
10476                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10477                     (freq &&
10478                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10479                     (sig_dbm &&
10480                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10481                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10482                         goto nla_put_failure;
10483
10484                 genlmsg_end(msg, hdr);
10485
10486                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10487         }
10488         spin_unlock_bh(&rdev->beacon_registrations_lock);
10489         return;
10490
10491  nla_put_failure:
10492         spin_unlock_bh(&rdev->beacon_registrations_lock);
10493         if (hdr)
10494                 genlmsg_cancel(msg, hdr);
10495         nlmsg_free(msg);
10496 }
10497 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10498
10499 #ifdef CONFIG_PM
10500 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10501                                    struct cfg80211_wowlan_wakeup *wakeup,
10502                                    gfp_t gfp)
10503 {
10504         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10505         struct sk_buff *msg;
10506         void *hdr;
10507         int size = 200;
10508
10509         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10510
10511         if (wakeup)
10512                 size += wakeup->packet_present_len;
10513
10514         msg = nlmsg_new(size, gfp);
10515         if (!msg)
10516                 return;
10517
10518         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10519         if (!hdr)
10520                 goto free_msg;
10521
10522         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10523             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10524                 goto free_msg;
10525
10526         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10527                                         wdev->netdev->ifindex))
10528                 goto free_msg;
10529
10530         if (wakeup) {
10531                 struct nlattr *reasons;
10532
10533                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10534
10535                 if (wakeup->disconnect &&
10536                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10537                         goto free_msg;
10538                 if (wakeup->magic_pkt &&
10539                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10540                         goto free_msg;
10541                 if (wakeup->gtk_rekey_failure &&
10542                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10543                         goto free_msg;
10544                 if (wakeup->eap_identity_req &&
10545                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10546                         goto free_msg;
10547                 if (wakeup->four_way_handshake &&
10548                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10549                         goto free_msg;
10550                 if (wakeup->rfkill_release &&
10551                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10552                         goto free_msg;
10553
10554                 if (wakeup->pattern_idx >= 0 &&
10555                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10556                                 wakeup->pattern_idx))
10557                         goto free_msg;
10558
10559                 if (wakeup->tcp_match)
10560                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10561
10562                 if (wakeup->tcp_connlost)
10563                         nla_put_flag(msg,
10564                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10565
10566                 if (wakeup->tcp_nomoretokens)
10567                         nla_put_flag(msg,
10568                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10569
10570                 if (wakeup->packet) {
10571                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10572                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10573
10574                         if (!wakeup->packet_80211) {
10575                                 pkt_attr =
10576                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10577                                 len_attr =
10578                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10579                         }
10580
10581                         if (wakeup->packet_len &&
10582                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10583                                 goto free_msg;
10584
10585                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10586                                     wakeup->packet))
10587                                 goto free_msg;
10588                 }
10589
10590                 nla_nest_end(msg, reasons);
10591         }
10592
10593         genlmsg_end(msg, hdr);
10594
10595         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10596                                 nl80211_mlme_mcgrp.id, gfp);
10597         return;
10598
10599  free_msg:
10600         nlmsg_free(msg);
10601 }
10602 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10603 #endif
10604
10605 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10606                                 enum nl80211_tdls_operation oper,
10607                                 u16 reason_code, gfp_t gfp)
10608 {
10609         struct wireless_dev *wdev = dev->ieee80211_ptr;
10610         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10611         struct sk_buff *msg;
10612         void *hdr;
10613
10614         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10615                                          reason_code);
10616
10617         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10618         if (!msg)
10619                 return;
10620
10621         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10622         if (!hdr) {
10623                 nlmsg_free(msg);
10624                 return;
10625         }
10626
10627         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10628             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10629             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10630             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10631             (reason_code > 0 &&
10632              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10633                 goto nla_put_failure;
10634
10635         genlmsg_end(msg, hdr);
10636
10637         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10638                                 nl80211_mlme_mcgrp.id, gfp);
10639         return;
10640
10641  nla_put_failure:
10642         genlmsg_cancel(msg, hdr);
10643         nlmsg_free(msg);
10644 }
10645 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10646
10647 static int nl80211_netlink_notify(struct notifier_block * nb,
10648                                   unsigned long state,
10649                                   void *_notify)
10650 {
10651         struct netlink_notify *notify = _notify;
10652         struct cfg80211_registered_device *rdev;
10653         struct wireless_dev *wdev;
10654         struct cfg80211_beacon_registration *reg, *tmp;
10655
10656         if (state != NETLINK_URELEASE)
10657                 return NOTIFY_DONE;
10658
10659         rcu_read_lock();
10660
10661         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10662                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10663                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10664
10665                 spin_lock_bh(&rdev->beacon_registrations_lock);
10666                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10667                                          list) {
10668                         if (reg->nlportid == notify->portid) {
10669                                 list_del(&reg->list);
10670                                 kfree(reg);
10671                                 break;
10672                         }
10673                 }
10674                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10675         }
10676
10677         rcu_read_unlock();
10678
10679         return NOTIFY_DONE;
10680 }
10681
10682 static struct notifier_block nl80211_netlink_notifier = {
10683         .notifier_call = nl80211_netlink_notify,
10684 };
10685
10686 void cfg80211_ft_event(struct net_device *netdev,
10687                        struct cfg80211_ft_event_params *ft_event)
10688 {
10689         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10690         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10691         struct sk_buff *msg;
10692         void *hdr;
10693
10694         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10695
10696         if (!ft_event->target_ap)
10697                 return;
10698
10699         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10700         if (!msg)
10701                 return;
10702
10703         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10704         if (!hdr) {
10705                 nlmsg_free(msg);
10706                 return;
10707         }
10708
10709         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10710         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10711         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10712         if (ft_event->ies)
10713                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10714         if (ft_event->ric_ies)
10715                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10716                         ft_event->ric_ies);
10717
10718         genlmsg_end(msg, hdr);
10719
10720         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10721                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10722 }
10723 EXPORT_SYMBOL(cfg80211_ft_event);
10724
10725 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10726 {
10727         struct cfg80211_registered_device *rdev;
10728         struct sk_buff *msg;
10729         void *hdr;
10730         u32 nlportid;
10731
10732         rdev = wiphy_to_dev(wdev->wiphy);
10733         if (!rdev->crit_proto_nlportid)
10734                 return;
10735
10736         nlportid = rdev->crit_proto_nlportid;
10737         rdev->crit_proto_nlportid = 0;
10738
10739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10740         if (!msg)
10741                 return;
10742
10743         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10744         if (!hdr)
10745                 goto nla_put_failure;
10746
10747         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10748             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10749                 goto nla_put_failure;
10750
10751         genlmsg_end(msg, hdr);
10752
10753         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10754         return;
10755
10756  nla_put_failure:
10757         if (hdr)
10758                 genlmsg_cancel(msg, hdr);
10759         nlmsg_free(msg);
10760
10761 }
10762 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10763
10764 /* initialisation/exit functions */
10765
10766 int nl80211_init(void)
10767 {
10768         int err;
10769
10770         err = genl_register_family_with_ops(&nl80211_fam,
10771                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10772         if (err)
10773                 return err;
10774
10775         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10776         if (err)
10777                 goto err_out;
10778
10779         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10780         if (err)
10781                 goto err_out;
10782
10783         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10784         if (err)
10785                 goto err_out;
10786
10787         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10788         if (err)
10789                 goto err_out;
10790
10791 #ifdef CONFIG_NL80211_TESTMODE
10792         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10793         if (err)
10794                 goto err_out;
10795 #endif
10796
10797         err = netlink_register_notifier(&nl80211_netlink_notifier);
10798         if (err)
10799                 goto err_out;
10800
10801         return 0;
10802  err_out:
10803         genl_unregister_family(&nl80211_fam);
10804         return err;
10805 }
10806
10807 void nl80211_exit(void)
10808 {
10809         netlink_unregister_notifier(&nl80211_netlink_notifier);
10810         genl_unregister_family(&nl80211_fam);
10811 }