net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015       Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170                 netdev = __dev_get_by_index(netns, ifindex);
 171                 if (netdev) {
 172                         if (netdev->ieee80211_ptr)
 173                                 tmp = wiphy_to_rdev(
 174                                         netdev->ieee80211_ptr->wiphy);
 175                         else
 176                                 tmp = NULL;
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 231
 232         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 235
 236         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 237         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 238
 239         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 240         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 241                                     .len = WLAN_MAX_KEY_LEN },
 242         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 243         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 244         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 245         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 246         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 249         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 250         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 251                                        .len = IEEE80211_MAX_DATA_LEN },
 252         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 255         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 256         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 258                                                .len = NL80211_MAX_SUPP_RATES },
 259         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 260         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 261         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 262         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 263                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 264         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 265
 266         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 267         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 268
 269         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 273                                            .len = NL80211_MAX_SUPP_RATES },
 274         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 275
 276         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 277         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 278
 279         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 280
 281         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 282         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 283                               .len = IEEE80211_MAX_DATA_LEN },
 284         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 286
 287         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 288                                 .len = IEEE80211_MAX_SSID_LEN },
 289         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 290         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 291         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_STA_FLAGS2] = {
 295                 .len = sizeof(struct nl80211_sta_flag_update),
 296         },
 297         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 303         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 304         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 305         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 306                                  .len = WLAN_PMKID_LEN },
 307         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 308         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 309         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 310         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 311                                  .len = IEEE80211_MAX_DATA_LEN },
 312         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 313         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 315         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 323         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 327         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 328         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 331         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 332                                          .len = IEEE80211_MAX_DATA_LEN },
 333         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 361         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 362         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 363         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 365         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 366         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 367         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 369                 .len = NL80211_VHT_CAPABILITY_LEN,
 370         },
 371         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 372         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 373                                   .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 376         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 378         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 384         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 387         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 388                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 389         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 390         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 391         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 394         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 396         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 397         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 398         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 401         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 402         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 403         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 404 };
 405
 406 /* policy for the key attributes */
 407 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 408         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 409         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 410         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 411         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 412         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 413         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 414         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 415         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 416 };
 417
 418 /* policy for the key default flags */
 419 static const struct nla_policy
 420 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 421         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 422         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 423 };
 424
 425 /* policy for WoWLAN attributes */
 426 static const struct nla_policy
 427 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 428         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 432         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 435         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 436         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 437         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 438 };
 439
 440 static const struct nla_policy
 441 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 442         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 443         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 444         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 445         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 446         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 447         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 448         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 449                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 450         },
 451         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 452                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 453         },
 454         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 455         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 456         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 457 };
 458
 459 /* policy for coalesce rule attributes */
 460 static const struct nla_policy
 461 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 462         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 463         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 464         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 465 };
 466
 467 /* policy for GTK rekey offload attributes */
 468 static const struct nla_policy
 469 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 470         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 471         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 472         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 473 };
 474
 475 static const struct nla_policy
 476 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 477         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 478                                                  .len = IEEE80211_MAX_SSID_LEN },
 479         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 480 };
 481
 482 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 483                                      struct netlink_callback *cb,
 484                                      struct cfg80211_registered_device **rdev,
 485                                      struct wireless_dev **wdev)
 486 {
 487         int err;
 488
 489         rtnl_lock();
 490
 491         if (!cb->args[0]) {
 492                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 493                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 494                                   nl80211_policy);
 495                 if (err)
 496                         goto out_unlock;
 497
 498                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 499                                                    nl80211_fam.attrbuf);
 500                 if (IS_ERR(*wdev)) {
 501                         err = PTR_ERR(*wdev);
 502                         goto out_unlock;
 503                 }
 504                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 505                 /* 0 is the first index - add 1 to parse only once */
 506                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 507                 cb->args[1] = (*wdev)->identifier;
 508         } else {
 509                 /* subtract the 1 again here */
 510                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 511                 struct wireless_dev *tmp;
 512
 513                 if (!wiphy) {
 514                         err = -ENODEV;
 515                         goto out_unlock;
 516                 }
 517                 *rdev = wiphy_to_rdev(wiphy);
 518                 *wdev = NULL;
 519
 520                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 521                         if (tmp->identifier == cb->args[1]) {
 522                                 *wdev = tmp;
 523                                 break;
 524                         }
 525                 }
 526
 527                 if (!*wdev) {
 528                         err = -ENODEV;
 529                         goto out_unlock;
 530                 }
 531         }
 532
 533         return 0;
 534  out_unlock:
 535         rtnl_unlock();
 536         return err;
 537 }
 538
 539 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 540 {
 541         rtnl_unlock();
 542 }
 543
 544 /* IE validation */
 545 static bool is_valid_ie_attr(const struct nlattr *attr)
 546 {
 547         const u8 *pos;
 548         int len;
 549
 550         if (!attr)
 551                 return true;
 552
 553         pos = nla_data(attr);
 554         len = nla_len(attr);
 555
 556         while (len) {
 557                 u8 elemlen;
 558
 559                 if (len < 2)
 560                         return false;
 561                 len -= 2;
 562
 563                 elemlen = pos[1];
 564                 if (elemlen > len)
 565                         return false;
 566
 567                 len -= elemlen;
 568                 pos += 2 + elemlen;
 569         }
 570
 571         return true;
 572 }
 573
 574 /* message building helper */
 575 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 576                                    int flags, u8 cmd)
 577 {
 578         /* since there is no private header just add the generic one */
 579         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 580 }
 581
 582 static int nl80211_msg_put_channel(struct sk_buff *msg,
 583                                    struct ieee80211_channel *chan,
 584                                    bool large)
 585 {
 586         /* Some channels must be completely excluded from the
 587          * list to protect old user-space tools from breaking
 588          */
 589         if (!large && chan->flags &
 590             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 591                 return 0;
 592
 593         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 594                         chan->center_freq))
 595                 goto nla_put_failure;
 596
 597         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 598             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 599                 goto nla_put_failure;
 600         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 601                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 602                         goto nla_put_failure;
 603                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 604                         goto nla_put_failure;
 605         }
 606         if (chan->flags & IEEE80211_CHAN_RADAR) {
 607                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 608                         goto nla_put_failure;
 609                 if (large) {
 610                         u32 time;
 611
 612                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 613
 614                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 615                                         chan->dfs_state))
 616                                 goto nla_put_failure;
 617                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 618                                         time))
 619                                 goto nla_put_failure;
 620                         if (nla_put_u32(msg,
 621                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 622                                         chan->dfs_cac_ms))
 623                                 goto nla_put_failure;
 624                 }
 625         }
 626
 627         if (large) {
 628                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 629                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 630                         goto nla_put_failure;
 631                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 632                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 633                         goto nla_put_failure;
 634                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 635                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 636                         goto nla_put_failure;
 637                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 638                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 639                         goto nla_put_failure;
 640                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 641                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 642                         goto nla_put_failure;
 643                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 644                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 645                         goto nla_put_failure;
 646                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 651                         goto nla_put_failure;
 652         }
 653
 654         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 655                         DBM_TO_MBM(chan->max_power)))
 656                 goto nla_put_failure;
 657
 658         return 0;
 659
 660  nla_put_failure:
 661         return -ENOBUFS;
 662 }
 663
 664 /* netlink command implementations */
 665
 666 struct key_parse {
 667         struct key_params p;
 668         int idx;
 669         int type;
 670         bool def, defmgmt;
 671         bool def_uni, def_multi;
 672 };
 673
 674 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 675 {
 676         struct nlattr *tb[NL80211_KEY_MAX + 1];
 677         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 678                                    nl80211_key_policy);
 679         if (err)
 680                 return err;
 681
 682         k->def = !!tb[NL80211_KEY_DEFAULT];
 683         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 684
 685         if (k->def) {
 686                 k->def_uni = true;
 687                 k->def_multi = true;
 688         }
 689         if (k->defmgmt)
 690                 k->def_multi = true;
 691
 692         if (tb[NL80211_KEY_IDX])
 693                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 694
 695         if (tb[NL80211_KEY_DATA]) {
 696                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 697                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 698         }
 699
 700         if (tb[NL80211_KEY_SEQ]) {
 701                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 702                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 703         }
 704
 705         if (tb[NL80211_KEY_CIPHER])
 706                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 707
 708         if (tb[NL80211_KEY_TYPE]) {
 709                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 710                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 711                         return -EINVAL;
 712         }
 713
 714         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 715                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 716                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 717                                        tb[NL80211_KEY_DEFAULT_TYPES],
 718                                        nl80211_key_default_policy);
 719                 if (err)
 720                         return err;
 721
 722                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 723                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 724         }
 725
 726         return 0;
 727 }
 728
 729 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 730 {
 731         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 732                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 733                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 734         }
 735
 736         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 737                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 738                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 739         }
 740
 741         if (info->attrs[NL80211_ATTR_KEY_IDX])
 742                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 743
 744         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 745                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 746
 747         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 748         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 749
 750         if (k->def) {
 751                 k->def_uni = true;
 752                 k->def_multi = true;
 753         }
 754         if (k->defmgmt)
 755                 k->def_multi = true;
 756
 757         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 758                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 759                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 760                         return -EINVAL;
 761         }
 762
 763         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 764                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 765                 int err = nla_parse_nested(
 766                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 767                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 768                                 nl80211_key_default_policy);
 769                 if (err)
 770                         return err;
 771
 772                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 773                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 774         }
 775
 776         return 0;
 777 }
 778
 779 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 780 {
 781         int err;
 782
 783         memset(k, 0, sizeof(*k));
 784         k->idx = -1;
 785         k->type = -1;
 786
 787         if (info->attrs[NL80211_ATTR_KEY])
 788                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 789         else
 790                 err = nl80211_parse_key_old(info, k);
 791
 792         if (err)
 793                 return err;
 794
 795         if (k->def && k->defmgmt)
 796                 return -EINVAL;
 797
 798         if (k->defmgmt) {
 799                 if (k->def_uni || !k->def_multi)
 800                         return -EINVAL;
 801         }
 802
 803         if (k->idx != -1) {
 804                 if (k->defmgmt) {
 805                         if (k->idx < 4 || k->idx > 5)
 806                                 return -EINVAL;
 807                 } else if (k->def) {
 808                         if (k->idx < 0 || k->idx > 3)
 809                                 return -EINVAL;
 810                 } else {
 811                         if (k->idx < 0 || k->idx > 5)
 812                                 return -EINVAL;
 813                 }
 814         }
 815
 816         return 0;
 817 }
 818
 819 static struct cfg80211_cached_keys *
 820 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 821                        struct nlattr *keys, bool *no_ht)
 822 {
 823         struct key_parse parse;
 824         struct nlattr *key;
 825         struct cfg80211_cached_keys *result;
 826         int rem, err, def = 0;
 827
 828         result = kzalloc(sizeof(*result), GFP_KERNEL);
 829         if (!result)
 830                 return ERR_PTR(-ENOMEM);
 831
 832         result->def = -1;
 833         result->defmgmt = -1;
 834
 835         nla_for_each_nested(key, keys, rem) {
 836                 memset(&parse, 0, sizeof(parse));
 837                 parse.idx = -1;
 838
 839                 err = nl80211_parse_key_new(key, &parse);
 840                 if (err)
 841                         goto error;
 842                 err = -EINVAL;
 843                 if (!parse.p.key)
 844                         goto error;
 845                 if (parse.idx < 0 || parse.idx > 4)
 846                         goto error;
 847                 if (parse.def) {
 848                         if (def)
 849                                 goto error;
 850                         def = 1;
 851                         result->def = parse.idx;
 852                         if (!parse.def_uni || !parse.def_multi)
 853                                 goto error;
 854                 } else if (parse.defmgmt)
 855                         goto error;
 856                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 857                                                      parse.idx, false, NULL);
 858                 if (err)
 859                         goto error;
 860                 result->params[parse.idx].cipher = parse.p.cipher;
 861                 result->params[parse.idx].key_len = parse.p.key_len;
 862                 result->params[parse.idx].key = result->data[parse.idx];
 863                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 864
 865                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 866                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 867                         if (no_ht)
 868                                 *no_ht = true;
 869                 }
 870         }
 871
 872         return result;
 873  error:
 874         kfree(result);
 875         return ERR_PTR(err);
 876 }
 877
 878 static int nl80211_key_allowed(struct wireless_dev *wdev)
 879 {
 880         ASSERT_WDEV_LOCK(wdev);
 881
 882         switch (wdev->iftype) {
 883         case NL80211_IFTYPE_AP:
 884         case NL80211_IFTYPE_AP_VLAN:
 885         case NL80211_IFTYPE_P2P_GO:
 886         case NL80211_IFTYPE_MESH_POINT:
 887                 break;
 888         case NL80211_IFTYPE_ADHOC:
 889         case NL80211_IFTYPE_STATION:
 890         case NL80211_IFTYPE_P2P_CLIENT:
 891                 if (!wdev->current_bss)
 892                         return -ENOLINK;
 893                 break;
 894         case NL80211_IFTYPE_UNSPECIFIED:
 895         case NL80211_IFTYPE_OCB:
 896         case NL80211_IFTYPE_MONITOR:
 897         case NL80211_IFTYPE_P2P_DEVICE:
 898         case NL80211_IFTYPE_WDS:
 899         case NUM_NL80211_IFTYPES:
 900                 return -EINVAL;
 901         }
 902
 903         return 0;
 904 }
 905
 906 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 907                                                         struct nlattr *tb)
 908 {
 909         struct ieee80211_channel *chan;
 910
 911         if (tb == NULL)
 912                 return NULL;
 913         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 914         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 915                 return NULL;
 916         return chan;
 917 }
 918
 919 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 920 {
 921         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 922         int i;
 923
 924         if (!nl_modes)
 925                 goto nla_put_failure;
 926
 927         i = 0;
 928         while (ifmodes) {
 929                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 930                         goto nla_put_failure;
 931                 ifmodes >>= 1;
 932                 i++;
 933         }
 934
 935         nla_nest_end(msg, nl_modes);
 936         return 0;
 937
 938 nla_put_failure:
 939         return -ENOBUFS;
 940 }
 941
 942 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 943                                           struct sk_buff *msg,
 944                                           bool large)
 945 {
 946         struct nlattr *nl_combis;
 947         int i, j;
 948
 949         nl_combis = nla_nest_start(msg,
 950                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 951         if (!nl_combis)
 952                 goto nla_put_failure;
 953
 954         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 955                 const struct ieee80211_iface_combination *c;
 956                 struct nlattr *nl_combi, *nl_limits;
 957
 958                 c = &wiphy->iface_combinations[i];
 959
 960                 nl_combi = nla_nest_start(msg, i + 1);
 961                 if (!nl_combi)
 962                         goto nla_put_failure;
 963
 964                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 965                 if (!nl_limits)
 966                         goto nla_put_failure;
 967
 968                 for (j = 0; j < c->n_limits; j++) {
 969                         struct nlattr *nl_limit;
 970
 971                         nl_limit = nla_nest_start(msg, j + 1);
 972                         if (!nl_limit)
 973                                 goto nla_put_failure;
 974                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 975                                         c->limits[j].max))
 976                                 goto nla_put_failure;
 977                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 978                                                 c->limits[j].types))
 979                                 goto nla_put_failure;
 980                         nla_nest_end(msg, nl_limit);
 981                 }
 982
 983                 nla_nest_end(msg, nl_limits);
 984
 985                 if (c->beacon_int_infra_match &&
 986                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 987                         goto nla_put_failure;
 988                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 989                                 c->num_different_channels) ||
 990                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 991                                 c->max_interfaces))
 992                         goto nla_put_failure;
 993                 if (large &&
 994                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 995                                 c->radar_detect_widths) ||
 996                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 997                                 c->radar_detect_regions)))
 998                         goto nla_put_failure;
 999
1000                 nla_nest_end(msg, nl_combi);
1001         }
1002
1003         nla_nest_end(msg, nl_combis);
1004
1005         return 0;
1006 nla_put_failure:
1007         return -ENOBUFS;
1008 }
1009
1010 #ifdef CONFIG_PM
1011 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1012                                         struct sk_buff *msg)
1013 {
1014         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1015         struct nlattr *nl_tcp;
1016
1017         if (!tcp)
1018                 return 0;
1019
1020         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1021         if (!nl_tcp)
1022                 return -ENOBUFS;
1023
1024         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1025                         tcp->data_payload_max))
1026                 return -ENOBUFS;
1027
1028         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1029                         tcp->data_payload_max))
1030                 return -ENOBUFS;
1031
1032         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1033                 return -ENOBUFS;
1034
1035         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1036                                 sizeof(*tcp->tok), tcp->tok))
1037                 return -ENOBUFS;
1038
1039         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1040                         tcp->data_interval_max))
1041                 return -ENOBUFS;
1042
1043         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1044                         tcp->wake_payload_max))
1045                 return -ENOBUFS;
1046
1047         nla_nest_end(msg, nl_tcp);
1048         return 0;
1049 }
1050
1051 static int nl80211_send_wowlan(struct sk_buff *msg,
1052                                struct cfg80211_registered_device *rdev,
1053                                bool large)
1054 {
1055         struct nlattr *nl_wowlan;
1056
1057         if (!rdev->wiphy.wowlan)
1058                 return 0;
1059
1060         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1061         if (!nl_wowlan)
1062                 return -ENOBUFS;
1063
1064         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1065              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1066             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1067              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1068             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1069              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1070             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1076             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1077              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1078             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1079              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1080                 return -ENOBUFS;
1081
1082         if (rdev->wiphy.wowlan->n_patterns) {
1083                 struct nl80211_pattern_support pat = {
1084                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1085                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1086                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1087                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1088                 };
1089
1090                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1091                             sizeof(pat), &pat))
1092                         return -ENOBUFS;
1093         }
1094
1095         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1096             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1097                         rdev->wiphy.wowlan->max_nd_match_sets))
1098                 return -ENOBUFS;
1099
1100         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1101                 return -ENOBUFS;
1102
1103         nla_nest_end(msg, nl_wowlan);
1104
1105         return 0;
1106 }
1107 #endif
1108
1109 static int nl80211_send_coalesce(struct sk_buff *msg,
1110                                  struct cfg80211_registered_device *rdev)
1111 {
1112         struct nl80211_coalesce_rule_support rule;
1113
1114         if (!rdev->wiphy.coalesce)
1115                 return 0;
1116
1117         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1118         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1119         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1120         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1121         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1122         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1123
1124         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1125                 return -ENOBUFS;
1126
1127         return 0;
1128 }
1129
1130 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1131                                       struct ieee80211_supported_band *sband)
1132 {
1133         struct nlattr *nl_rates, *nl_rate;
1134         struct ieee80211_rate *rate;
1135         int i;
1136
1137         /* add HT info */
1138         if (sband->ht_cap.ht_supported &&
1139             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1140                      sizeof(sband->ht_cap.mcs),
1141                      &sband->ht_cap.mcs) ||
1142              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1143                          sband->ht_cap.cap) ||
1144              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1145                         sband->ht_cap.ampdu_factor) ||
1146              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1147                         sband->ht_cap.ampdu_density)))
1148                 return -ENOBUFS;
1149
1150         /* add VHT info */
1151         if (sband->vht_cap.vht_supported &&
1152             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1153                      sizeof(sband->vht_cap.vht_mcs),
1154                      &sband->vht_cap.vht_mcs) ||
1155              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1156                          sband->vht_cap.cap)))
1157                 return -ENOBUFS;
1158
1159         /* add bitrates */
1160         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1161         if (!nl_rates)
1162                 return -ENOBUFS;
1163
1164         for (i = 0; i < sband->n_bitrates; i++) {
1165                 nl_rate = nla_nest_start(msg, i);
1166                 if (!nl_rate)
1167                         return -ENOBUFS;
1168
1169                 rate = &sband->bitrates[i];
1170                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1171                                 rate->bitrate))
1172                         return -ENOBUFS;
1173                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1174                     nla_put_flag(msg,
1175                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1176                         return -ENOBUFS;
1177
1178                 nla_nest_end(msg, nl_rate);
1179         }
1180
1181         nla_nest_end(msg, nl_rates);
1182
1183         return 0;
1184 }
1185
1186 static int
1187 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1188                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1189 {
1190         u16 stypes;
1191         struct nlattr *nl_ftypes, *nl_ifs;
1192         enum nl80211_iftype ift;
1193         int i;
1194
1195         if (!mgmt_stypes)
1196                 return 0;
1197
1198         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1199         if (!nl_ifs)
1200                 return -ENOBUFS;
1201
1202         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1203                 nl_ftypes = nla_nest_start(msg, ift);
1204                 if (!nl_ftypes)
1205                         return -ENOBUFS;
1206                 i = 0;
1207                 stypes = mgmt_stypes[ift].tx;
1208                 while (stypes) {
1209                         if ((stypes & 1) &&
1210                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1211                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1212                                 return -ENOBUFS;
1213                         stypes >>= 1;
1214                         i++;
1215                 }
1216                 nla_nest_end(msg, nl_ftypes);
1217         }
1218
1219         nla_nest_end(msg, nl_ifs);
1220
1221         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1222         if (!nl_ifs)
1223                 return -ENOBUFS;
1224
1225         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1226                 nl_ftypes = nla_nest_start(msg, ift);
1227                 if (!nl_ftypes)
1228                         return -ENOBUFS;
1229                 i = 0;
1230                 stypes = mgmt_stypes[ift].rx;
1231                 while (stypes) {
1232                         if ((stypes & 1) &&
1233                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1234                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1235                                 return -ENOBUFS;
1236                         stypes >>= 1;
1237                         i++;
1238                 }
1239                 nla_nest_end(msg, nl_ftypes);
1240         }
1241         nla_nest_end(msg, nl_ifs);
1242
1243         return 0;
1244 }
1245
1246 struct nl80211_dump_wiphy_state {
1247         s64 filter_wiphy;
1248         long start;
1249         long split_start, band_start, chan_start;
1250         bool split;
1251 };
1252
1253 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1254                               enum nl80211_commands cmd,
1255                               struct sk_buff *msg, u32 portid, u32 seq,
1256                               int flags, struct nl80211_dump_wiphy_state *state)
1257 {
1258         void *hdr;
1259         struct nlattr *nl_bands, *nl_band;
1260         struct nlattr *nl_freqs, *nl_freq;
1261         struct nlattr *nl_cmds;
1262         enum ieee80211_band band;
1263         struct ieee80211_channel *chan;
1264         int i;
1265         const struct ieee80211_txrx_stypes *mgmt_stypes =
1266                                 rdev->wiphy.mgmt_stypes;
1267         u32 features;
1268
1269         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1270         if (!hdr)
1271                 return -ENOBUFS;
1272
1273         if (WARN_ON(!state))
1274                 return -EINVAL;
1275
1276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1277             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1278                            wiphy_name(&rdev->wiphy)) ||
1279             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1280                         cfg80211_rdev_list_generation))
1281                 goto nla_put_failure;
1282
1283         if (cmd != NL80211_CMD_NEW_WIPHY)
1284                 goto finish;
1285
1286         switch (state->split_start) {
1287         case 0:
1288                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1289                                rdev->wiphy.retry_short) ||
1290                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1291                                rdev->wiphy.retry_long) ||
1292                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1293                                 rdev->wiphy.frag_threshold) ||
1294                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1295                                 rdev->wiphy.rts_threshold) ||
1296                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1297                                rdev->wiphy.coverage_class) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1299                                rdev->wiphy.max_scan_ssids) ||
1300                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1301                                rdev->wiphy.max_sched_scan_ssids) ||
1302                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1303                                 rdev->wiphy.max_scan_ie_len) ||
1304                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1305                                 rdev->wiphy.max_sched_scan_ie_len) ||
1306                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1307                                rdev->wiphy.max_match_sets))
1308                         goto nla_put_failure;
1309
1310                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1311                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1312                         goto nla_put_failure;
1313                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1314                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1315                         goto nla_put_failure;
1316                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1317                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1318                         goto nla_put_failure;
1319                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1320                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1321                         goto nla_put_failure;
1322                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1323                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1324                         goto nla_put_failure;
1325                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1326                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1327                         goto nla_put_failure;
1328                 state->split_start++;
1329                 if (state->split)
1330                         break;
1331         case 1:
1332                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1333                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1334                             rdev->wiphy.cipher_suites))
1335                         goto nla_put_failure;
1336
1337                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1338                                rdev->wiphy.max_num_pmkids))
1339                         goto nla_put_failure;
1340
1341                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1342                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1343                         goto nla_put_failure;
1344
1345                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1346                                 rdev->wiphy.available_antennas_tx) ||
1347                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1348                                 rdev->wiphy.available_antennas_rx))
1349                         goto nla_put_failure;
1350
1351                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1352                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1353                                 rdev->wiphy.probe_resp_offload))
1354                         goto nla_put_failure;
1355
1356                 if ((rdev->wiphy.available_antennas_tx ||
1357                      rdev->wiphy.available_antennas_rx) &&
1358                     rdev->ops->get_antenna) {
1359                         u32 tx_ant = 0, rx_ant = 0;
1360                         int res;
1361                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1362                         if (!res) {
1363                                 if (nla_put_u32(msg,
1364                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1365                                                 tx_ant) ||
1366                                     nla_put_u32(msg,
1367                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1368                                                 rx_ant))
1369                                         goto nla_put_failure;
1370                         }
1371                 }
1372
1373                 state->split_start++;
1374                 if (state->split)
1375                         break;
1376         case 2:
1377                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1378                                         rdev->wiphy.interface_modes))
1379                                 goto nla_put_failure;
1380                 state->split_start++;
1381                 if (state->split)
1382                         break;
1383         case 3:
1384                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1385                 if (!nl_bands)
1386                         goto nla_put_failure;
1387
1388                 for (band = state->band_start;
1389                      band < IEEE80211_NUM_BANDS; band++) {
1390                         struct ieee80211_supported_band *sband;
1391
1392                         sband = rdev->wiphy.bands[band];
1393
1394                         if (!sband)
1395                                 continue;
1396
1397                         nl_band = nla_nest_start(msg, band);
1398                         if (!nl_band)
1399                                 goto nla_put_failure;
1400
1401                         switch (state->chan_start) {
1402                         case 0:
1403                                 if (nl80211_send_band_rateinfo(msg, sband))
1404                                         goto nla_put_failure;
1405                                 state->chan_start++;
1406                                 if (state->split)
1407                                         break;
1408                         default:
1409                                 /* add frequencies */
1410                                 nl_freqs = nla_nest_start(
1411                                         msg, NL80211_BAND_ATTR_FREQS);
1412                                 if (!nl_freqs)
1413                                         goto nla_put_failure;
1414
1415                                 for (i = state->chan_start - 1;
1416                                      i < sband->n_channels;
1417                                      i++) {
1418                                         nl_freq = nla_nest_start(msg, i);
1419                                         if (!nl_freq)
1420                                                 goto nla_put_failure;
1421
1422                                         chan = &sband->channels[i];
1423
1424                                         if (nl80211_msg_put_channel(
1425                                                         msg, chan,
1426                                                         state->split))
1427                                                 goto nla_put_failure;
1428
1429                                         nla_nest_end(msg, nl_freq);
1430                                         if (state->split)
1431                                                 break;
1432                                 }
1433                                 if (i < sband->n_channels)
1434                                         state->chan_start = i + 2;
1435                                 else
1436                                         state->chan_start = 0;
1437                                 nla_nest_end(msg, nl_freqs);
1438                         }
1439
1440                         nla_nest_end(msg, nl_band);
1441
1442                         if (state->split) {
1443                                 /* start again here */
1444                                 if (state->chan_start)
1445                                         band--;
1446                                 break;
1447                         }
1448                 }
1449                 nla_nest_end(msg, nl_bands);
1450
1451                 if (band < IEEE80211_NUM_BANDS)
1452                         state->band_start = band + 1;
1453                 else
1454                         state->band_start = 0;
1455
1456                 /* if bands & channels are done, continue outside */
1457                 if (state->band_start == 0 && state->chan_start == 0)
1458                         state->split_start++;
1459                 if (state->split)
1460                         break;
1461         case 4:
1462                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1463                 if (!nl_cmds)
1464                         goto nla_put_failure;
1465
1466                 i = 0;
1467 #define CMD(op, n)                                                      \
1468                  do {                                                   \
1469                         if (rdev->ops->op) {                            \
1470                                 i++;                                    \
1471                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1472                                         goto nla_put_failure;           \
1473                         }                                               \
1474                 } while (0)
1475
1476                 CMD(add_virtual_intf, NEW_INTERFACE);
1477                 CMD(change_virtual_intf, SET_INTERFACE);
1478                 CMD(add_key, NEW_KEY);
1479                 CMD(start_ap, START_AP);
1480                 CMD(add_station, NEW_STATION);
1481                 CMD(add_mpath, NEW_MPATH);
1482                 CMD(update_mesh_config, SET_MESH_CONFIG);
1483                 CMD(change_bss, SET_BSS);
1484                 CMD(auth, AUTHENTICATE);
1485                 CMD(assoc, ASSOCIATE);
1486                 CMD(deauth, DEAUTHENTICATE);
1487                 CMD(disassoc, DISASSOCIATE);
1488                 CMD(join_ibss, JOIN_IBSS);
1489                 CMD(join_mesh, JOIN_MESH);
1490                 CMD(set_pmksa, SET_PMKSA);
1491                 CMD(del_pmksa, DEL_PMKSA);
1492                 CMD(flush_pmksa, FLUSH_PMKSA);
1493                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1494                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1495                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1496                 CMD(mgmt_tx, FRAME);
1497                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1498                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1499                         i++;
1500                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1501                                 goto nla_put_failure;
1502                 }
1503                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1504                     rdev->ops->join_mesh) {
1505                         i++;
1506                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1507                                 goto nla_put_failure;
1508                 }
1509                 CMD(set_wds_peer, SET_WDS_PEER);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1511                         CMD(tdls_mgmt, TDLS_MGMT);
1512                         CMD(tdls_oper, TDLS_OPER);
1513                 }
1514                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1515                         CMD(sched_scan_start, START_SCHED_SCAN);
1516                 CMD(probe_client, PROBE_CLIENT);
1517                 CMD(set_noack_map, SET_NOACK_MAP);
1518                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1519                         i++;
1520                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1521                                 goto nla_put_failure;
1522                 }
1523                 CMD(start_p2p_device, START_P2P_DEVICE);
1524                 CMD(set_mcast_rate, SET_MCAST_RATE);
1525 #ifdef CONFIG_NL80211_TESTMODE
1526                 CMD(testmode_cmd, TESTMODE);
1527 #endif
1528                 if (state->split) {
1529                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1530                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1531                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1532                                 CMD(channel_switch, CHANNEL_SWITCH);
1533                         CMD(set_qos_map, SET_QOS_MAP);
1534                         if (rdev->wiphy.features &
1535                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1536                                 CMD(add_tx_ts, ADD_TX_TS);
1537                 }
1538                 /* add into the if now */
1539 #undef CMD
1540
1541                 if (rdev->ops->connect || rdev->ops->auth) {
1542                         i++;
1543                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1544                                 goto nla_put_failure;
1545                 }
1546
1547                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1548                         i++;
1549                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1550                                 goto nla_put_failure;
1551                 }
1552
1553                 nla_nest_end(msg, nl_cmds);
1554                 state->split_start++;
1555                 if (state->split)
1556                         break;
1557         case 5:
1558                 if (rdev->ops->remain_on_channel &&
1559                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1560                     nla_put_u32(msg,
1561                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1562                                 rdev->wiphy.max_remain_on_channel_duration))
1563                         goto nla_put_failure;
1564
1565                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1566                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1567                         goto nla_put_failure;
1568
1569                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1570                         goto nla_put_failure;
1571                 state->split_start++;
1572                 if (state->split)
1573                         break;
1574         case 6:
1575 #ifdef CONFIG_PM
1576                 if (nl80211_send_wowlan(msg, rdev, state->split))
1577                         goto nla_put_failure;
1578                 state->split_start++;
1579                 if (state->split)
1580                         break;
1581 #else
1582                 state->split_start++;
1583 #endif
1584         case 7:
1585                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1586                                         rdev->wiphy.software_iftypes))
1587                         goto nla_put_failure;
1588
1589                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1590                                                    state->split))
1591                         goto nla_put_failure;
1592
1593                 state->split_start++;
1594                 if (state->split)
1595                         break;
1596         case 8:
1597                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1598                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1599                                 rdev->wiphy.ap_sme_capa))
1600                         goto nla_put_failure;
1601
1602                 features = rdev->wiphy.features;
1603                 /*
1604                  * We can only add the per-channel limit information if the
1605                  * dump is split, otherwise it makes it too big. Therefore
1606                  * only advertise it in that case.
1607                  */
1608                 if (state->split)
1609                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1610                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1611                         goto nla_put_failure;
1612
1613                 if (rdev->wiphy.ht_capa_mod_mask &&
1614                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1615                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1616                             rdev->wiphy.ht_capa_mod_mask))
1617                         goto nla_put_failure;
1618
1619                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1620                     rdev->wiphy.max_acl_mac_addrs &&
1621                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1622                                 rdev->wiphy.max_acl_mac_addrs))
1623                         goto nla_put_failure;
1624
1625                 /*
1626                  * Any information below this point is only available to
1627                  * applications that can deal with it being split. This
1628                  * helps ensure that newly added capabilities don't break
1629                  * older tools by overrunning their buffers.
1630                  *
1631                  * We still increment split_start so that in the split
1632                  * case we'll continue with more data in the next round,
1633                  * but break unconditionally so unsplit data stops here.
1634                  */
1635                 state->split_start++;
1636                 break;
1637         case 9:
1638                 if (rdev->wiphy.extended_capabilities &&
1639                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1640                              rdev->wiphy.extended_capabilities_len,
1641                              rdev->wiphy.extended_capabilities) ||
1642                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1643                              rdev->wiphy.extended_capabilities_len,
1644                              rdev->wiphy.extended_capabilities_mask)))
1645                         goto nla_put_failure;
1646
1647                 if (rdev->wiphy.vht_capa_mod_mask &&
1648                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1649                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1650                             rdev->wiphy.vht_capa_mod_mask))
1651                         goto nla_put_failure;
1652
1653                 state->split_start++;
1654                 break;
1655         case 10:
1656                 if (nl80211_send_coalesce(msg, rdev))
1657                         goto nla_put_failure;
1658
1659                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1660                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1661                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1662                         goto nla_put_failure;
1663
1664                 if (rdev->wiphy.max_ap_assoc_sta &&
1665                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1666                                 rdev->wiphy.max_ap_assoc_sta))
1667                         goto nla_put_failure;
1668
1669                 state->split_start++;
1670                 break;
1671         case 11:
1672                 if (rdev->wiphy.n_vendor_commands) {
1673                         const struct nl80211_vendor_cmd_info *info;
1674                         struct nlattr *nested;
1675
1676                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1677                         if (!nested)
1678                                 goto nla_put_failure;
1679
1680                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1681                                 info = &rdev->wiphy.vendor_commands[i].info;
1682                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1683                                         goto nla_put_failure;
1684                         }
1685                         nla_nest_end(msg, nested);
1686                 }
1687
1688                 if (rdev->wiphy.n_vendor_events) {
1689                         const struct nl80211_vendor_cmd_info *info;
1690                         struct nlattr *nested;
1691
1692                         nested = nla_nest_start(msg,
1693                                                 NL80211_ATTR_VENDOR_EVENTS);
1694                         if (!nested)
1695                                 goto nla_put_failure;
1696
1697                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1698                                 info = &rdev->wiphy.vendor_events[i];
1699                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1700                                         goto nla_put_failure;
1701                         }
1702                         nla_nest_end(msg, nested);
1703                 }
1704                 state->split_start++;
1705                 break;
1706         case 12:
1707                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1708                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1709                                rdev->wiphy.max_num_csa_counters))
1710                         goto nla_put_failure;
1711
1712                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1713                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1714                         goto nla_put_failure;
1715
1716                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1717                             sizeof(rdev->wiphy.ext_features),
1718                             rdev->wiphy.ext_features))
1719                         goto nla_put_failure;
1720
1721                 /* done */
1722                 state->split_start = 0;
1723                 break;
1724         }
1725  finish:
1726         genlmsg_end(msg, hdr);
1727         return 0;
1728
1729  nla_put_failure:
1730         genlmsg_cancel(msg, hdr);
1731         return -EMSGSIZE;
1732 }
1733
1734 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1735                                     struct netlink_callback *cb,
1736                                     struct nl80211_dump_wiphy_state *state)
1737 {
1738         struct nlattr **tb = nl80211_fam.attrbuf;
1739         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1740                               tb, nl80211_fam.maxattr, nl80211_policy);
1741         /* ignore parse errors for backward compatibility */
1742         if (ret)
1743                 return 0;
1744
1745         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1746         if (tb[NL80211_ATTR_WIPHY])
1747                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1748         if (tb[NL80211_ATTR_WDEV])
1749                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1750         if (tb[NL80211_ATTR_IFINDEX]) {
1751                 struct net_device *netdev;
1752                 struct cfg80211_registered_device *rdev;
1753                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1754
1755                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1756                 if (!netdev)
1757                         return -ENODEV;
1758                 if (netdev->ieee80211_ptr) {
1759                         rdev = wiphy_to_rdev(
1760                                 netdev->ieee80211_ptr->wiphy);
1761                         state->filter_wiphy = rdev->wiphy_idx;
1762                 }
1763         }
1764
1765         return 0;
1766 }
1767
1768 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1769 {
1770         int idx = 0, ret;
1771         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1772         struct cfg80211_registered_device *rdev;
1773
1774         rtnl_lock();
1775         if (!state) {
1776                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1777                 if (!state) {
1778                         rtnl_unlock();
1779                         return -ENOMEM;
1780                 }
1781                 state->filter_wiphy = -1;
1782                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1783                 if (ret) {
1784                         kfree(state);
1785                         rtnl_unlock();
1786                         return ret;
1787                 }
1788                 cb->args[0] = (long)state;
1789         }
1790
1791         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1792                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1793                         continue;
1794                 if (++idx <= state->start)
1795                         continue;
1796                 if (state->filter_wiphy != -1 &&
1797                     state->filter_wiphy != rdev->wiphy_idx)
1798                         continue;
1799                 /* attempt to fit multiple wiphy data chunks into the skb */
1800                 do {
1801                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1802                                                  skb,
1803                                                  NETLINK_CB(cb->skb).portid,
1804                                                  cb->nlh->nlmsg_seq,
1805                                                  NLM_F_MULTI, state);
1806                         if (ret < 0) {
1807                                 /*
1808                                  * If sending the wiphy data didn't fit (ENOBUFS
1809                                  * or EMSGSIZE returned), this SKB is still
1810                                  * empty (so it's not too big because another
1811                                  * wiphy dataset is already in the skb) and
1812                                  * we've not tried to adjust the dump allocation
1813                                  * yet ... then adjust the alloc size to be
1814                                  * bigger, and return 1 but with the empty skb.
1815                                  * This results in an empty message being RX'ed
1816                                  * in userspace, but that is ignored.
1817                                  *
1818                                  * We can then retry with the larger buffer.
1819                                  */
1820                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1821                                     !skb->len && !state->split &&
1822                                     cb->min_dump_alloc < 4096) {
1823                                         cb->min_dump_alloc = 4096;
1824                                         state->split_start = 0;
1825                                         rtnl_unlock();
1826                                         return 1;
1827                                 }
1828                                 idx--;
1829                                 break;
1830                         }
1831                 } while (state->split_start > 0);
1832                 break;
1833         }
1834         rtnl_unlock();
1835
1836         state->start = idx;
1837
1838         return skb->len;
1839 }
1840
1841 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1842 {
1843         kfree((void *)cb->args[0]);
1844         return 0;
1845 }
1846
1847 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1848 {
1849         struct sk_buff *msg;
1850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1851         struct nl80211_dump_wiphy_state state = {};
1852
1853         msg = nlmsg_new(4096, GFP_KERNEL);
1854         if (!msg)
1855                 return -ENOMEM;
1856
1857         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1858                                info->snd_portid, info->snd_seq, 0,
1859                                &state) < 0) {
1860                 nlmsg_free(msg);
1861                 return -ENOBUFS;
1862         }
1863
1864         return genlmsg_reply(msg, info);
1865 }
1866
1867 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1868         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1869         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1870         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1871         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1872         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1873 };
1874
1875 static int parse_txq_params(struct nlattr *tb[],
1876                             struct ieee80211_txq_params *txq_params)
1877 {
1878         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1879             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1880             !tb[NL80211_TXQ_ATTR_AIFS])
1881                 return -EINVAL;
1882
1883         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1884         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1885         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1886         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1887         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1888
1889         if (txq_params->ac >= NL80211_NUM_ACS)
1890                 return -EINVAL;
1891
1892         return 0;
1893 }
1894
1895 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1896 {
1897         /*
1898          * You can only set the channel explicitly for WDS interfaces,
1899          * all others have their channel managed via their respective
1900          * "establish a connection" command (connect, join, ...)
1901          *
1902          * For AP/GO and mesh mode, the channel can be set with the
1903          * channel userspace API, but is only stored and passed to the
1904          * low-level driver when the AP starts or the mesh is joined.
1905          * This is for backward compatibility, userspace can also give
1906          * the channel in the start-ap or join-mesh commands instead.
1907          *
1908          * Monitors are special as they are normally slaved to
1909          * whatever else is going on, so they have their own special
1910          * operation to set the monitor channel if possible.
1911          */
1912         return !wdev ||
1913                 wdev->iftype == NL80211_IFTYPE_AP ||
1914                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1915                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1916                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1917 }
1918
1919 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1920                                  struct genl_info *info,
1921                                  struct cfg80211_chan_def *chandef)
1922 {
1923         u32 control_freq;
1924
1925         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1926                 return -EINVAL;
1927
1928         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1929
1930         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1931         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1932         chandef->center_freq1 = control_freq;
1933         chandef->center_freq2 = 0;
1934
1935         /* Primary channel not allowed */
1936         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1937                 return -EINVAL;
1938
1939         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1940                 enum nl80211_channel_type chantype;
1941
1942                 chantype = nla_get_u32(
1943                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1944
1945                 switch (chantype) {
1946                 case NL80211_CHAN_NO_HT:
1947                 case NL80211_CHAN_HT20:
1948                 case NL80211_CHAN_HT40PLUS:
1949                 case NL80211_CHAN_HT40MINUS:
1950                         cfg80211_chandef_create(chandef, chandef->chan,
1951                                                 chantype);
1952                         break;
1953                 default:
1954                         return -EINVAL;
1955                 }
1956         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1957                 chandef->width =
1958                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1959                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1960                         chandef->center_freq1 =
1961                                 nla_get_u32(
1962                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1963                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1964                         chandef->center_freq2 =
1965                                 nla_get_u32(
1966                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1967         }
1968
1969         if (!cfg80211_chandef_valid(chandef))
1970                 return -EINVAL;
1971
1972         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1973                                      IEEE80211_CHAN_DISABLED))
1974                 return -EINVAL;
1975
1976         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1977              chandef->width == NL80211_CHAN_WIDTH_10) &&
1978             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1979                 return -EINVAL;
1980
1981         return 0;
1982 }
1983
1984 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1985                                  struct net_device *dev,
1986                                  struct genl_info *info)
1987 {
1988         struct cfg80211_chan_def chandef;
1989         int result;
1990         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1991         struct wireless_dev *wdev = NULL;
1992
1993         if (dev)
1994                 wdev = dev->ieee80211_ptr;
1995         if (!nl80211_can_set_dev_channel(wdev))
1996                 return -EOPNOTSUPP;
1997         if (wdev)
1998                 iftype = wdev->iftype;
1999
2000         result = nl80211_parse_chandef(rdev, info, &chandef);
2001         if (result)
2002                 return result;
2003
2004         switch (iftype) {
2005         case NL80211_IFTYPE_AP:
2006         case NL80211_IFTYPE_P2P_GO:
2007                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2008                                                    iftype)) {
2009                         result = -EINVAL;
2010                         break;
2011                 }
2012                 if (wdev->beacon_interval) {
2013                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2014                             !(rdev->wiphy.features &
2015                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2016                                 result = -EBUSY;
2017                                 break;
2018                         }
2019
2020                         /* Only allow dynamic channel width changes */
2021                         if (chandef.chan != wdev->preset_chandef.chan) {
2022                                 result = -EBUSY;
2023                                 break;
2024                         }
2025                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2026                         if (result)
2027                                 break;
2028                 }
2029                 wdev->preset_chandef = chandef;
2030                 result = 0;
2031                 break;
2032         case NL80211_IFTYPE_MESH_POINT:
2033                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2034                 break;
2035         case NL80211_IFTYPE_MONITOR:
2036                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2037                 break;
2038         default:
2039                 result = -EINVAL;
2040         }
2041
2042         return result;
2043 }
2044
2045 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2046 {
2047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2048         struct net_device *netdev = info->user_ptr[1];
2049
2050         return __nl80211_set_channel(rdev, netdev, info);
2051 }
2052
2053 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2054 {
2055         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2056         struct net_device *dev = info->user_ptr[1];
2057         struct wireless_dev *wdev = dev->ieee80211_ptr;
2058         const u8 *bssid;
2059
2060         if (!info->attrs[NL80211_ATTR_MAC])
2061                 return -EINVAL;
2062
2063         if (netif_running(dev))
2064                 return -EBUSY;
2065
2066         if (!rdev->ops->set_wds_peer)
2067                 return -EOPNOTSUPP;
2068
2069         if (wdev->iftype != NL80211_IFTYPE_WDS)
2070                 return -EOPNOTSUPP;
2071
2072         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2073         return rdev_set_wds_peer(rdev, dev, bssid);
2074 }
2075
2076
2077 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2078 {
2079         struct cfg80211_registered_device *rdev;
2080         struct net_device *netdev = NULL;
2081         struct wireless_dev *wdev;
2082         int result = 0, rem_txq_params = 0;
2083         struct nlattr *nl_txq_params;
2084         u32 changed;
2085         u8 retry_short = 0, retry_long = 0;
2086         u32 frag_threshold = 0, rts_threshold = 0;
2087         u8 coverage_class = 0;
2088
2089         ASSERT_RTNL();
2090
2091         /*
2092          * Try to find the wiphy and netdev. Normally this
2093          * function shouldn't need the netdev, but this is
2094          * done for backward compatibility -- previously
2095          * setting the channel was done per wiphy, but now
2096          * it is per netdev. Previous userland like hostapd
2097          * also passed a netdev to set_wiphy, so that it is
2098          * possible to let that go to the right netdev!
2099          */
2100
2101         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2102                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2103
2104                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2105                 if (netdev && netdev->ieee80211_ptr)
2106                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2107                 else
2108                         netdev = NULL;
2109         }
2110
2111         if (!netdev) {
2112                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2113                                                   info->attrs);
2114                 if (IS_ERR(rdev))
2115                         return PTR_ERR(rdev);
2116                 wdev = NULL;
2117                 netdev = NULL;
2118                 result = 0;
2119         } else
2120                 wdev = netdev->ieee80211_ptr;
2121
2122         /*
2123          * end workaround code, by now the rdev is available
2124          * and locked, and wdev may or may not be NULL.
2125          */
2126
2127         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2128                 result = cfg80211_dev_rename(
2129                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2130
2131         if (result)
2132                 return result;
2133
2134         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2135                 struct ieee80211_txq_params txq_params;
2136                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2137
2138                 if (!rdev->ops->set_txq_params)
2139                         return -EOPNOTSUPP;
2140
2141                 if (!netdev)
2142                         return -EINVAL;
2143
2144                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2145                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2146                         return -EINVAL;
2147
2148                 if (!netif_running(netdev))
2149                         return -ENETDOWN;
2150
2151                 nla_for_each_nested(nl_txq_params,
2152                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2153                                     rem_txq_params) {
2154                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2155                                            nla_data(nl_txq_params),
2156                                            nla_len(nl_txq_params),
2157                                            txq_params_policy);
2158                         if (result)
2159                                 return result;
2160                         result = parse_txq_params(tb, &txq_params);
2161                         if (result)
2162                                 return result;
2163
2164                         result = rdev_set_txq_params(rdev, netdev,
2165                                                      &txq_params);
2166                         if (result)
2167                                 return result;
2168                 }
2169         }
2170
2171         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2172                 result = __nl80211_set_channel(
2173                         rdev,
2174                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2175                         info);
2176                 if (result)
2177                         return result;
2178         }
2179
2180         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2181                 struct wireless_dev *txp_wdev = wdev;
2182                 enum nl80211_tx_power_setting type;
2183                 int idx, mbm = 0;
2184
2185                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2186                         txp_wdev = NULL;
2187
2188                 if (!rdev->ops->set_tx_power)
2189                         return -EOPNOTSUPP;
2190
2191                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2192                 type = nla_get_u32(info->attrs[idx]);
2193
2194                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2195                     (type != NL80211_TX_POWER_AUTOMATIC))
2196                         return -EINVAL;
2197
2198                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2199                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2200                         mbm = nla_get_u32(info->attrs[idx]);
2201                 }
2202
2203                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2204                 if (result)
2205                         return result;
2206         }
2207
2208         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2209             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2210                 u32 tx_ant, rx_ant;
2211                 if ((!rdev->wiphy.available_antennas_tx &&
2212                      !rdev->wiphy.available_antennas_rx) ||
2213                     !rdev->ops->set_antenna)
2214                         return -EOPNOTSUPP;
2215
2216                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2217                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2218
2219                 /* reject antenna configurations which don't match the
2220                  * available antenna masks, except for the "all" mask */
2221                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2222                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2223                         return -EINVAL;
2224
2225                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2226                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2227
2228                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2229                 if (result)
2230                         return result;
2231         }
2232
2233         changed = 0;
2234
2235         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2236                 retry_short = nla_get_u8(
2237                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2238                 if (retry_short == 0)
2239                         return -EINVAL;
2240
2241                 changed |= WIPHY_PARAM_RETRY_SHORT;
2242         }
2243
2244         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2245                 retry_long = nla_get_u8(
2246                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2247                 if (retry_long == 0)
2248                         return -EINVAL;
2249
2250                 changed |= WIPHY_PARAM_RETRY_LONG;
2251         }
2252
2253         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2254                 frag_threshold = nla_get_u32(
2255                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2256                 if (frag_threshold < 256)
2257                         return -EINVAL;
2258
2259                 if (frag_threshold != (u32) -1) {
2260                         /*
2261                          * Fragments (apart from the last one) are required to
2262                          * have even length. Make the fragmentation code
2263                          * simpler by stripping LSB should someone try to use
2264                          * odd threshold value.
2265                          */
2266                         frag_threshold &= ~0x1;
2267                 }
2268                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2269         }
2270
2271         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2272                 rts_threshold = nla_get_u32(
2273                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2274                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2275         }
2276
2277         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2278                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2279                         return -EINVAL;
2280
2281                 coverage_class = nla_get_u8(
2282                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2283                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2284         }
2285
2286         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2287                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2288                         return -EOPNOTSUPP;
2289
2290                 changed |= WIPHY_PARAM_DYN_ACK;
2291         }
2292
2293         if (changed) {
2294                 u8 old_retry_short, old_retry_long;
2295                 u32 old_frag_threshold, old_rts_threshold;
2296                 u8 old_coverage_class;
2297
2298                 if (!rdev->ops->set_wiphy_params)
2299                         return -EOPNOTSUPP;
2300
2301                 old_retry_short = rdev->wiphy.retry_short;
2302                 old_retry_long = rdev->wiphy.retry_long;
2303                 old_frag_threshold = rdev->wiphy.frag_threshold;
2304                 old_rts_threshold = rdev->wiphy.rts_threshold;
2305                 old_coverage_class = rdev->wiphy.coverage_class;
2306
2307                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2308                         rdev->wiphy.retry_short = retry_short;
2309                 if (changed & WIPHY_PARAM_RETRY_LONG)
2310                         rdev->wiphy.retry_long = retry_long;
2311                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2312                         rdev->wiphy.frag_threshold = frag_threshold;
2313                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2314                         rdev->wiphy.rts_threshold = rts_threshold;
2315                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2316                         rdev->wiphy.coverage_class = coverage_class;
2317
2318                 result = rdev_set_wiphy_params(rdev, changed);
2319                 if (result) {
2320                         rdev->wiphy.retry_short = old_retry_short;
2321                         rdev->wiphy.retry_long = old_retry_long;
2322                         rdev->wiphy.frag_threshold = old_frag_threshold;
2323                         rdev->wiphy.rts_threshold = old_rts_threshold;
2324                         rdev->wiphy.coverage_class = old_coverage_class;
2325                         return result;
2326                 }
2327         }
2328         return 0;
2329 }
2330
2331 static inline u64 wdev_id(struct wireless_dev *wdev)
2332 {
2333         return (u64)wdev->identifier |
2334                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2335 }
2336
2337 static int nl80211_send_chandef(struct sk_buff *msg,
2338                                 const struct cfg80211_chan_def *chandef)
2339 {
2340         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2341                 return -EINVAL;
2342
2343         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2344                         chandef->chan->center_freq))
2345                 return -ENOBUFS;
2346         switch (chandef->width) {
2347         case NL80211_CHAN_WIDTH_20_NOHT:
2348         case NL80211_CHAN_WIDTH_20:
2349         case NL80211_CHAN_WIDTH_40:
2350                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2351                                 cfg80211_get_chandef_type(chandef)))
2352                         return -ENOBUFS;
2353                 break;
2354         default:
2355                 break;
2356         }
2357         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2358                 return -ENOBUFS;
2359         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2360                 return -ENOBUFS;
2361         if (chandef->center_freq2 &&
2362             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2363                 return -ENOBUFS;
2364         return 0;
2365 }
2366
2367 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2368                               struct cfg80211_registered_device *rdev,
2369                               struct wireless_dev *wdev, bool removal)
2370 {
2371         struct net_device *dev = wdev->netdev;
2372         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2373         void *hdr;
2374
2375         if (removal)
2376                 cmd = NL80211_CMD_DEL_INTERFACE;
2377
2378         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2379         if (!hdr)
2380                 return -1;
2381
2382         if (dev &&
2383             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2384              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2385                 goto nla_put_failure;
2386
2387         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2388             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2389             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2390             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2391             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2392                         rdev->devlist_generation ^
2393                         (cfg80211_rdev_list_generation << 2)))
2394                 goto nla_put_failure;
2395
2396         if (rdev->ops->get_channel) {
2397                 int ret;
2398                 struct cfg80211_chan_def chandef;
2399
2400                 ret = rdev_get_channel(rdev, wdev, &chandef);
2401                 if (ret == 0) {
2402                         if (nl80211_send_chandef(msg, &chandef))
2403                                 goto nla_put_failure;
2404                 }
2405         }
2406
2407         if (rdev->ops->get_tx_power) {
2408                 int dbm, ret;
2409
2410                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2411                 if (ret == 0 &&
2412                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2413                                 DBM_TO_MBM(dbm)))
2414                         goto nla_put_failure;
2415         }
2416
2417         if (wdev->ssid_len) {
2418                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2419                         goto nla_put_failure;
2420         }
2421
2422         genlmsg_end(msg, hdr);
2423         return 0;
2424
2425  nla_put_failure:
2426         genlmsg_cancel(msg, hdr);
2427         return -EMSGSIZE;
2428 }
2429
2430 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2431 {
2432         int wp_idx = 0;
2433         int if_idx = 0;
2434         int wp_start = cb->args[0];
2435         int if_start = cb->args[1];
2436         struct cfg80211_registered_device *rdev;
2437         struct wireless_dev *wdev;
2438
2439         rtnl_lock();
2440         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2441                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2442                         continue;
2443                 if (wp_idx < wp_start) {
2444                         wp_idx++;
2445                         continue;
2446                 }
2447                 if_idx = 0;
2448
2449                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2450                         if (if_idx < if_start) {
2451                                 if_idx++;
2452                                 continue;
2453                         }
2454                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2455                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2456                                                rdev, wdev, false) < 0) {
2457                                 goto out;
2458                         }
2459                         if_idx++;
2460                 }
2461
2462                 wp_idx++;
2463         }
2464  out:
2465         rtnl_unlock();
2466
2467         cb->args[0] = wp_idx;
2468         cb->args[1] = if_idx;
2469
2470         return skb->len;
2471 }
2472
2473 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2474 {
2475         struct sk_buff *msg;
2476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2477         struct wireless_dev *wdev = info->user_ptr[1];
2478
2479         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2480         if (!msg)
2481                 return -ENOMEM;
2482
2483         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2484                                rdev, wdev, false) < 0) {
2485                 nlmsg_free(msg);
2486                 return -ENOBUFS;
2487         }
2488
2489         return genlmsg_reply(msg, info);
2490 }
2491
2492 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2493         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2494         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2495         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2496         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2497         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2498         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2499 };
2500
2501 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2502 {
2503         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2504         int flag;
2505
2506         *mntrflags = 0;
2507
2508         if (!nla)
2509                 return -EINVAL;
2510
2511         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2512                              nla, mntr_flags_policy))
2513                 return -EINVAL;
2514
2515         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2516                 if (flags[flag])
2517                         *mntrflags |= (1<<flag);
2518
2519         return 0;
2520 }
2521
2522 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2523                                struct net_device *netdev, u8 use_4addr,
2524                                enum nl80211_iftype iftype)
2525 {
2526         if (!use_4addr) {
2527                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2528                         return -EBUSY;
2529                 return 0;
2530         }
2531
2532         switch (iftype) {
2533         case NL80211_IFTYPE_AP_VLAN:
2534                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2535                         return 0;
2536                 break;
2537         case NL80211_IFTYPE_STATION:
2538                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2539                         return 0;
2540                 break;
2541         default:
2542                 break;
2543         }
2544
2545         return -EOPNOTSUPP;
2546 }
2547
2548 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2549 {
2550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2551         struct vif_params params;
2552         int err;
2553         enum nl80211_iftype otype, ntype;
2554         struct net_device *dev = info->user_ptr[1];
2555         u32 _flags, *flags = NULL;
2556         bool change = false;
2557
2558         memset(&params, 0, sizeof(params));
2559
2560         otype = ntype = dev->ieee80211_ptr->iftype;
2561
2562         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2563                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2564                 if (otype != ntype)
2565                         change = true;
2566                 if (ntype > NL80211_IFTYPE_MAX)
2567                         return -EINVAL;
2568         }
2569
2570         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2571                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2572
2573                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2574                         return -EINVAL;
2575                 if (netif_running(dev))
2576                         return -EBUSY;
2577
2578                 wdev_lock(wdev);
2579                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2580                              IEEE80211_MAX_MESH_ID_LEN);
2581                 wdev->mesh_id_up_len =
2582                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2583                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2584                        wdev->mesh_id_up_len);
2585                 wdev_unlock(wdev);
2586         }
2587
2588         if (info->attrs[NL80211_ATTR_4ADDR]) {
2589                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2590                 change = true;
2591                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2592                 if (err)
2593                         return err;
2594         } else {
2595                 params.use_4addr = -1;
2596         }
2597
2598         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2599                 if (ntype != NL80211_IFTYPE_MONITOR)
2600                         return -EINVAL;
2601                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2602                                           &_flags);
2603                 if (err)
2604                         return err;
2605
2606                 flags = &_flags;
2607                 change = true;
2608         }
2609
2610         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2611             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2612                 return -EOPNOTSUPP;
2613
2614         if (change)
2615                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2616         else
2617                 err = 0;
2618
2619         if (!err && params.use_4addr != -1)
2620                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2621
2622         return err;
2623 }
2624
2625 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2626 {
2627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2628         struct vif_params params;
2629         struct wireless_dev *wdev;
2630         struct sk_buff *msg, *event;
2631         int err;
2632         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2633         u32 flags;
2634
2635         /* to avoid failing a new interface creation due to pending removal */
2636         cfg80211_destroy_ifaces(rdev);
2637
2638         memset(&params, 0, sizeof(params));
2639
2640         if (!info->attrs[NL80211_ATTR_IFNAME])
2641                 return -EINVAL;
2642
2643         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2644                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2645                 if (type > NL80211_IFTYPE_MAX)
2646                         return -EINVAL;
2647         }
2648
2649         if (!rdev->ops->add_virtual_intf ||
2650             !(rdev->wiphy.interface_modes & (1 << type)))
2651                 return -EOPNOTSUPP;
2652
2653         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2654              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2655             info->attrs[NL80211_ATTR_MAC]) {
2656                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2657                            ETH_ALEN);
2658                 if (!is_valid_ether_addr(params.macaddr))
2659                         return -EADDRNOTAVAIL;
2660         }
2661
2662         if (info->attrs[NL80211_ATTR_4ADDR]) {
2663                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2664                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2665                 if (err)
2666                         return err;
2667         }
2668
2669         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2670                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2671                                   &flags);
2672
2673         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2674             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2675                 return -EOPNOTSUPP;
2676
2677         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2678         if (!msg)
2679                 return -ENOMEM;
2680
2681         wdev = rdev_add_virtual_intf(rdev,
2682                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2683                                 NET_NAME_USER, type, err ? NULL : &flags,
2684                                 &params);
2685         if (WARN_ON(!wdev)) {
2686                 nlmsg_free(msg);
2687                 return -EPROTO;
2688         } else if (IS_ERR(wdev)) {
2689                 nlmsg_free(msg);
2690                 return PTR_ERR(wdev);
2691         }
2692
2693         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2694                 wdev->owner_nlportid = info->snd_portid;
2695
2696         switch (type) {
2697         case NL80211_IFTYPE_MESH_POINT:
2698                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2699                         break;
2700                 wdev_lock(wdev);
2701                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2702                              IEEE80211_MAX_MESH_ID_LEN);
2703                 wdev->mesh_id_up_len =
2704                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2705                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2706                        wdev->mesh_id_up_len);
2707                 wdev_unlock(wdev);
2708                 break;
2709         case NL80211_IFTYPE_P2P_DEVICE:
2710                 /*
2711                  * P2P Device doesn't have a netdev, so doesn't go
2712                  * through the netdev notifier and must be added here
2713                  */
2714                 mutex_init(&wdev->mtx);
2715                 INIT_LIST_HEAD(&wdev->event_list);
2716                 spin_lock_init(&wdev->event_lock);
2717                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2718                 spin_lock_init(&wdev->mgmt_registrations_lock);
2719
2720                 wdev->identifier = ++rdev->wdev_id;
2721                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2722                 rdev->devlist_generation++;
2723                 break;
2724         default:
2725                 break;
2726         }
2727
2728         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2729                                rdev, wdev, false) < 0) {
2730                 nlmsg_free(msg);
2731                 return -ENOBUFS;
2732         }
2733
2734         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2735         if (event) {
2736                 if (nl80211_send_iface(event, 0, 0, 0,
2737                                        rdev, wdev, false) < 0) {
2738                         nlmsg_free(event);
2739                         goto out;
2740                 }
2741
2742                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2743                                         event, 0, NL80211_MCGRP_CONFIG,
2744                                         GFP_KERNEL);
2745         }
2746
2747 out:
2748         return genlmsg_reply(msg, info);
2749 }
2750
2751 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2752 {
2753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2754         struct wireless_dev *wdev = info->user_ptr[1];
2755         struct sk_buff *msg;
2756         int status;
2757
2758         if (!rdev->ops->del_virtual_intf)
2759                 return -EOPNOTSUPP;
2760
2761         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2762         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2763                 nlmsg_free(msg);
2764                 msg = NULL;
2765         }
2766
2767         /*
2768          * If we remove a wireless device without a netdev then clear
2769          * user_ptr[1] so that nl80211_post_doit won't dereference it
2770          * to check if it needs to do dev_put(). Otherwise it crashes
2771          * since the wdev has been freed, unlike with a netdev where
2772          * we need the dev_put() for the netdev to really be freed.
2773          */
2774         if (!wdev->netdev)
2775                 info->user_ptr[1] = NULL;
2776
2777         status = rdev_del_virtual_intf(rdev, wdev);
2778         if (status >= 0 && msg)
2779                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2780                                         msg, 0, NL80211_MCGRP_CONFIG,
2781                                         GFP_KERNEL);
2782         else
2783                 nlmsg_free(msg);
2784
2785         return status;
2786 }
2787
2788 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2789 {
2790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2791         struct net_device *dev = info->user_ptr[1];
2792         u16 noack_map;
2793
2794         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2795                 return -EINVAL;
2796
2797         if (!rdev->ops->set_noack_map)
2798                 return -EOPNOTSUPP;
2799
2800         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2801
2802         return rdev_set_noack_map(rdev, dev, noack_map);
2803 }
2804
2805 struct get_key_cookie {
2806         struct sk_buff *msg;
2807         int error;
2808         int idx;
2809 };
2810
2811 static void get_key_callback(void *c, struct key_params *params)
2812 {
2813         struct nlattr *key;
2814         struct get_key_cookie *cookie = c;
2815
2816         if ((params->key &&
2817              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2818                      params->key_len, params->key)) ||
2819             (params->seq &&
2820              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2821                      params->seq_len, params->seq)) ||
2822             (params->cipher &&
2823              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2824                          params->cipher)))
2825                 goto nla_put_failure;
2826
2827         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2828         if (!key)
2829                 goto nla_put_failure;
2830
2831         if ((params->key &&
2832              nla_put(cookie->msg, NL80211_KEY_DATA,
2833                      params->key_len, params->key)) ||
2834             (params->seq &&
2835              nla_put(cookie->msg, NL80211_KEY_SEQ,
2836                      params->seq_len, params->seq)) ||
2837             (params->cipher &&
2838              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2839                          params->cipher)))
2840                 goto nla_put_failure;
2841
2842         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2843                 goto nla_put_failure;
2844
2845         nla_nest_end(cookie->msg, key);
2846
2847         return;
2848  nla_put_failure:
2849         cookie->error = 1;
2850 }
2851
2852 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2853 {
2854         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2855         int err;
2856         struct net_device *dev = info->user_ptr[1];
2857         u8 key_idx = 0;
2858         const u8 *mac_addr = NULL;
2859         bool pairwise;
2860         struct get_key_cookie cookie = {
2861                 .error = 0,
2862         };
2863         void *hdr;
2864         struct sk_buff *msg;
2865
2866         if (info->attrs[NL80211_ATTR_KEY_IDX])
2867                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2868
2869         if (key_idx > 5)
2870                 return -EINVAL;
2871
2872         if (info->attrs[NL80211_ATTR_MAC])
2873                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2874
2875         pairwise = !!mac_addr;
2876         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2877                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2878                 if (kt >= NUM_NL80211_KEYTYPES)
2879                         return -EINVAL;
2880                 if (kt != NL80211_KEYTYPE_GROUP &&
2881                     kt != NL80211_KEYTYPE_PAIRWISE)
2882                         return -EINVAL;
2883                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2884         }
2885
2886         if (!rdev->ops->get_key)
2887                 return -EOPNOTSUPP;
2888
2889         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2890                 return -ENOENT;
2891
2892         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2893         if (!msg)
2894                 return -ENOMEM;
2895
2896         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2897                              NL80211_CMD_NEW_KEY);
2898         if (!hdr)
2899                 goto nla_put_failure;
2900
2901         cookie.msg = msg;
2902         cookie.idx = key_idx;
2903
2904         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2905             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2906                 goto nla_put_failure;
2907         if (mac_addr &&
2908             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2909                 goto nla_put_failure;
2910
2911         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2912                            get_key_callback);
2913
2914         if (err)
2915                 goto free_msg;
2916
2917         if (cookie.error)
2918                 goto nla_put_failure;
2919
2920         genlmsg_end(msg, hdr);
2921         return genlmsg_reply(msg, info);
2922
2923  nla_put_failure:
2924         err = -ENOBUFS;
2925  free_msg:
2926         nlmsg_free(msg);
2927         return err;
2928 }
2929
2930 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2931 {
2932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2933         struct key_parse key;
2934         int err;
2935         struct net_device *dev = info->user_ptr[1];
2936
2937         err = nl80211_parse_key(info, &key);
2938         if (err)
2939                 return err;
2940
2941         if (key.idx < 0)
2942                 return -EINVAL;
2943
2944         /* only support setting default key */
2945         if (!key.def && !key.defmgmt)
2946                 return -EINVAL;
2947
2948         wdev_lock(dev->ieee80211_ptr);
2949
2950         if (key.def) {
2951                 if (!rdev->ops->set_default_key) {
2952                         err = -EOPNOTSUPP;
2953                         goto out;
2954                 }
2955
2956                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2957                 if (err)
2958                         goto out;
2959
2960                 err = rdev_set_default_key(rdev, dev, key.idx,
2961                                                  key.def_uni, key.def_multi);
2962
2963                 if (err)
2964                         goto out;
2965
2966 #ifdef CONFIG_CFG80211_WEXT
2967                 dev->ieee80211_ptr->wext.default_key = key.idx;
2968 #endif
2969         } else {
2970                 if (key.def_uni || !key.def_multi) {
2971                         err = -EINVAL;
2972                         goto out;
2973                 }
2974
2975                 if (!rdev->ops->set_default_mgmt_key) {
2976                         err = -EOPNOTSUPP;
2977                         goto out;
2978                 }
2979
2980                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2981                 if (err)
2982                         goto out;
2983
2984                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2985                 if (err)
2986                         goto out;
2987
2988 #ifdef CONFIG_CFG80211_WEXT
2989                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2990 #endif
2991         }
2992
2993  out:
2994         wdev_unlock(dev->ieee80211_ptr);
2995
2996         return err;
2997 }
2998
2999 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3000 {
3001         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3002         int err;
3003         struct net_device *dev = info->user_ptr[1];
3004         struct key_parse key;
3005         const u8 *mac_addr = NULL;
3006
3007         err = nl80211_parse_key(info, &key);
3008         if (err)
3009                 return err;
3010
3011         if (!key.p.key)
3012                 return -EINVAL;
3013
3014         if (info->attrs[NL80211_ATTR_MAC])
3015                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3016
3017         if (key.type == -1) {
3018                 if (mac_addr)
3019                         key.type = NL80211_KEYTYPE_PAIRWISE;
3020                 else
3021                         key.type = NL80211_KEYTYPE_GROUP;
3022         }
3023
3024         /* for now */
3025         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3026             key.type != NL80211_KEYTYPE_GROUP)
3027                 return -EINVAL;
3028
3029         if (!rdev->ops->add_key)
3030                 return -EOPNOTSUPP;
3031
3032         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3033                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3034                                            mac_addr))
3035                 return -EINVAL;
3036
3037         wdev_lock(dev->ieee80211_ptr);
3038         err = nl80211_key_allowed(dev->ieee80211_ptr);
3039         if (!err)
3040                 err = rdev_add_key(rdev, dev, key.idx,
3041                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3042                                     mac_addr, &key.p);
3043         wdev_unlock(dev->ieee80211_ptr);
3044
3045         return err;
3046 }
3047
3048 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3049 {
3050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3051         int err;
3052         struct net_device *dev = info->user_ptr[1];
3053         u8 *mac_addr = NULL;
3054         struct key_parse key;
3055
3056         err = nl80211_parse_key(info, &key);
3057         if (err)
3058                 return err;
3059
3060         if (info->attrs[NL80211_ATTR_MAC])
3061                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3062
3063         if (key.type == -1) {
3064                 if (mac_addr)
3065                         key.type = NL80211_KEYTYPE_PAIRWISE;
3066                 else
3067                         key.type = NL80211_KEYTYPE_GROUP;
3068         }
3069
3070         /* for now */
3071         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3072             key.type != NL80211_KEYTYPE_GROUP)
3073                 return -EINVAL;
3074
3075         if (!rdev->ops->del_key)
3076                 return -EOPNOTSUPP;
3077
3078         wdev_lock(dev->ieee80211_ptr);
3079         err = nl80211_key_allowed(dev->ieee80211_ptr);
3080
3081         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3082             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3083                 err = -ENOENT;
3084
3085         if (!err)
3086                 err = rdev_del_key(rdev, dev, key.idx,
3087                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3088                                    mac_addr);
3089
3090 #ifdef CONFIG_CFG80211_WEXT
3091         if (!err) {
3092                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3093                         dev->ieee80211_ptr->wext.default_key = -1;
3094                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3095                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3096         }
3097 #endif
3098         wdev_unlock(dev->ieee80211_ptr);
3099
3100         return err;
3101 }
3102
3103 /* This function returns an error or the number of nested attributes */
3104 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3105 {
3106         struct nlattr *attr;
3107         int n_entries = 0, tmp;
3108
3109         nla_for_each_nested(attr, nl_attr, tmp) {
3110                 if (nla_len(attr) != ETH_ALEN)
3111                         return -EINVAL;
3112
3113                 n_entries++;
3114         }
3115
3116         return n_entries;
3117 }
3118
3119 /*
3120  * This function parses ACL information and allocates memory for ACL data.
3121  * On successful return, the calling function is responsible to free the
3122  * ACL buffer returned by this function.
3123  */
3124 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3125                                                 struct genl_info *info)
3126 {
3127         enum nl80211_acl_policy acl_policy;
3128         struct nlattr *attr;
3129         struct cfg80211_acl_data *acl;
3130         int i = 0, n_entries, tmp;
3131
3132         if (!wiphy->max_acl_mac_addrs)
3133                 return ERR_PTR(-EOPNOTSUPP);
3134
3135         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3136                 return ERR_PTR(-EINVAL);
3137
3138         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3139         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3140             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3141                 return ERR_PTR(-EINVAL);
3142
3143         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3144                 return ERR_PTR(-EINVAL);
3145
3146         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3147         if (n_entries < 0)
3148                 return ERR_PTR(n_entries);
3149
3150         if (n_entries > wiphy->max_acl_mac_addrs)
3151                 return ERR_PTR(-ENOTSUPP);
3152
3153         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3154                       GFP_KERNEL);
3155         if (!acl)
3156                 return ERR_PTR(-ENOMEM);
3157
3158         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3159                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3160                 i++;
3161         }
3162
3163         acl->n_acl_entries = n_entries;
3164         acl->acl_policy = acl_policy;
3165
3166         return acl;
3167 }
3168
3169 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3170 {
3171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3172         struct net_device *dev = info->user_ptr[1];
3173         struct cfg80211_acl_data *acl;
3174         int err;
3175
3176         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3177             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3178                 return -EOPNOTSUPP;
3179
3180         if (!dev->ieee80211_ptr->beacon_interval)
3181                 return -EINVAL;
3182
3183         acl = parse_acl_data(&rdev->wiphy, info);
3184         if (IS_ERR(acl))
3185                 return PTR_ERR(acl);
3186
3187         err = rdev_set_mac_acl(rdev, dev, acl);
3188
3189         kfree(acl);
3190
3191         return err;
3192 }
3193
3194 static int nl80211_parse_beacon(struct nlattr *attrs[],
3195                                 struct cfg80211_beacon_data *bcn)
3196 {
3197         bool haveinfo = false;
3198
3199         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3200             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3201             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3202             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3203                 return -EINVAL;
3204
3205         memset(bcn, 0, sizeof(*bcn));
3206
3207         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3208                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3209                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3210                 if (!bcn->head_len)
3211                         return -EINVAL;
3212                 haveinfo = true;
3213         }
3214
3215         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3216                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3217                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3218                 haveinfo = true;
3219         }
3220
3221         if (!haveinfo)
3222                 return -EINVAL;
3223
3224         if (attrs[NL80211_ATTR_IE]) {
3225                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3226                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3227         }
3228
3229         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3230                 bcn->proberesp_ies =
3231                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3232                 bcn->proberesp_ies_len =
3233                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3234         }
3235
3236         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3237                 bcn->assocresp_ies =
3238                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3239                 bcn->assocresp_ies_len =
3240                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3241         }
3242
3243         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3244                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3245                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3246         }
3247
3248         return 0;
3249 }
3250
3251 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3252                                    struct cfg80211_ap_settings *params)
3253 {
3254         struct wireless_dev *wdev;
3255         bool ret = false;
3256
3257         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3258                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3259                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3260                         continue;
3261
3262                 if (!wdev->preset_chandef.chan)
3263                         continue;
3264
3265                 params->chandef = wdev->preset_chandef;
3266                 ret = true;
3267                 break;
3268         }
3269
3270         return ret;
3271 }
3272
3273 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3274                                     enum nl80211_auth_type auth_type,
3275                                     enum nl80211_commands cmd)
3276 {
3277         if (auth_type > NL80211_AUTHTYPE_MAX)
3278                 return false;
3279
3280         switch (cmd) {
3281         case NL80211_CMD_AUTHENTICATE:
3282                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3283                     auth_type == NL80211_AUTHTYPE_SAE)
3284                         return false;
3285                 return true;
3286         case NL80211_CMD_CONNECT:
3287         case NL80211_CMD_START_AP:
3288                 /* SAE not supported yet */
3289                 if (auth_type == NL80211_AUTHTYPE_SAE)
3290                         return false;
3291                 return true;
3292         default:
3293                 return false;
3294         }
3295 }
3296
3297 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3298 {
3299         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3300         struct net_device *dev = info->user_ptr[1];
3301         struct wireless_dev *wdev = dev->ieee80211_ptr;
3302         struct cfg80211_ap_settings params;
3303         int err;
3304
3305         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3306             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3307                 return -EOPNOTSUPP;
3308
3309         if (!rdev->ops->start_ap)
3310                 return -EOPNOTSUPP;
3311
3312         if (wdev->beacon_interval)
3313                 return -EALREADY;
3314
3315         memset(&params, 0, sizeof(params));
3316
3317         /* these are required for START_AP */
3318         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3319             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3320             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3321                 return -EINVAL;
3322
3323         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3324         if (err)
3325                 return err;
3326
3327         params.beacon_interval =
3328                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3329         params.dtim_period =
3330                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3331
3332         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3333         if (err)
3334                 return err;
3335
3336         /*
3337          * In theory, some of these attributes should be required here
3338          * but since they were not used when the command was originally
3339          * added, keep them optional for old user space programs to let
3340          * them continue to work with drivers that do not need the
3341          * additional information -- drivers must check!
3342          */
3343         if (info->attrs[NL80211_ATTR_SSID]) {
3344                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3345                 params.ssid_len =
3346                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3347                 if (params.ssid_len == 0 ||
3348                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3349                         return -EINVAL;
3350         }
3351
3352         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3353                 params.hidden_ssid = nla_get_u32(
3354                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3355                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3356                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3357                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3358                         return -EINVAL;
3359         }
3360
3361         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3362
3363         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3364                 params.auth_type = nla_get_u32(
3365                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3366                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3367                                              NL80211_CMD_START_AP))
3368                         return -EINVAL;
3369         } else
3370                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3371
3372         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3373                                       NL80211_MAX_NR_CIPHER_SUITES);
3374         if (err)
3375                 return err;
3376
3377         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3378                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3379                         return -EOPNOTSUPP;
3380                 params.inactivity_timeout = nla_get_u16(
3381                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3382         }
3383
3384         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3385                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3386                         return -EINVAL;
3387                 params.p2p_ctwindow =
3388                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3389                 if (params.p2p_ctwindow > 127)
3390                         return -EINVAL;
3391                 if (params.p2p_ctwindow != 0 &&
3392                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3393                         return -EINVAL;
3394         }
3395
3396         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3397                 u8 tmp;
3398
3399                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3400                         return -EINVAL;
3401                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3402                 if (tmp > 1)
3403                         return -EINVAL;
3404                 params.p2p_opp_ps = tmp;
3405                 if (params.p2p_opp_ps != 0 &&
3406                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3407                         return -EINVAL;
3408         }
3409
3410         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3411                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3412                 if (err)
3413                         return err;
3414         } else if (wdev->preset_chandef.chan) {
3415                 params.chandef = wdev->preset_chandef;
3416         } else if (!nl80211_get_ap_channel(rdev, &params))
3417                 return -EINVAL;
3418
3419         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3420                                            wdev->iftype))
3421                 return -EINVAL;
3422
3423         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3424                 params.acl = parse_acl_data(&rdev->wiphy, info);
3425                 if (IS_ERR(params.acl))
3426                         return PTR_ERR(params.acl);
3427         }
3428
3429         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3430                 params.smps_mode =
3431                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3432                 switch (params.smps_mode) {
3433                 case NL80211_SMPS_OFF:
3434                         break;
3435                 case NL80211_SMPS_STATIC:
3436                         if (!(rdev->wiphy.features &
3437                               NL80211_FEATURE_STATIC_SMPS))
3438                                 return -EINVAL;
3439                         break;
3440                 case NL80211_SMPS_DYNAMIC:
3441                         if (!(rdev->wiphy.features &
3442                               NL80211_FEATURE_DYNAMIC_SMPS))
3443                                 return -EINVAL;
3444                         break;
3445                 default:
3446                         return -EINVAL;
3447                 }
3448         } else {
3449                 params.smps_mode = NL80211_SMPS_OFF;
3450         }
3451
3452         wdev_lock(wdev);
3453         err = rdev_start_ap(rdev, dev, &params);
3454         if (!err) {
3455                 wdev->preset_chandef = params.chandef;
3456                 wdev->beacon_interval = params.beacon_interval;
3457                 wdev->chandef = params.chandef;
3458                 wdev->ssid_len = params.ssid_len;
3459                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3460         }
3461         wdev_unlock(wdev);
3462
3463         kfree(params.acl);
3464
3465         return err;
3466 }
3467
3468 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3469 {
3470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3471         struct net_device *dev = info->user_ptr[1];
3472         struct wireless_dev *wdev = dev->ieee80211_ptr;
3473         struct cfg80211_beacon_data params;
3474         int err;
3475
3476         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3477             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3478                 return -EOPNOTSUPP;
3479
3480         if (!rdev->ops->change_beacon)
3481                 return -EOPNOTSUPP;
3482
3483         if (!wdev->beacon_interval)
3484                 return -EINVAL;
3485
3486         err = nl80211_parse_beacon(info->attrs, &params);
3487         if (err)
3488                 return err;
3489
3490         wdev_lock(wdev);
3491         err = rdev_change_beacon(rdev, dev, &params);
3492         wdev_unlock(wdev);
3493
3494         return err;
3495 }
3496
3497 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3498 {
3499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3500         struct net_device *dev = info->user_ptr[1];
3501
3502         return cfg80211_stop_ap(rdev, dev, false);
3503 }
3504
3505 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3506         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3507         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3508         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3509         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3510         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3511         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3512 };
3513
3514 static int parse_station_flags(struct genl_info *info,
3515                                enum nl80211_iftype iftype,
3516                                struct station_parameters *params)
3517 {
3518         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3519         struct nlattr *nla;
3520         int flag;
3521
3522         /*
3523          * Try parsing the new attribute first so userspace
3524          * can specify both for older kernels.
3525          */
3526         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3527         if (nla) {
3528                 struct nl80211_sta_flag_update *sta_flags;
3529
3530                 sta_flags = nla_data(nla);
3531                 params->sta_flags_mask = sta_flags->mask;
3532                 params->sta_flags_set = sta_flags->set;
3533                 params->sta_flags_set &= params->sta_flags_mask;
3534                 if ((params->sta_flags_mask |
3535                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3536                         return -EINVAL;
3537                 return 0;
3538         }
3539
3540         /* if present, parse the old attribute */
3541
3542         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3543         if (!nla)
3544                 return 0;
3545
3546         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3547                              nla, sta_flags_policy))
3548                 return -EINVAL;
3549
3550         /*
3551          * Only allow certain flags for interface types so that
3552          * other attributes are silently ignored. Remember that
3553          * this is backward compatibility code with old userspace
3554          * and shouldn't be hit in other cases anyway.
3555          */
3556         switch (iftype) {
3557         case NL80211_IFTYPE_AP:
3558         case NL80211_IFTYPE_AP_VLAN:
3559         case NL80211_IFTYPE_P2P_GO:
3560                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3561                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3562                                          BIT(NL80211_STA_FLAG_WME) |
3563                                          BIT(NL80211_STA_FLAG_MFP);
3564                 break;
3565         case NL80211_IFTYPE_P2P_CLIENT:
3566         case NL80211_IFTYPE_STATION:
3567                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3568                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3569                 break;
3570         case NL80211_IFTYPE_MESH_POINT:
3571                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3572                                          BIT(NL80211_STA_FLAG_MFP) |
3573                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3574         default:
3575                 return -EINVAL;
3576         }
3577
3578         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3579                 if (flags[flag]) {
3580                         params->sta_flags_set |= (1<<flag);
3581
3582                         /* no longer support new API additions in old API */
3583                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3584                                 return -EINVAL;
3585                 }
3586         }
3587
3588         return 0;
3589 }
3590
3591 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3592                                  int attr)
3593 {
3594         struct nlattr *rate;
3595         u32 bitrate;
3596         u16 bitrate_compat;
3597         enum nl80211_attrs rate_flg;
3598
3599         rate = nla_nest_start(msg, attr);
3600         if (!rate)
3601                 return false;
3602
3603         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3604         bitrate = cfg80211_calculate_bitrate(info);
3605         /* report 16-bit bitrate only if we can */
3606         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3607         if (bitrate > 0 &&
3608             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3609                 return false;
3610         if (bitrate_compat > 0 &&
3611             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3612                 return false;
3613
3614         switch (info->bw) {
3615         case RATE_INFO_BW_5:
3616                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3617                 break;
3618         case RATE_INFO_BW_10:
3619                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3620                 break;
3621         default:
3622                 WARN_ON(1);
3623                 /* fall through */
3624         case RATE_INFO_BW_20:
3625                 rate_flg = 0;
3626                 break;
3627         case RATE_INFO_BW_40:
3628                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3629                 break;
3630         case RATE_INFO_BW_80:
3631                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3632                 break;
3633         case RATE_INFO_BW_160:
3634                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3635                 break;
3636         }
3637
3638         if (rate_flg && nla_put_flag(msg, rate_flg))
3639                 return false;
3640
3641         if (info->flags & RATE_INFO_FLAGS_MCS) {
3642                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3643                         return false;
3644                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3645                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3646                         return false;
3647         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3648                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3649                         return false;
3650                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3651                         return false;
3652                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3653                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3654                         return false;
3655         }
3656
3657         nla_nest_end(msg, rate);
3658         return true;
3659 }
3660
3661 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3662                                int id)
3663 {
3664         void *attr;
3665         int i = 0;
3666
3667         if (!mask)
3668                 return true;
3669
3670         attr = nla_nest_start(msg, id);
3671         if (!attr)
3672                 return false;
3673
3674         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3675                 if (!(mask & BIT(i)))
3676                         continue;
3677
3678                 if (nla_put_u8(msg, i, signal[i]))
3679                         return false;
3680         }
3681
3682         nla_nest_end(msg, attr);
3683
3684         return true;
3685 }
3686
3687 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3688                                 u32 seq, int flags,
3689                                 struct cfg80211_registered_device *rdev,
3690                                 struct net_device *dev,
3691                                 const u8 *mac_addr, struct station_info *sinfo)
3692 {
3693         void *hdr;
3694         struct nlattr *sinfoattr, *bss_param;
3695
3696         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3697         if (!hdr)
3698                 return -1;
3699
3700         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3701             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3702             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3703                 goto nla_put_failure;
3704
3705         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3706         if (!sinfoattr)
3707                 goto nla_put_failure;
3708
3709 #define PUT_SINFO(attr, memb, type) do {                                \
3710         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3711             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3712                              sinfo->memb))                              \
3713                 goto nla_put_failure;                                   \
3714         } while (0)
3715
3716         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3717         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3718
3719         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3720                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3721             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3722                         (u32)sinfo->rx_bytes))
3723                 goto nla_put_failure;
3724
3725         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3726                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3727             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3728                         (u32)sinfo->tx_bytes))
3729                 goto nla_put_failure;
3730
3731         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3732         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3733         PUT_SINFO(LLID, llid, u16);
3734         PUT_SINFO(PLID, plid, u16);
3735         PUT_SINFO(PLINK_STATE, plink_state, u8);
3736
3737         switch (rdev->wiphy.signal_type) {
3738         case CFG80211_SIGNAL_TYPE_MBM:
3739                 PUT_SINFO(SIGNAL, signal, u8);
3740                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3741                 break;
3742         default:
3743                 break;
3744         }
3745         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3746                 if (!nl80211_put_signal(msg, sinfo->chains,
3747                                         sinfo->chain_signal,
3748                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3749                         goto nla_put_failure;
3750         }
3751         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3752                 if (!nl80211_put_signal(msg, sinfo->chains,
3753                                         sinfo->chain_signal_avg,
3754                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3755                         goto nla_put_failure;
3756         }
3757         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3758                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3759                                           NL80211_STA_INFO_TX_BITRATE))
3760                         goto nla_put_failure;
3761         }
3762         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3763                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3764                                           NL80211_STA_INFO_RX_BITRATE))
3765                         goto nla_put_failure;
3766         }
3767
3768         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3769         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3770         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3771         PUT_SINFO(TX_FAILED, tx_failed, u32);
3772         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3773         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3774         PUT_SINFO(LOCAL_PM, local_pm, u32);
3775         PUT_SINFO(PEER_PM, peer_pm, u32);
3776         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3777
3778         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3779                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3780                 if (!bss_param)
3781                         goto nla_put_failure;
3782
3783                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3784                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3785                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3786                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3787                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3788                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3789                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3790                                sinfo->bss_param.dtim_period) ||
3791                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3792                                 sinfo->bss_param.beacon_interval))
3793                         goto nla_put_failure;
3794
3795                 nla_nest_end(msg, bss_param);
3796         }
3797         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3798             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3799                     sizeof(struct nl80211_sta_flag_update),
3800                     &sinfo->sta_flags))
3801                 goto nla_put_failure;
3802
3803         PUT_SINFO(T_OFFSET, t_offset, u64);
3804         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3805         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3806         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3807
3808 #undef PUT_SINFO
3809
3810         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3811                 struct nlattr *tidsattr;
3812                 int tid;
3813
3814                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3815                 if (!tidsattr)
3816                         goto nla_put_failure;
3817
3818                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3819                         struct cfg80211_tid_stats *tidstats;
3820                         struct nlattr *tidattr;
3821
3822                         tidstats = &sinfo->pertid[tid];
3823
3824                         if (!tidstats->filled)
3825                                 continue;
3826
3827                         tidattr = nla_nest_start(msg, tid + 1);
3828                         if (!tidattr)
3829                                 goto nla_put_failure;
3830
3831 #define PUT_TIDVAL(attr, memb, type) do {                               \
3832         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3833             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3834                              tidstats->memb))                           \
3835                 goto nla_put_failure;                                   \
3836         } while (0)
3837
3838                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3839                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3840                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3841                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3842
3843 #undef PUT_TIDVAL
3844                         nla_nest_end(msg, tidattr);
3845                 }
3846
3847                 nla_nest_end(msg, tidsattr);
3848         }
3849
3850         nla_nest_end(msg, sinfoattr);
3851
3852         if (sinfo->assoc_req_ies_len &&
3853             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3854                     sinfo->assoc_req_ies))
3855                 goto nla_put_failure;
3856
3857         genlmsg_end(msg, hdr);
3858         return 0;
3859
3860  nla_put_failure:
3861         genlmsg_cancel(msg, hdr);
3862         return -EMSGSIZE;
3863 }
3864
3865 static int nl80211_dump_station(struct sk_buff *skb,
3866                                 struct netlink_callback *cb)
3867 {
3868         struct station_info sinfo;
3869         struct cfg80211_registered_device *rdev;
3870         struct wireless_dev *wdev;
3871         u8 mac_addr[ETH_ALEN];
3872         int sta_idx = cb->args[2];
3873         int err;
3874
3875         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3876         if (err)
3877                 return err;
3878
3879         if (!wdev->netdev) {
3880                 err = -EINVAL;
3881                 goto out_err;
3882         }
3883
3884         if (!rdev->ops->dump_station) {
3885                 err = -EOPNOTSUPP;
3886                 goto out_err;
3887         }
3888
3889         while (1) {
3890                 memset(&sinfo, 0, sizeof(sinfo));
3891                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3892                                         mac_addr, &sinfo);
3893                 if (err == -ENOENT)
3894                         break;
3895                 if (err)
3896                         goto out_err;
3897
3898                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3899                                 NETLINK_CB(cb->skb).portid,
3900                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3901                                 rdev, wdev->netdev, mac_addr,
3902                                 &sinfo) < 0)
3903                         goto out;
3904
3905                 sta_idx++;
3906         }
3907
3908
3909  out:
3910         cb->args[2] = sta_idx;
3911         err = skb->len;
3912  out_err:
3913         nl80211_finish_wdev_dump(rdev);
3914
3915         return err;
3916 }
3917
3918 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3919 {
3920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3921         struct net_device *dev = info->user_ptr[1];
3922         struct station_info sinfo;
3923         struct sk_buff *msg;
3924         u8 *mac_addr = NULL;
3925         int err;
3926
3927         memset(&sinfo, 0, sizeof(sinfo));
3928
3929         if (!info->attrs[NL80211_ATTR_MAC])
3930                 return -EINVAL;
3931
3932         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3933
3934         if (!rdev->ops->get_station)
3935                 return -EOPNOTSUPP;
3936
3937         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3938         if (err)
3939                 return err;
3940
3941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3942         if (!msg)
3943                 return -ENOMEM;
3944
3945         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3946                                  info->snd_portid, info->snd_seq, 0,
3947                                  rdev, dev, mac_addr, &sinfo) < 0) {
3948                 nlmsg_free(msg);
3949                 return -ENOBUFS;
3950         }
3951
3952         return genlmsg_reply(msg, info);
3953 }
3954
3955 int cfg80211_check_station_change(struct wiphy *wiphy,
3956                                   struct station_parameters *params,
3957                                   enum cfg80211_station_type statype)
3958 {
3959         if (params->listen_interval != -1)
3960                 return -EINVAL;
3961         if (params->aid &&
3962             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3963                 return -EINVAL;
3964
3965         /* When you run into this, adjust the code below for the new flag */
3966         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3967
3968         switch (statype) {
3969         case CFG80211_STA_MESH_PEER_KERNEL:
3970         case CFG80211_STA_MESH_PEER_USER:
3971                 /*
3972                  * No ignoring the TDLS flag here -- the userspace mesh
3973                  * code doesn't have the bug of including TDLS in the
3974                  * mask everywhere.
3975                  */
3976                 if (params->sta_flags_mask &
3977                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3978                                   BIT(NL80211_STA_FLAG_MFP) |
3979                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3980                         return -EINVAL;
3981                 break;
3982         case CFG80211_STA_TDLS_PEER_SETUP:
3983         case CFG80211_STA_TDLS_PEER_ACTIVE:
3984                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3985                         return -EINVAL;
3986                 /* ignore since it can't change */
3987                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3988                 break;
3989         default:
3990                 /* disallow mesh-specific things */
3991                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3992                         return -EINVAL;
3993                 if (params->local_pm)
3994                         return -EINVAL;
3995                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3996                         return -EINVAL;
3997         }
3998
3999         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4000             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4001                 /* TDLS can't be set, ... */
4002                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4003                         return -EINVAL;
4004                 /*
4005                  * ... but don't bother the driver with it. This works around
4006                  * a hostapd/wpa_supplicant issue -- it always includes the
4007                  * TLDS_PEER flag in the mask even for AP mode.
4008                  */
4009                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4010         }
4011
4012         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4013             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4014                 /* reject other things that can't change */
4015                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4016                         return -EINVAL;
4017                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4018                         return -EINVAL;
4019                 if (params->supported_rates)
4020                         return -EINVAL;
4021                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4022                         return -EINVAL;
4023         }
4024
4025         if (statype != CFG80211_STA_AP_CLIENT &&
4026             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4027                 if (params->vlan)
4028                         return -EINVAL;
4029         }
4030
4031         switch (statype) {
4032         case CFG80211_STA_AP_MLME_CLIENT:
4033                 /* Use this only for authorizing/unauthorizing a station */
4034                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4035                         return -EOPNOTSUPP;
4036                 break;
4037         case CFG80211_STA_AP_CLIENT:
4038         case CFG80211_STA_AP_CLIENT_UNASSOC:
4039                 /* accept only the listed bits */
4040                 if (params->sta_flags_mask &
4041                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4042                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4043                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4044                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4045                                   BIT(NL80211_STA_FLAG_WME) |
4046                                   BIT(NL80211_STA_FLAG_MFP)))
4047                         return -EINVAL;
4048
4049                 /* but authenticated/associated only if driver handles it */
4050                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4051                     params->sta_flags_mask &
4052                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4053                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4054                         return -EINVAL;
4055                 break;
4056         case CFG80211_STA_IBSS:
4057         case CFG80211_STA_AP_STA:
4058                 /* reject any changes other than AUTHORIZED */
4059                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4060                         return -EINVAL;
4061                 break;
4062         case CFG80211_STA_TDLS_PEER_SETUP:
4063                 /* reject any changes other than AUTHORIZED or WME */
4064                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4065                                                BIT(NL80211_STA_FLAG_WME)))
4066                         return -EINVAL;
4067                 /* force (at least) rates when authorizing */
4068                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4069                     !params->supported_rates)
4070                         return -EINVAL;
4071                 break;
4072         case CFG80211_STA_TDLS_PEER_ACTIVE:
4073                 /* reject any changes */
4074                 return -EINVAL;
4075         case CFG80211_STA_MESH_PEER_KERNEL:
4076                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4077                         return -EINVAL;
4078                 break;
4079         case CFG80211_STA_MESH_PEER_USER:
4080                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4081                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4082                         return -EINVAL;
4083                 break;
4084         }
4085
4086         return 0;
4087 }
4088 EXPORT_SYMBOL(cfg80211_check_station_change);
4089
4090 /*
4091  * Get vlan interface making sure it is running and on the right wiphy.
4092  */
4093 static struct net_device *get_vlan(struct genl_info *info,
4094                                    struct cfg80211_registered_device *rdev)
4095 {
4096         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4097         struct net_device *v;
4098         int ret;
4099
4100         if (!vlanattr)
4101                 return NULL;
4102
4103         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4104         if (!v)
4105                 return ERR_PTR(-ENODEV);
4106
4107         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4108                 ret = -EINVAL;
4109                 goto error;
4110         }
4111
4112         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4113             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4114             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4115                 ret = -EINVAL;
4116                 goto error;
4117         }
4118
4119         if (!netif_running(v)) {
4120                 ret = -ENETDOWN;
4121                 goto error;
4122         }
4123
4124         return v;
4125  error:
4126         dev_put(v);
4127         return ERR_PTR(ret);
4128 }
4129
4130 static const struct nla_policy
4131 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4132         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4133         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4134 };
4135
4136 static int nl80211_parse_sta_wme(struct genl_info *info,
4137                                  struct station_parameters *params)
4138 {
4139         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4140         struct nlattr *nla;
4141         int err;
4142
4143         /* parse WME attributes if present */
4144         if (!info->attrs[NL80211_ATTR_STA_WME])
4145                 return 0;
4146
4147         nla = info->attrs[NL80211_ATTR_STA_WME];
4148         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4149                                nl80211_sta_wme_policy);
4150         if (err)
4151                 return err;
4152
4153         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4154                 params->uapsd_queues = nla_get_u8(
4155                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4156         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4157                 return -EINVAL;
4158
4159         if (tb[NL80211_STA_WME_MAX_SP])
4160                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4161
4162         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4163                 return -EINVAL;
4164
4165         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4166
4167         return 0;
4168 }
4169
4170 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4171                                       struct station_parameters *params)
4172 {
4173         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4174                 params->supported_channels =
4175                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4176                 params->supported_channels_len =
4177                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4178                 /*
4179                  * Need to include at least one (first channel, number of
4180                  * channels) tuple for each subband, and must have proper
4181                  * tuples for the rest of the data as well.
4182                  */
4183                 if (params->supported_channels_len < 2)
4184                         return -EINVAL;
4185                 if (params->supported_channels_len % 2)
4186                         return -EINVAL;
4187         }
4188
4189         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4190                 params->supported_oper_classes =
4191                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4192                 params->supported_oper_classes_len =
4193                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4194                 /*
4195                  * The value of the Length field of the Supported Operating
4196                  * Classes element is between 2 and 253.
4197                  */
4198                 if (params->supported_oper_classes_len < 2 ||
4199                     params->supported_oper_classes_len > 253)
4200                         return -EINVAL;
4201         }
4202         return 0;
4203 }
4204
4205 static int nl80211_set_station_tdls(struct genl_info *info,
4206                                     struct station_parameters *params)
4207 {
4208         int err;
4209         /* Dummy STA entry gets updated once the peer capabilities are known */
4210         if (info->attrs[NL80211_ATTR_PEER_AID])
4211                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4212         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4213                 params->ht_capa =
4214                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4215         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4216                 params->vht_capa =
4217                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4218
4219         err = nl80211_parse_sta_channel_info(info, params);
4220         if (err)
4221                 return err;
4222
4223         return nl80211_parse_sta_wme(info, params);
4224 }
4225
4226 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4227 {
4228         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4229         struct net_device *dev = info->user_ptr[1];
4230         struct station_parameters params;
4231         u8 *mac_addr;
4232         int err;
4233
4234         memset(&params, 0, sizeof(params));
4235
4236         params.listen_interval = -1;
4237
4238         if (!rdev->ops->change_station)
4239                 return -EOPNOTSUPP;
4240
4241         if (info->attrs[NL80211_ATTR_STA_AID])
4242                 return -EINVAL;
4243
4244         if (!info->attrs[NL80211_ATTR_MAC])
4245                 return -EINVAL;
4246
4247         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4248
4249         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4250                 params.supported_rates =
4251                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4252                 params.supported_rates_len =
4253                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4254         }
4255
4256         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4257                 params.capability =
4258                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4259                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4260         }
4261
4262         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4263                 params.ext_capab =
4264                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4265                 params.ext_capab_len =
4266                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4267         }
4268
4269         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4270                 return -EINVAL;
4271
4272         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4273                 return -EINVAL;
4274
4275         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4276                 params.plink_action =
4277                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4278                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4279                         return -EINVAL;
4280         }
4281
4282         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4283                 params.plink_state =
4284                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4285                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4286                         return -EINVAL;
4287                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4288         }
4289
4290         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4291                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4292                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4293
4294                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4295                     pm > NL80211_MESH_POWER_MAX)
4296                         return -EINVAL;
4297
4298                 params.local_pm = pm;
4299         }
4300
4301         /* Include parameters for TDLS peer (will check later) */
4302         err = nl80211_set_station_tdls(info, &params);
4303         if (err)
4304                 return err;
4305
4306         params.vlan = get_vlan(info, rdev);
4307         if (IS_ERR(params.vlan))
4308                 return PTR_ERR(params.vlan);
4309
4310         switch (dev->ieee80211_ptr->iftype) {
4311         case NL80211_IFTYPE_AP:
4312         case NL80211_IFTYPE_AP_VLAN:
4313         case NL80211_IFTYPE_P2P_GO:
4314         case NL80211_IFTYPE_P2P_CLIENT:
4315         case NL80211_IFTYPE_STATION:
4316         case NL80211_IFTYPE_ADHOC:
4317         case NL80211_IFTYPE_MESH_POINT:
4318                 break;
4319         default:
4320                 err = -EOPNOTSUPP;
4321                 goto out_put_vlan;
4322         }
4323
4324         /* driver will call cfg80211_check_station_change() */
4325         err = rdev_change_station(rdev, dev, mac_addr, &params);
4326
4327  out_put_vlan:
4328         if (params.vlan)
4329                 dev_put(params.vlan);
4330
4331         return err;
4332 }
4333
4334 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4335 {
4336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4337         int err;
4338         struct net_device *dev = info->user_ptr[1];
4339         struct station_parameters params;
4340         u8 *mac_addr = NULL;
4341
4342         memset(&params, 0, sizeof(params));
4343
4344         if (!rdev->ops->add_station)
4345                 return -EOPNOTSUPP;
4346
4347         if (!info->attrs[NL80211_ATTR_MAC])
4348                 return -EINVAL;
4349
4350         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4351                 return -EINVAL;
4352
4353         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4354                 return -EINVAL;
4355
4356         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4357             !info->attrs[NL80211_ATTR_PEER_AID])
4358                 return -EINVAL;
4359
4360         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4361         params.supported_rates =
4362                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4363         params.supported_rates_len =
4364                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4365         params.listen_interval =
4366                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4367
4368         if (info->attrs[NL80211_ATTR_PEER_AID])
4369                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4370         else
4371                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4372         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4373                 return -EINVAL;
4374
4375         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4376                 params.capability =
4377                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4378                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4379         }
4380
4381         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4382                 params.ext_capab =
4383                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4384                 params.ext_capab_len =
4385                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4386         }
4387
4388         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4389                 params.ht_capa =
4390                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4391
4392         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4393                 params.vht_capa =
4394                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4395
4396         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4397                 params.opmode_notif_used = true;
4398                 params.opmode_notif =
4399                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4400         }
4401
4402         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4403                 params.plink_action =
4404                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4405                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4406                         return -EINVAL;
4407         }
4408
4409         err = nl80211_parse_sta_channel_info(info, &params);
4410         if (err)
4411                 return err;
4412
4413         err = nl80211_parse_sta_wme(info, &params);
4414         if (err)
4415                 return err;
4416
4417         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4418                 return -EINVAL;
4419
4420         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4421          * as userspace might just pass through the capabilities from the IEs
4422          * directly, rather than enforcing this restriction and returning an
4423          * error in this case.
4424          */
4425         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4426                 params.ht_capa = NULL;
4427                 params.vht_capa = NULL;
4428         }
4429
4430         /* When you run into this, adjust the code below for the new flag */
4431         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4432
4433         switch (dev->ieee80211_ptr->iftype) {
4434         case NL80211_IFTYPE_AP:
4435         case NL80211_IFTYPE_AP_VLAN:
4436         case NL80211_IFTYPE_P2P_GO:
4437                 /* ignore WME attributes if iface/sta is not capable */
4438                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4439                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4440                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4441
4442                 /* TDLS peers cannot be added */
4443                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4444                     info->attrs[NL80211_ATTR_PEER_AID])
4445                         return -EINVAL;
4446                 /* but don't bother the driver with it */
4447                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4448
4449                 /* allow authenticated/associated only if driver handles it */
4450                 if (!(rdev->wiphy.features &
4451                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4452                     params.sta_flags_mask &
4453                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4454                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4455                         return -EINVAL;
4456
4457                 /* must be last in here for error handling */
4458                 params.vlan = get_vlan(info, rdev);
4459                 if (IS_ERR(params.vlan))
4460                         return PTR_ERR(params.vlan);
4461                 break;
4462         case NL80211_IFTYPE_MESH_POINT:
4463                 /* ignore uAPSD data */
4464                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4465
4466                 /* associated is disallowed */
4467                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4468                         return -EINVAL;
4469                 /* TDLS peers cannot be added */
4470                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4471                     info->attrs[NL80211_ATTR_PEER_AID])
4472                         return -EINVAL;
4473                 break;
4474         case NL80211_IFTYPE_STATION:
4475         case NL80211_IFTYPE_P2P_CLIENT:
4476                 /* ignore uAPSD data */
4477                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4478
4479                 /* these are disallowed */
4480                 if (params.sta_flags_mask &
4481                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4482                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4483                         return -EINVAL;
4484                 /* Only TDLS peers can be added */
4485                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4486                         return -EINVAL;
4487                 /* Can only add if TDLS ... */
4488                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4489                         return -EOPNOTSUPP;
4490                 /* ... with external setup is supported */
4491                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4492                         return -EOPNOTSUPP;
4493                 /*
4494                  * Older wpa_supplicant versions always mark the TDLS peer
4495                  * as authorized, but it shouldn't yet be.
4496                  */
4497                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4498                 break;
4499         default:
4500                 return -EOPNOTSUPP;
4501         }
4502
4503         /* be aware of params.vlan when changing code here */
4504
4505         err = rdev_add_station(rdev, dev, mac_addr, &params);
4506
4507         if (params.vlan)
4508                 dev_put(params.vlan);
4509         return err;
4510 }
4511
4512 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4513 {
4514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4515         struct net_device *dev = info->user_ptr[1];
4516         struct station_del_parameters params;
4517
4518         memset(&params, 0, sizeof(params));
4519
4520         if (info->attrs[NL80211_ATTR_MAC])
4521                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4522
4523         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4524             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4525             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4526             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4527                 return -EINVAL;
4528
4529         if (!rdev->ops->del_station)
4530                 return -EOPNOTSUPP;
4531
4532         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4533                 params.subtype =
4534                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4535                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4536                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4537                         return -EINVAL;
4538         } else {
4539                 /* Default to Deauthentication frame */
4540                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4541         }
4542
4543         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4544                 params.reason_code =
4545                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4546                 if (params.reason_code == 0)
4547                         return -EINVAL; /* 0 is reserved */
4548         } else {
4549                 /* Default to reason code 2 */
4550                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4551         }
4552
4553         return rdev_del_station(rdev, dev, &params);
4554 }
4555
4556 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4557                                 int flags, struct net_device *dev,
4558                                 u8 *dst, u8 *next_hop,
4559                                 struct mpath_info *pinfo)
4560 {
4561         void *hdr;
4562         struct nlattr *pinfoattr;
4563
4564         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4565         if (!hdr)
4566                 return -1;
4567
4568         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4569             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4570             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4571             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4572                 goto nla_put_failure;
4573
4574         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4575         if (!pinfoattr)
4576                 goto nla_put_failure;
4577         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4578             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4579                         pinfo->frame_qlen))
4580                 goto nla_put_failure;
4581         if (((pinfo->filled & MPATH_INFO_SN) &&
4582              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4583             ((pinfo->filled & MPATH_INFO_METRIC) &&
4584              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4585                          pinfo->metric)) ||
4586             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4587              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4588                          pinfo->exptime)) ||
4589             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4590              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4591                         pinfo->flags)) ||
4592             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4593              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4594                          pinfo->discovery_timeout)) ||
4595             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4596              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4597                         pinfo->discovery_retries)))
4598                 goto nla_put_failure;
4599
4600         nla_nest_end(msg, pinfoattr);
4601
4602         genlmsg_end(msg, hdr);
4603         return 0;
4604
4605  nla_put_failure:
4606         genlmsg_cancel(msg, hdr);
4607         return -EMSGSIZE;
4608 }
4609
4610 static int nl80211_dump_mpath(struct sk_buff *skb,
4611                               struct netlink_callback *cb)
4612 {
4613         struct mpath_info pinfo;
4614         struct cfg80211_registered_device *rdev;
4615         struct wireless_dev *wdev;
4616         u8 dst[ETH_ALEN];
4617         u8 next_hop[ETH_ALEN];
4618         int path_idx = cb->args[2];
4619         int err;
4620
4621         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4622         if (err)
4623                 return err;
4624
4625         if (!rdev->ops->dump_mpath) {
4626                 err = -EOPNOTSUPP;
4627                 goto out_err;
4628         }
4629
4630         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4631                 err = -EOPNOTSUPP;
4632                 goto out_err;
4633         }
4634
4635         while (1) {
4636                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4637                                       next_hop, &pinfo);
4638                 if (err == -ENOENT)
4639                         break;
4640                 if (err)
4641                         goto out_err;
4642
4643                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4644                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4645                                        wdev->netdev, dst, next_hop,
4646                                        &pinfo) < 0)
4647                         goto out;
4648
4649                 path_idx++;
4650         }
4651
4652
4653  out:
4654         cb->args[2] = path_idx;
4655         err = skb->len;
4656  out_err:
4657         nl80211_finish_wdev_dump(rdev);
4658         return err;
4659 }
4660
4661 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4662 {
4663         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4664         int err;
4665         struct net_device *dev = info->user_ptr[1];
4666         struct mpath_info pinfo;
4667         struct sk_buff *msg;
4668         u8 *dst = NULL;
4669         u8 next_hop[ETH_ALEN];
4670
4671         memset(&pinfo, 0, sizeof(pinfo));
4672
4673         if (!info->attrs[NL80211_ATTR_MAC])
4674                 return -EINVAL;
4675
4676         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4677
4678         if (!rdev->ops->get_mpath)
4679                 return -EOPNOTSUPP;
4680
4681         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4682                 return -EOPNOTSUPP;
4683
4684         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4685         if (err)
4686                 return err;
4687
4688         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4689         if (!msg)
4690                 return -ENOMEM;
4691
4692         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4693                                  dev, dst, next_hop, &pinfo) < 0) {
4694                 nlmsg_free(msg);
4695                 return -ENOBUFS;
4696         }
4697
4698         return genlmsg_reply(msg, info);
4699 }
4700
4701 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4702 {
4703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4704         struct net_device *dev = info->user_ptr[1];
4705         u8 *dst = NULL;
4706         u8 *next_hop = NULL;
4707
4708         if (!info->attrs[NL80211_ATTR_MAC])
4709                 return -EINVAL;
4710
4711         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4712                 return -EINVAL;
4713
4714         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4715         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4716
4717         if (!rdev->ops->change_mpath)
4718                 return -EOPNOTSUPP;
4719
4720         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4721                 return -EOPNOTSUPP;
4722
4723         return rdev_change_mpath(rdev, dev, dst, next_hop);
4724 }
4725
4726 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4727 {
4728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4729         struct net_device *dev = info->user_ptr[1];
4730         u8 *dst = NULL;
4731         u8 *next_hop = NULL;
4732
4733         if (!info->attrs[NL80211_ATTR_MAC])
4734                 return -EINVAL;
4735
4736         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4737                 return -EINVAL;
4738
4739         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4740         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4741
4742         if (!rdev->ops->add_mpath)
4743                 return -EOPNOTSUPP;
4744
4745         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4746                 return -EOPNOTSUPP;
4747
4748         return rdev_add_mpath(rdev, dev, dst, next_hop);
4749 }
4750
4751 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4752 {
4753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4754         struct net_device *dev = info->user_ptr[1];
4755         u8 *dst = NULL;
4756
4757         if (info->attrs[NL80211_ATTR_MAC])
4758                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4759
4760         if (!rdev->ops->del_mpath)
4761                 return -EOPNOTSUPP;
4762
4763         return rdev_del_mpath(rdev, dev, dst);
4764 }
4765
4766 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4767 {
4768         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4769         int err;
4770         struct net_device *dev = info->user_ptr[1];
4771         struct mpath_info pinfo;
4772         struct sk_buff *msg;
4773         u8 *dst = NULL;
4774         u8 mpp[ETH_ALEN];
4775
4776         memset(&pinfo, 0, sizeof(pinfo));
4777
4778         if (!info->attrs[NL80211_ATTR_MAC])
4779                 return -EINVAL;
4780
4781         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4782
4783         if (!rdev->ops->get_mpp)
4784                 return -EOPNOTSUPP;
4785
4786         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4787                 return -EOPNOTSUPP;
4788
4789         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4790         if (err)
4791                 return err;
4792
4793         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4794         if (!msg)
4795                 return -ENOMEM;
4796
4797         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4798                                dev, dst, mpp, &pinfo) < 0) {
4799                 nlmsg_free(msg);
4800                 return -ENOBUFS;
4801         }
4802
4803         return genlmsg_reply(msg, info);
4804 }
4805
4806 static int nl80211_dump_mpp(struct sk_buff *skb,
4807                             struct netlink_callback *cb)
4808 {
4809         struct mpath_info pinfo;
4810         struct cfg80211_registered_device *rdev;
4811         struct wireless_dev *wdev;
4812         u8 dst[ETH_ALEN];
4813         u8 mpp[ETH_ALEN];
4814         int path_idx = cb->args[2];
4815         int err;
4816
4817         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4818         if (err)
4819                 return err;
4820
4821         if (!rdev->ops->dump_mpp) {
4822                 err = -EOPNOTSUPP;
4823                 goto out_err;
4824         }
4825
4826         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4827                 err = -EOPNOTSUPP;
4828                 goto out_err;
4829         }
4830
4831         while (1) {
4832                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4833                                     mpp, &pinfo);
4834                 if (err == -ENOENT)
4835                         break;
4836                 if (err)
4837                         goto out_err;
4838
4839                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4840                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4841                                        wdev->netdev, dst, mpp,
4842                                        &pinfo) < 0)
4843                         goto out;
4844
4845                 path_idx++;
4846         }
4847
4848  out:
4849         cb->args[2] = path_idx;
4850         err = skb->len;
4851  out_err:
4852         nl80211_finish_wdev_dump(rdev);
4853         return err;
4854 }
4855
4856 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4857 {
4858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4859         struct net_device *dev = info->user_ptr[1];
4860         struct wireless_dev *wdev = dev->ieee80211_ptr;
4861         struct bss_parameters params;
4862         int err;
4863
4864         memset(&params, 0, sizeof(params));
4865         /* default to not changing parameters */
4866         params.use_cts_prot = -1;
4867         params.use_short_preamble = -1;
4868         params.use_short_slot_time = -1;
4869         params.ap_isolate = -1;
4870         params.ht_opmode = -1;
4871         params.p2p_ctwindow = -1;
4872         params.p2p_opp_ps = -1;
4873
4874         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4875                 params.use_cts_prot =
4876                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4877         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4878                 params.use_short_preamble =
4879                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4880         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4881                 params.use_short_slot_time =
4882                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4883         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4884                 params.basic_rates =
4885                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4886                 params.basic_rates_len =
4887                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4888         }
4889         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4890                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4891         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4892                 params.ht_opmode =
4893                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4894
4895         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4896                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4897                         return -EINVAL;
4898                 params.p2p_ctwindow =
4899                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4900                 if (params.p2p_ctwindow < 0)
4901                         return -EINVAL;
4902                 if (params.p2p_ctwindow != 0 &&
4903                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4904                         return -EINVAL;
4905         }
4906
4907         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4908                 u8 tmp;
4909
4910                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4911                         return -EINVAL;
4912                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4913                 if (tmp > 1)
4914                         return -EINVAL;
4915                 params.p2p_opp_ps = tmp;
4916                 if (params.p2p_opp_ps &&
4917                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4918                         return -EINVAL;
4919         }
4920
4921         if (!rdev->ops->change_bss)
4922                 return -EOPNOTSUPP;
4923
4924         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4925             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4926                 return -EOPNOTSUPP;
4927
4928         wdev_lock(wdev);
4929         err = rdev_change_bss(rdev, dev, &params);
4930         wdev_unlock(wdev);
4931
4932         return err;
4933 }
4934
4935 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4936         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4937         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4938         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4939         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4940         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4941         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4942         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4943 };
4944
4945 static int parse_reg_rule(struct nlattr *tb[],
4946         struct ieee80211_reg_rule *reg_rule)
4947 {
4948         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4949         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4950
4951         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4952                 return -EINVAL;
4953         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4954                 return -EINVAL;
4955         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4956                 return -EINVAL;
4957         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4958                 return -EINVAL;
4959         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4960                 return -EINVAL;
4961
4962         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4963
4964         freq_range->start_freq_khz =
4965                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4966         freq_range->end_freq_khz =
4967                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4968         freq_range->max_bandwidth_khz =
4969                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4970
4971         power_rule->max_eirp =
4972                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4973
4974         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4975                 power_rule->max_antenna_gain =
4976                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4977
4978         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4979                 reg_rule->dfs_cac_ms =
4980                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4981
4982         return 0;
4983 }
4984
4985 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4986 {
4987         char *data = NULL;
4988         bool is_indoor;
4989         enum nl80211_user_reg_hint_type user_reg_hint_type;
4990         u32 owner_nlportid;
4991
4992
4993         /*
4994          * You should only get this when cfg80211 hasn't yet initialized
4995          * completely when built-in to the kernel right between the time
4996          * window between nl80211_init() and regulatory_init(), if that is
4997          * even possible.
4998          */
4999         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5000                 return -EINPROGRESS;
5001
5002         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5003                 user_reg_hint_type =
5004                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5005         else
5006                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5007
5008         switch (user_reg_hint_type) {
5009         case NL80211_USER_REG_HINT_USER:
5010         case NL80211_USER_REG_HINT_CELL_BASE:
5011                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5012                         return -EINVAL;
5013
5014                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5015                 return regulatory_hint_user(data, user_reg_hint_type);
5016         case NL80211_USER_REG_HINT_INDOOR:
5017                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5018                         owner_nlportid = info->snd_portid;
5019                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5020                 } else {
5021                         owner_nlportid = 0;
5022                         is_indoor = true;
5023                 }
5024
5025                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5026         default:
5027                 return -EINVAL;
5028         }
5029 }
5030
5031 static int nl80211_get_mesh_config(struct sk_buff *skb,
5032                                    struct genl_info *info)
5033 {
5034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5035         struct net_device *dev = info->user_ptr[1];
5036         struct wireless_dev *wdev = dev->ieee80211_ptr;
5037         struct mesh_config cur_params;
5038         int err = 0;
5039         void *hdr;
5040         struct nlattr *pinfoattr;
5041         struct sk_buff *msg;
5042
5043         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5044                 return -EOPNOTSUPP;
5045
5046         if (!rdev->ops->get_mesh_config)
5047                 return -EOPNOTSUPP;
5048
5049         wdev_lock(wdev);
5050         /* If not connected, get default parameters */
5051         if (!wdev->mesh_id_len)
5052                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5053         else
5054                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5055         wdev_unlock(wdev);
5056
5057         if (err)
5058                 return err;
5059
5060         /* Draw up a netlink message to send back */
5061         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5062         if (!msg)
5063                 return -ENOMEM;
5064         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5065                              NL80211_CMD_GET_MESH_CONFIG);
5066         if (!hdr)
5067                 goto out;
5068         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5069         if (!pinfoattr)
5070                 goto nla_put_failure;
5071         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5072             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5073                         cur_params.dot11MeshRetryTimeout) ||
5074             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5075                         cur_params.dot11MeshConfirmTimeout) ||
5076             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5077                         cur_params.dot11MeshHoldingTimeout) ||
5078             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5079                         cur_params.dot11MeshMaxPeerLinks) ||
5080             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5081                        cur_params.dot11MeshMaxRetries) ||
5082             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5083                        cur_params.dot11MeshTTL) ||
5084             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5085                        cur_params.element_ttl) ||
5086             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5087                        cur_params.auto_open_plinks) ||
5088             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5089                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5090             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5091                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5092             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5093                         cur_params.path_refresh_time) ||
5094             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5095                         cur_params.min_discovery_timeout) ||
5096             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5097                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5098             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5099                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5100             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5101                         cur_params.dot11MeshHWMPperrMinInterval) ||
5102             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5103                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5104             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5105                        cur_params.dot11MeshHWMPRootMode) ||
5106             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5107                         cur_params.dot11MeshHWMPRannInterval) ||
5108             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5109                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5110             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5111                        cur_params.dot11MeshForwarding) ||
5112             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5113                         cur_params.rssi_threshold) ||
5114             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5115                         cur_params.ht_opmode) ||
5116             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5117                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5118             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5119                         cur_params.dot11MeshHWMProotInterval) ||
5120             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5121                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5122             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5123                         cur_params.power_mode) ||
5124             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5125                         cur_params.dot11MeshAwakeWindowDuration) ||
5126             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5127                         cur_params.plink_timeout))
5128                 goto nla_put_failure;
5129         nla_nest_end(msg, pinfoattr);
5130         genlmsg_end(msg, hdr);
5131         return genlmsg_reply(msg, info);
5132
5133  nla_put_failure:
5134         genlmsg_cancel(msg, hdr);
5135  out:
5136         nlmsg_free(msg);
5137         return -ENOBUFS;
5138 }
5139
5140 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5141         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5142         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5143         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5144         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5145         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5146         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5147         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5148         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5149         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5150         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5151         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5152         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5153         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5154         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5155         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5156         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5157         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5158         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5159         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5160         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5161         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5162         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5163         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5164         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5165         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5166         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5167         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5168         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5169 };
5170
5171 static const struct nla_policy
5172         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5173         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5174         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5175         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5176         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5177         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5178         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5179         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5180                                     .len = IEEE80211_MAX_DATA_LEN },
5181         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5182 };
5183
5184 static int nl80211_parse_mesh_config(struct genl_info *info,
5185                                      struct mesh_config *cfg,
5186                                      u32 *mask_out)
5187 {
5188         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5189         u32 mask = 0;
5190
5191 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5192 do {                                                                        \
5193         if (tb[attr]) {                                                     \
5194                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5195                         return -EINVAL;                                     \
5196                 cfg->param = fn(tb[attr]);                                  \
5197                 mask |= (1 << (attr - 1));                                  \
5198         }                                                                   \
5199 } while (0)
5200
5201
5202         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5203                 return -EINVAL;
5204         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5205                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5206                              nl80211_meshconf_params_policy))
5207                 return -EINVAL;
5208
5209         /* This makes sure that there aren't more than 32 mesh config
5210          * parameters (otherwise our bitfield scheme would not work.) */
5211         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5212
5213         /* Fill in the params struct */
5214         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5215                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5216                                   nla_get_u16);
5217         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5218                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5219                                   nla_get_u16);
5220         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5221                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5222                                   nla_get_u16);
5223         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5224                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5225                                   nla_get_u16);
5226         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5227                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5228                                   nla_get_u8);
5229         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5230                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5231         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5232                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5233                                   nla_get_u8);
5234         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5235                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5236                                   nla_get_u8);
5237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5238                                   1, 255, mask,
5239                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5240                                   nla_get_u32);
5241         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5242                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5243                                   nla_get_u8);
5244         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5245                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5246                                   nla_get_u32);
5247         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5248                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5249                                   nla_get_u16);
5250         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5251                                   1, 65535, mask,
5252                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5253                                   nla_get_u32);
5254         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5255                                   1, 65535, mask,
5256                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5257                                   nla_get_u16);
5258         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5259                                   1, 65535, mask,
5260                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5261                                   nla_get_u16);
5262         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5263                                   dot11MeshHWMPnetDiameterTraversalTime,
5264                                   1, 65535, mask,
5265                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5266                                   nla_get_u16);
5267         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5268                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5269                                   nla_get_u8);
5270         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5271                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5272                                   nla_get_u16);
5273         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5274                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5275                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5276                                   nla_get_u8);
5277         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5278                                   mask, NL80211_MESHCONF_FORWARDING,
5279                                   nla_get_u8);
5280         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5281                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5282                                   nla_get_s32);
5283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5284                                   mask, NL80211_MESHCONF_HT_OPMODE,
5285                                   nla_get_u16);
5286         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5287                                   1, 65535, mask,
5288                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5289                                   nla_get_u32);
5290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5291                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5292                                   nla_get_u16);
5293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5294                                   dot11MeshHWMPconfirmationInterval,
5295                                   1, 65535, mask,
5296                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5297                                   nla_get_u16);
5298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5299                                   NL80211_MESH_POWER_ACTIVE,
5300                                   NL80211_MESH_POWER_MAX,
5301                                   mask, NL80211_MESHCONF_POWER_MODE,
5302                                   nla_get_u32);
5303         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5304                                   0, 65535, mask,
5305                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5307                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5308                                   nla_get_u32);
5309         if (mask_out)
5310                 *mask_out = mask;
5311
5312         return 0;
5313
5314 #undef FILL_IN_MESH_PARAM_IF_SET
5315 }
5316
5317 static int nl80211_parse_mesh_setup(struct genl_info *info,
5318                                      struct mesh_setup *setup)
5319 {
5320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5321         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5322
5323         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5324                 return -EINVAL;
5325         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5326                              info->attrs[NL80211_ATTR_MESH_SETUP],
5327                              nl80211_mesh_setup_params_policy))
5328                 return -EINVAL;
5329
5330         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5331                 setup->sync_method =
5332                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5333                  IEEE80211_SYNC_METHOD_VENDOR :
5334                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5335
5336         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5337                 setup->path_sel_proto =
5338                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5339                  IEEE80211_PATH_PROTOCOL_VENDOR :
5340                  IEEE80211_PATH_PROTOCOL_HWMP;
5341
5342         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5343                 setup->path_metric =
5344                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5345                  IEEE80211_PATH_METRIC_VENDOR :
5346                  IEEE80211_PATH_METRIC_AIRTIME;
5347
5348
5349         if (tb[NL80211_MESH_SETUP_IE]) {
5350                 struct nlattr *ieattr =
5351                         tb[NL80211_MESH_SETUP_IE];
5352                 if (!is_valid_ie_attr(ieattr))
5353                         return -EINVAL;
5354                 setup->ie = nla_data(ieattr);
5355                 setup->ie_len = nla_len(ieattr);
5356         }
5357         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5358             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5359                 return -EINVAL;
5360         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5361         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5362         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5363         if (setup->is_secure)
5364                 setup->user_mpm = true;
5365
5366         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5367                 if (!setup->user_mpm)
5368                         return -EINVAL;
5369                 setup->auth_id =
5370                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5371         }
5372
5373         return 0;
5374 }
5375
5376 static int nl80211_update_mesh_config(struct sk_buff *skb,
5377                                       struct genl_info *info)
5378 {
5379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5380         struct net_device *dev = info->user_ptr[1];
5381         struct wireless_dev *wdev = dev->ieee80211_ptr;
5382         struct mesh_config cfg;
5383         u32 mask;
5384         int err;
5385
5386         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5387                 return -EOPNOTSUPP;
5388
5389         if (!rdev->ops->update_mesh_config)
5390                 return -EOPNOTSUPP;
5391
5392         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5393         if (err)
5394                 return err;
5395
5396         wdev_lock(wdev);
5397         if (!wdev->mesh_id_len)
5398                 err = -ENOLINK;
5399
5400         if (!err)
5401                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5402
5403         wdev_unlock(wdev);
5404
5405         return err;
5406 }
5407
5408 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5409                               struct sk_buff *msg)
5410 {
5411         struct nlattr *nl_reg_rules;
5412         unsigned int i;
5413
5414         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5415             (regdom->dfs_region &&
5416              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5417                 goto nla_put_failure;
5418
5419         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5420         if (!nl_reg_rules)
5421                 goto nla_put_failure;
5422
5423         for (i = 0; i < regdom->n_reg_rules; i++) {
5424                 struct nlattr *nl_reg_rule;
5425                 const struct ieee80211_reg_rule *reg_rule;
5426                 const struct ieee80211_freq_range *freq_range;
5427                 const struct ieee80211_power_rule *power_rule;
5428                 unsigned int max_bandwidth_khz;
5429
5430                 reg_rule = &regdom->reg_rules[i];
5431                 freq_range = &reg_rule->freq_range;
5432                 power_rule = &reg_rule->power_rule;
5433
5434                 nl_reg_rule = nla_nest_start(msg, i);
5435                 if (!nl_reg_rule)
5436                         goto nla_put_failure;
5437
5438                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5439                 if (!max_bandwidth_khz)
5440                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5441                                                                   reg_rule);
5442
5443                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5444                                 reg_rule->flags) ||
5445                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5446                                 freq_range->start_freq_khz) ||
5447                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5448                                 freq_range->end_freq_khz) ||
5449                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5450                                 max_bandwidth_khz) ||
5451                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5452                                 power_rule->max_antenna_gain) ||
5453                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5454                                 power_rule->max_eirp) ||
5455                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5456                                 reg_rule->dfs_cac_ms))
5457                         goto nla_put_failure;
5458
5459                 nla_nest_end(msg, nl_reg_rule);
5460         }
5461
5462         nla_nest_end(msg, nl_reg_rules);
5463         return 0;
5464
5465 nla_put_failure:
5466         return -EMSGSIZE;
5467 }
5468
5469 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5470 {
5471         const struct ieee80211_regdomain *regdom = NULL;
5472         struct cfg80211_registered_device *rdev;
5473         struct wiphy *wiphy = NULL;
5474         struct sk_buff *msg;
5475         void *hdr;
5476
5477         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5478         if (!msg)
5479                 return -ENOBUFS;
5480
5481         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5482                              NL80211_CMD_GET_REG);
5483         if (!hdr)
5484                 goto put_failure;
5485
5486         if (info->attrs[NL80211_ATTR_WIPHY]) {
5487                 bool self_managed;
5488
5489                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5490                 if (IS_ERR(rdev)) {
5491                         nlmsg_free(msg);
5492                         return PTR_ERR(rdev);
5493                 }
5494
5495                 wiphy = &rdev->wiphy;
5496                 self_managed = wiphy->regulatory_flags &
5497                                REGULATORY_WIPHY_SELF_MANAGED;
5498                 regdom = get_wiphy_regdom(wiphy);
5499
5500                 /* a self-managed-reg device must have a private regdom */
5501                 if (WARN_ON(!regdom && self_managed)) {
5502                         nlmsg_free(msg);
5503                         return -EINVAL;
5504                 }
5505
5506                 if (regdom &&
5507                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5508                         goto nla_put_failure;
5509         }
5510
5511         if (!wiphy && reg_last_request_cell_base() &&
5512             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5513                         NL80211_USER_REG_HINT_CELL_BASE))
5514                 goto nla_put_failure;
5515
5516         rcu_read_lock();
5517
5518         if (!regdom)
5519                 regdom = rcu_dereference(cfg80211_regdomain);
5520
5521         if (nl80211_put_regdom(regdom, msg))
5522                 goto nla_put_failure_rcu;
5523
5524         rcu_read_unlock();
5525
5526         genlmsg_end(msg, hdr);
5527         return genlmsg_reply(msg, info);
5528
5529 nla_put_failure_rcu:
5530         rcu_read_unlock();
5531 nla_put_failure:
5532         genlmsg_cancel(msg, hdr);
5533 put_failure:
5534         nlmsg_free(msg);
5535         return -EMSGSIZE;
5536 }
5537
5538 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5539                                u32 seq, int flags, struct wiphy *wiphy,
5540                                const struct ieee80211_regdomain *regdom)
5541 {
5542         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5543                                    NL80211_CMD_GET_REG);
5544
5545         if (!hdr)
5546                 return -1;
5547
5548         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5549
5550         if (nl80211_put_regdom(regdom, msg))
5551                 goto nla_put_failure;
5552
5553         if (!wiphy && reg_last_request_cell_base() &&
5554             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5555                         NL80211_USER_REG_HINT_CELL_BASE))
5556                 goto nla_put_failure;
5557
5558         if (wiphy &&
5559             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5560                 goto nla_put_failure;
5561
5562         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5563             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5564                 goto nla_put_failure;
5565
5566         genlmsg_end(msg, hdr);
5567         return 0;
5568
5569 nla_put_failure:
5570         genlmsg_cancel(msg, hdr);
5571         return -EMSGSIZE;
5572 }
5573
5574 static int nl80211_get_reg_dump(struct sk_buff *skb,
5575                                 struct netlink_callback *cb)
5576 {
5577         const struct ieee80211_regdomain *regdom = NULL;
5578         struct cfg80211_registered_device *rdev;
5579         int err, reg_idx, start = cb->args[2];
5580
5581         rtnl_lock();
5582
5583         if (cfg80211_regdomain && start == 0) {
5584                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5585                                           NLM_F_MULTI, NULL,
5586                                           rtnl_dereference(cfg80211_regdomain));
5587                 if (err < 0)
5588                         goto out_err;
5589         }
5590
5591         /* the global regdom is idx 0 */
5592         reg_idx = 1;
5593         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5594                 regdom = get_wiphy_regdom(&rdev->wiphy);
5595                 if (!regdom)
5596                         continue;
5597
5598                 if (++reg_idx <= start)
5599                         continue;
5600
5601                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5602                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5603                 if (err < 0) {
5604                         reg_idx--;
5605                         break;
5606                 }
5607         }
5608
5609         cb->args[2] = reg_idx;
5610         err = skb->len;
5611 out_err:
5612         rtnl_unlock();
5613         return err;
5614 }
5615
5616 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5617 {
5618         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5619         struct nlattr *nl_reg_rule;
5620         char *alpha2;
5621         int rem_reg_rules, r;
5622         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5623         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5624         struct ieee80211_regdomain *rd;
5625
5626         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5627                 return -EINVAL;
5628
5629         if (!info->attrs[NL80211_ATTR_REG_RULES])
5630                 return -EINVAL;
5631
5632         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5633
5634         if (info->attrs[NL80211_ATTR_DFS_REGION])
5635                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5636
5637         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5638                             rem_reg_rules) {
5639                 num_rules++;
5640                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5641                         return -EINVAL;
5642         }
5643
5644         if (!reg_is_valid_request(alpha2))
5645                 return -EINVAL;
5646
5647         size_of_regd = sizeof(struct ieee80211_regdomain) +
5648                        num_rules * sizeof(struct ieee80211_reg_rule);
5649
5650         rd = kzalloc(size_of_regd, GFP_KERNEL);
5651         if (!rd)
5652                 return -ENOMEM;
5653
5654         rd->n_reg_rules = num_rules;
5655         rd->alpha2[0] = alpha2[0];
5656         rd->alpha2[1] = alpha2[1];
5657
5658         /*
5659          * Disable DFS master mode if the DFS region was
5660          * not supported or known on this kernel.
5661          */
5662         if (reg_supported_dfs_region(dfs_region))
5663                 rd->dfs_region = dfs_region;
5664
5665         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5666                             rem_reg_rules) {
5667                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5668                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5669                               reg_rule_policy);
5670                 if (r)
5671                         goto bad_reg;
5672                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5673                 if (r)
5674                         goto bad_reg;
5675
5676                 rule_idx++;
5677
5678                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5679                         r = -EINVAL;
5680                         goto bad_reg;
5681                 }
5682         }
5683
5684         r = set_regdom(rd, REGD_SOURCE_CRDA);
5685         /* set_regdom took ownership */
5686         rd = NULL;
5687
5688  bad_reg:
5689         kfree(rd);
5690         return r;
5691 }
5692
5693 static int validate_scan_freqs(struct nlattr *freqs)
5694 {
5695         struct nlattr *attr1, *attr2;
5696         int n_channels = 0, tmp1, tmp2;
5697
5698         nla_for_each_nested(attr1, freqs, tmp1) {
5699                 n_channels++;
5700                 /*
5701                  * Some hardware has a limited channel list for
5702                  * scanning, and it is pretty much nonsensical
5703                  * to scan for a channel twice, so disallow that
5704                  * and don't require drivers to check that the
5705                  * channel list they get isn't longer than what
5706                  * they can scan, as long as they can scan all
5707                  * the channels they registered at once.
5708                  */
5709                 nla_for_each_nested(attr2, freqs, tmp2)
5710                         if (attr1 != attr2 &&
5711                             nla_get_u32(attr1) == nla_get_u32(attr2))
5712                                 return 0;
5713         }
5714
5715         return n_channels;
5716 }
5717
5718 static int nl80211_parse_random_mac(struct nlattr **attrs,
5719                                     u8 *mac_addr, u8 *mac_addr_mask)
5720 {
5721         int i;
5722
5723         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5724                 eth_zero_addr(mac_addr);
5725                 eth_zero_addr(mac_addr_mask);
5726                 mac_addr[0] = 0x2;
5727                 mac_addr_mask[0] = 0x3;
5728
5729                 return 0;
5730         }
5731
5732         /* need both or none */
5733         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5734                 return -EINVAL;
5735
5736         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5737         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5738
5739         /* don't allow or configure an mcast address */
5740         if (!is_multicast_ether_addr(mac_addr_mask) ||
5741             is_multicast_ether_addr(mac_addr))
5742                 return -EINVAL;
5743
5744         /*
5745          * allow users to pass a MAC address that has bits set outside
5746          * of the mask, but don't bother drivers with having to deal
5747          * with such bits
5748          */
5749         for (i = 0; i < ETH_ALEN; i++)
5750                 mac_addr[i] &= mac_addr_mask[i];
5751
5752         return 0;
5753 }
5754
5755 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5756 {
5757         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5758         struct wireless_dev *wdev = info->user_ptr[1];
5759         struct cfg80211_scan_request *request;
5760         struct nlattr *attr;
5761         struct wiphy *wiphy;
5762         int err, tmp, n_ssids = 0, n_channels, i;
5763         size_t ie_len;
5764
5765         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5766                 return -EINVAL;
5767
5768         wiphy = &rdev->wiphy;
5769
5770         if (!rdev->ops->scan)
5771                 return -EOPNOTSUPP;
5772
5773         if (rdev->scan_req || rdev->scan_msg) {
5774                 err = -EBUSY;
5775                 goto unlock;
5776         }
5777
5778         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5779                 n_channels = validate_scan_freqs(
5780                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5781                 if (!n_channels) {
5782                         err = -EINVAL;
5783                         goto unlock;
5784                 }
5785         } else {
5786                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5787         }
5788
5789         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5790                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5791                         n_ssids++;
5792
5793         if (n_ssids > wiphy->max_scan_ssids) {
5794                 err = -EINVAL;
5795                 goto unlock;
5796         }
5797
5798         if (info->attrs[NL80211_ATTR_IE])
5799                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5800         else
5801                 ie_len = 0;
5802
5803         if (ie_len > wiphy->max_scan_ie_len) {
5804                 err = -EINVAL;
5805                 goto unlock;
5806         }
5807
5808         request = kzalloc(sizeof(*request)
5809                         + sizeof(*request->ssids) * n_ssids
5810                         + sizeof(*request->channels) * n_channels
5811                         + ie_len, GFP_KERNEL);
5812         if (!request) {
5813                 err = -ENOMEM;
5814                 goto unlock;
5815         }
5816
5817         if (n_ssids)
5818                 request->ssids = (void *)&request->channels[n_channels];
5819         request->n_ssids = n_ssids;
5820         if (ie_len) {
5821                 if (n_ssids)
5822                         request->ie = (void *)(request->ssids + n_ssids);
5823                 else
5824                         request->ie = (void *)(request->channels + n_channels);
5825         }
5826
5827         i = 0;
5828         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5829                 /* user specified, bail out if channel not found */
5830                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5831                         struct ieee80211_channel *chan;
5832
5833                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5834
5835                         if (!chan) {
5836                                 err = -EINVAL;
5837                                 goto out_free;
5838                         }
5839
5840                         /* ignore disabled channels */
5841                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5842                                 continue;
5843
5844                         request->channels[i] = chan;
5845                         i++;
5846                 }
5847         } else {
5848                 enum ieee80211_band band;
5849
5850                 /* all channels */
5851                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5852                         int j;
5853                         if (!wiphy->bands[band])
5854                                 continue;
5855                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5856                                 struct ieee80211_channel *chan;
5857
5858                                 chan = &wiphy->bands[band]->channels[j];
5859
5860                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5861                                         continue;
5862
5863                                 request->channels[i] = chan;
5864                                 i++;
5865                         }
5866                 }
5867         }
5868
5869         if (!i) {
5870                 err = -EINVAL;
5871                 goto out_free;
5872         }
5873
5874         request->n_channels = i;
5875
5876         i = 0;
5877         if (n_ssids) {
5878                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5879                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5880                                 err = -EINVAL;
5881                                 goto out_free;
5882                         }
5883                         request->ssids[i].ssid_len = nla_len(attr);
5884                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5885                         i++;
5886                 }
5887         }
5888
5889         if (info->attrs[NL80211_ATTR_IE]) {
5890                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5891                 memcpy((void *)request->ie,
5892                        nla_data(info->attrs[NL80211_ATTR_IE]),
5893                        request->ie_len);
5894         }
5895
5896         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5897                 if (wiphy->bands[i])
5898                         request->rates[i] =
5899                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5900
5901         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5902                 nla_for_each_nested(attr,
5903                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5904                                     tmp) {
5905                         enum ieee80211_band band = nla_type(attr);
5906
5907                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5908                                 err = -EINVAL;
5909                                 goto out_free;
5910                         }
5911
5912                         if (!wiphy->bands[band])
5913                                 continue;
5914
5915                         err = ieee80211_get_ratemask(wiphy->bands[band],
5916                                                      nla_data(attr),
5917                                                      nla_len(attr),
5918                                                      &request->rates[band]);
5919                         if (err)
5920                                 goto out_free;
5921                 }
5922         }
5923
5924         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5925                 request->flags = nla_get_u32(
5926                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5927                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5928                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5929                         err = -EOPNOTSUPP;
5930                         goto out_free;
5931                 }
5932
5933                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5934                         if (!(wiphy->features &
5935                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5936                                 err = -EOPNOTSUPP;
5937                                 goto out_free;
5938                         }
5939
5940                         if (wdev->current_bss) {
5941                                 err = -EOPNOTSUPP;
5942                                 goto out_free;
5943                         }
5944
5945                         err = nl80211_parse_random_mac(info->attrs,
5946                                                        request->mac_addr,
5947                                                        request->mac_addr_mask);
5948                         if (err)
5949                                 goto out_free;
5950                 }
5951         }
5952
5953         request->no_cck =
5954                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5955
5956         request->wdev = wdev;
5957         request->wiphy = &rdev->wiphy;
5958         request->scan_start = jiffies;
5959
5960         rdev->scan_req = request;
5961         err = rdev_scan(rdev, request);
5962
5963         if (!err) {
5964                 nl80211_send_scan_start(rdev, wdev);
5965                 if (wdev->netdev)
5966                         dev_hold(wdev->netdev);
5967         } else {
5968  out_free:
5969                 rdev->scan_req = NULL;
5970                 kfree(request);
5971         }
5972
5973  unlock:
5974         return err;
5975 }
5976
5977 static struct cfg80211_sched_scan_request *
5978 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
5979                          struct nlattr **attrs)
5980 {
5981         struct cfg80211_sched_scan_request *request;
5982         struct nlattr *attr;
5983         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5984         u32 interval;
5985         enum ieee80211_band band;
5986         size_t ie_len;
5987         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5988         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5989
5990         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
5991                 return ERR_PTR(-EINVAL);
5992
5993         if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5994                 return ERR_PTR(-EINVAL);
5995
5996         interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5997         if (interval == 0)
5998                 return ERR_PTR(-EINVAL);
5999
6000         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6001                 n_channels = validate_scan_freqs(
6002                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6003                 if (!n_channels)
6004                         return ERR_PTR(-EINVAL);
6005         } else {
6006                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6007         }
6008
6009         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6010                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6011                                     tmp)
6012                         n_ssids++;
6013
6014         if (n_ssids > wiphy->max_sched_scan_ssids)
6015                 return ERR_PTR(-EINVAL);
6016
6017         /*
6018          * First, count the number of 'real' matchsets. Due to an issue with
6019          * the old implementation, matchsets containing only the RSSI attribute
6020          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6021          * RSSI for all matchsets, rather than their own matchset for reporting
6022          * all APs with a strong RSSI. This is needed to be compatible with
6023          * older userspace that treated a matchset with only the RSSI as the
6024          * global RSSI for all other matchsets - if there are other matchsets.
6025          */
6026         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6027                 nla_for_each_nested(attr,
6028                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6029                                     tmp) {
6030                         struct nlattr *rssi;
6031
6032                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6033                                         nla_data(attr), nla_len(attr),
6034                                         nl80211_match_policy);
6035                         if (err)
6036                                 return ERR_PTR(err);
6037                         /* add other standalone attributes here */
6038                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6039                                 n_match_sets++;
6040                                 continue;
6041                         }
6042                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6043                         if (rssi)
6044                                 default_match_rssi = nla_get_s32(rssi);
6045                 }
6046         }
6047
6048         /* However, if there's no other matchset, add the RSSI one */
6049         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6050                 n_match_sets = 1;
6051
6052         if (n_match_sets > wiphy->max_match_sets)
6053                 return ERR_PTR(-EINVAL);
6054
6055         if (attrs[NL80211_ATTR_IE])
6056                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6057         else
6058                 ie_len = 0;
6059
6060         if (ie_len > wiphy->max_sched_scan_ie_len)
6061                 return ERR_PTR(-EINVAL);
6062
6063         request = kzalloc(sizeof(*request)
6064                         + sizeof(*request->ssids) * n_ssids
6065                         + sizeof(*request->match_sets) * n_match_sets
6066                         + sizeof(*request->channels) * n_channels
6067                         + ie_len, GFP_KERNEL);
6068         if (!request)
6069                 return ERR_PTR(-ENOMEM);
6070
6071         if (n_ssids)
6072                 request->ssids = (void *)&request->channels[n_channels];
6073         request->n_ssids = n_ssids;
6074         if (ie_len) {
6075                 if (n_ssids)
6076                         request->ie = (void *)(request->ssids + n_ssids);
6077                 else
6078                         request->ie = (void *)(request->channels + n_channels);
6079         }
6080
6081         if (n_match_sets) {
6082                 if (request->ie)
6083                         request->match_sets = (void *)(request->ie + ie_len);
6084                 else if (n_ssids)
6085                         request->match_sets =
6086                                 (void *)(request->ssids + n_ssids);
6087                 else
6088                         request->match_sets =
6089                                 (void *)(request->channels + n_channels);
6090         }
6091         request->n_match_sets = n_match_sets;
6092
6093         i = 0;
6094         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6095                 /* user specified, bail out if channel not found */
6096                 nla_for_each_nested(attr,
6097                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6098                                     tmp) {
6099                         struct ieee80211_channel *chan;
6100
6101                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6102
6103                         if (!chan) {
6104                                 err = -EINVAL;
6105                                 goto out_free;
6106                         }
6107
6108                         /* ignore disabled channels */
6109                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6110                                 continue;
6111
6112                         request->channels[i] = chan;
6113                         i++;
6114                 }
6115         } else {
6116                 /* all channels */
6117                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6118                         int j;
6119                         if (!wiphy->bands[band])
6120                                 continue;
6121                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6122                                 struct ieee80211_channel *chan;
6123
6124                                 chan = &wiphy->bands[band]->channels[j];
6125
6126                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6127                                         continue;
6128
6129                                 request->channels[i] = chan;
6130                                 i++;
6131                         }
6132                 }
6133         }
6134
6135         if (!i) {
6136                 err = -EINVAL;
6137                 goto out_free;
6138         }
6139
6140         request->n_channels = i;
6141
6142         i = 0;
6143         if (n_ssids) {
6144                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6145                                     tmp) {
6146                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6147                                 err = -EINVAL;
6148                                 goto out_free;
6149                         }
6150                         request->ssids[i].ssid_len = nla_len(attr);
6151                         memcpy(request->ssids[i].ssid, nla_data(attr),
6152                                nla_len(attr));
6153                         i++;
6154                 }
6155         }
6156
6157         i = 0;
6158         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6159                 nla_for_each_nested(attr,
6160                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6161                                     tmp) {
6162                         struct nlattr *ssid, *rssi;
6163
6164                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6165                                         nla_data(attr), nla_len(attr),
6166                                         nl80211_match_policy);
6167                         if (err)
6168                                 goto out_free;
6169                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6170                         if (ssid) {
6171                                 if (WARN_ON(i >= n_match_sets)) {
6172                                         /* this indicates a programming error,
6173                                          * the loop above should have verified
6174                                          * things properly
6175                                          */
6176                                         err = -EINVAL;
6177                                         goto out_free;
6178                                 }
6179
6180                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6181                                         err = -EINVAL;
6182                                         goto out_free;
6183                                 }
6184                                 memcpy(request->match_sets[i].ssid.ssid,
6185                                        nla_data(ssid), nla_len(ssid));
6186                                 request->match_sets[i].ssid.ssid_len =
6187                                         nla_len(ssid);
6188                                 /* special attribute - old implemenation w/a */
6189                                 request->match_sets[i].rssi_thold =
6190                                         default_match_rssi;
6191                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6192                                 if (rssi)
6193                                         request->match_sets[i].rssi_thold =
6194                                                 nla_get_s32(rssi);
6195                         }
6196                         i++;
6197                 }
6198
6199                 /* there was no other matchset, so the RSSI one is alone */
6200                 if (i == 0 && n_match_sets)
6201                         request->match_sets[0].rssi_thold = default_match_rssi;
6202
6203                 request->min_rssi_thold = INT_MAX;
6204                 for (i = 0; i < n_match_sets; i++)
6205                         request->min_rssi_thold =
6206                                 min(request->match_sets[i].rssi_thold,
6207                                     request->min_rssi_thold);
6208         } else {
6209                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6210         }
6211
6212         if (ie_len) {
6213                 request->ie_len = ie_len;
6214                 memcpy((void *)request->ie,
6215                        nla_data(attrs[NL80211_ATTR_IE]),
6216                        request->ie_len);
6217         }
6218
6219         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6220                 request->flags = nla_get_u32(
6221                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6222                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6223                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6224                         err = -EOPNOTSUPP;
6225                         goto out_free;
6226                 }
6227
6228                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6229                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6230
6231                         if (!wdev) /* must be net-detect */
6232                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6233
6234                         if (!(wiphy->features & flg)) {
6235                                 err = -EOPNOTSUPP;
6236                                 goto out_free;
6237                         }
6238
6239                         if (wdev && wdev->current_bss) {
6240                                 err = -EOPNOTSUPP;
6241                                 goto out_free;
6242                         }
6243
6244                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6245                                                        request->mac_addr_mask);
6246                         if (err)
6247                                 goto out_free;
6248                 }
6249         }
6250
6251         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6252                 request->delay =
6253                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6254
6255         request->interval = interval;
6256         request->scan_start = jiffies;
6257
6258         return request;
6259
6260 out_free:
6261         kfree(request);
6262         return ERR_PTR(err);
6263 }
6264
6265 static int nl80211_start_sched_scan(struct sk_buff *skb,
6266                                     struct genl_info *info)
6267 {
6268         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6269         struct net_device *dev = info->user_ptr[1];
6270         struct wireless_dev *wdev = dev->ieee80211_ptr;
6271         struct cfg80211_sched_scan_request *sched_scan_req;
6272         int err;
6273
6274         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6275             !rdev->ops->sched_scan_start)
6276                 return -EOPNOTSUPP;
6277
6278         if (rdev->sched_scan_req)
6279                 return -EINPROGRESS;
6280
6281         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6282                                                   info->attrs);
6283
6284         err = PTR_ERR_OR_ZERO(sched_scan_req);
6285         if (err)
6286                 goto out_err;
6287
6288         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6289         if (err)
6290                 goto out_free;
6291
6292         sched_scan_req->dev = dev;
6293         sched_scan_req->wiphy = &rdev->wiphy;
6294
6295         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6296                 sched_scan_req->owner_nlportid = info->snd_portid;
6297
6298         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6299
6300         nl80211_send_sched_scan(rdev, dev,
6301                                 NL80211_CMD_START_SCHED_SCAN);
6302         return 0;
6303
6304 out_free:
6305         kfree(sched_scan_req);
6306 out_err:
6307         return err;
6308 }
6309
6310 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6311                                    struct genl_info *info)
6312 {
6313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6314
6315         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6316             !rdev->ops->sched_scan_stop)
6317                 return -EOPNOTSUPP;
6318
6319         return __cfg80211_stop_sched_scan(rdev, false);
6320 }
6321
6322 static int nl80211_start_radar_detection(struct sk_buff *skb,
6323                                          struct genl_info *info)
6324 {
6325         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6326         struct net_device *dev = info->user_ptr[1];
6327         struct wireless_dev *wdev = dev->ieee80211_ptr;
6328         struct cfg80211_chan_def chandef;
6329         enum nl80211_dfs_regions dfs_region;
6330         unsigned int cac_time_ms;
6331         int err;
6332
6333         dfs_region = reg_get_dfs_region(wdev->wiphy);
6334         if (dfs_region == NL80211_DFS_UNSET)
6335                 return -EINVAL;
6336
6337         err = nl80211_parse_chandef(rdev, info, &chandef);
6338         if (err)
6339                 return err;
6340
6341         if (netif_carrier_ok(dev))
6342                 return -EBUSY;
6343
6344         if (wdev->cac_started)
6345                 return -EBUSY;
6346
6347         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6348                                             wdev->iftype);
6349         if (err < 0)
6350                 return err;
6351
6352         if (err == 0)
6353                 return -EINVAL;
6354
6355         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6356                 return -EINVAL;
6357
6358         if (!rdev->ops->start_radar_detection)
6359                 return -EOPNOTSUPP;
6360
6361         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6362         if (WARN_ON(!cac_time_ms))
6363                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6364
6365         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6366                                                cac_time_ms);
6367         if (!err) {
6368                 wdev->chandef = chandef;
6369                 wdev->cac_started = true;
6370                 wdev->cac_start_time = jiffies;
6371                 wdev->cac_time_ms = cac_time_ms;
6372         }
6373         return err;
6374 }
6375
6376 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6377 {
6378         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6379         struct net_device *dev = info->user_ptr[1];
6380         struct wireless_dev *wdev = dev->ieee80211_ptr;
6381         struct cfg80211_csa_settings params;
6382         /* csa_attrs is defined static to avoid waste of stack size - this
6383          * function is called under RTNL lock, so this should not be a problem.
6384          */
6385         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6386         int err;
6387         bool need_new_beacon = false;
6388         int len, i;
6389         u32 cs_count;
6390
6391         if (!rdev->ops->channel_switch ||
6392             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6393                 return -EOPNOTSUPP;
6394
6395         switch (dev->ieee80211_ptr->iftype) {
6396         case NL80211_IFTYPE_AP:
6397         case NL80211_IFTYPE_P2P_GO:
6398                 need_new_beacon = true;
6399
6400                 /* useless if AP is not running */
6401                 if (!wdev->beacon_interval)
6402                         return -ENOTCONN;
6403                 break;
6404         case NL80211_IFTYPE_ADHOC:
6405                 if (!wdev->ssid_len)
6406                         return -ENOTCONN;
6407                 break;
6408         case NL80211_IFTYPE_MESH_POINT:
6409                 if (!wdev->mesh_id_len)
6410                         return -ENOTCONN;
6411                 break;
6412         default:
6413                 return -EOPNOTSUPP;
6414         }
6415
6416         memset(&params, 0, sizeof(params));
6417
6418         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6419             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6420                 return -EINVAL;
6421
6422         /* only important for AP, IBSS and mesh create IEs internally */
6423         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6424                 return -EINVAL;
6425
6426         /* Even though the attribute is u32, the specification says
6427          * u8, so let's make sure we don't overflow.
6428          */
6429         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6430         if (cs_count > 255)
6431                 return -EINVAL;
6432
6433         params.count = cs_count;
6434
6435         if (!need_new_beacon)
6436                 goto skip_beacons;
6437
6438         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6439         if (err)
6440                 return err;
6441
6442         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6443                                info->attrs[NL80211_ATTR_CSA_IES],
6444                                nl80211_policy);
6445         if (err)
6446                 return err;
6447
6448         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6449         if (err)
6450                 return err;
6451
6452         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6453                 return -EINVAL;
6454
6455         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6456         if (!len || (len % sizeof(u16)))
6457                 return -EINVAL;
6458
6459         params.n_counter_offsets_beacon = len / sizeof(u16);
6460         if (rdev->wiphy.max_num_csa_counters &&
6461             (params.n_counter_offsets_beacon >
6462              rdev->wiphy.max_num_csa_counters))
6463                 return -EINVAL;
6464
6465         params.counter_offsets_beacon =
6466                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6467
6468         /* sanity checks - counters should fit and be the same */
6469         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6470                 u16 offset = params.counter_offsets_beacon[i];
6471
6472                 if (offset >= params.beacon_csa.tail_len)
6473                         return -EINVAL;
6474
6475                 if (params.beacon_csa.tail[offset] != params.count)
6476                         return -EINVAL;
6477         }
6478
6479         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6480                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6481                 if (!len || (len % sizeof(u16)))
6482                         return -EINVAL;
6483
6484                 params.n_counter_offsets_presp = len / sizeof(u16);
6485                 if (rdev->wiphy.max_num_csa_counters &&
6486                     (params.n_counter_offsets_beacon >
6487                      rdev->wiphy.max_num_csa_counters))
6488                         return -EINVAL;
6489
6490                 params.counter_offsets_presp =
6491                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6492
6493                 /* sanity checks - counters should fit and be the same */
6494                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6495                         u16 offset = params.counter_offsets_presp[i];
6496
6497                         if (offset >= params.beacon_csa.probe_resp_len)
6498                                 return -EINVAL;
6499
6500                         if (params.beacon_csa.probe_resp[offset] !=
6501                             params.count)
6502                                 return -EINVAL;
6503                 }
6504         }
6505
6506 skip_beacons:
6507         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6508         if (err)
6509                 return err;
6510
6511         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
6512                                            wdev->iftype))
6513                 return -EINVAL;
6514
6515         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6516                                             &params.chandef,
6517                                             wdev->iftype);
6518         if (err < 0)
6519                 return err;
6520
6521         if (err > 0)
6522                 params.radar_required = true;
6523
6524         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6525                 params.block_tx = true;
6526
6527         wdev_lock(wdev);
6528         err = rdev_channel_switch(rdev, dev, &params);
6529         wdev_unlock(wdev);
6530
6531         return err;
6532 }
6533
6534 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6535                             u32 seq, int flags,
6536                             struct cfg80211_registered_device *rdev,
6537                             struct wireless_dev *wdev,
6538                             struct cfg80211_internal_bss *intbss)
6539 {
6540         struct cfg80211_bss *res = &intbss->pub;
6541         const struct cfg80211_bss_ies *ies;
6542         void *hdr;
6543         struct nlattr *bss;
6544
6545         ASSERT_WDEV_LOCK(wdev);
6546
6547         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6548                              NL80211_CMD_NEW_SCAN_RESULTS);
6549         if (!hdr)
6550                 return -1;
6551
6552         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6553
6554         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6555                 goto nla_put_failure;
6556         if (wdev->netdev &&
6557             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6558                 goto nla_put_failure;
6559         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6560                 goto nla_put_failure;
6561
6562         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6563         if (!bss)
6564                 goto nla_put_failure;
6565         if ((!is_zero_ether_addr(res->bssid) &&
6566              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6567                 goto nla_put_failure;
6568
6569         rcu_read_lock();
6570         /* indicate whether we have probe response data or not */
6571         if (rcu_access_pointer(res->proberesp_ies) &&
6572             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6573                 goto fail_unlock_rcu;
6574
6575         /* this pointer prefers to be pointed to probe response data
6576          * but is always valid
6577          */
6578         ies = rcu_dereference(res->ies);
6579         if (ies) {
6580                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6581                         goto fail_unlock_rcu;
6582                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6583                                         ies->len, ies->data))
6584                         goto fail_unlock_rcu;
6585         }
6586
6587         /* and this pointer is always (unless driver didn't know) beacon data */
6588         ies = rcu_dereference(res->beacon_ies);
6589         if (ies && ies->from_beacon) {
6590                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6591                         goto fail_unlock_rcu;
6592                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6593                                         ies->len, ies->data))
6594                         goto fail_unlock_rcu;
6595         }
6596         rcu_read_unlock();
6597
6598         if (res->beacon_interval &&
6599             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6600                 goto nla_put_failure;
6601         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6602             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6603             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6604             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6605                         jiffies_to_msecs(jiffies - intbss->ts)))
6606                 goto nla_put_failure;
6607
6608         switch (rdev->wiphy.signal_type) {
6609         case CFG80211_SIGNAL_TYPE_MBM:
6610                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6611                         goto nla_put_failure;
6612                 break;
6613         case CFG80211_SIGNAL_TYPE_UNSPEC:
6614                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6615                         goto nla_put_failure;
6616                 break;
6617         default:
6618                 break;
6619         }
6620
6621         switch (wdev->iftype) {
6622         case NL80211_IFTYPE_P2P_CLIENT:
6623         case NL80211_IFTYPE_STATION:
6624                 if (intbss == wdev->current_bss &&
6625                     nla_put_u32(msg, NL80211_BSS_STATUS,
6626                                 NL80211_BSS_STATUS_ASSOCIATED))
6627                         goto nla_put_failure;
6628                 break;
6629         case NL80211_IFTYPE_ADHOC:
6630                 if (intbss == wdev->current_bss &&
6631                     nla_put_u32(msg, NL80211_BSS_STATUS,
6632                                 NL80211_BSS_STATUS_IBSS_JOINED))
6633                         goto nla_put_failure;
6634                 break;
6635         default:
6636                 break;
6637         }
6638
6639         nla_nest_end(msg, bss);
6640
6641         genlmsg_end(msg, hdr);
6642         return 0;
6643
6644  fail_unlock_rcu:
6645         rcu_read_unlock();
6646  nla_put_failure:
6647         genlmsg_cancel(msg, hdr);
6648         return -EMSGSIZE;
6649 }
6650
6651 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6652 {
6653         struct cfg80211_registered_device *rdev;
6654         struct cfg80211_internal_bss *scan;
6655         struct wireless_dev *wdev;
6656         int start = cb->args[2], idx = 0;
6657         int err;
6658
6659         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6660         if (err)
6661                 return err;
6662
6663         wdev_lock(wdev);
6664         spin_lock_bh(&rdev->bss_lock);
6665         cfg80211_bss_expire(rdev);
6666
6667         cb->seq = rdev->bss_generation;
6668
6669         list_for_each_entry(scan, &rdev->bss_list, list) {
6670                 if (++idx <= start)
6671                         continue;
6672                 if (nl80211_send_bss(skb, cb,
6673                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6674                                 rdev, wdev, scan) < 0) {
6675                         idx--;
6676                         break;
6677                 }
6678         }
6679
6680         spin_unlock_bh(&rdev->bss_lock);
6681         wdev_unlock(wdev);
6682
6683         cb->args[2] = idx;
6684         nl80211_finish_wdev_dump(rdev);
6685
6686         return skb->len;
6687 }
6688
6689 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6690                                int flags, struct net_device *dev,
6691                                bool allow_radio_stats,
6692                                struct survey_info *survey)
6693 {
6694         void *hdr;
6695         struct nlattr *infoattr;
6696
6697         /* skip radio stats if userspace didn't request them */
6698         if (!survey->channel && !allow_radio_stats)
6699                 return 0;
6700
6701         hdr = nl80211hdr_put(msg, portid, seq, flags,
6702                              NL80211_CMD_NEW_SURVEY_RESULTS);
6703         if (!hdr)
6704                 return -ENOMEM;
6705
6706         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6707                 goto nla_put_failure;
6708
6709         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6710         if (!infoattr)
6711                 goto nla_put_failure;
6712
6713         if (survey->channel &&
6714             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6715                         survey->channel->center_freq))
6716                 goto nla_put_failure;
6717
6718         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6719             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6720                 goto nla_put_failure;
6721         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6722             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6723                 goto nla_put_failure;
6724         if ((survey->filled & SURVEY_INFO_TIME) &&
6725             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
6726                         survey->time))
6727                 goto nla_put_failure;
6728         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
6729             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
6730                         survey->time_busy))
6731                 goto nla_put_failure;
6732         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
6733             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
6734                         survey->time_ext_busy))
6735                 goto nla_put_failure;
6736         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
6737             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
6738                         survey->time_rx))
6739                 goto nla_put_failure;
6740         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
6741             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
6742                         survey->time_tx))
6743                 goto nla_put_failure;
6744         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
6745             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
6746                         survey->time_scan))
6747                 goto nla_put_failure;
6748
6749         nla_nest_end(msg, infoattr);
6750
6751         genlmsg_end(msg, hdr);
6752         return 0;
6753
6754  nla_put_failure:
6755         genlmsg_cancel(msg, hdr);
6756         return -EMSGSIZE;
6757 }
6758
6759 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
6760 {
6761         struct survey_info survey;
6762         struct cfg80211_registered_device *rdev;
6763         struct wireless_dev *wdev;
6764         int survey_idx = cb->args[2];
6765         int res;
6766         bool radio_stats;
6767
6768         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6769         if (res)
6770                 return res;
6771
6772         /* prepare_wdev_dump parsed the attributes */
6773         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
6774
6775         if (!wdev->netdev) {
6776                 res = -EINVAL;
6777                 goto out_err;
6778         }
6779
6780         if (!rdev->ops->dump_survey) {
6781                 res = -EOPNOTSUPP;
6782                 goto out_err;
6783         }
6784
6785         while (1) {
6786                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6787                 if (res == -ENOENT)
6788                         break;
6789                 if (res)
6790                         goto out_err;
6791
6792                 /* don't send disabled channels, but do send non-channel data */
6793                 if (survey.channel &&
6794                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6795                         survey_idx++;
6796                         continue;
6797                 }
6798
6799                 if (nl80211_send_survey(skb,
6800                                 NETLINK_CB(cb->skb).portid,
6801                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6802                                 wdev->netdev, radio_stats, &survey) < 0)
6803                         goto out;
6804                 survey_idx++;
6805         }
6806
6807  out:
6808         cb->args[2] = survey_idx;
6809         res = skb->len;
6810  out_err:
6811         nl80211_finish_wdev_dump(rdev);
6812         return res;
6813 }
6814
6815 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6816 {
6817         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6818                                   NL80211_WPA_VERSION_2));
6819 }
6820
6821 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6822 {
6823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6824         struct net_device *dev = info->user_ptr[1];
6825         struct ieee80211_channel *chan;
6826         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6827         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6828         enum nl80211_auth_type auth_type;
6829         struct key_parse key;
6830         bool local_state_change;
6831
6832         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6833                 return -EINVAL;
6834
6835         if (!info->attrs[NL80211_ATTR_MAC])
6836                 return -EINVAL;
6837
6838         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6839                 return -EINVAL;
6840
6841         if (!info->attrs[NL80211_ATTR_SSID])
6842                 return -EINVAL;
6843
6844         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6845                 return -EINVAL;
6846
6847         err = nl80211_parse_key(info, &key);
6848         if (err)
6849                 return err;
6850
6851         if (key.idx >= 0) {
6852                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6853                         return -EINVAL;
6854                 if (!key.p.key || !key.p.key_len)
6855                         return -EINVAL;
6856                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6857                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6858                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6859                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6860                         return -EINVAL;
6861                 if (key.idx > 4)
6862                         return -EINVAL;
6863         } else {
6864                 key.p.key_len = 0;
6865                 key.p.key = NULL;
6866         }
6867
6868         if (key.idx >= 0) {
6869                 int i;
6870                 bool ok = false;
6871                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6872                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6873                                 ok = true;
6874                                 break;
6875                         }
6876                 }
6877                 if (!ok)
6878                         return -EINVAL;
6879         }
6880
6881         if (!rdev->ops->auth)
6882                 return -EOPNOTSUPP;
6883
6884         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6885             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6886                 return -EOPNOTSUPP;
6887
6888         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6889         chan = nl80211_get_valid_chan(&rdev->wiphy,
6890                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6891         if (!chan)
6892                 return -EINVAL;
6893
6894         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6895         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6896
6897         if (info->attrs[NL80211_ATTR_IE]) {
6898                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6899                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6900         }
6901
6902         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6903         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6904                 return -EINVAL;
6905
6906         if (auth_type == NL80211_AUTHTYPE_SAE &&
6907             !info->attrs[NL80211_ATTR_SAE_DATA])
6908                 return -EINVAL;
6909
6910         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6911                 if (auth_type != NL80211_AUTHTYPE_SAE)
6912                         return -EINVAL;
6913                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6914                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6915                 /* need to include at least Auth Transaction and Status Code */
6916                 if (sae_data_len < 4)
6917                         return -EINVAL;
6918         }
6919
6920         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6921
6922         /*
6923          * Since we no longer track auth state, ignore
6924          * requests to only change local state.
6925          */
6926         if (local_state_change)
6927                 return 0;
6928
6929         wdev_lock(dev->ieee80211_ptr);
6930         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6931                                  ssid, ssid_len, ie, ie_len,
6932                                  key.p.key, key.p.key_len, key.idx,
6933                                  sae_data, sae_data_len);
6934         wdev_unlock(dev->ieee80211_ptr);
6935         return err;
6936 }
6937
6938 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6939                                    struct genl_info *info,
6940                                    struct cfg80211_crypto_settings *settings,
6941                                    int cipher_limit)
6942 {
6943         memset(settings, 0, sizeof(*settings));
6944
6945         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6946
6947         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6948                 u16 proto;
6949                 proto = nla_get_u16(
6950                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6951                 settings->control_port_ethertype = cpu_to_be16(proto);
6952                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6953                     proto != ETH_P_PAE)
6954                         return -EINVAL;
6955                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6956                         settings->control_port_no_encrypt = true;
6957         } else
6958                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6959
6960         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6961                 void *data;
6962                 int len, i;
6963
6964                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6965                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6966                 settings->n_ciphers_pairwise = len / sizeof(u32);
6967
6968                 if (len % sizeof(u32))
6969                         return -EINVAL;
6970
6971                 if (settings->n_ciphers_pairwise > cipher_limit)
6972                         return -EINVAL;
6973
6974                 memcpy(settings->ciphers_pairwise, data, len);
6975
6976                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6977                         if (!cfg80211_supported_cipher_suite(
6978                                         &rdev->wiphy,
6979                                         settings->ciphers_pairwise[i]))
6980                                 return -EINVAL;
6981         }
6982
6983         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6984                 settings->cipher_group =
6985                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6986                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6987                                                      settings->cipher_group))
6988                         return -EINVAL;
6989         }
6990
6991         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6992                 settings->wpa_versions =
6993                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6994                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6995                         return -EINVAL;
6996         }
6997
6998         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6999                 void *data;
7000                 int len;
7001
7002                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7003                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7004                 settings->n_akm_suites = len / sizeof(u32);
7005
7006                 if (len % sizeof(u32))
7007                         return -EINVAL;
7008
7009                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7010                         return -EINVAL;
7011
7012                 memcpy(settings->akm_suites, data, len);
7013         }
7014
7015         return 0;
7016 }
7017
7018 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7019 {
7020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7021         struct net_device *dev = info->user_ptr[1];
7022         struct ieee80211_channel *chan;
7023         struct cfg80211_assoc_request req = {};
7024         const u8 *bssid, *ssid;
7025         int err, ssid_len = 0;
7026
7027         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7028                 return -EINVAL;
7029
7030         if (!info->attrs[NL80211_ATTR_MAC] ||
7031             !info->attrs[NL80211_ATTR_SSID] ||
7032             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7033                 return -EINVAL;
7034
7035         if (!rdev->ops->assoc)
7036                 return -EOPNOTSUPP;
7037
7038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7040                 return -EOPNOTSUPP;
7041
7042         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7043
7044         chan = nl80211_get_valid_chan(&rdev->wiphy,
7045                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7046         if (!chan)
7047                 return -EINVAL;
7048
7049         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7050         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7051
7052         if (info->attrs[NL80211_ATTR_IE]) {
7053                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7054                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7055         }
7056
7057         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7058                 enum nl80211_mfp mfp =
7059                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7060                 if (mfp == NL80211_MFP_REQUIRED)
7061                         req.use_mfp = true;
7062                 else if (mfp != NL80211_MFP_NO)
7063                         return -EINVAL;
7064         }
7065
7066         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7067                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7068
7069         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7070                 req.flags |= ASSOC_REQ_DISABLE_HT;
7071
7072         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7073                 memcpy(&req.ht_capa_mask,
7074                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7075                        sizeof(req.ht_capa_mask));
7076
7077         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7078                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7079                         return -EINVAL;
7080                 memcpy(&req.ht_capa,
7081                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7082                        sizeof(req.ht_capa));
7083         }
7084
7085         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7086                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7087
7088         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7089                 memcpy(&req.vht_capa_mask,
7090                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7091                        sizeof(req.vht_capa_mask));
7092
7093         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7094                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7095                         return -EINVAL;
7096                 memcpy(&req.vht_capa,
7097                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7098                        sizeof(req.vht_capa));
7099         }
7100
7101         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7102                 if (!(rdev->wiphy.features &
7103                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7104                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7105                         return -EINVAL;
7106                 req.flags |= ASSOC_REQ_USE_RRM;
7107         }
7108
7109         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7110         if (!err) {
7111                 wdev_lock(dev->ieee80211_ptr);
7112                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7113                                           ssid, ssid_len, &req);
7114                 wdev_unlock(dev->ieee80211_ptr);
7115         }
7116
7117         return err;
7118 }
7119
7120 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7121 {
7122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7123         struct net_device *dev = info->user_ptr[1];
7124         const u8 *ie = NULL, *bssid;
7125         int ie_len = 0, err;
7126         u16 reason_code;
7127         bool local_state_change;
7128
7129         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7130                 return -EINVAL;
7131
7132         if (!info->attrs[NL80211_ATTR_MAC])
7133                 return -EINVAL;
7134
7135         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7136                 return -EINVAL;
7137
7138         if (!rdev->ops->deauth)
7139                 return -EOPNOTSUPP;
7140
7141         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7142             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7143                 return -EOPNOTSUPP;
7144
7145         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7146
7147         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7148         if (reason_code == 0) {
7149                 /* Reason Code 0 is reserved */
7150                 return -EINVAL;
7151         }
7152
7153         if (info->attrs[NL80211_ATTR_IE]) {
7154                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7155                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7156         }
7157
7158         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7159
7160         wdev_lock(dev->ieee80211_ptr);
7161         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7162                                    local_state_change);
7163         wdev_unlock(dev->ieee80211_ptr);
7164         return err;
7165 }
7166
7167 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7168 {
7169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7170         struct net_device *dev = info->user_ptr[1];
7171         const u8 *ie = NULL, *bssid;
7172         int ie_len = 0, err;
7173         u16 reason_code;
7174         bool local_state_change;
7175
7176         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7177                 return -EINVAL;
7178
7179         if (!info->attrs[NL80211_ATTR_MAC])
7180                 return -EINVAL;
7181
7182         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7183                 return -EINVAL;
7184
7185         if (!rdev->ops->disassoc)
7186                 return -EOPNOTSUPP;
7187
7188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7190                 return -EOPNOTSUPP;
7191
7192         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7193
7194         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7195         if (reason_code == 0) {
7196                 /* Reason Code 0 is reserved */
7197                 return -EINVAL;
7198         }
7199
7200         if (info->attrs[NL80211_ATTR_IE]) {
7201                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7202                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7203         }
7204
7205         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7206
7207         wdev_lock(dev->ieee80211_ptr);
7208         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7209                                      local_state_change);
7210         wdev_unlock(dev->ieee80211_ptr);
7211         return err;
7212 }
7213
7214 static bool
7215 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7216                          int mcast_rate[IEEE80211_NUM_BANDS],
7217                          int rateval)
7218 {
7219         struct wiphy *wiphy = &rdev->wiphy;
7220         bool found = false;
7221         int band, i;
7222
7223         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7224                 struct ieee80211_supported_band *sband;
7225
7226                 sband = wiphy->bands[band];
7227                 if (!sband)
7228                         continue;
7229
7230                 for (i = 0; i < sband->n_bitrates; i++) {
7231                         if (sband->bitrates[i].bitrate == rateval) {
7232                                 mcast_rate[band] = i + 1;
7233                                 found = true;
7234                                 break;
7235                         }
7236                 }
7237         }
7238
7239         return found;
7240 }
7241
7242 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7243 {
7244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7245         struct net_device *dev = info->user_ptr[1];
7246         struct cfg80211_ibss_params ibss;
7247         struct wiphy *wiphy;
7248         struct cfg80211_cached_keys *connkeys = NULL;
7249         int err;
7250
7251         memset(&ibss, 0, sizeof(ibss));
7252
7253         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7254                 return -EINVAL;
7255
7256         if (!info->attrs[NL80211_ATTR_SSID] ||
7257             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7258                 return -EINVAL;
7259
7260         ibss.beacon_interval = 100;
7261
7262         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7263                 ibss.beacon_interval =
7264                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7265                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7266                         return -EINVAL;
7267         }
7268
7269         if (!rdev->ops->join_ibss)
7270                 return -EOPNOTSUPP;
7271
7272         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7273                 return -EOPNOTSUPP;
7274
7275         wiphy = &rdev->wiphy;
7276
7277         if (info->attrs[NL80211_ATTR_MAC]) {
7278                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7279
7280                 if (!is_valid_ether_addr(ibss.bssid))
7281                         return -EINVAL;
7282         }
7283         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7284         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7285
7286         if (info->attrs[NL80211_ATTR_IE]) {
7287                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7288                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7289         }
7290
7291         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7292         if (err)
7293                 return err;
7294
7295         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7296                                      NL80211_IFTYPE_ADHOC))
7297                 return -EINVAL;
7298
7299         switch (ibss.chandef.width) {
7300         case NL80211_CHAN_WIDTH_5:
7301         case NL80211_CHAN_WIDTH_10:
7302         case NL80211_CHAN_WIDTH_20_NOHT:
7303                 break;
7304         case NL80211_CHAN_WIDTH_20:
7305         case NL80211_CHAN_WIDTH_40:
7306                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7307                         return -EINVAL;
7308                 break;
7309         case NL80211_CHAN_WIDTH_80:
7310         case NL80211_CHAN_WIDTH_80P80:
7311         case NL80211_CHAN_WIDTH_160:
7312                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7313                         return -EINVAL;
7314                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7315                                              NL80211_EXT_FEATURE_VHT_IBSS))
7316                         return -EINVAL;
7317                 break;
7318         default:
7319                 return -EINVAL;
7320         }
7321
7322         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7323         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7324
7325         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7326                 u8 *rates =
7327                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7328                 int n_rates =
7329                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7330                 struct ieee80211_supported_band *sband =
7331                         wiphy->bands[ibss.chandef.chan->band];
7332
7333                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7334                                              &ibss.basic_rates);
7335                 if (err)
7336                         return err;
7337         }
7338
7339         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7340                 memcpy(&ibss.ht_capa_mask,
7341                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7342                        sizeof(ibss.ht_capa_mask));
7343
7344         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7345                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7346                         return -EINVAL;
7347                 memcpy(&ibss.ht_capa,
7348                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7349                        sizeof(ibss.ht_capa));
7350         }
7351
7352         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7353             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7354                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7355                 return -EINVAL;
7356
7357         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7358                 bool no_ht = false;
7359
7360                 connkeys = nl80211_parse_connkeys(rdev,
7361                                           info->attrs[NL80211_ATTR_KEYS],
7362                                           &no_ht);
7363                 if (IS_ERR(connkeys))
7364                         return PTR_ERR(connkeys);
7365
7366                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7367                     no_ht) {
7368                         kfree(connkeys);
7369                         return -EINVAL;
7370                 }
7371         }
7372
7373         ibss.control_port =
7374                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7375
7376         ibss.userspace_handles_dfs =
7377                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7378
7379         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7380         if (err)
7381                 kzfree(connkeys);
7382         return err;
7383 }
7384
7385 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7386 {
7387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7388         struct net_device *dev = info->user_ptr[1];
7389
7390         if (!rdev->ops->leave_ibss)
7391                 return -EOPNOTSUPP;
7392
7393         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7394                 return -EOPNOTSUPP;
7395
7396         return cfg80211_leave_ibss(rdev, dev, false);
7397 }
7398
7399 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7400 {
7401         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7402         struct net_device *dev = info->user_ptr[1];
7403         int mcast_rate[IEEE80211_NUM_BANDS];
7404         u32 nla_rate;
7405         int err;
7406
7407         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7408             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7409             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7410                 return -EOPNOTSUPP;
7411
7412         if (!rdev->ops->set_mcast_rate)
7413                 return -EOPNOTSUPP;
7414
7415         memset(mcast_rate, 0, sizeof(mcast_rate));
7416
7417         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7418                 return -EINVAL;
7419
7420         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7421         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7422                 return -EINVAL;
7423
7424         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7425
7426         return err;
7427 }
7428
7429 static struct sk_buff *
7430 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7431                             struct wireless_dev *wdev, int approxlen,
7432                             u32 portid, u32 seq, enum nl80211_commands cmd,
7433                             enum nl80211_attrs attr,
7434                             const struct nl80211_vendor_cmd_info *info,
7435                             gfp_t gfp)
7436 {
7437         struct sk_buff *skb;
7438         void *hdr;
7439         struct nlattr *data;
7440
7441         skb = nlmsg_new(approxlen + 100, gfp);
7442         if (!skb)
7443                 return NULL;
7444
7445         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7446         if (!hdr) {
7447                 kfree_skb(skb);
7448                 return NULL;
7449         }
7450
7451         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7452                 goto nla_put_failure;
7453
7454         if (info) {
7455                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7456                                 info->vendor_id))
7457                         goto nla_put_failure;
7458                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7459                                 info->subcmd))
7460                         goto nla_put_failure;
7461         }
7462
7463         if (wdev) {
7464                 if (nla_put_u64(skb, NL80211_ATTR_WDEV,
7465                                 wdev_id(wdev)))
7466                         goto nla_put_failure;
7467                 if (wdev->netdev &&
7468                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
7469                                 wdev->netdev->ifindex))
7470                         goto nla_put_failure;
7471         }
7472
7473         data = nla_nest_start(skb, attr);
7474
7475         ((void **)skb->cb)[0] = rdev;
7476         ((void **)skb->cb)[1] = hdr;
7477         ((void **)skb->cb)[2] = data;
7478
7479         return skb;
7480
7481  nla_put_failure:
7482         kfree_skb(skb);
7483         return NULL;
7484 }
7485
7486 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7487                                            struct wireless_dev *wdev,
7488                                            enum nl80211_commands cmd,
7489                                            enum nl80211_attrs attr,
7490                                            int vendor_event_idx,
7491                                            int approxlen, gfp_t gfp)
7492 {
7493         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7494         const struct nl80211_vendor_cmd_info *info;
7495
7496         switch (cmd) {
7497         case NL80211_CMD_TESTMODE:
7498                 if (WARN_ON(vendor_event_idx != -1))
7499                         return NULL;
7500                 info = NULL;
7501                 break;
7502         case NL80211_CMD_VENDOR:
7503                 if (WARN_ON(vendor_event_idx < 0 ||
7504                             vendor_event_idx >= wiphy->n_vendor_events))
7505                         return NULL;
7506                 info = &wiphy->vendor_events[vendor_event_idx];
7507                 break;
7508         default:
7509                 WARN_ON(1);
7510                 return NULL;
7511         }
7512
7513         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
7514                                            cmd, attr, info, gfp);
7515 }
7516 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7517
7518 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7519 {
7520         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7521         void *hdr = ((void **)skb->cb)[1];
7522         struct nlattr *data = ((void **)skb->cb)[2];
7523         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7524
7525         /* clear CB data for netlink core to own from now on */
7526         memset(skb->cb, 0, sizeof(skb->cb));
7527
7528         nla_nest_end(skb, data);
7529         genlmsg_end(skb, hdr);
7530
7531         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7532                 mcgrp = NL80211_MCGRP_VENDOR;
7533
7534         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7535                                 mcgrp, gfp);
7536 }
7537 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7538
7539 #ifdef CONFIG_NL80211_TESTMODE
7540 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7541 {
7542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7543         struct wireless_dev *wdev =
7544                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7545         int err;
7546
7547         if (!rdev->ops->testmode_cmd)
7548                 return -EOPNOTSUPP;
7549
7550         if (IS_ERR(wdev)) {
7551                 err = PTR_ERR(wdev);
7552                 if (err != -EINVAL)
7553                         return err;
7554                 wdev = NULL;
7555         } else if (wdev->wiphy != &rdev->wiphy) {
7556                 return -EINVAL;
7557         }
7558
7559         if (!info->attrs[NL80211_ATTR_TESTDATA])
7560                 return -EINVAL;
7561
7562         rdev->cur_cmd_info = info;
7563         err = rdev_testmode_cmd(rdev, wdev,
7564                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7565                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7566         rdev->cur_cmd_info = NULL;
7567
7568         return err;
7569 }
7570
7571 static int nl80211_testmode_dump(struct sk_buff *skb,
7572                                  struct netlink_callback *cb)
7573 {
7574         struct cfg80211_registered_device *rdev;
7575         int err;
7576         long phy_idx;
7577         void *data = NULL;
7578         int data_len = 0;
7579
7580         rtnl_lock();
7581
7582         if (cb->args[0]) {
7583                 /*
7584                  * 0 is a valid index, but not valid for args[0],
7585                  * so we need to offset by 1.
7586                  */
7587                 phy_idx = cb->args[0] - 1;
7588         } else {
7589                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7590                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7591                                   nl80211_policy);
7592                 if (err)
7593                         goto out_err;
7594
7595                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7596                                                   nl80211_fam.attrbuf);
7597                 if (IS_ERR(rdev)) {
7598                         err = PTR_ERR(rdev);
7599                         goto out_err;
7600                 }
7601                 phy_idx = rdev->wiphy_idx;
7602                 rdev = NULL;
7603
7604                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7605                         cb->args[1] =
7606                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7607         }
7608
7609         if (cb->args[1]) {
7610                 data = nla_data((void *)cb->args[1]);
7611                 data_len = nla_len((void *)cb->args[1]);
7612         }
7613
7614         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7615         if (!rdev) {
7616                 err = -ENOENT;
7617                 goto out_err;
7618         }
7619
7620         if (!rdev->ops->testmode_dump) {
7621                 err = -EOPNOTSUPP;
7622                 goto out_err;
7623         }
7624
7625         while (1) {
7626                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7627                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7628                                            NL80211_CMD_TESTMODE);
7629                 struct nlattr *tmdata;
7630
7631                 if (!hdr)
7632                         break;
7633
7634                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7635                         genlmsg_cancel(skb, hdr);
7636                         break;
7637                 }
7638
7639                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7640                 if (!tmdata) {
7641                         genlmsg_cancel(skb, hdr);
7642                         break;
7643                 }
7644                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7645                 nla_nest_end(skb, tmdata);
7646
7647                 if (err == -ENOBUFS || err == -ENOENT) {
7648                         genlmsg_cancel(skb, hdr);
7649                         break;
7650                 } else if (err) {
7651                         genlmsg_cancel(skb, hdr);
7652                         goto out_err;
7653                 }
7654
7655                 genlmsg_end(skb, hdr);
7656         }
7657
7658         err = skb->len;
7659         /* see above */
7660         cb->args[0] = phy_idx + 1;
7661  out_err:
7662         rtnl_unlock();
7663         return err;
7664 }
7665 #endif
7666
7667 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7668 {
7669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7670         struct net_device *dev = info->user_ptr[1];
7671         struct cfg80211_connect_params connect;
7672         struct wiphy *wiphy;
7673         struct cfg80211_cached_keys *connkeys = NULL;
7674         int err;
7675
7676         memset(&connect, 0, sizeof(connect));
7677
7678         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7679                 return -EINVAL;
7680
7681         if (!info->attrs[NL80211_ATTR_SSID] ||
7682             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7683                 return -EINVAL;
7684
7685         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7686                 connect.auth_type =
7687                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7688                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7689                                              NL80211_CMD_CONNECT))
7690                         return -EINVAL;
7691         } else
7692                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7693
7694         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7695
7696         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7697                                       NL80211_MAX_NR_CIPHER_SUITES);
7698         if (err)
7699                 return err;
7700
7701         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7702             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7703                 return -EOPNOTSUPP;
7704
7705         wiphy = &rdev->wiphy;
7706
7707         connect.bg_scan_period = -1;
7708         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7709                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7710                 connect.bg_scan_period =
7711                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7712         }
7713
7714         if (info->attrs[NL80211_ATTR_MAC])
7715                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7716         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7717                 connect.bssid_hint =
7718                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7719         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7720         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7721
7722         if (info->attrs[NL80211_ATTR_IE]) {
7723                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7724                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7725         }
7726
7727         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7728                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7729                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7730                     connect.mfp != NL80211_MFP_NO)
7731                         return -EINVAL;
7732         } else {
7733                 connect.mfp = NL80211_MFP_NO;
7734         }
7735
7736         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7737                 connect.channel = nl80211_get_valid_chan(
7738                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7739                 if (!connect.channel)
7740                         return -EINVAL;
7741         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7742                 connect.channel_hint = nl80211_get_valid_chan(
7743                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7744                 if (!connect.channel_hint)
7745                         return -EINVAL;
7746         }
7747
7748         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7749                 connkeys = nl80211_parse_connkeys(rdev,
7750                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7751                 if (IS_ERR(connkeys))
7752                         return PTR_ERR(connkeys);
7753         }
7754
7755         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7756                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7757
7758         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7759                 memcpy(&connect.ht_capa_mask,
7760                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7761                        sizeof(connect.ht_capa_mask));
7762
7763         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7764                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7765                         kzfree(connkeys);
7766                         return -EINVAL;
7767                 }
7768                 memcpy(&connect.ht_capa,
7769                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7770                        sizeof(connect.ht_capa));
7771         }
7772
7773         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7774                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7775
7776         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7777                 memcpy(&connect.vht_capa_mask,
7778                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7779                        sizeof(connect.vht_capa_mask));
7780
7781         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7782                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7783                         kzfree(connkeys);
7784                         return -EINVAL;
7785                 }
7786                 memcpy(&connect.vht_capa,
7787                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7788                        sizeof(connect.vht_capa));
7789         }
7790
7791         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7792                 if (!(rdev->wiphy.features &
7793                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7794                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7795                         return -EINVAL;
7796                 connect.flags |= ASSOC_REQ_USE_RRM;
7797         }
7798
7799         wdev_lock(dev->ieee80211_ptr);
7800         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7801         wdev_unlock(dev->ieee80211_ptr);
7802         if (err)
7803                 kzfree(connkeys);
7804         return err;
7805 }
7806
7807 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7808 {
7809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7810         struct net_device *dev = info->user_ptr[1];
7811         u16 reason;
7812         int ret;
7813
7814         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7815                 reason = WLAN_REASON_DEAUTH_LEAVING;
7816         else
7817                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7818
7819         if (reason == 0)
7820                 return -EINVAL;
7821
7822         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7824                 return -EOPNOTSUPP;
7825
7826         wdev_lock(dev->ieee80211_ptr);
7827         ret = cfg80211_disconnect(rdev, dev, reason, true);
7828         wdev_unlock(dev->ieee80211_ptr);
7829         return ret;
7830 }
7831
7832 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7833 {
7834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7835         struct net *net;
7836         int err;
7837
7838         if (info->attrs[NL80211_ATTR_PID]) {
7839                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7840
7841                 net = get_net_ns_by_pid(pid);
7842         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
7843                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
7844
7845                 net = get_net_ns_by_fd(fd);
7846         } else {
7847                 return -EINVAL;
7848         }
7849
7850         if (IS_ERR(net))
7851                 return PTR_ERR(net);
7852
7853         err = 0;
7854
7855         /* check if anything to do */
7856         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7857                 err = cfg80211_switch_netns(rdev, net);
7858
7859         put_net(net);
7860         return err;
7861 }
7862
7863 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7864 {
7865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7866         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7867                         struct cfg80211_pmksa *pmksa) = NULL;
7868         struct net_device *dev = info->user_ptr[1];
7869         struct cfg80211_pmksa pmksa;
7870
7871         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7872
7873         if (!info->attrs[NL80211_ATTR_MAC])
7874                 return -EINVAL;
7875
7876         if (!info->attrs[NL80211_ATTR_PMKID])
7877                 return -EINVAL;
7878
7879         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7880         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7881
7882         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7883             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7884                 return -EOPNOTSUPP;
7885
7886         switch (info->genlhdr->cmd) {
7887         case NL80211_CMD_SET_PMKSA:
7888                 rdev_ops = rdev->ops->set_pmksa;
7889                 break;
7890         case NL80211_CMD_DEL_PMKSA:
7891                 rdev_ops = rdev->ops->del_pmksa;
7892                 break;
7893         default:
7894                 WARN_ON(1);
7895                 break;
7896         }
7897
7898         if (!rdev_ops)
7899                 return -EOPNOTSUPP;
7900
7901         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7902 }
7903
7904 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7905 {
7906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7907         struct net_device *dev = info->user_ptr[1];
7908
7909         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7910             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7911                 return -EOPNOTSUPP;
7912
7913         if (!rdev->ops->flush_pmksa)
7914                 return -EOPNOTSUPP;
7915
7916         return rdev_flush_pmksa(rdev, dev);
7917 }
7918
7919 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7920 {
7921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7922         struct net_device *dev = info->user_ptr[1];
7923         u8 action_code, dialog_token;
7924         u32 peer_capability = 0;
7925         u16 status_code;
7926         u8 *peer;
7927         bool initiator;
7928
7929         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7930             !rdev->ops->tdls_mgmt)
7931                 return -EOPNOTSUPP;
7932
7933         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7934             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7935             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7936             !info->attrs[NL80211_ATTR_IE] ||
7937             !info->attrs[NL80211_ATTR_MAC])
7938                 return -EINVAL;
7939
7940         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7941         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7942         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7943         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7944         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7945         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7946                 peer_capability =
7947                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7948
7949         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7950                               dialog_token, status_code, peer_capability,
7951                               initiator,
7952                               nla_data(info->attrs[NL80211_ATTR_IE]),
7953                               nla_len(info->attrs[NL80211_ATTR_IE]));
7954 }
7955
7956 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7957 {
7958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7959         struct net_device *dev = info->user_ptr[1];
7960         enum nl80211_tdls_operation operation;
7961         u8 *peer;
7962
7963         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7964             !rdev->ops->tdls_oper)
7965                 return -EOPNOTSUPP;
7966
7967         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7968             !info->attrs[NL80211_ATTR_MAC])
7969                 return -EINVAL;
7970
7971         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7972         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7973
7974         return rdev_tdls_oper(rdev, dev, peer, operation);
7975 }
7976
7977 static int nl80211_remain_on_channel(struct sk_buff *skb,
7978                                      struct genl_info *info)
7979 {
7980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7981         struct wireless_dev *wdev = info->user_ptr[1];
7982         struct cfg80211_chan_def chandef;
7983         struct sk_buff *msg;
7984         void *hdr;
7985         u64 cookie;
7986         u32 duration;
7987         int err;
7988
7989         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7990             !info->attrs[NL80211_ATTR_DURATION])
7991                 return -EINVAL;
7992
7993         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7994
7995         if (!rdev->ops->remain_on_channel ||
7996             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7997                 return -EOPNOTSUPP;
7998
7999         /*
8000          * We should be on that channel for at least a minimum amount of
8001          * time (10ms) but no longer than the driver supports.
8002          */
8003         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8004             duration > rdev->wiphy.max_remain_on_channel_duration)
8005                 return -EINVAL;
8006
8007         err = nl80211_parse_chandef(rdev, info, &chandef);
8008         if (err)
8009                 return err;
8010
8011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8012         if (!msg)
8013                 return -ENOMEM;
8014
8015         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8016                              NL80211_CMD_REMAIN_ON_CHANNEL);
8017         if (!hdr) {
8018                 err = -ENOBUFS;
8019                 goto free_msg;
8020         }
8021
8022         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8023                                      duration, &cookie);
8024
8025         if (err)
8026                 goto free_msg;
8027
8028         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8029                 goto nla_put_failure;
8030
8031         genlmsg_end(msg, hdr);
8032
8033         return genlmsg_reply(msg, info);
8034
8035  nla_put_failure:
8036         err = -ENOBUFS;
8037  free_msg:
8038         nlmsg_free(msg);
8039         return err;
8040 }
8041
8042 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8043                                             struct genl_info *info)
8044 {
8045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8046         struct wireless_dev *wdev = info->user_ptr[1];
8047         u64 cookie;
8048
8049         if (!info->attrs[NL80211_ATTR_COOKIE])
8050                 return -EINVAL;
8051
8052         if (!rdev->ops->cancel_remain_on_channel)
8053                 return -EOPNOTSUPP;
8054
8055         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8056
8057         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8058 }
8059
8060 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8061                            u8 *rates, u8 rates_len)
8062 {
8063         u8 i;
8064         u32 mask = 0;
8065
8066         for (i = 0; i < rates_len; i++) {
8067                 int rate = (rates[i] & 0x7f) * 5;
8068                 int ridx;
8069                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8070                         struct ieee80211_rate *srate =
8071                                 &sband->bitrates[ridx];
8072                         if (rate == srate->bitrate) {
8073                                 mask |= 1 << ridx;
8074                                 break;
8075                         }
8076                 }
8077                 if (ridx == sband->n_bitrates)
8078                         return 0; /* rate not found */
8079         }
8080
8081         return mask;
8082 }
8083
8084 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8085                                u8 *rates, u8 rates_len,
8086                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8087 {
8088         u8 i;
8089
8090         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8091
8092         for (i = 0; i < rates_len; i++) {
8093                 int ridx, rbit;
8094
8095                 ridx = rates[i] / 8;
8096                 rbit = BIT(rates[i] % 8);
8097
8098                 /* check validity */
8099                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8100                         return false;
8101
8102                 /* check availability */
8103                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8104                         mcs[ridx] |= rbit;
8105                 else
8106                         return false;
8107         }
8108
8109         return true;
8110 }
8111
8112 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8113 {
8114         u16 mcs_mask = 0;
8115
8116         switch (vht_mcs_map) {
8117         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8118                 break;
8119         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8120                 mcs_mask = 0x00FF;
8121                 break;
8122         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8123                 mcs_mask = 0x01FF;
8124                 break;
8125         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8126                 mcs_mask = 0x03FF;
8127                 break;
8128         default:
8129                 break;
8130         }
8131
8132         return mcs_mask;
8133 }
8134
8135 static void vht_build_mcs_mask(u16 vht_mcs_map,
8136                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8137 {
8138         u8 nss;
8139
8140         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8141                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8142                 vht_mcs_map >>= 2;
8143         }
8144 }
8145
8146 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8147                              struct nl80211_txrate_vht *txrate,
8148                              u16 mcs[NL80211_VHT_NSS_MAX])
8149 {
8150         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8151         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8152         u8 i;
8153
8154         if (!sband->vht_cap.vht_supported)
8155                 return false;
8156
8157         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8158
8159         /* Build vht_mcs_mask from VHT capabilities */
8160         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8161
8162         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8163                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8164                         mcs[i] = txrate->mcs[i];
8165                 else
8166                         return false;
8167         }
8168
8169         return true;
8170 }
8171
8172 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8173         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8174                                     .len = NL80211_MAX_SUPP_RATES },
8175         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8176                                 .len = NL80211_MAX_SUPP_HT_RATES },
8177         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8178         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8179 };
8180
8181 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8182                                        struct genl_info *info)
8183 {
8184         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8185         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8186         struct cfg80211_bitrate_mask mask;
8187         int rem, i;
8188         struct net_device *dev = info->user_ptr[1];
8189         struct nlattr *tx_rates;
8190         struct ieee80211_supported_band *sband;
8191         u16 vht_tx_mcs_map;
8192
8193         if (!rdev->ops->set_bitrate_mask)
8194                 return -EOPNOTSUPP;
8195
8196         memset(&mask, 0, sizeof(mask));
8197         /* Default to all rates enabled */
8198         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
8199                 sband = rdev->wiphy.bands[i];
8200
8201                 if (!sband)
8202                         continue;
8203
8204                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8205                 memcpy(mask.control[i].ht_mcs,
8206                        sband->ht_cap.mcs.rx_mask,
8207                        sizeof(mask.control[i].ht_mcs));
8208
8209                 if (!sband->vht_cap.vht_supported)
8210                         continue;
8211
8212                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8213                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8214         }
8215
8216         /* if no rates are given set it back to the defaults */
8217         if (!info->attrs[NL80211_ATTR_TX_RATES])
8218                 goto out;
8219
8220         /*
8221          * The nested attribute uses enum nl80211_band as the index. This maps
8222          * directly to the enum ieee80211_band values used in cfg80211.
8223          */
8224         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8225         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8226                 enum ieee80211_band band = nla_type(tx_rates);
8227                 int err;
8228
8229                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
8230                         return -EINVAL;
8231                 sband = rdev->wiphy.bands[band];
8232                 if (sband == NULL)
8233                         return -EINVAL;
8234                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8235                                 nla_len(tx_rates), nl80211_txattr_policy);
8236                 if (err)
8237                         return err;
8238                 if (tb[NL80211_TXRATE_LEGACY]) {
8239                         mask.control[band].legacy = rateset_to_mask(
8240                                 sband,
8241                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8242                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8243                         if ((mask.control[band].legacy == 0) &&
8244                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8245                                 return -EINVAL;
8246                 }
8247                 if (tb[NL80211_TXRATE_HT]) {
8248                         if (!ht_rateset_to_mask(
8249                                         sband,
8250                                         nla_data(tb[NL80211_TXRATE_HT]),
8251                                         nla_len(tb[NL80211_TXRATE_HT]),
8252                                         mask.control[band].ht_mcs))
8253                                 return -EINVAL;
8254                 }
8255                 if (tb[NL80211_TXRATE_VHT]) {
8256                         if (!vht_set_mcs_mask(
8257                                         sband,
8258                                         nla_data(tb[NL80211_TXRATE_VHT]),
8259                                         mask.control[band].vht_mcs))
8260                                 return -EINVAL;
8261                 }
8262                 if (tb[NL80211_TXRATE_GI]) {
8263                         mask.control[band].gi =
8264                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8265                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8266                                 return -EINVAL;
8267                 }
8268
8269                 if (mask.control[band].legacy == 0) {
8270                         /* don't allow empty legacy rates if HT or VHT
8271                          * are not even supported.
8272                          */
8273                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8274                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8275                                 return -EINVAL;
8276
8277                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8278                                 if (mask.control[band].ht_mcs[i])
8279                                         goto out;
8280
8281                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8282                                 if (mask.control[band].vht_mcs[i])
8283                                         goto out;
8284
8285                         /* legacy and mcs rates may not be both empty */
8286                         return -EINVAL;
8287                 }
8288         }
8289
8290 out:
8291         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8292 }
8293
8294 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8295 {
8296         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8297         struct wireless_dev *wdev = info->user_ptr[1];
8298         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8299
8300         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8301                 return -EINVAL;
8302
8303         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8304                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8305
8306         switch (wdev->iftype) {
8307         case NL80211_IFTYPE_STATION:
8308         case NL80211_IFTYPE_ADHOC:
8309         case NL80211_IFTYPE_P2P_CLIENT:
8310         case NL80211_IFTYPE_AP:
8311         case NL80211_IFTYPE_AP_VLAN:
8312         case NL80211_IFTYPE_MESH_POINT:
8313         case NL80211_IFTYPE_P2P_GO:
8314         case NL80211_IFTYPE_P2P_DEVICE:
8315                 break;
8316         default:
8317                 return -EOPNOTSUPP;
8318         }
8319
8320         /* not much point in registering if we can't reply */
8321         if (!rdev->ops->mgmt_tx)
8322                 return -EOPNOTSUPP;
8323
8324         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8325                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8326                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8327 }
8328
8329 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8330 {
8331         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8332         struct wireless_dev *wdev = info->user_ptr[1];
8333         struct cfg80211_chan_def chandef;
8334         int err;
8335         void *hdr = NULL;
8336         u64 cookie;
8337         struct sk_buff *msg = NULL;
8338         struct cfg80211_mgmt_tx_params params = {
8339                 .dont_wait_for_ack =
8340                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8341         };
8342
8343         if (!info->attrs[NL80211_ATTR_FRAME])
8344                 return -EINVAL;
8345
8346         if (!rdev->ops->mgmt_tx)
8347                 return -EOPNOTSUPP;
8348
8349         switch (wdev->iftype) {
8350         case NL80211_IFTYPE_P2P_DEVICE:
8351                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8352                         return -EINVAL;
8353         case NL80211_IFTYPE_STATION:
8354         case NL80211_IFTYPE_ADHOC:
8355         case NL80211_IFTYPE_P2P_CLIENT:
8356         case NL80211_IFTYPE_AP:
8357         case NL80211_IFTYPE_AP_VLAN:
8358         case NL80211_IFTYPE_MESH_POINT:
8359         case NL80211_IFTYPE_P2P_GO:
8360                 break;
8361         default:
8362                 return -EOPNOTSUPP;
8363         }
8364
8365         if (info->attrs[NL80211_ATTR_DURATION]) {
8366                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8367                         return -EINVAL;
8368                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8369
8370                 /*
8371                  * We should wait on the channel for at least a minimum amount
8372                  * of time (10ms) but no longer than the driver supports.
8373                  */
8374                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8375                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8376                         return -EINVAL;
8377
8378         }
8379
8380         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8381
8382         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8383                 return -EINVAL;
8384
8385         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8386
8387         /* get the channel if any has been specified, otherwise pass NULL to
8388          * the driver. The latter will use the current one
8389          */
8390         chandef.chan = NULL;
8391         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8392                 err = nl80211_parse_chandef(rdev, info, &chandef);
8393                 if (err)
8394                         return err;
8395         }
8396
8397         if (!chandef.chan && params.offchan)
8398                 return -EINVAL;
8399
8400         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8401         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8402
8403         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8404                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8405                 int i;
8406
8407                 if (len % sizeof(u16))
8408                         return -EINVAL;
8409
8410                 params.n_csa_offsets = len / sizeof(u16);
8411                 params.csa_offsets =
8412                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8413
8414                 /* check that all the offsets fit the frame */
8415                 for (i = 0; i < params.n_csa_offsets; i++) {
8416                         if (params.csa_offsets[i] >= params.len)
8417                                 return -EINVAL;
8418                 }
8419         }
8420
8421         if (!params.dont_wait_for_ack) {
8422                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8423                 if (!msg)
8424                         return -ENOMEM;
8425
8426                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8427                                      NL80211_CMD_FRAME);
8428                 if (!hdr) {
8429                         err = -ENOBUFS;
8430                         goto free_msg;
8431                 }
8432         }
8433
8434         params.chan = chandef.chan;
8435         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8436         if (err)
8437                 goto free_msg;
8438
8439         if (msg) {
8440                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8441                         goto nla_put_failure;
8442
8443                 genlmsg_end(msg, hdr);
8444                 return genlmsg_reply(msg, info);
8445         }
8446
8447         return 0;
8448
8449  nla_put_failure:
8450         err = -ENOBUFS;
8451  free_msg:
8452         nlmsg_free(msg);
8453         return err;
8454 }
8455
8456 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8457 {
8458         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8459         struct wireless_dev *wdev = info->user_ptr[1];
8460         u64 cookie;
8461
8462         if (!info->attrs[NL80211_ATTR_COOKIE])
8463                 return -EINVAL;
8464
8465         if (!rdev->ops->mgmt_tx_cancel_wait)
8466                 return -EOPNOTSUPP;
8467
8468         switch (wdev->iftype) {
8469         case NL80211_IFTYPE_STATION:
8470         case NL80211_IFTYPE_ADHOC:
8471         case NL80211_IFTYPE_P2P_CLIENT:
8472         case NL80211_IFTYPE_AP:
8473         case NL80211_IFTYPE_AP_VLAN:
8474         case NL80211_IFTYPE_P2P_GO:
8475         case NL80211_IFTYPE_P2P_DEVICE:
8476                 break;
8477         default:
8478                 return -EOPNOTSUPP;
8479         }
8480
8481         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8482
8483         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8484 }
8485
8486 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8487 {
8488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8489         struct wireless_dev *wdev;
8490         struct net_device *dev = info->user_ptr[1];
8491         u8 ps_state;
8492         bool state;
8493         int err;
8494
8495         if (!info->attrs[NL80211_ATTR_PS_STATE])
8496                 return -EINVAL;
8497
8498         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8499
8500         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8501                 return -EINVAL;
8502
8503         wdev = dev->ieee80211_ptr;
8504
8505         if (!rdev->ops->set_power_mgmt)
8506                 return -EOPNOTSUPP;
8507
8508         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8509
8510         if (state == wdev->ps)
8511                 return 0;
8512
8513         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8514         if (!err)
8515                 wdev->ps = state;
8516         return err;
8517 }
8518
8519 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8520 {
8521         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8522         enum nl80211_ps_state ps_state;
8523         struct wireless_dev *wdev;
8524         struct net_device *dev = info->user_ptr[1];
8525         struct sk_buff *msg;
8526         void *hdr;
8527         int err;
8528
8529         wdev = dev->ieee80211_ptr;
8530
8531         if (!rdev->ops->set_power_mgmt)
8532                 return -EOPNOTSUPP;
8533
8534         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8535         if (!msg)
8536                 return -ENOMEM;
8537
8538         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8539                              NL80211_CMD_GET_POWER_SAVE);
8540         if (!hdr) {
8541                 err = -ENOBUFS;
8542                 goto free_msg;
8543         }
8544
8545         if (wdev->ps)
8546                 ps_state = NL80211_PS_ENABLED;
8547         else
8548                 ps_state = NL80211_PS_DISABLED;
8549
8550         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8551                 goto nla_put_failure;
8552
8553         genlmsg_end(msg, hdr);
8554         return genlmsg_reply(msg, info);
8555
8556  nla_put_failure:
8557         err = -ENOBUFS;
8558  free_msg:
8559         nlmsg_free(msg);
8560         return err;
8561 }
8562
8563 static const struct nla_policy
8564 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8565         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8566         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8567         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8568         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8569         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8570         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8571 };
8572
8573 static int nl80211_set_cqm_txe(struct genl_info *info,
8574                                u32 rate, u32 pkts, u32 intvl)
8575 {
8576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8577         struct net_device *dev = info->user_ptr[1];
8578         struct wireless_dev *wdev = dev->ieee80211_ptr;
8579
8580         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8581                 return -EINVAL;
8582
8583         if (!rdev->ops->set_cqm_txe_config)
8584                 return -EOPNOTSUPP;
8585
8586         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8587             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8588                 return -EOPNOTSUPP;
8589
8590         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8591 }
8592
8593 static int nl80211_set_cqm_rssi(struct genl_info *info,
8594                                 s32 threshold, u32 hysteresis)
8595 {
8596         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8597         struct net_device *dev = info->user_ptr[1];
8598         struct wireless_dev *wdev = dev->ieee80211_ptr;
8599
8600         if (threshold > 0)
8601                 return -EINVAL;
8602
8603         /* disabling - hysteresis should also be zero then */
8604         if (threshold == 0)
8605                 hysteresis = 0;
8606
8607         if (!rdev->ops->set_cqm_rssi_config)
8608                 return -EOPNOTSUPP;
8609
8610         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8611             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8612                 return -EOPNOTSUPP;
8613
8614         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8615 }
8616
8617 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8618 {
8619         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8620         struct nlattr *cqm;
8621         int err;
8622
8623         cqm = info->attrs[NL80211_ATTR_CQM];
8624         if (!cqm)
8625                 return -EINVAL;
8626
8627         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8628                                nl80211_attr_cqm_policy);
8629         if (err)
8630                 return err;
8631
8632         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8633             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8634                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8635                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8636
8637                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8638         }
8639
8640         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8641             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8642             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8643                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8644                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8645                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8646
8647                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8648         }
8649
8650         return -EINVAL;
8651 }
8652
8653 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8654 {
8655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8656         struct net_device *dev = info->user_ptr[1];
8657         struct ocb_setup setup = {};
8658         int err;
8659
8660         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8661         if (err)
8662                 return err;
8663
8664         return cfg80211_join_ocb(rdev, dev, &setup);
8665 }
8666
8667 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8668 {
8669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8670         struct net_device *dev = info->user_ptr[1];
8671
8672         return cfg80211_leave_ocb(rdev, dev);
8673 }
8674
8675 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8676 {
8677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8678         struct net_device *dev = info->user_ptr[1];
8679         struct mesh_config cfg;
8680         struct mesh_setup setup;
8681         int err;
8682
8683         /* start with default */
8684         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8685         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8686
8687         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8688                 /* and parse parameters if given */
8689                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8690                 if (err)
8691                         return err;
8692         }
8693
8694         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8695             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8696                 return -EINVAL;
8697
8698         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8699         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8700
8701         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8702             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8703                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8704                         return -EINVAL;
8705
8706         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8707                 setup.beacon_interval =
8708                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8709                 if (setup.beacon_interval < 10 ||
8710                     setup.beacon_interval > 10000)
8711                         return -EINVAL;
8712         }
8713
8714         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8715                 setup.dtim_period =
8716                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8717                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8718                         return -EINVAL;
8719         }
8720
8721         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8722                 /* parse additional setup parameters if given */
8723                 err = nl80211_parse_mesh_setup(info, &setup);
8724                 if (err)
8725                         return err;
8726         }
8727
8728         if (setup.user_mpm)
8729                 cfg.auto_open_plinks = false;
8730
8731         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8732                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8733                 if (err)
8734                         return err;
8735         } else {
8736                 /* cfg80211_join_mesh() will sort it out */
8737                 setup.chandef.chan = NULL;
8738         }
8739
8740         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8741                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8742                 int n_rates =
8743                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8744                 struct ieee80211_supported_band *sband;
8745
8746                 if (!setup.chandef.chan)
8747                         return -EINVAL;
8748
8749                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8750
8751                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8752                                              &setup.basic_rates);
8753                 if (err)
8754                         return err;
8755         }
8756
8757         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8758 }
8759
8760 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8761 {
8762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8763         struct net_device *dev = info->user_ptr[1];
8764
8765         return cfg80211_leave_mesh(rdev, dev);
8766 }
8767
8768 #ifdef CONFIG_PM
8769 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8770                                         struct cfg80211_registered_device *rdev)
8771 {
8772         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8773         struct nlattr *nl_pats, *nl_pat;
8774         int i, pat_len;
8775
8776         if (!wowlan->n_patterns)
8777                 return 0;
8778
8779         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8780         if (!nl_pats)
8781                 return -ENOBUFS;
8782
8783         for (i = 0; i < wowlan->n_patterns; i++) {
8784                 nl_pat = nla_nest_start(msg, i + 1);
8785                 if (!nl_pat)
8786                         return -ENOBUFS;
8787                 pat_len = wowlan->patterns[i].pattern_len;
8788                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8789                             wowlan->patterns[i].mask) ||
8790                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8791                             wowlan->patterns[i].pattern) ||
8792                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8793                                 wowlan->patterns[i].pkt_offset))
8794                         return -ENOBUFS;
8795                 nla_nest_end(msg, nl_pat);
8796         }
8797         nla_nest_end(msg, nl_pats);
8798
8799         return 0;
8800 }
8801
8802 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8803                                    struct cfg80211_wowlan_tcp *tcp)
8804 {
8805         struct nlattr *nl_tcp;
8806
8807         if (!tcp)
8808                 return 0;
8809
8810         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8811         if (!nl_tcp)
8812                 return -ENOBUFS;
8813
8814         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8815             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8816             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8817             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8818             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8819             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8820                     tcp->payload_len, tcp->payload) ||
8821             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8822                         tcp->data_interval) ||
8823             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8824                     tcp->wake_len, tcp->wake_data) ||
8825             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8826                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8827                 return -ENOBUFS;
8828
8829         if (tcp->payload_seq.len &&
8830             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8831                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8832                 return -ENOBUFS;
8833
8834         if (tcp->payload_tok.len &&
8835             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8836                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8837                     &tcp->payload_tok))
8838                 return -ENOBUFS;
8839
8840         nla_nest_end(msg, nl_tcp);
8841
8842         return 0;
8843 }
8844
8845 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
8846                                   struct cfg80211_sched_scan_request *req)
8847 {
8848         struct nlattr *nd, *freqs, *matches, *match;
8849         int i;
8850
8851         if (!req)
8852                 return 0;
8853
8854         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
8855         if (!nd)
8856                 return -ENOBUFS;
8857
8858         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, req->interval))
8859                 return -ENOBUFS;
8860
8861         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
8862                 return -ENOBUFS;
8863
8864         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8865         if (!freqs)
8866                 return -ENOBUFS;
8867
8868         for (i = 0; i < req->n_channels; i++)
8869                 nla_put_u32(msg, i, req->channels[i]->center_freq);
8870
8871         nla_nest_end(msg, freqs);
8872
8873         if (req->n_match_sets) {
8874                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
8875                 for (i = 0; i < req->n_match_sets; i++) {
8876                         match = nla_nest_start(msg, i);
8877                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
8878                                 req->match_sets[i].ssid.ssid_len,
8879                                 req->match_sets[i].ssid.ssid);
8880                         nla_nest_end(msg, match);
8881                 }
8882                 nla_nest_end(msg, matches);
8883         }
8884
8885         nla_nest_end(msg, nd);
8886
8887         return 0;
8888 }
8889
8890 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8891 {
8892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8893         struct sk_buff *msg;
8894         void *hdr;
8895         u32 size = NLMSG_DEFAULT_SIZE;
8896
8897         if (!rdev->wiphy.wowlan)
8898                 return -EOPNOTSUPP;
8899
8900         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8901                 /* adjust size to have room for all the data */
8902                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8903                         rdev->wiphy.wowlan_config->tcp->payload_len +
8904                         rdev->wiphy.wowlan_config->tcp->wake_len +
8905                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8906         }
8907
8908         msg = nlmsg_new(size, GFP_KERNEL);
8909         if (!msg)
8910                 return -ENOMEM;
8911
8912         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8913                              NL80211_CMD_GET_WOWLAN);
8914         if (!hdr)
8915                 goto nla_put_failure;
8916
8917         if (rdev->wiphy.wowlan_config) {
8918                 struct nlattr *nl_wowlan;
8919
8920                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8921                 if (!nl_wowlan)
8922                         goto nla_put_failure;
8923
8924                 if ((rdev->wiphy.wowlan_config->any &&
8925                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8926                     (rdev->wiphy.wowlan_config->disconnect &&
8927                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8928                     (rdev->wiphy.wowlan_config->magic_pkt &&
8929                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8930                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8931                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8932                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8933                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8934                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8935                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8936                     (rdev->wiphy.wowlan_config->rfkill_release &&
8937                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8938                         goto nla_put_failure;
8939
8940                 if (nl80211_send_wowlan_patterns(msg, rdev))
8941                         goto nla_put_failure;
8942
8943                 if (nl80211_send_wowlan_tcp(msg,
8944                                             rdev->wiphy.wowlan_config->tcp))
8945                         goto nla_put_failure;
8946
8947                 if (nl80211_send_wowlan_nd(
8948                             msg,
8949                             rdev->wiphy.wowlan_config->nd_config))
8950                         goto nla_put_failure;
8951
8952                 nla_nest_end(msg, nl_wowlan);
8953         }
8954
8955         genlmsg_end(msg, hdr);
8956         return genlmsg_reply(msg, info);
8957
8958 nla_put_failure:
8959         nlmsg_free(msg);
8960         return -ENOBUFS;
8961 }
8962
8963 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8964                                     struct nlattr *attr,
8965                                     struct cfg80211_wowlan *trig)
8966 {
8967         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8968         struct cfg80211_wowlan_tcp *cfg;
8969         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8970         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8971         u32 size;
8972         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8973         int err, port;
8974
8975         if (!rdev->wiphy.wowlan->tcp)
8976                 return -EINVAL;
8977
8978         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8979                         nla_data(attr), nla_len(attr),
8980                         nl80211_wowlan_tcp_policy);
8981         if (err)
8982                 return err;
8983
8984         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8985             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8986             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8987             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8988             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8989             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8990             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8991             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8992                 return -EINVAL;
8993
8994         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8995         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8996                 return -EINVAL;
8997
8998         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8999                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9000             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9001                 return -EINVAL;
9002
9003         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9004         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9005                 return -EINVAL;
9006
9007         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9008         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9009                 return -EINVAL;
9010
9011         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9012                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9013
9014                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9015                 tokens_size = tokln - sizeof(*tok);
9016
9017                 if (!tok->len || tokens_size % tok->len)
9018                         return -EINVAL;
9019                 if (!rdev->wiphy.wowlan->tcp->tok)
9020                         return -EINVAL;
9021                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9022                         return -EINVAL;
9023                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9024                         return -EINVAL;
9025                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9026                         return -EINVAL;
9027                 if (tok->offset + tok->len > data_size)
9028                         return -EINVAL;
9029         }
9030
9031         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9032                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9033                 if (!rdev->wiphy.wowlan->tcp->seq)
9034                         return -EINVAL;
9035                 if (seq->len == 0 || seq->len > 4)
9036                         return -EINVAL;
9037                 if (seq->len + seq->offset > data_size)
9038                         return -EINVAL;
9039         }
9040
9041         size = sizeof(*cfg);
9042         size += data_size;
9043         size += wake_size + wake_mask_size;
9044         size += tokens_size;
9045
9046         cfg = kzalloc(size, GFP_KERNEL);
9047         if (!cfg)
9048                 return -ENOMEM;
9049         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9050         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9051         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9052                ETH_ALEN);
9053         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9054                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9055         else
9056                 port = 0;
9057 #ifdef CONFIG_INET
9058         /* allocate a socket and port for it and use it */
9059         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9060                             IPPROTO_TCP, &cfg->sock, 1);
9061         if (err) {
9062                 kfree(cfg);
9063                 return err;
9064         }
9065         if (inet_csk_get_port(cfg->sock->sk, port)) {
9066                 sock_release(cfg->sock);
9067                 kfree(cfg);
9068                 return -EADDRINUSE;
9069         }
9070         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9071 #else
9072         if (!port) {
9073                 kfree(cfg);
9074                 return -EINVAL;
9075         }
9076         cfg->src_port = port;
9077 #endif
9078
9079         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9080         cfg->payload_len = data_size;
9081         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9082         memcpy((void *)cfg->payload,
9083                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9084                data_size);
9085         if (seq)
9086                 cfg->payload_seq = *seq;
9087         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9088         cfg->wake_len = wake_size;
9089         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9090         memcpy((void *)cfg->wake_data,
9091                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9092                wake_size);
9093         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9094                          data_size + wake_size;
9095         memcpy((void *)cfg->wake_mask,
9096                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9097                wake_mask_size);
9098         if (tok) {
9099                 cfg->tokens_size = tokens_size;
9100                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9101         }
9102
9103         trig->tcp = cfg;
9104
9105         return 0;
9106 }
9107
9108 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9109                                    const struct wiphy_wowlan_support *wowlan,
9110                                    struct nlattr *attr,
9111                                    struct cfg80211_wowlan *trig)
9112 {
9113         struct nlattr **tb;
9114         int err;
9115
9116         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9117         if (!tb)
9118                 return -ENOMEM;
9119
9120         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9121                 err = -EOPNOTSUPP;
9122                 goto out;
9123         }
9124
9125         err = nla_parse(tb, NL80211_ATTR_MAX,
9126                         nla_data(attr), nla_len(attr),
9127                         nl80211_policy);
9128         if (err)
9129                 goto out;
9130
9131         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9132         err = PTR_ERR_OR_ZERO(trig->nd_config);
9133         if (err)
9134                 trig->nd_config = NULL;
9135
9136 out:
9137         kfree(tb);
9138         return err;
9139 }
9140
9141 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9142 {
9143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9144         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9145         struct cfg80211_wowlan new_triggers = {};
9146         struct cfg80211_wowlan *ntrig;
9147         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9148         int err, i;
9149         bool prev_enabled = rdev->wiphy.wowlan_config;
9150         bool regular = false;
9151
9152         if (!wowlan)
9153                 return -EOPNOTSUPP;
9154
9155         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9156                 cfg80211_rdev_free_wowlan(rdev);
9157                 rdev->wiphy.wowlan_config = NULL;
9158                 goto set_wakeup;
9159         }
9160
9161         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9162                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9163                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9164                         nl80211_wowlan_policy);
9165         if (err)
9166                 return err;
9167
9168         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9169                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9170                         return -EINVAL;
9171                 new_triggers.any = true;
9172         }
9173
9174         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9175                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9176                         return -EINVAL;
9177                 new_triggers.disconnect = true;
9178                 regular = true;
9179         }
9180
9181         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9182                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9183                         return -EINVAL;
9184                 new_triggers.magic_pkt = true;
9185                 regular = true;
9186         }
9187
9188         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9189                 return -EINVAL;
9190
9191         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9192                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9193                         return -EINVAL;
9194                 new_triggers.gtk_rekey_failure = true;
9195                 regular = true;
9196         }
9197
9198         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9199                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9200                         return -EINVAL;
9201                 new_triggers.eap_identity_req = true;
9202                 regular = true;
9203         }
9204
9205         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9206                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9207                         return -EINVAL;
9208                 new_triggers.four_way_handshake = true;
9209                 regular = true;
9210         }
9211
9212         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9213                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9214                         return -EINVAL;
9215                 new_triggers.rfkill_release = true;
9216                 regular = true;
9217         }
9218
9219         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9220                 struct nlattr *pat;
9221                 int n_patterns = 0;
9222                 int rem, pat_len, mask_len, pkt_offset;
9223                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9224
9225                 regular = true;
9226
9227                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9228                                     rem)
9229                         n_patterns++;
9230                 if (n_patterns > wowlan->n_patterns)
9231                         return -EINVAL;
9232
9233                 new_triggers.patterns = kcalloc(n_patterns,
9234                                                 sizeof(new_triggers.patterns[0]),
9235                                                 GFP_KERNEL);
9236                 if (!new_triggers.patterns)
9237                         return -ENOMEM;
9238
9239                 new_triggers.n_patterns = n_patterns;
9240                 i = 0;
9241
9242                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9243                                     rem) {
9244                         u8 *mask_pat;
9245
9246                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9247                                   nla_len(pat), NULL);
9248                         err = -EINVAL;
9249                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9250                             !pat_tb[NL80211_PKTPAT_PATTERN])
9251                                 goto error;
9252                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9253                         mask_len = DIV_ROUND_UP(pat_len, 8);
9254                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9255                                 goto error;
9256                         if (pat_len > wowlan->pattern_max_len ||
9257                             pat_len < wowlan->pattern_min_len)
9258                                 goto error;
9259
9260                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9261                                 pkt_offset = 0;
9262                         else
9263                                 pkt_offset = nla_get_u32(
9264                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9265                         if (pkt_offset > wowlan->max_pkt_offset)
9266                                 goto error;
9267                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9268
9269                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9270                         if (!mask_pat) {
9271                                 err = -ENOMEM;
9272                                 goto error;
9273                         }
9274                         new_triggers.patterns[i].mask = mask_pat;
9275                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9276                                mask_len);
9277                         mask_pat += mask_len;
9278                         new_triggers.patterns[i].pattern = mask_pat;
9279                         new_triggers.patterns[i].pattern_len = pat_len;
9280                         memcpy(mask_pat,
9281                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9282                                pat_len);
9283                         i++;
9284                 }
9285         }
9286
9287         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9288                 regular = true;
9289                 err = nl80211_parse_wowlan_tcp(
9290                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9291                         &new_triggers);
9292                 if (err)
9293                         goto error;
9294         }
9295
9296         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9297                 regular = true;
9298                 err = nl80211_parse_wowlan_nd(
9299                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9300                         &new_triggers);
9301                 if (err)
9302                         goto error;
9303         }
9304
9305         /* The 'any' trigger means the device continues operating more or less
9306          * as in its normal operation mode and wakes up the host on most of the
9307          * normal interrupts (like packet RX, ...)
9308          * It therefore makes little sense to combine with the more constrained
9309          * wakeup trigger modes.
9310          */
9311         if (new_triggers.any && regular) {
9312                 err = -EINVAL;
9313                 goto error;
9314         }
9315
9316         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9317         if (!ntrig) {
9318                 err = -ENOMEM;
9319                 goto error;
9320         }
9321         cfg80211_rdev_free_wowlan(rdev);
9322         rdev->wiphy.wowlan_config = ntrig;
9323
9324  set_wakeup:
9325         if (rdev->ops->set_wakeup &&
9326             prev_enabled != !!rdev->wiphy.wowlan_config)
9327                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9328
9329         return 0;
9330  error:
9331         for (i = 0; i < new_triggers.n_patterns; i++)
9332                 kfree(new_triggers.patterns[i].mask);
9333         kfree(new_triggers.patterns);
9334         if (new_triggers.tcp && new_triggers.tcp->sock)
9335                 sock_release(new_triggers.tcp->sock);
9336         kfree(new_triggers.tcp);
9337         return err;
9338 }
9339 #endif
9340
9341 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9342                                        struct cfg80211_registered_device *rdev)
9343 {
9344         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9345         int i, j, pat_len;
9346         struct cfg80211_coalesce_rules *rule;
9347
9348         if (!rdev->coalesce->n_rules)
9349                 return 0;
9350
9351         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9352         if (!nl_rules)
9353                 return -ENOBUFS;
9354
9355         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9356                 nl_rule = nla_nest_start(msg, i + 1);
9357                 if (!nl_rule)
9358                         return -ENOBUFS;
9359
9360                 rule = &rdev->coalesce->rules[i];
9361                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9362                                 rule->delay))
9363                         return -ENOBUFS;
9364
9365                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9366                                 rule->condition))
9367                         return -ENOBUFS;
9368
9369                 nl_pats = nla_nest_start(msg,
9370                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9371                 if (!nl_pats)
9372                         return -ENOBUFS;
9373
9374                 for (j = 0; j < rule->n_patterns; j++) {
9375                         nl_pat = nla_nest_start(msg, j + 1);
9376                         if (!nl_pat)
9377                                 return -ENOBUFS;
9378                         pat_len = rule->patterns[j].pattern_len;
9379                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9380                                     DIV_ROUND_UP(pat_len, 8),
9381                                     rule->patterns[j].mask) ||
9382                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9383                                     rule->patterns[j].pattern) ||
9384                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9385                                         rule->patterns[j].pkt_offset))
9386                                 return -ENOBUFS;
9387                         nla_nest_end(msg, nl_pat);
9388                 }
9389                 nla_nest_end(msg, nl_pats);
9390                 nla_nest_end(msg, nl_rule);
9391         }
9392         nla_nest_end(msg, nl_rules);
9393
9394         return 0;
9395 }
9396
9397 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9398 {
9399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9400         struct sk_buff *msg;
9401         void *hdr;
9402
9403         if (!rdev->wiphy.coalesce)
9404                 return -EOPNOTSUPP;
9405
9406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9407         if (!msg)
9408                 return -ENOMEM;
9409
9410         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9411                              NL80211_CMD_GET_COALESCE);
9412         if (!hdr)
9413                 goto nla_put_failure;
9414
9415         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9416                 goto nla_put_failure;
9417
9418         genlmsg_end(msg, hdr);
9419         return genlmsg_reply(msg, info);
9420
9421 nla_put_failure:
9422         nlmsg_free(msg);
9423         return -ENOBUFS;
9424 }
9425
9426 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9427 {
9428         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9429         int i, j;
9430         struct cfg80211_coalesce_rules *rule;
9431
9432         if (!coalesce)
9433                 return;
9434
9435         for (i = 0; i < coalesce->n_rules; i++) {
9436                 rule = &coalesce->rules[i];
9437                 for (j = 0; j < rule->n_patterns; j++)
9438                         kfree(rule->patterns[j].mask);
9439                 kfree(rule->patterns);
9440         }
9441         kfree(coalesce->rules);
9442         kfree(coalesce);
9443         rdev->coalesce = NULL;
9444 }
9445
9446 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9447                                        struct nlattr *rule,
9448                                        struct cfg80211_coalesce_rules *new_rule)
9449 {
9450         int err, i;
9451         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9452         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9453         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9454         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9455
9456         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9457                         nla_len(rule), nl80211_coalesce_policy);
9458         if (err)
9459                 return err;
9460
9461         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9462                 new_rule->delay =
9463                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9464         if (new_rule->delay > coalesce->max_delay)
9465                 return -EINVAL;
9466
9467         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9468                 new_rule->condition =
9469                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9470         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9471             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9472                 return -EINVAL;
9473
9474         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9475                 return -EINVAL;
9476
9477         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9478                             rem)
9479                 n_patterns++;
9480         if (n_patterns > coalesce->n_patterns)
9481                 return -EINVAL;
9482
9483         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9484                                      GFP_KERNEL);
9485         if (!new_rule->patterns)
9486                 return -ENOMEM;
9487
9488         new_rule->n_patterns = n_patterns;
9489         i = 0;
9490
9491         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9492                             rem) {
9493                 u8 *mask_pat;
9494
9495                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9496                           nla_len(pat), NULL);
9497                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9498                     !pat_tb[NL80211_PKTPAT_PATTERN])
9499                         return -EINVAL;
9500                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9501                 mask_len = DIV_ROUND_UP(pat_len, 8);
9502                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9503                         return -EINVAL;
9504                 if (pat_len > coalesce->pattern_max_len ||
9505                     pat_len < coalesce->pattern_min_len)
9506                         return -EINVAL;
9507
9508                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9509                         pkt_offset = 0;
9510                 else
9511                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9512                 if (pkt_offset > coalesce->max_pkt_offset)
9513                         return -EINVAL;
9514                 new_rule->patterns[i].pkt_offset = pkt_offset;
9515
9516                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9517                 if (!mask_pat)
9518                         return -ENOMEM;
9519
9520                 new_rule->patterns[i].mask = mask_pat;
9521                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9522                        mask_len);
9523
9524                 mask_pat += mask_len;
9525                 new_rule->patterns[i].pattern = mask_pat;
9526                 new_rule->patterns[i].pattern_len = pat_len;
9527                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9528                        pat_len);
9529                 i++;
9530         }
9531
9532         return 0;
9533 }
9534
9535 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9536 {
9537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9538         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9539         struct cfg80211_coalesce new_coalesce = {};
9540         struct cfg80211_coalesce *n_coalesce;
9541         int err, rem_rule, n_rules = 0, i, j;
9542         struct nlattr *rule;
9543         struct cfg80211_coalesce_rules *tmp_rule;
9544
9545         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9546                 return -EOPNOTSUPP;
9547
9548         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9549                 cfg80211_rdev_free_coalesce(rdev);
9550                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9551                 return 0;
9552         }
9553
9554         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9555                             rem_rule)
9556                 n_rules++;
9557         if (n_rules > coalesce->n_rules)
9558                 return -EINVAL;
9559
9560         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9561                                      GFP_KERNEL);
9562         if (!new_coalesce.rules)
9563                 return -ENOMEM;
9564
9565         new_coalesce.n_rules = n_rules;
9566         i = 0;
9567
9568         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9569                             rem_rule) {
9570                 err = nl80211_parse_coalesce_rule(rdev, rule,
9571                                                   &new_coalesce.rules[i]);
9572                 if (err)
9573                         goto error;
9574
9575                 i++;
9576         }
9577
9578         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9579         if (err)
9580                 goto error;
9581
9582         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9583         if (!n_coalesce) {
9584                 err = -ENOMEM;
9585                 goto error;
9586         }
9587         cfg80211_rdev_free_coalesce(rdev);
9588         rdev->coalesce = n_coalesce;
9589
9590         return 0;
9591 error:
9592         for (i = 0; i < new_coalesce.n_rules; i++) {
9593                 tmp_rule = &new_coalesce.rules[i];
9594                 for (j = 0; j < tmp_rule->n_patterns; j++)
9595                         kfree(tmp_rule->patterns[j].mask);
9596                 kfree(tmp_rule->patterns);
9597         }
9598         kfree(new_coalesce.rules);
9599
9600         return err;
9601 }
9602
9603 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9604 {
9605         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9606         struct net_device *dev = info->user_ptr[1];
9607         struct wireless_dev *wdev = dev->ieee80211_ptr;
9608         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9609         struct cfg80211_gtk_rekey_data rekey_data;
9610         int err;
9611
9612         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9613                 return -EINVAL;
9614
9615         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9616                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9617                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9618                         nl80211_rekey_policy);
9619         if (err)
9620                 return err;
9621
9622         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9623                 return -ERANGE;
9624         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9625                 return -ERANGE;
9626         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9627                 return -ERANGE;
9628
9629         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9630         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9631         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9632
9633         wdev_lock(wdev);
9634         if (!wdev->current_bss) {
9635                 err = -ENOTCONN;
9636                 goto out;
9637         }
9638
9639         if (!rdev->ops->set_rekey_data) {
9640                 err = -EOPNOTSUPP;
9641                 goto out;
9642         }
9643
9644         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9645  out:
9646         wdev_unlock(wdev);
9647         return err;
9648 }
9649
9650 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9651                                              struct genl_info *info)
9652 {
9653         struct net_device *dev = info->user_ptr[1];
9654         struct wireless_dev *wdev = dev->ieee80211_ptr;
9655
9656         if (wdev->iftype != NL80211_IFTYPE_AP &&
9657             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9658                 return -EINVAL;
9659
9660         if (wdev->ap_unexpected_nlportid)
9661                 return -EBUSY;
9662
9663         wdev->ap_unexpected_nlportid = info->snd_portid;
9664         return 0;
9665 }
9666
9667 static int nl80211_probe_client(struct sk_buff *skb,
9668                                 struct genl_info *info)
9669 {
9670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9671         struct net_device *dev = info->user_ptr[1];
9672         struct wireless_dev *wdev = dev->ieee80211_ptr;
9673         struct sk_buff *msg;
9674         void *hdr;
9675         const u8 *addr;
9676         u64 cookie;
9677         int err;
9678
9679         if (wdev->iftype != NL80211_IFTYPE_AP &&
9680             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9681                 return -EOPNOTSUPP;
9682
9683         if (!info->attrs[NL80211_ATTR_MAC])
9684                 return -EINVAL;
9685
9686         if (!rdev->ops->probe_client)
9687                 return -EOPNOTSUPP;
9688
9689         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9690         if (!msg)
9691                 return -ENOMEM;
9692
9693         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9694                              NL80211_CMD_PROBE_CLIENT);
9695         if (!hdr) {
9696                 err = -ENOBUFS;
9697                 goto free_msg;
9698         }
9699
9700         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9701
9702         err = rdev_probe_client(rdev, dev, addr, &cookie);
9703         if (err)
9704                 goto free_msg;
9705
9706         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9707                 goto nla_put_failure;
9708
9709         genlmsg_end(msg, hdr);
9710
9711         return genlmsg_reply(msg, info);
9712
9713  nla_put_failure:
9714         err = -ENOBUFS;
9715  free_msg:
9716         nlmsg_free(msg);
9717         return err;
9718 }
9719
9720 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9721 {
9722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9723         struct cfg80211_beacon_registration *reg, *nreg;
9724         int rv;
9725
9726         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9727                 return -EOPNOTSUPP;
9728
9729         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9730         if (!nreg)
9731                 return -ENOMEM;
9732
9733         /* First, check if already registered. */
9734         spin_lock_bh(&rdev->beacon_registrations_lock);
9735         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9736                 if (reg->nlportid == info->snd_portid) {
9737                         rv = -EALREADY;
9738                         goto out_err;
9739                 }
9740         }
9741         /* Add it to the list */
9742         nreg->nlportid = info->snd_portid;
9743         list_add(&nreg->list, &rdev->beacon_registrations);
9744
9745         spin_unlock_bh(&rdev->beacon_registrations_lock);
9746
9747         return 0;
9748 out_err:
9749         spin_unlock_bh(&rdev->beacon_registrations_lock);
9750         kfree(nreg);
9751         return rv;
9752 }
9753
9754 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9755 {
9756         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9757         struct wireless_dev *wdev = info->user_ptr[1];
9758         int err;
9759
9760         if (!rdev->ops->start_p2p_device)
9761                 return -EOPNOTSUPP;
9762
9763         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9764                 return -EOPNOTSUPP;
9765
9766         if (wdev->p2p_started)
9767                 return 0;
9768
9769         if (rfkill_blocked(rdev->rfkill))
9770                 return -ERFKILL;
9771
9772         err = rdev_start_p2p_device(rdev, wdev);
9773         if (err)
9774                 return err;
9775
9776         wdev->p2p_started = true;
9777         rdev->opencount++;
9778
9779         return 0;
9780 }
9781
9782 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9783 {
9784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9785         struct wireless_dev *wdev = info->user_ptr[1];
9786
9787         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9788                 return -EOPNOTSUPP;
9789
9790         if (!rdev->ops->stop_p2p_device)
9791                 return -EOPNOTSUPP;
9792
9793         cfg80211_stop_p2p_device(rdev, wdev);
9794
9795         return 0;
9796 }
9797
9798 static int nl80211_get_protocol_features(struct sk_buff *skb,
9799                                          struct genl_info *info)
9800 {
9801         void *hdr;
9802         struct sk_buff *msg;
9803
9804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9805         if (!msg)
9806                 return -ENOMEM;
9807
9808         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9809                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9810         if (!hdr)
9811                 goto nla_put_failure;
9812
9813         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9814                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9815                 goto nla_put_failure;
9816
9817         genlmsg_end(msg, hdr);
9818         return genlmsg_reply(msg, info);
9819
9820  nla_put_failure:
9821         kfree_skb(msg);
9822         return -ENOBUFS;
9823 }
9824
9825 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9826 {
9827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9828         struct cfg80211_update_ft_ies_params ft_params;
9829         struct net_device *dev = info->user_ptr[1];
9830
9831         if (!rdev->ops->update_ft_ies)
9832                 return -EOPNOTSUPP;
9833
9834         if (!info->attrs[NL80211_ATTR_MDID] ||
9835             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9836                 return -EINVAL;
9837
9838         memset(&ft_params, 0, sizeof(ft_params));
9839         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9840         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9841         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9842
9843         return rdev_update_ft_ies(rdev, dev, &ft_params);
9844 }
9845
9846 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9847                                        struct genl_info *info)
9848 {
9849         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9850         struct wireless_dev *wdev = info->user_ptr[1];
9851         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9852         u16 duration;
9853         int ret;
9854
9855         if (!rdev->ops->crit_proto_start)
9856                 return -EOPNOTSUPP;
9857
9858         if (WARN_ON(!rdev->ops->crit_proto_stop))
9859                 return -EINVAL;
9860
9861         if (rdev->crit_proto_nlportid)
9862                 return -EBUSY;
9863
9864         /* determine protocol if provided */
9865         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9866                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9867
9868         if (proto >= NUM_NL80211_CRIT_PROTO)
9869                 return -EINVAL;
9870
9871         /* timeout must be provided */
9872         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9873                 return -EINVAL;
9874
9875         duration =
9876                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9877
9878         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9879                 return -ERANGE;
9880
9881         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9882         if (!ret)
9883                 rdev->crit_proto_nlportid = info->snd_portid;
9884
9885         return ret;
9886 }
9887
9888 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9889                                       struct genl_info *info)
9890 {
9891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9892         struct wireless_dev *wdev = info->user_ptr[1];
9893
9894         if (!rdev->ops->crit_proto_stop)
9895                 return -EOPNOTSUPP;
9896
9897         if (rdev->crit_proto_nlportid) {
9898                 rdev->crit_proto_nlportid = 0;
9899                 rdev_crit_proto_stop(rdev, wdev);
9900         }
9901         return 0;
9902 }
9903
9904 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9905 {
9906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9907         struct wireless_dev *wdev =
9908                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9909         int i, err;
9910         u32 vid, subcmd;
9911
9912         if (!rdev->wiphy.vendor_commands)
9913                 return -EOPNOTSUPP;
9914
9915         if (IS_ERR(wdev)) {
9916                 err = PTR_ERR(wdev);
9917                 if (err != -EINVAL)
9918                         return err;
9919                 wdev = NULL;
9920         } else if (wdev->wiphy != &rdev->wiphy) {
9921                 return -EINVAL;
9922         }
9923
9924         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9925             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9926                 return -EINVAL;
9927
9928         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9929         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9930         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9931                 const struct wiphy_vendor_command *vcmd;
9932                 void *data = NULL;
9933                 int len = 0;
9934
9935                 vcmd = &rdev->wiphy.vendor_commands[i];
9936
9937                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9938                         continue;
9939
9940                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9941                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9942                         if (!wdev)
9943                                 return -EINVAL;
9944                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9945                             !wdev->netdev)
9946                                 return -EINVAL;
9947
9948                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9949                                 if (wdev->netdev &&
9950                                     !netif_running(wdev->netdev))
9951                                         return -ENETDOWN;
9952                                 if (!wdev->netdev && !wdev->p2p_started)
9953                                         return -ENETDOWN;
9954                         }
9955
9956                         if (!vcmd->doit)
9957                                 return -EOPNOTSUPP;
9958                 } else {
9959                         wdev = NULL;
9960                 }
9961
9962                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9963                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9964                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9965                 }
9966
9967                 rdev->cur_cmd_info = info;
9968                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9969                                                           data, len);
9970                 rdev->cur_cmd_info = NULL;
9971                 return err;
9972         }
9973
9974         return -EOPNOTSUPP;
9975 }
9976
9977 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
9978                                        struct netlink_callback *cb,
9979                                        struct cfg80211_registered_device **rdev,
9980                                        struct wireless_dev **wdev)
9981 {
9982         u32 vid, subcmd;
9983         unsigned int i;
9984         int vcmd_idx = -1;
9985         int err;
9986         void *data = NULL;
9987         unsigned int data_len = 0;
9988
9989         rtnl_lock();
9990
9991         if (cb->args[0]) {
9992                 /* subtract the 1 again here */
9993                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
9994                 struct wireless_dev *tmp;
9995
9996                 if (!wiphy) {
9997                         err = -ENODEV;
9998                         goto out_unlock;
9999                 }
10000                 *rdev = wiphy_to_rdev(wiphy);
10001                 *wdev = NULL;
10002
10003                 if (cb->args[1]) {
10004                         list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
10005                                 if (tmp->identifier == cb->args[1] - 1) {
10006                                         *wdev = tmp;
10007                                         break;
10008                                 }
10009                         }
10010                 }
10011
10012                 /* keep rtnl locked in successful case */
10013                 return 0;
10014         }
10015
10016         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10017                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10018                           nl80211_policy);
10019         if (err)
10020                 goto out_unlock;
10021
10022         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10023             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10024                 err = -EINVAL;
10025                 goto out_unlock;
10026         }
10027
10028         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10029                                            nl80211_fam.attrbuf);
10030         if (IS_ERR(*wdev))
10031                 *wdev = NULL;
10032
10033         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10034                                            nl80211_fam.attrbuf);
10035         if (IS_ERR(*rdev)) {
10036                 err = PTR_ERR(*rdev);
10037                 goto out_unlock;
10038         }
10039
10040         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10041         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10042
10043         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10044                 const struct wiphy_vendor_command *vcmd;
10045
10046                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10047
10048                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10049                         continue;
10050
10051                 if (!vcmd->dumpit) {
10052                         err = -EOPNOTSUPP;
10053                         goto out_unlock;
10054                 }
10055
10056                 vcmd_idx = i;
10057                 break;
10058         }
10059
10060         if (vcmd_idx < 0) {
10061                 err = -EOPNOTSUPP;
10062                 goto out_unlock;
10063         }
10064
10065         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10066                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10067                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10068         }
10069
10070         /* 0 is the first index - add 1 to parse only once */
10071         cb->args[0] = (*rdev)->wiphy_idx + 1;
10072         /* add 1 to know if it was NULL */
10073         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10074         cb->args[2] = vcmd_idx;
10075         cb->args[3] = (unsigned long)data;
10076         cb->args[4] = data_len;
10077
10078         /* keep rtnl locked in successful case */
10079         return 0;
10080  out_unlock:
10081         rtnl_unlock();
10082         return err;
10083 }
10084
10085 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10086                                    struct netlink_callback *cb)
10087 {
10088         struct cfg80211_registered_device *rdev;
10089         struct wireless_dev *wdev;
10090         unsigned int vcmd_idx;
10091         const struct wiphy_vendor_command *vcmd;
10092         void *data;
10093         int data_len;
10094         int err;
10095         struct nlattr *vendor_data;
10096
10097         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10098         if (err)
10099                 return err;
10100
10101         vcmd_idx = cb->args[2];
10102         data = (void *)cb->args[3];
10103         data_len = cb->args[4];
10104         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10105
10106         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10107                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10108                 if (!wdev)
10109                         return -EINVAL;
10110                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10111                     !wdev->netdev)
10112                         return -EINVAL;
10113
10114                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10115                         if (wdev->netdev &&
10116                             !netif_running(wdev->netdev))
10117                                 return -ENETDOWN;
10118                         if (!wdev->netdev && !wdev->p2p_started)
10119                                 return -ENETDOWN;
10120                 }
10121         }
10122
10123         while (1) {
10124                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10125                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10126                                            NL80211_CMD_VENDOR);
10127                 if (!hdr)
10128                         break;
10129
10130                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10131                     (wdev && nla_put_u64(skb, NL80211_ATTR_WDEV,
10132                                          wdev_id(wdev)))) {
10133                         genlmsg_cancel(skb, hdr);
10134                         break;
10135                 }
10136
10137                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10138                 if (!vendor_data) {
10139                         genlmsg_cancel(skb, hdr);
10140                         break;
10141                 }
10142
10143                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10144                                    (unsigned long *)&cb->args[5]);
10145                 nla_nest_end(skb, vendor_data);
10146
10147                 if (err == -ENOBUFS || err == -ENOENT) {
10148                         genlmsg_cancel(skb, hdr);
10149                         break;
10150                 } else if (err) {
10151                         genlmsg_cancel(skb, hdr);
10152                         goto out;
10153                 }
10154
10155                 genlmsg_end(skb, hdr);
10156         }
10157
10158         err = skb->len;
10159  out:
10160         rtnl_unlock();
10161         return err;
10162 }
10163
10164 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10165                                            enum nl80211_commands cmd,
10166                                            enum nl80211_attrs attr,
10167                                            int approxlen)
10168 {
10169         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10170
10171         if (WARN_ON(!rdev->cur_cmd_info))
10172                 return NULL;
10173
10174         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10175                                            rdev->cur_cmd_info->snd_portid,
10176                                            rdev->cur_cmd_info->snd_seq,
10177                                            cmd, attr, NULL, GFP_KERNEL);
10178 }
10179 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10180
10181 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10182 {
10183         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10184         void *hdr = ((void **)skb->cb)[1];
10185         struct nlattr *data = ((void **)skb->cb)[2];
10186
10187         /* clear CB data for netlink core to own from now on */
10188         memset(skb->cb, 0, sizeof(skb->cb));
10189
10190         if (WARN_ON(!rdev->cur_cmd_info)) {
10191                 kfree_skb(skb);
10192                 return -EINVAL;
10193         }
10194
10195         nla_nest_end(skb, data);
10196         genlmsg_end(skb, hdr);
10197         return genlmsg_reply(skb, rdev->cur_cmd_info);
10198 }
10199 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10200
10201
10202 static int nl80211_set_qos_map(struct sk_buff *skb,
10203                                struct genl_info *info)
10204 {
10205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10206         struct cfg80211_qos_map *qos_map = NULL;
10207         struct net_device *dev = info->user_ptr[1];
10208         u8 *pos, len, num_des, des_len, des;
10209         int ret;
10210
10211         if (!rdev->ops->set_qos_map)
10212                 return -EOPNOTSUPP;
10213
10214         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10215                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10216                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10217
10218                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10219                     len > IEEE80211_QOS_MAP_LEN_MAX)
10220                         return -EINVAL;
10221
10222                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10223                 if (!qos_map)
10224                         return -ENOMEM;
10225
10226                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10227                 if (num_des) {
10228                         des_len = num_des *
10229                                 sizeof(struct cfg80211_dscp_exception);
10230                         memcpy(qos_map->dscp_exception, pos, des_len);
10231                         qos_map->num_des = num_des;
10232                         for (des = 0; des < num_des; des++) {
10233                                 if (qos_map->dscp_exception[des].up > 7) {
10234                                         kfree(qos_map);
10235                                         return -EINVAL;
10236                                 }
10237                         }
10238                         pos += des_len;
10239                 }
10240                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10241         }
10242
10243         wdev_lock(dev->ieee80211_ptr);
10244         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10245         if (!ret)
10246                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10247         wdev_unlock(dev->ieee80211_ptr);
10248
10249         kfree(qos_map);
10250         return ret;
10251 }
10252
10253 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10254 {
10255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10256         struct net_device *dev = info->user_ptr[1];
10257         struct wireless_dev *wdev = dev->ieee80211_ptr;
10258         const u8 *peer;
10259         u8 tsid, up;
10260         u16 admitted_time = 0;
10261         int err;
10262
10263         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10264                 return -EOPNOTSUPP;
10265
10266         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10267             !info->attrs[NL80211_ATTR_USER_PRIO])
10268                 return -EINVAL;
10269
10270         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10271         if (tsid >= IEEE80211_NUM_TIDS)
10272                 return -EINVAL;
10273
10274         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10275         if (up >= IEEE80211_NUM_UPS)
10276                 return -EINVAL;
10277
10278         /* WMM uses TIDs 0-7 even for TSPEC */
10279         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10280                 /* TODO: handle 802.11 TSPEC/admission control
10281                  * need more attributes for that (e.g. BA session requirement);
10282                  * change the WMM adminssion test above to allow both then
10283                  */
10284                 return -EINVAL;
10285         }
10286
10287         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10288
10289         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10290                 admitted_time =
10291                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10292                 if (!admitted_time)
10293                         return -EINVAL;
10294         }
10295
10296         wdev_lock(wdev);
10297         switch (wdev->iftype) {
10298         case NL80211_IFTYPE_STATION:
10299         case NL80211_IFTYPE_P2P_CLIENT:
10300                 if (wdev->current_bss)
10301                         break;
10302                 err = -ENOTCONN;
10303                 goto out;
10304         default:
10305                 err = -EOPNOTSUPP;
10306                 goto out;
10307         }
10308
10309         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10310
10311  out:
10312         wdev_unlock(wdev);
10313         return err;
10314 }
10315
10316 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10317 {
10318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10319         struct net_device *dev = info->user_ptr[1];
10320         struct wireless_dev *wdev = dev->ieee80211_ptr;
10321         const u8 *peer;
10322         u8 tsid;
10323         int err;
10324
10325         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10326                 return -EINVAL;
10327
10328         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10329         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10330
10331         wdev_lock(wdev);
10332         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10333         wdev_unlock(wdev);
10334
10335         return err;
10336 }
10337
10338 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10339                                        struct genl_info *info)
10340 {
10341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10342         struct net_device *dev = info->user_ptr[1];
10343         struct wireless_dev *wdev = dev->ieee80211_ptr;
10344         struct cfg80211_chan_def chandef = {};
10345         const u8 *addr;
10346         u8 oper_class;
10347         int err;
10348
10349         if (!rdev->ops->tdls_channel_switch ||
10350             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10351                 return -EOPNOTSUPP;
10352
10353         switch (dev->ieee80211_ptr->iftype) {
10354         case NL80211_IFTYPE_STATION:
10355         case NL80211_IFTYPE_P2P_CLIENT:
10356                 break;
10357         default:
10358                 return -EOPNOTSUPP;
10359         }
10360
10361         if (!info->attrs[NL80211_ATTR_MAC] ||
10362             !info->attrs[NL80211_ATTR_OPER_CLASS])
10363                 return -EINVAL;
10364
10365         err = nl80211_parse_chandef(rdev, info, &chandef);
10366         if (err)
10367                 return err;
10368
10369         /*
10370          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10371          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10372          * specification is not defined for them.
10373          */
10374         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
10375             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10376             chandef.width != NL80211_CHAN_WIDTH_20)
10377                 return -EINVAL;
10378
10379         /* we will be active on the TDLS link */
10380         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10381                                            wdev->iftype))
10382                 return -EINVAL;
10383
10384         /* don't allow switching to DFS channels */
10385         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10386                 return -EINVAL;
10387
10388         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10389         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10390
10391         wdev_lock(wdev);
10392         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10393         wdev_unlock(wdev);
10394
10395         return err;
10396 }
10397
10398 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10399                                               struct genl_info *info)
10400 {
10401         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10402         struct net_device *dev = info->user_ptr[1];
10403         struct wireless_dev *wdev = dev->ieee80211_ptr;
10404         const u8 *addr;
10405
10406         if (!rdev->ops->tdls_channel_switch ||
10407             !rdev->ops->tdls_cancel_channel_switch ||
10408             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10409                 return -EOPNOTSUPP;
10410
10411         switch (dev->ieee80211_ptr->iftype) {
10412         case NL80211_IFTYPE_STATION:
10413         case NL80211_IFTYPE_P2P_CLIENT:
10414                 break;
10415         default:
10416                 return -EOPNOTSUPP;
10417         }
10418
10419         if (!info->attrs[NL80211_ATTR_MAC])
10420                 return -EINVAL;
10421
10422         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10423
10424         wdev_lock(wdev);
10425         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10426         wdev_unlock(wdev);
10427
10428         return 0;
10429 }
10430
10431 #define NL80211_FLAG_NEED_WIPHY         0x01
10432 #define NL80211_FLAG_NEED_NETDEV        0x02
10433 #define NL80211_FLAG_NEED_RTNL          0x04
10434 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10435 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10436                                          NL80211_FLAG_CHECK_NETDEV_UP)
10437 #define NL80211_FLAG_NEED_WDEV          0x10
10438 /* If a netdev is associated, it must be UP, P2P must be started */
10439 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10440                                          NL80211_FLAG_CHECK_NETDEV_UP)
10441 #define NL80211_FLAG_CLEAR_SKB          0x20
10442
10443 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10444                             struct genl_info *info)
10445 {
10446         struct cfg80211_registered_device *rdev;
10447         struct wireless_dev *wdev;
10448         struct net_device *dev;
10449         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10450
10451         if (rtnl)
10452                 rtnl_lock();
10453
10454         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10455                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10456                 if (IS_ERR(rdev)) {
10457                         if (rtnl)
10458                                 rtnl_unlock();
10459                         return PTR_ERR(rdev);
10460                 }
10461                 info->user_ptr[0] = rdev;
10462         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10463                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10464                 ASSERT_RTNL();
10465
10466                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10467                                                   info->attrs);
10468                 if (IS_ERR(wdev)) {
10469                         if (rtnl)
10470                                 rtnl_unlock();
10471                         return PTR_ERR(wdev);
10472                 }
10473
10474                 dev = wdev->netdev;
10475                 rdev = wiphy_to_rdev(wdev->wiphy);
10476
10477                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10478                         if (!dev) {
10479                                 if (rtnl)
10480                                         rtnl_unlock();
10481                                 return -EINVAL;
10482                         }
10483
10484                         info->user_ptr[1] = dev;
10485                 } else {
10486                         info->user_ptr[1] = wdev;
10487                 }
10488
10489                 if (dev) {
10490                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10491                             !netif_running(dev)) {
10492                                 if (rtnl)
10493                                         rtnl_unlock();
10494                                 return -ENETDOWN;
10495                         }
10496
10497                         dev_hold(dev);
10498                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10499                         if (!wdev->p2p_started) {
10500                                 if (rtnl)
10501                                         rtnl_unlock();
10502                                 return -ENETDOWN;
10503                         }
10504                 }
10505
10506                 info->user_ptr[0] = rdev;
10507         }
10508
10509         return 0;
10510 }
10511
10512 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10513                               struct genl_info *info)
10514 {
10515         if (info->user_ptr[1]) {
10516                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10517                         struct wireless_dev *wdev = info->user_ptr[1];
10518
10519                         if (wdev->netdev)
10520                                 dev_put(wdev->netdev);
10521                 } else {
10522                         dev_put(info->user_ptr[1]);
10523                 }
10524         }
10525
10526         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10527                 rtnl_unlock();
10528
10529         /* If needed, clear the netlink message payload from the SKB
10530          * as it might contain key data that shouldn't stick around on
10531          * the heap after the SKB is freed. The netlink message header
10532          * is still needed for further processing, so leave it intact.
10533          */
10534         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10535                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10536
10537                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10538         }
10539 }
10540
10541 static const struct genl_ops nl80211_ops[] = {
10542         {
10543                 .cmd = NL80211_CMD_GET_WIPHY,
10544                 .doit = nl80211_get_wiphy,
10545                 .dumpit = nl80211_dump_wiphy,
10546                 .done = nl80211_dump_wiphy_done,
10547                 .policy = nl80211_policy,
10548                 /* can be retrieved by unprivileged users */
10549                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10550                                   NL80211_FLAG_NEED_RTNL,
10551         },
10552         {
10553                 .cmd = NL80211_CMD_SET_WIPHY,
10554                 .doit = nl80211_set_wiphy,
10555                 .policy = nl80211_policy,
10556                 .flags = GENL_ADMIN_PERM,
10557                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10558         },
10559         {
10560                 .cmd = NL80211_CMD_GET_INTERFACE,
10561                 .doit = nl80211_get_interface,
10562                 .dumpit = nl80211_dump_interface,
10563                 .policy = nl80211_policy,
10564                 /* can be retrieved by unprivileged users */
10565                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10566                                   NL80211_FLAG_NEED_RTNL,
10567         },
10568         {
10569                 .cmd = NL80211_CMD_SET_INTERFACE,
10570                 .doit = nl80211_set_interface,
10571                 .policy = nl80211_policy,
10572                 .flags = GENL_ADMIN_PERM,
10573                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10574                                   NL80211_FLAG_NEED_RTNL,
10575         },
10576         {
10577                 .cmd = NL80211_CMD_NEW_INTERFACE,
10578                 .doit = nl80211_new_interface,
10579                 .policy = nl80211_policy,
10580                 .flags = GENL_ADMIN_PERM,
10581                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10582                                   NL80211_FLAG_NEED_RTNL,
10583         },
10584         {
10585                 .cmd = NL80211_CMD_DEL_INTERFACE,
10586                 .doit = nl80211_del_interface,
10587                 .policy = nl80211_policy,
10588                 .flags = GENL_ADMIN_PERM,
10589                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10590                                   NL80211_FLAG_NEED_RTNL,
10591         },
10592         {
10593                 .cmd = NL80211_CMD_GET_KEY,
10594                 .doit = nl80211_get_key,
10595                 .policy = nl80211_policy,
10596                 .flags = GENL_ADMIN_PERM,
10597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10598                                   NL80211_FLAG_NEED_RTNL,
10599         },
10600         {
10601                 .cmd = NL80211_CMD_SET_KEY,
10602                 .doit = nl80211_set_key,
10603                 .policy = nl80211_policy,
10604                 .flags = GENL_ADMIN_PERM,
10605                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10606                                   NL80211_FLAG_NEED_RTNL |
10607                                   NL80211_FLAG_CLEAR_SKB,
10608         },
10609         {
10610                 .cmd = NL80211_CMD_NEW_KEY,
10611                 .doit = nl80211_new_key,
10612                 .policy = nl80211_policy,
10613                 .flags = GENL_ADMIN_PERM,
10614                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10615                                   NL80211_FLAG_NEED_RTNL |
10616                                   NL80211_FLAG_CLEAR_SKB,
10617         },
10618         {
10619                 .cmd = NL80211_CMD_DEL_KEY,
10620                 .doit = nl80211_del_key,
10621                 .policy = nl80211_policy,
10622                 .flags = GENL_ADMIN_PERM,
10623                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10624                                   NL80211_FLAG_NEED_RTNL,
10625         },
10626         {
10627                 .cmd = NL80211_CMD_SET_BEACON,
10628                 .policy = nl80211_policy,
10629                 .flags = GENL_ADMIN_PERM,
10630                 .doit = nl80211_set_beacon,
10631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10632                                   NL80211_FLAG_NEED_RTNL,
10633         },
10634         {
10635                 .cmd = NL80211_CMD_START_AP,
10636                 .policy = nl80211_policy,
10637                 .flags = GENL_ADMIN_PERM,
10638                 .doit = nl80211_start_ap,
10639                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10640                                   NL80211_FLAG_NEED_RTNL,
10641         },
10642         {
10643                 .cmd = NL80211_CMD_STOP_AP,
10644                 .policy = nl80211_policy,
10645                 .flags = GENL_ADMIN_PERM,
10646                 .doit = nl80211_stop_ap,
10647                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10648                                   NL80211_FLAG_NEED_RTNL,
10649         },
10650         {
10651                 .cmd = NL80211_CMD_GET_STATION,
10652                 .doit = nl80211_get_station,
10653                 .dumpit = nl80211_dump_station,
10654                 .policy = nl80211_policy,
10655                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10656                                   NL80211_FLAG_NEED_RTNL,
10657         },
10658         {
10659                 .cmd = NL80211_CMD_SET_STATION,
10660                 .doit = nl80211_set_station,
10661                 .policy = nl80211_policy,
10662                 .flags = GENL_ADMIN_PERM,
10663                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10664                                   NL80211_FLAG_NEED_RTNL,
10665         },
10666         {
10667                 .cmd = NL80211_CMD_NEW_STATION,
10668                 .doit = nl80211_new_station,
10669                 .policy = nl80211_policy,
10670                 .flags = GENL_ADMIN_PERM,
10671                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10672                                   NL80211_FLAG_NEED_RTNL,
10673         },
10674         {
10675                 .cmd = NL80211_CMD_DEL_STATION,
10676                 .doit = nl80211_del_station,
10677                 .policy = nl80211_policy,
10678                 .flags = GENL_ADMIN_PERM,
10679                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10680                                   NL80211_FLAG_NEED_RTNL,
10681         },
10682         {
10683                 .cmd = NL80211_CMD_GET_MPATH,
10684                 .doit = nl80211_get_mpath,
10685                 .dumpit = nl80211_dump_mpath,
10686                 .policy = nl80211_policy,
10687                 .flags = GENL_ADMIN_PERM,
10688                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10689                                   NL80211_FLAG_NEED_RTNL,
10690         },
10691         {
10692                 .cmd = NL80211_CMD_GET_MPP,
10693                 .doit = nl80211_get_mpp,
10694                 .dumpit = nl80211_dump_mpp,
10695                 .policy = nl80211_policy,
10696                 .flags = GENL_ADMIN_PERM,
10697                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10698                                   NL80211_FLAG_NEED_RTNL,
10699         },
10700         {
10701                 .cmd = NL80211_CMD_SET_MPATH,
10702                 .doit = nl80211_set_mpath,
10703                 .policy = nl80211_policy,
10704                 .flags = GENL_ADMIN_PERM,
10705                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10706                                   NL80211_FLAG_NEED_RTNL,
10707         },
10708         {
10709                 .cmd = NL80211_CMD_NEW_MPATH,
10710                 .doit = nl80211_new_mpath,
10711                 .policy = nl80211_policy,
10712                 .flags = GENL_ADMIN_PERM,
10713                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10714                                   NL80211_FLAG_NEED_RTNL,
10715         },
10716         {
10717                 .cmd = NL80211_CMD_DEL_MPATH,
10718                 .doit = nl80211_del_mpath,
10719                 .policy = nl80211_policy,
10720                 .flags = GENL_ADMIN_PERM,
10721                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10722                                   NL80211_FLAG_NEED_RTNL,
10723         },
10724         {
10725                 .cmd = NL80211_CMD_SET_BSS,
10726                 .doit = nl80211_set_bss,
10727                 .policy = nl80211_policy,
10728                 .flags = GENL_ADMIN_PERM,
10729                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10730                                   NL80211_FLAG_NEED_RTNL,
10731         },
10732         {
10733                 .cmd = NL80211_CMD_GET_REG,
10734                 .doit = nl80211_get_reg_do,
10735                 .dumpit = nl80211_get_reg_dump,
10736                 .policy = nl80211_policy,
10737                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10738                 /* can be retrieved by unprivileged users */
10739         },
10740         {
10741                 .cmd = NL80211_CMD_SET_REG,
10742                 .doit = nl80211_set_reg,
10743                 .policy = nl80211_policy,
10744                 .flags = GENL_ADMIN_PERM,
10745                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10746         },
10747         {
10748                 .cmd = NL80211_CMD_REQ_SET_REG,
10749                 .doit = nl80211_req_set_reg,
10750                 .policy = nl80211_policy,
10751                 .flags = GENL_ADMIN_PERM,
10752         },
10753         {
10754                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10755                 .doit = nl80211_get_mesh_config,
10756                 .policy = nl80211_policy,
10757                 /* can be retrieved by unprivileged users */
10758                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10759                                   NL80211_FLAG_NEED_RTNL,
10760         },
10761         {
10762                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10763                 .doit = nl80211_update_mesh_config,
10764                 .policy = nl80211_policy,
10765                 .flags = GENL_ADMIN_PERM,
10766                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10767                                   NL80211_FLAG_NEED_RTNL,
10768         },
10769         {
10770                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10771                 .doit = nl80211_trigger_scan,
10772                 .policy = nl80211_policy,
10773                 .flags = GENL_ADMIN_PERM,
10774                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10775                                   NL80211_FLAG_NEED_RTNL,
10776         },
10777         {
10778                 .cmd = NL80211_CMD_GET_SCAN,
10779                 .policy = nl80211_policy,
10780                 .dumpit = nl80211_dump_scan,
10781         },
10782         {
10783                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10784                 .doit = nl80211_start_sched_scan,
10785                 .policy = nl80211_policy,
10786                 .flags = GENL_ADMIN_PERM,
10787                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10788                                   NL80211_FLAG_NEED_RTNL,
10789         },
10790         {
10791                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10792                 .doit = nl80211_stop_sched_scan,
10793                 .policy = nl80211_policy,
10794                 .flags = GENL_ADMIN_PERM,
10795                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10796                                   NL80211_FLAG_NEED_RTNL,
10797         },
10798         {
10799                 .cmd = NL80211_CMD_AUTHENTICATE,
10800                 .doit = nl80211_authenticate,
10801                 .policy = nl80211_policy,
10802                 .flags = GENL_ADMIN_PERM,
10803                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10804                                   NL80211_FLAG_NEED_RTNL |
10805                                   NL80211_FLAG_CLEAR_SKB,
10806         },
10807         {
10808                 .cmd = NL80211_CMD_ASSOCIATE,
10809                 .doit = nl80211_associate,
10810                 .policy = nl80211_policy,
10811                 .flags = GENL_ADMIN_PERM,
10812                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10813                                   NL80211_FLAG_NEED_RTNL,
10814         },
10815         {
10816                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10817                 .doit = nl80211_deauthenticate,
10818                 .policy = nl80211_policy,
10819                 .flags = GENL_ADMIN_PERM,
10820                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10821                                   NL80211_FLAG_NEED_RTNL,
10822         },
10823         {
10824                 .cmd = NL80211_CMD_DISASSOCIATE,
10825                 .doit = nl80211_disassociate,
10826                 .policy = nl80211_policy,
10827                 .flags = GENL_ADMIN_PERM,
10828                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10829                                   NL80211_FLAG_NEED_RTNL,
10830         },
10831         {
10832                 .cmd = NL80211_CMD_JOIN_IBSS,
10833                 .doit = nl80211_join_ibss,
10834                 .policy = nl80211_policy,
10835                 .flags = GENL_ADMIN_PERM,
10836                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10837                                   NL80211_FLAG_NEED_RTNL,
10838         },
10839         {
10840                 .cmd = NL80211_CMD_LEAVE_IBSS,
10841                 .doit = nl80211_leave_ibss,
10842                 .policy = nl80211_policy,
10843                 .flags = GENL_ADMIN_PERM,
10844                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10845                                   NL80211_FLAG_NEED_RTNL,
10846         },
10847 #ifdef CONFIG_NL80211_TESTMODE
10848         {
10849                 .cmd = NL80211_CMD_TESTMODE,
10850                 .doit = nl80211_testmode_do,
10851                 .dumpit = nl80211_testmode_dump,
10852                 .policy = nl80211_policy,
10853                 .flags = GENL_ADMIN_PERM,
10854                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10855                                   NL80211_FLAG_NEED_RTNL,
10856         },
10857 #endif
10858         {
10859                 .cmd = NL80211_CMD_CONNECT,
10860                 .doit = nl80211_connect,
10861                 .policy = nl80211_policy,
10862                 .flags = GENL_ADMIN_PERM,
10863                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10864                                   NL80211_FLAG_NEED_RTNL,
10865         },
10866         {
10867                 .cmd = NL80211_CMD_DISCONNECT,
10868                 .doit = nl80211_disconnect,
10869                 .policy = nl80211_policy,
10870                 .flags = GENL_ADMIN_PERM,
10871                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10872                                   NL80211_FLAG_NEED_RTNL,
10873         },
10874         {
10875                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10876                 .doit = nl80211_wiphy_netns,
10877                 .policy = nl80211_policy,
10878                 .flags = GENL_ADMIN_PERM,
10879                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10880                                   NL80211_FLAG_NEED_RTNL,
10881         },
10882         {
10883                 .cmd = NL80211_CMD_GET_SURVEY,
10884                 .policy = nl80211_policy,
10885                 .dumpit = nl80211_dump_survey,
10886         },
10887         {
10888                 .cmd = NL80211_CMD_SET_PMKSA,
10889                 .doit = nl80211_setdel_pmksa,
10890                 .policy = nl80211_policy,
10891                 .flags = GENL_ADMIN_PERM,
10892                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10893                                   NL80211_FLAG_NEED_RTNL,
10894         },
10895         {
10896                 .cmd = NL80211_CMD_DEL_PMKSA,
10897                 .doit = nl80211_setdel_pmksa,
10898                 .policy = nl80211_policy,
10899                 .flags = GENL_ADMIN_PERM,
10900                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10901                                   NL80211_FLAG_NEED_RTNL,
10902         },
10903         {
10904                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10905                 .doit = nl80211_flush_pmksa,
10906                 .policy = nl80211_policy,
10907                 .flags = GENL_ADMIN_PERM,
10908                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10909                                   NL80211_FLAG_NEED_RTNL,
10910         },
10911         {
10912                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10913                 .doit = nl80211_remain_on_channel,
10914                 .policy = nl80211_policy,
10915                 .flags = GENL_ADMIN_PERM,
10916                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10917                                   NL80211_FLAG_NEED_RTNL,
10918         },
10919         {
10920                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10921                 .doit = nl80211_cancel_remain_on_channel,
10922                 .policy = nl80211_policy,
10923                 .flags = GENL_ADMIN_PERM,
10924                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10925                                   NL80211_FLAG_NEED_RTNL,
10926         },
10927         {
10928                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10929                 .doit = nl80211_set_tx_bitrate_mask,
10930                 .policy = nl80211_policy,
10931                 .flags = GENL_ADMIN_PERM,
10932                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10933                                   NL80211_FLAG_NEED_RTNL,
10934         },
10935         {
10936                 .cmd = NL80211_CMD_REGISTER_FRAME,
10937                 .doit = nl80211_register_mgmt,
10938                 .policy = nl80211_policy,
10939                 .flags = GENL_ADMIN_PERM,
10940                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10941                                   NL80211_FLAG_NEED_RTNL,
10942         },
10943         {
10944                 .cmd = NL80211_CMD_FRAME,
10945                 .doit = nl80211_tx_mgmt,
10946                 .policy = nl80211_policy,
10947                 .flags = GENL_ADMIN_PERM,
10948                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10949                                   NL80211_FLAG_NEED_RTNL,
10950         },
10951         {
10952                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10953                 .doit = nl80211_tx_mgmt_cancel_wait,
10954                 .policy = nl80211_policy,
10955                 .flags = GENL_ADMIN_PERM,
10956                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10957                                   NL80211_FLAG_NEED_RTNL,
10958         },
10959         {
10960                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10961                 .doit = nl80211_set_power_save,
10962                 .policy = nl80211_policy,
10963                 .flags = GENL_ADMIN_PERM,
10964                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10965                                   NL80211_FLAG_NEED_RTNL,
10966         },
10967         {
10968                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10969                 .doit = nl80211_get_power_save,
10970                 .policy = nl80211_policy,
10971                 /* can be retrieved by unprivileged users */
10972                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10973                                   NL80211_FLAG_NEED_RTNL,
10974         },
10975         {
10976                 .cmd = NL80211_CMD_SET_CQM,
10977                 .doit = nl80211_set_cqm,
10978                 .policy = nl80211_policy,
10979                 .flags = GENL_ADMIN_PERM,
10980                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10981                                   NL80211_FLAG_NEED_RTNL,
10982         },
10983         {
10984                 .cmd = NL80211_CMD_SET_CHANNEL,
10985                 .doit = nl80211_set_channel,
10986                 .policy = nl80211_policy,
10987                 .flags = GENL_ADMIN_PERM,
10988                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10989                                   NL80211_FLAG_NEED_RTNL,
10990         },
10991         {
10992                 .cmd = NL80211_CMD_SET_WDS_PEER,
10993                 .doit = nl80211_set_wds_peer,
10994                 .policy = nl80211_policy,
10995                 .flags = GENL_ADMIN_PERM,
10996                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10997                                   NL80211_FLAG_NEED_RTNL,
10998         },
10999         {
11000                 .cmd = NL80211_CMD_JOIN_MESH,
11001                 .doit = nl80211_join_mesh,
11002                 .policy = nl80211_policy,
11003                 .flags = GENL_ADMIN_PERM,
11004                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11005                                   NL80211_FLAG_NEED_RTNL,
11006         },
11007         {
11008                 .cmd = NL80211_CMD_LEAVE_MESH,
11009                 .doit = nl80211_leave_mesh,
11010                 .policy = nl80211_policy,
11011                 .flags = GENL_ADMIN_PERM,
11012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11013                                   NL80211_FLAG_NEED_RTNL,
11014         },
11015         {
11016                 .cmd = NL80211_CMD_JOIN_OCB,
11017                 .doit = nl80211_join_ocb,
11018                 .policy = nl80211_policy,
11019                 .flags = GENL_ADMIN_PERM,
11020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11021                                   NL80211_FLAG_NEED_RTNL,
11022         },
11023         {
11024                 .cmd = NL80211_CMD_LEAVE_OCB,
11025                 .doit = nl80211_leave_ocb,
11026                 .policy = nl80211_policy,
11027                 .flags = GENL_ADMIN_PERM,
11028                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11029                                   NL80211_FLAG_NEED_RTNL,
11030         },
11031 #ifdef CONFIG_PM
11032         {
11033                 .cmd = NL80211_CMD_GET_WOWLAN,
11034                 .doit = nl80211_get_wowlan,
11035                 .policy = nl80211_policy,
11036                 /* can be retrieved by unprivileged users */
11037                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11038                                   NL80211_FLAG_NEED_RTNL,
11039         },
11040         {
11041                 .cmd = NL80211_CMD_SET_WOWLAN,
11042                 .doit = nl80211_set_wowlan,
11043                 .policy = nl80211_policy,
11044                 .flags = GENL_ADMIN_PERM,
11045                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11046                                   NL80211_FLAG_NEED_RTNL,
11047         },
11048 #endif
11049         {
11050                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11051                 .doit = nl80211_set_rekey_data,
11052                 .policy = nl80211_policy,
11053                 .flags = GENL_ADMIN_PERM,
11054                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11055                                   NL80211_FLAG_NEED_RTNL |
11056                                   NL80211_FLAG_CLEAR_SKB,
11057         },
11058         {
11059                 .cmd = NL80211_CMD_TDLS_MGMT,
11060                 .doit = nl80211_tdls_mgmt,
11061                 .policy = nl80211_policy,
11062                 .flags = GENL_ADMIN_PERM,
11063                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11064                                   NL80211_FLAG_NEED_RTNL,
11065         },
11066         {
11067                 .cmd = NL80211_CMD_TDLS_OPER,
11068                 .doit = nl80211_tdls_oper,
11069                 .policy = nl80211_policy,
11070                 .flags = GENL_ADMIN_PERM,
11071                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11072                                   NL80211_FLAG_NEED_RTNL,
11073         },
11074         {
11075                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11076                 .doit = nl80211_register_unexpected_frame,
11077                 .policy = nl80211_policy,
11078                 .flags = GENL_ADMIN_PERM,
11079                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11080                                   NL80211_FLAG_NEED_RTNL,
11081         },
11082         {
11083                 .cmd = NL80211_CMD_PROBE_CLIENT,
11084                 .doit = nl80211_probe_client,
11085                 .policy = nl80211_policy,
11086                 .flags = GENL_ADMIN_PERM,
11087                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11088                                   NL80211_FLAG_NEED_RTNL,
11089         },
11090         {
11091                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11092                 .doit = nl80211_register_beacons,
11093                 .policy = nl80211_policy,
11094                 .flags = GENL_ADMIN_PERM,
11095                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11096                                   NL80211_FLAG_NEED_RTNL,
11097         },
11098         {
11099                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11100                 .doit = nl80211_set_noack_map,
11101                 .policy = nl80211_policy,
11102                 .flags = GENL_ADMIN_PERM,
11103                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11104                                   NL80211_FLAG_NEED_RTNL,
11105         },
11106         {
11107                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11108                 .doit = nl80211_start_p2p_device,
11109                 .policy = nl80211_policy,
11110                 .flags = GENL_ADMIN_PERM,
11111                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11112                                   NL80211_FLAG_NEED_RTNL,
11113         },
11114         {
11115                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11116                 .doit = nl80211_stop_p2p_device,
11117                 .policy = nl80211_policy,
11118                 .flags = GENL_ADMIN_PERM,
11119                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11120                                   NL80211_FLAG_NEED_RTNL,
11121         },
11122         {
11123                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11124                 .doit = nl80211_set_mcast_rate,
11125                 .policy = nl80211_policy,
11126                 .flags = GENL_ADMIN_PERM,
11127                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11128                                   NL80211_FLAG_NEED_RTNL,
11129         },
11130         {
11131                 .cmd = NL80211_CMD_SET_MAC_ACL,
11132                 .doit = nl80211_set_mac_acl,
11133                 .policy = nl80211_policy,
11134                 .flags = GENL_ADMIN_PERM,
11135                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11136                                   NL80211_FLAG_NEED_RTNL,
11137         },
11138         {
11139                 .cmd = NL80211_CMD_RADAR_DETECT,
11140                 .doit = nl80211_start_radar_detection,
11141                 .policy = nl80211_policy,
11142                 .flags = GENL_ADMIN_PERM,
11143                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11144                                   NL80211_FLAG_NEED_RTNL,
11145         },
11146         {
11147                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11148                 .doit = nl80211_get_protocol_features,
11149                 .policy = nl80211_policy,
11150         },
11151         {
11152                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11153                 .doit = nl80211_update_ft_ies,
11154                 .policy = nl80211_policy,
11155                 .flags = GENL_ADMIN_PERM,
11156                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11157                                   NL80211_FLAG_NEED_RTNL,
11158         },
11159         {
11160                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11161                 .doit = nl80211_crit_protocol_start,
11162                 .policy = nl80211_policy,
11163                 .flags = GENL_ADMIN_PERM,
11164                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11165                                   NL80211_FLAG_NEED_RTNL,
11166         },
11167         {
11168                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11169                 .doit = nl80211_crit_protocol_stop,
11170                 .policy = nl80211_policy,
11171                 .flags = GENL_ADMIN_PERM,
11172                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11173                                   NL80211_FLAG_NEED_RTNL,
11174         },
11175         {
11176                 .cmd = NL80211_CMD_GET_COALESCE,
11177                 .doit = nl80211_get_coalesce,
11178                 .policy = nl80211_policy,
11179                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11180                                   NL80211_FLAG_NEED_RTNL,
11181         },
11182         {
11183                 .cmd = NL80211_CMD_SET_COALESCE,
11184                 .doit = nl80211_set_coalesce,
11185                 .policy = nl80211_policy,
11186                 .flags = GENL_ADMIN_PERM,
11187                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11188                                   NL80211_FLAG_NEED_RTNL,
11189         },
11190         {
11191                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11192                 .doit = nl80211_channel_switch,
11193                 .policy = nl80211_policy,
11194                 .flags = GENL_ADMIN_PERM,
11195                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11196                                   NL80211_FLAG_NEED_RTNL,
11197         },
11198         {
11199                 .cmd = NL80211_CMD_VENDOR,
11200                 .doit = nl80211_vendor_cmd,
11201                 .dumpit = nl80211_vendor_cmd_dump,
11202                 .policy = nl80211_policy,
11203                 .flags = GENL_ADMIN_PERM,
11204                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11205                                   NL80211_FLAG_NEED_RTNL,
11206         },
11207         {
11208                 .cmd = NL80211_CMD_SET_QOS_MAP,
11209                 .doit = nl80211_set_qos_map,
11210                 .policy = nl80211_policy,
11211                 .flags = GENL_ADMIN_PERM,
11212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11213                                   NL80211_FLAG_NEED_RTNL,
11214         },
11215         {
11216                 .cmd = NL80211_CMD_ADD_TX_TS,
11217                 .doit = nl80211_add_tx_ts,
11218                 .policy = nl80211_policy,
11219                 .flags = GENL_ADMIN_PERM,
11220                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11221                                   NL80211_FLAG_NEED_RTNL,
11222         },
11223         {
11224                 .cmd = NL80211_CMD_DEL_TX_TS,
11225                 .doit = nl80211_del_tx_ts,
11226                 .policy = nl80211_policy,
11227                 .flags = GENL_ADMIN_PERM,
11228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11229                                   NL80211_FLAG_NEED_RTNL,
11230         },
11231         {
11232                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11233                 .doit = nl80211_tdls_channel_switch,
11234                 .policy = nl80211_policy,
11235                 .flags = GENL_ADMIN_PERM,
11236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11237                                   NL80211_FLAG_NEED_RTNL,
11238         },
11239         {
11240                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11241                 .doit = nl80211_tdls_cancel_channel_switch,
11242                 .policy = nl80211_policy,
11243                 .flags = GENL_ADMIN_PERM,
11244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11245                                   NL80211_FLAG_NEED_RTNL,
11246         },
11247 };
11248
11249 /* notification functions */
11250
11251 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11252                           enum nl80211_commands cmd)
11253 {
11254         struct sk_buff *msg;
11255         struct nl80211_dump_wiphy_state state = {};
11256
11257         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11258                 cmd != NL80211_CMD_DEL_WIPHY);
11259
11260         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11261         if (!msg)
11262                 return;
11263
11264         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11265                 nlmsg_free(msg);
11266                 return;
11267         }
11268
11269         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11270                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11271 }
11272
11273 static int nl80211_add_scan_req(struct sk_buff *msg,
11274                                 struct cfg80211_registered_device *rdev)
11275 {
11276         struct cfg80211_scan_request *req = rdev->scan_req;
11277         struct nlattr *nest;
11278         int i;
11279
11280         if (WARN_ON(!req))
11281                 return 0;
11282
11283         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11284         if (!nest)
11285                 goto nla_put_failure;
11286         for (i = 0; i < req->n_ssids; i++) {
11287                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11288                         goto nla_put_failure;
11289         }
11290         nla_nest_end(msg, nest);
11291
11292         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11293         if (!nest)
11294                 goto nla_put_failure;
11295         for (i = 0; i < req->n_channels; i++) {
11296                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11297                         goto nla_put_failure;
11298         }
11299         nla_nest_end(msg, nest);
11300
11301         if (req->ie &&
11302             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11303                 goto nla_put_failure;
11304
11305         if (req->flags &&
11306             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11307                 goto nla_put_failure;
11308
11309         return 0;
11310  nla_put_failure:
11311         return -ENOBUFS;
11312 }
11313
11314 static int nl80211_send_scan_msg(struct sk_buff *msg,
11315                                  struct cfg80211_registered_device *rdev,
11316                                  struct wireless_dev *wdev,
11317                                  u32 portid, u32 seq, int flags,
11318                                  u32 cmd)
11319 {
11320         void *hdr;
11321
11322         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11323         if (!hdr)
11324                 return -1;
11325
11326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11327             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11328                                          wdev->netdev->ifindex)) ||
11329             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11330                 goto nla_put_failure;
11331
11332         /* ignore errors and send incomplete event anyway */
11333         nl80211_add_scan_req(msg, rdev);
11334
11335         genlmsg_end(msg, hdr);
11336         return 0;
11337
11338  nla_put_failure:
11339         genlmsg_cancel(msg, hdr);
11340         return -EMSGSIZE;
11341 }
11342
11343 static int
11344 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11345                             struct cfg80211_registered_device *rdev,
11346                             struct net_device *netdev,
11347                             u32 portid, u32 seq, int flags, u32 cmd)
11348 {
11349         void *hdr;
11350
11351         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11352         if (!hdr)
11353                 return -1;
11354
11355         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11356             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11357                 goto nla_put_failure;
11358
11359         genlmsg_end(msg, hdr);
11360         return 0;
11361
11362  nla_put_failure:
11363         genlmsg_cancel(msg, hdr);
11364         return -EMSGSIZE;
11365 }
11366
11367 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11368                              struct wireless_dev *wdev)
11369 {
11370         struct sk_buff *msg;
11371
11372         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11373         if (!msg)
11374                 return;
11375
11376         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11377                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11378                 nlmsg_free(msg);
11379                 return;
11380         }
11381
11382         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11383                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11384 }
11385
11386 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11387                                        struct wireless_dev *wdev, bool aborted)
11388 {
11389         struct sk_buff *msg;
11390
11391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11392         if (!msg)
11393                 return NULL;
11394
11395         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11396                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11397                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11398                 nlmsg_free(msg);
11399                 return NULL;
11400         }
11401
11402         return msg;
11403 }
11404
11405 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11406                               struct sk_buff *msg)
11407 {
11408         if (!msg)
11409                 return;
11410
11411         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11412                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11413 }
11414
11415 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11416                                      struct net_device *netdev)
11417 {
11418         struct sk_buff *msg;
11419
11420         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11421         if (!msg)
11422                 return;
11423
11424         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11425                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11426                 nlmsg_free(msg);
11427                 return;
11428         }
11429
11430         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11431                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11432 }
11433
11434 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11435                              struct net_device *netdev, u32 cmd)
11436 {
11437         struct sk_buff *msg;
11438
11439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11440         if (!msg)
11441                 return;
11442
11443         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11444                 nlmsg_free(msg);
11445                 return;
11446         }
11447
11448         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11449                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11450 }
11451
11452 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11453                                           struct regulatory_request *request)
11454 {
11455         /* Userspace can always count this one always being set */
11456         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11457                 goto nla_put_failure;
11458
11459         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11460                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11461                                NL80211_REGDOM_TYPE_WORLD))
11462                         goto nla_put_failure;
11463         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11464                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11465                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11466                         goto nla_put_failure;
11467         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11468                    request->intersect) {
11469                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11470                                NL80211_REGDOM_TYPE_INTERSECTION))
11471                         goto nla_put_failure;
11472         } else {
11473                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11474                                NL80211_REGDOM_TYPE_COUNTRY) ||
11475                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11476                                    request->alpha2))
11477                         goto nla_put_failure;
11478         }
11479
11480         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11481                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11482
11483                 if (wiphy &&
11484                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11485                         goto nla_put_failure;
11486
11487                 if (wiphy &&
11488                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11489                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11490                         goto nla_put_failure;
11491         }
11492
11493         return true;
11494
11495 nla_put_failure:
11496         return false;
11497 }
11498
11499 /*
11500  * This can happen on global regulatory changes or device specific settings
11501  * based on custom regulatory domains.
11502  */
11503 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11504                                      struct regulatory_request *request)
11505 {
11506         struct sk_buff *msg;
11507         void *hdr;
11508
11509         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11510         if (!msg)
11511                 return;
11512
11513         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11514         if (!hdr) {
11515                 nlmsg_free(msg);
11516                 return;
11517         }
11518
11519         if (nl80211_reg_change_event_fill(msg, request) == false)
11520                 goto nla_put_failure;
11521
11522         genlmsg_end(msg, hdr);
11523
11524         rcu_read_lock();
11525         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11526                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11527         rcu_read_unlock();
11528
11529         return;
11530
11531 nla_put_failure:
11532         genlmsg_cancel(msg, hdr);
11533         nlmsg_free(msg);
11534 }
11535
11536 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11537                                     struct net_device *netdev,
11538                                     const u8 *buf, size_t len,
11539                                     enum nl80211_commands cmd, gfp_t gfp,
11540                                     int uapsd_queues)
11541 {
11542         struct sk_buff *msg;
11543         void *hdr;
11544
11545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11546         if (!msg)
11547                 return;
11548
11549         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11550         if (!hdr) {
11551                 nlmsg_free(msg);
11552                 return;
11553         }
11554
11555         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11556             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11557             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11558                 goto nla_put_failure;
11559
11560         if (uapsd_queues >= 0) {
11561                 struct nlattr *nla_wmm =
11562                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11563                 if (!nla_wmm)
11564                         goto nla_put_failure;
11565
11566                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11567                                uapsd_queues))
11568                         goto nla_put_failure;
11569
11570                 nla_nest_end(msg, nla_wmm);
11571         }
11572
11573         genlmsg_end(msg, hdr);
11574
11575         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11576                                 NL80211_MCGRP_MLME, gfp);
11577         return;
11578
11579  nla_put_failure:
11580         genlmsg_cancel(msg, hdr);
11581         nlmsg_free(msg);
11582 }
11583
11584 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11585                           struct net_device *netdev, const u8 *buf,
11586                           size_t len, gfp_t gfp)
11587 {
11588         nl80211_send_mlme_event(rdev, netdev, buf, len,
11589                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11590 }
11591
11592 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11593                            struct net_device *netdev, const u8 *buf,
11594                            size_t len, gfp_t gfp, int uapsd_queues)
11595 {
11596         nl80211_send_mlme_event(rdev, netdev, buf, len,
11597                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11598 }
11599
11600 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11601                          struct net_device *netdev, const u8 *buf,
11602                          size_t len, gfp_t gfp)
11603 {
11604         nl80211_send_mlme_event(rdev, netdev, buf, len,
11605                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11606 }
11607
11608 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11609                            struct net_device *netdev, const u8 *buf,
11610                            size_t len, gfp_t gfp)
11611 {
11612         nl80211_send_mlme_event(rdev, netdev, buf, len,
11613                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11614 }
11615
11616 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11617                                   size_t len)
11618 {
11619         struct wireless_dev *wdev = dev->ieee80211_ptr;
11620         struct wiphy *wiphy = wdev->wiphy;
11621         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11622         const struct ieee80211_mgmt *mgmt = (void *)buf;
11623         u32 cmd;
11624
11625         if (WARN_ON(len < 2))
11626                 return;
11627
11628         if (ieee80211_is_deauth(mgmt->frame_control))
11629                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11630         else
11631                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11632
11633         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11634         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11635 }
11636 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11637
11638 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11639                                       struct net_device *netdev, int cmd,
11640                                       const u8 *addr, gfp_t gfp)
11641 {
11642         struct sk_buff *msg;
11643         void *hdr;
11644
11645         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11646         if (!msg)
11647                 return;
11648
11649         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11650         if (!hdr) {
11651                 nlmsg_free(msg);
11652                 return;
11653         }
11654
11655         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11656             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11657             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11658             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11659                 goto nla_put_failure;
11660
11661         genlmsg_end(msg, hdr);
11662
11663         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11664                                 NL80211_MCGRP_MLME, gfp);
11665         return;
11666
11667  nla_put_failure:
11668         genlmsg_cancel(msg, hdr);
11669         nlmsg_free(msg);
11670 }
11671
11672 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11673                                struct net_device *netdev, const u8 *addr,
11674                                gfp_t gfp)
11675 {
11676         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11677                                   addr, gfp);
11678 }
11679
11680 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11681                                 struct net_device *netdev, const u8 *addr,
11682                                 gfp_t gfp)
11683 {
11684         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11685                                   addr, gfp);
11686 }
11687
11688 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11689                                  struct net_device *netdev, const u8 *bssid,
11690                                  const u8 *req_ie, size_t req_ie_len,
11691                                  const u8 *resp_ie, size_t resp_ie_len,
11692                                  u16 status, gfp_t gfp)
11693 {
11694         struct sk_buff *msg;
11695         void *hdr;
11696
11697         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11698         if (!msg)
11699                 return;
11700
11701         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11702         if (!hdr) {
11703                 nlmsg_free(msg);
11704                 return;
11705         }
11706
11707         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11708             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11709             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11710             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11711             (req_ie &&
11712              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11713             (resp_ie &&
11714              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11715                 goto nla_put_failure;
11716
11717         genlmsg_end(msg, hdr);
11718
11719         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11720                                 NL80211_MCGRP_MLME, gfp);
11721         return;
11722
11723  nla_put_failure:
11724         genlmsg_cancel(msg, hdr);
11725         nlmsg_free(msg);
11726
11727 }
11728
11729 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11730                          struct net_device *netdev, const u8 *bssid,
11731                          const u8 *req_ie, size_t req_ie_len,
11732                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11733 {
11734         struct sk_buff *msg;
11735         void *hdr;
11736
11737         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11738         if (!msg)
11739                 return;
11740
11741         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11742         if (!hdr) {
11743                 nlmsg_free(msg);
11744                 return;
11745         }
11746
11747         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11748             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11749             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11750             (req_ie &&
11751              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11752             (resp_ie &&
11753              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11754                 goto nla_put_failure;
11755
11756         genlmsg_end(msg, hdr);
11757
11758         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11759                                 NL80211_MCGRP_MLME, gfp);
11760         return;
11761
11762  nla_put_failure:
11763         genlmsg_cancel(msg, hdr);
11764         nlmsg_free(msg);
11765
11766 }
11767
11768 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11769                                struct net_device *netdev, u16 reason,
11770                                const u8 *ie, size_t ie_len, bool from_ap)
11771 {
11772         struct sk_buff *msg;
11773         void *hdr;
11774
11775         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11776         if (!msg)
11777                 return;
11778
11779         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11780         if (!hdr) {
11781                 nlmsg_free(msg);
11782                 return;
11783         }
11784
11785         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11786             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11787             (from_ap && reason &&
11788              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
11789             (from_ap &&
11790              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
11791             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
11792                 goto nla_put_failure;
11793
11794         genlmsg_end(msg, hdr);
11795
11796         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11797                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11798         return;
11799
11800  nla_put_failure:
11801         genlmsg_cancel(msg, hdr);
11802         nlmsg_free(msg);
11803
11804 }
11805
11806 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
11807                              struct net_device *netdev, const u8 *bssid,
11808                              gfp_t gfp)
11809 {
11810         struct sk_buff *msg;
11811         void *hdr;
11812
11813         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11814         if (!msg)
11815                 return;
11816
11817         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11818         if (!hdr) {
11819                 nlmsg_free(msg);
11820                 return;
11821         }
11822
11823         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11824             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11825             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11826                 goto nla_put_failure;
11827
11828         genlmsg_end(msg, hdr);
11829
11830         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11831                                 NL80211_MCGRP_MLME, gfp);
11832         return;
11833
11834  nla_put_failure:
11835         genlmsg_cancel(msg, hdr);
11836         nlmsg_free(msg);
11837 }
11838
11839 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
11840                                         const u8* ie, u8 ie_len, gfp_t gfp)
11841 {
11842         struct wireless_dev *wdev = dev->ieee80211_ptr;
11843         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11844         struct sk_buff *msg;
11845         void *hdr;
11846
11847         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11848                 return;
11849
11850         trace_cfg80211_notify_new_peer_candidate(dev, addr);
11851
11852         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11853         if (!msg)
11854                 return;
11855
11856         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
11857         if (!hdr) {
11858                 nlmsg_free(msg);
11859                 return;
11860         }
11861
11862         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11863             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11864             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11865             (ie_len && ie &&
11866              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11867                 goto nla_put_failure;
11868
11869         genlmsg_end(msg, hdr);
11870
11871         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11872                                 NL80211_MCGRP_MLME, gfp);
11873         return;
11874
11875  nla_put_failure:
11876         genlmsg_cancel(msg, hdr);
11877         nlmsg_free(msg);
11878 }
11879 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11880
11881 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11882                                  struct net_device *netdev, const u8 *addr,
11883                                  enum nl80211_key_type key_type, int key_id,
11884                                  const u8 *tsc, gfp_t gfp)
11885 {
11886         struct sk_buff *msg;
11887         void *hdr;
11888
11889         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11890         if (!msg)
11891                 return;
11892
11893         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11894         if (!hdr) {
11895                 nlmsg_free(msg);
11896                 return;
11897         }
11898
11899         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11900             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11901             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11902             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11903             (key_id != -1 &&
11904              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11905             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11906                 goto nla_put_failure;
11907
11908         genlmsg_end(msg, hdr);
11909
11910         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11911                                 NL80211_MCGRP_MLME, gfp);
11912         return;
11913
11914  nla_put_failure:
11915         genlmsg_cancel(msg, hdr);
11916         nlmsg_free(msg);
11917 }
11918
11919 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11920                                     struct ieee80211_channel *channel_before,
11921                                     struct ieee80211_channel *channel_after)
11922 {
11923         struct sk_buff *msg;
11924         void *hdr;
11925         struct nlattr *nl_freq;
11926
11927         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11928         if (!msg)
11929                 return;
11930
11931         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11932         if (!hdr) {
11933                 nlmsg_free(msg);
11934                 return;
11935         }
11936
11937         /*
11938          * Since we are applying the beacon hint to a wiphy we know its
11939          * wiphy_idx is valid
11940          */
11941         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11942                 goto nla_put_failure;
11943
11944         /* Before */
11945         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11946         if (!nl_freq)
11947                 goto nla_put_failure;
11948         if (nl80211_msg_put_channel(msg, channel_before, false))
11949                 goto nla_put_failure;
11950         nla_nest_end(msg, nl_freq);
11951
11952         /* After */
11953         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11954         if (!nl_freq)
11955                 goto nla_put_failure;
11956         if (nl80211_msg_put_channel(msg, channel_after, false))
11957                 goto nla_put_failure;
11958         nla_nest_end(msg, nl_freq);
11959
11960         genlmsg_end(msg, hdr);
11961
11962         rcu_read_lock();
11963         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11964                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11965         rcu_read_unlock();
11966
11967         return;
11968
11969 nla_put_failure:
11970         genlmsg_cancel(msg, hdr);
11971         nlmsg_free(msg);
11972 }
11973
11974 static void nl80211_send_remain_on_chan_event(
11975         int cmd, struct cfg80211_registered_device *rdev,
11976         struct wireless_dev *wdev, u64 cookie,
11977         struct ieee80211_channel *chan,
11978         unsigned int duration, gfp_t gfp)
11979 {
11980         struct sk_buff *msg;
11981         void *hdr;
11982
11983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11984         if (!msg)
11985                 return;
11986
11987         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11988         if (!hdr) {
11989                 nlmsg_free(msg);
11990                 return;
11991         }
11992
11993         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11994             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11995                                          wdev->netdev->ifindex)) ||
11996             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11997             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11998             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11999                         NL80211_CHAN_NO_HT) ||
12000             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
12001                 goto nla_put_failure;
12002
12003         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12004             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12005                 goto nla_put_failure;
12006
12007         genlmsg_end(msg, hdr);
12008
12009         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12010                                 NL80211_MCGRP_MLME, gfp);
12011         return;
12012
12013  nla_put_failure:
12014         genlmsg_cancel(msg, hdr);
12015         nlmsg_free(msg);
12016 }
12017
12018 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12019                                struct ieee80211_channel *chan,
12020                                unsigned int duration, gfp_t gfp)
12021 {
12022         struct wiphy *wiphy = wdev->wiphy;
12023         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12024
12025         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12026         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12027                                           rdev, wdev, cookie, chan,
12028                                           duration, gfp);
12029 }
12030 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12031
12032 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12033                                         struct ieee80211_channel *chan,
12034                                         gfp_t gfp)
12035 {
12036         struct wiphy *wiphy = wdev->wiphy;
12037         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12038
12039         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12040         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12041                                           rdev, wdev, cookie, chan, 0, gfp);
12042 }
12043 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12044
12045 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12046                       struct station_info *sinfo, gfp_t gfp)
12047 {
12048         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12049         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12050         struct sk_buff *msg;
12051
12052         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12053
12054         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12055         if (!msg)
12056                 return;
12057
12058         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12059                                  rdev, dev, mac_addr, sinfo) < 0) {
12060                 nlmsg_free(msg);
12061                 return;
12062         }
12063
12064         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12065                                 NL80211_MCGRP_MLME, gfp);
12066 }
12067 EXPORT_SYMBOL(cfg80211_new_sta);
12068
12069 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12070                             struct station_info *sinfo, gfp_t gfp)
12071 {
12072         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12073         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12074         struct sk_buff *msg;
12075         struct station_info empty_sinfo = {};
12076
12077         if (!sinfo)
12078                 sinfo = &empty_sinfo;
12079
12080         trace_cfg80211_del_sta(dev, mac_addr);
12081
12082         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12083         if (!msg)
12084                 return;
12085
12086         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12087                                  rdev, dev, mac_addr, sinfo) < 0) {
12088                 nlmsg_free(msg);
12089                 return;
12090         }
12091
12092         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12093                                 NL80211_MCGRP_MLME, gfp);
12094 }
12095 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12096
12097 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12098                           enum nl80211_connect_failed_reason reason,
12099                           gfp_t gfp)
12100 {
12101         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12102         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12103         struct sk_buff *msg;
12104         void *hdr;
12105
12106         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12107         if (!msg)
12108                 return;
12109
12110         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12111         if (!hdr) {
12112                 nlmsg_free(msg);
12113                 return;
12114         }
12115
12116         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12117             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12118             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12119                 goto nla_put_failure;
12120
12121         genlmsg_end(msg, hdr);
12122
12123         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12124                                 NL80211_MCGRP_MLME, gfp);
12125         return;
12126
12127  nla_put_failure:
12128         genlmsg_cancel(msg, hdr);
12129         nlmsg_free(msg);
12130 }
12131 EXPORT_SYMBOL(cfg80211_conn_failed);
12132
12133 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12134                                        const u8 *addr, gfp_t gfp)
12135 {
12136         struct wireless_dev *wdev = dev->ieee80211_ptr;
12137         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12138         struct sk_buff *msg;
12139         void *hdr;
12140         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12141
12142         if (!nlportid)
12143                 return false;
12144
12145         msg = nlmsg_new(100, gfp);
12146         if (!msg)
12147                 return true;
12148
12149         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12150         if (!hdr) {
12151                 nlmsg_free(msg);
12152                 return true;
12153         }
12154
12155         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12156             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12157             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12158                 goto nla_put_failure;
12159
12160         genlmsg_end(msg, hdr);
12161         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12162         return true;
12163
12164  nla_put_failure:
12165         genlmsg_cancel(msg, hdr);
12166         nlmsg_free(msg);
12167         return true;
12168 }
12169
12170 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12171                                 const u8 *addr, gfp_t gfp)
12172 {
12173         struct wireless_dev *wdev = dev->ieee80211_ptr;
12174         bool ret;
12175
12176         trace_cfg80211_rx_spurious_frame(dev, addr);
12177
12178         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12179                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12180                 trace_cfg80211_return_bool(false);
12181                 return false;
12182         }
12183         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12184                                          addr, gfp);
12185         trace_cfg80211_return_bool(ret);
12186         return ret;
12187 }
12188 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12189
12190 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12191                                         const u8 *addr, gfp_t gfp)
12192 {
12193         struct wireless_dev *wdev = dev->ieee80211_ptr;
12194         bool ret;
12195
12196         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12197
12198         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12199                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12200                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12201                 trace_cfg80211_return_bool(false);
12202                 return false;
12203         }
12204         ret = __nl80211_unexpected_frame(dev,
12205                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12206                                          addr, gfp);
12207         trace_cfg80211_return_bool(ret);
12208         return ret;
12209 }
12210 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12211
12212 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12213                       struct wireless_dev *wdev, u32 nlportid,
12214                       int freq, int sig_dbm,
12215                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12216 {
12217         struct net_device *netdev = wdev->netdev;
12218         struct sk_buff *msg;
12219         void *hdr;
12220
12221         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12222         if (!msg)
12223                 return -ENOMEM;
12224
12225         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12226         if (!hdr) {
12227                 nlmsg_free(msg);
12228                 return -ENOMEM;
12229         }
12230
12231         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12232             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12233                                         netdev->ifindex)) ||
12234             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12235             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12236             (sig_dbm &&
12237              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12238             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12239             (flags &&
12240              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12241                 goto nla_put_failure;
12242
12243         genlmsg_end(msg, hdr);
12244
12245         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12246
12247  nla_put_failure:
12248         genlmsg_cancel(msg, hdr);
12249         nlmsg_free(msg);
12250         return -ENOBUFS;
12251 }
12252
12253 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12254                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12255 {
12256         struct wiphy *wiphy = wdev->wiphy;
12257         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12258         struct net_device *netdev = wdev->netdev;
12259         struct sk_buff *msg;
12260         void *hdr;
12261
12262         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12263
12264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12265         if (!msg)
12266                 return;
12267
12268         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12269         if (!hdr) {
12270                 nlmsg_free(msg);
12271                 return;
12272         }
12273
12274         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12275             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12276                                    netdev->ifindex)) ||
12277             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12278             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12279             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12280             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12281                 goto nla_put_failure;
12282
12283         genlmsg_end(msg, hdr);
12284
12285         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12286                                 NL80211_MCGRP_MLME, gfp);
12287         return;
12288
12289  nla_put_failure:
12290         genlmsg_cancel(msg, hdr);
12291         nlmsg_free(msg);
12292 }
12293 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12294
12295 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12296                                             const char *mac, gfp_t gfp)
12297 {
12298         struct wireless_dev *wdev = dev->ieee80211_ptr;
12299         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12300         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12301         void **cb;
12302
12303         if (!msg)
12304                 return NULL;
12305
12306         cb = (void **)msg->cb;
12307
12308         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12309         if (!cb[0]) {
12310                 nlmsg_free(msg);
12311                 return NULL;
12312         }
12313
12314         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12315             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12316                 goto nla_put_failure;
12317
12318         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12319                 goto nla_put_failure;
12320
12321         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12322         if (!cb[1])
12323                 goto nla_put_failure;
12324
12325         cb[2] = rdev;
12326
12327         return msg;
12328  nla_put_failure:
12329         nlmsg_free(msg);
12330         return NULL;
12331 }
12332
12333 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12334 {
12335         void **cb = (void **)msg->cb;
12336         struct cfg80211_registered_device *rdev = cb[2];
12337
12338         nla_nest_end(msg, cb[1]);
12339         genlmsg_end(msg, cb[0]);
12340
12341         memset(msg->cb, 0, sizeof(msg->cb));
12342
12343         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12344                                 NL80211_MCGRP_MLME, gfp);
12345 }
12346
12347 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12348                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12349                               gfp_t gfp)
12350 {
12351         struct sk_buff *msg;
12352
12353         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12354
12355         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12356                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12357                 return;
12358
12359         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12360         if (!msg)
12361                 return;
12362
12363         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12364                         rssi_event))
12365                 goto nla_put_failure;
12366
12367         cfg80211_send_cqm(msg, gfp);
12368
12369         return;
12370
12371  nla_put_failure:
12372         nlmsg_free(msg);
12373 }
12374 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12375
12376 void cfg80211_cqm_txe_notify(struct net_device *dev,
12377                              const u8 *peer, u32 num_packets,
12378                              u32 rate, u32 intvl, gfp_t gfp)
12379 {
12380         struct sk_buff *msg;
12381
12382         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12383         if (!msg)
12384                 return;
12385
12386         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12387                 goto nla_put_failure;
12388
12389         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12390                 goto nla_put_failure;
12391
12392         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12393                 goto nla_put_failure;
12394
12395         cfg80211_send_cqm(msg, gfp);
12396         return;
12397
12398  nla_put_failure:
12399         nlmsg_free(msg);
12400 }
12401 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12402
12403 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12404                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12405 {
12406         struct sk_buff *msg;
12407
12408         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12409
12410         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12411         if (!msg)
12412                 return;
12413
12414         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12415                 goto nla_put_failure;
12416
12417         cfg80211_send_cqm(msg, gfp);
12418         return;
12419
12420  nla_put_failure:
12421         nlmsg_free(msg);
12422 }
12423 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12424
12425 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12426 {
12427         struct sk_buff *msg;
12428
12429         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12430         if (!msg)
12431                 return;
12432
12433         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12434                 goto nla_put_failure;
12435
12436         cfg80211_send_cqm(msg, gfp);
12437         return;
12438
12439  nla_put_failure:
12440         nlmsg_free(msg);
12441 }
12442 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12443
12444 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12445                                      struct net_device *netdev, const u8 *bssid,
12446                                      const u8 *replay_ctr, gfp_t gfp)
12447 {
12448         struct sk_buff *msg;
12449         struct nlattr *rekey_attr;
12450         void *hdr;
12451
12452         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12453         if (!msg)
12454                 return;
12455
12456         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12457         if (!hdr) {
12458                 nlmsg_free(msg);
12459                 return;
12460         }
12461
12462         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12463             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12464             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12465                 goto nla_put_failure;
12466
12467         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12468         if (!rekey_attr)
12469                 goto nla_put_failure;
12470
12471         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12472                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12473                 goto nla_put_failure;
12474
12475         nla_nest_end(msg, rekey_attr);
12476
12477         genlmsg_end(msg, hdr);
12478
12479         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12480                                 NL80211_MCGRP_MLME, gfp);
12481         return;
12482
12483  nla_put_failure:
12484         genlmsg_cancel(msg, hdr);
12485         nlmsg_free(msg);
12486 }
12487
12488 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12489                                const u8 *replay_ctr, gfp_t gfp)
12490 {
12491         struct wireless_dev *wdev = dev->ieee80211_ptr;
12492         struct wiphy *wiphy = wdev->wiphy;
12493         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12494
12495         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12496         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12497 }
12498 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12499
12500 static void
12501 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12502                                struct net_device *netdev, int index,
12503                                const u8 *bssid, bool preauth, gfp_t gfp)
12504 {
12505         struct sk_buff *msg;
12506         struct nlattr *attr;
12507         void *hdr;
12508
12509         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12510         if (!msg)
12511                 return;
12512
12513         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12514         if (!hdr) {
12515                 nlmsg_free(msg);
12516                 return;
12517         }
12518
12519         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12520             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12521                 goto nla_put_failure;
12522
12523         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12524         if (!attr)
12525                 goto nla_put_failure;
12526
12527         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12528             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12529             (preauth &&
12530              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12531                 goto nla_put_failure;
12532
12533         nla_nest_end(msg, attr);
12534
12535         genlmsg_end(msg, hdr);
12536
12537         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12538                                 NL80211_MCGRP_MLME, gfp);
12539         return;
12540
12541  nla_put_failure:
12542         genlmsg_cancel(msg, hdr);
12543         nlmsg_free(msg);
12544 }
12545
12546 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12547                                      const u8 *bssid, bool preauth, gfp_t gfp)
12548 {
12549         struct wireless_dev *wdev = dev->ieee80211_ptr;
12550         struct wiphy *wiphy = wdev->wiphy;
12551         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12552
12553         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12554         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12555 }
12556 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12557
12558 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12559                                      struct net_device *netdev,
12560                                      struct cfg80211_chan_def *chandef,
12561                                      gfp_t gfp,
12562                                      enum nl80211_commands notif,
12563                                      u8 count)
12564 {
12565         struct sk_buff *msg;
12566         void *hdr;
12567
12568         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12569         if (!msg)
12570                 return;
12571
12572         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12573         if (!hdr) {
12574                 nlmsg_free(msg);
12575                 return;
12576         }
12577
12578         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12579                 goto nla_put_failure;
12580
12581         if (nl80211_send_chandef(msg, chandef))
12582                 goto nla_put_failure;
12583
12584         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12585             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12586                         goto nla_put_failure;
12587
12588         genlmsg_end(msg, hdr);
12589
12590         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12591                                 NL80211_MCGRP_MLME, gfp);
12592         return;
12593
12594  nla_put_failure:
12595         genlmsg_cancel(msg, hdr);
12596         nlmsg_free(msg);
12597 }
12598
12599 void cfg80211_ch_switch_notify(struct net_device *dev,
12600                                struct cfg80211_chan_def *chandef)
12601 {
12602         struct wireless_dev *wdev = dev->ieee80211_ptr;
12603         struct wiphy *wiphy = wdev->wiphy;
12604         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12605
12606         ASSERT_WDEV_LOCK(wdev);
12607
12608         trace_cfg80211_ch_switch_notify(dev, chandef);
12609
12610         wdev->chandef = *chandef;
12611         wdev->preset_chandef = *chandef;
12612         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12613                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12614 }
12615 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
12616
12617 void cfg80211_ch_switch_started_notify(struct net_device *dev,
12618                                        struct cfg80211_chan_def *chandef,
12619                                        u8 count)
12620 {
12621         struct wireless_dev *wdev = dev->ieee80211_ptr;
12622         struct wiphy *wiphy = wdev->wiphy;
12623         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12624
12625         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12626
12627         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12628                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12629 }
12630 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12631
12632 void
12633 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12634                      const struct cfg80211_chan_def *chandef,
12635                      enum nl80211_radar_event event,
12636                      struct net_device *netdev, gfp_t gfp)
12637 {
12638         struct sk_buff *msg;
12639         void *hdr;
12640
12641         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12642         if (!msg)
12643                 return;
12644
12645         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12646         if (!hdr) {
12647                 nlmsg_free(msg);
12648                 return;
12649         }
12650
12651         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12652                 goto nla_put_failure;
12653
12654         /* NOP and radar events don't need a netdev parameter */
12655         if (netdev) {
12656                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12657
12658                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12659                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12660                         goto nla_put_failure;
12661         }
12662
12663         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12664                 goto nla_put_failure;
12665
12666         if (nl80211_send_chandef(msg, chandef))
12667                 goto nla_put_failure;
12668
12669         genlmsg_end(msg, hdr);
12670
12671         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12672                                 NL80211_MCGRP_MLME, gfp);
12673         return;
12674
12675  nla_put_failure:
12676         genlmsg_cancel(msg, hdr);
12677         nlmsg_free(msg);
12678 }
12679
12680 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12681                            u64 cookie, bool acked, gfp_t gfp)
12682 {
12683         struct wireless_dev *wdev = dev->ieee80211_ptr;
12684         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12685         struct sk_buff *msg;
12686         void *hdr;
12687
12688         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12689
12690         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12691
12692         if (!msg)
12693                 return;
12694
12695         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12696         if (!hdr) {
12697                 nlmsg_free(msg);
12698                 return;
12699         }
12700
12701         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12702             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12703             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12704             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12705             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12706                 goto nla_put_failure;
12707
12708         genlmsg_end(msg, hdr);
12709
12710         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12711                                 NL80211_MCGRP_MLME, gfp);
12712         return;
12713
12714  nla_put_failure:
12715         genlmsg_cancel(msg, hdr);
12716         nlmsg_free(msg);
12717 }
12718 EXPORT_SYMBOL(cfg80211_probe_status);
12719
12720 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12721                                  const u8 *frame, size_t len,
12722                                  int freq, int sig_dbm)
12723 {
12724         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12725         struct sk_buff *msg;
12726         void *hdr;
12727         struct cfg80211_beacon_registration *reg;
12728
12729         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12730
12731         spin_lock_bh(&rdev->beacon_registrations_lock);
12732         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12733                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12734                 if (!msg) {
12735                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12736                         return;
12737                 }
12738
12739                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12740                 if (!hdr)
12741                         goto nla_put_failure;
12742
12743                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12744                     (freq &&
12745                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12746                     (sig_dbm &&
12747                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12748                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12749                         goto nla_put_failure;
12750
12751                 genlmsg_end(msg, hdr);
12752
12753                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12754         }
12755         spin_unlock_bh(&rdev->beacon_registrations_lock);
12756         return;
12757
12758  nla_put_failure:
12759         spin_unlock_bh(&rdev->beacon_registrations_lock);
12760         if (hdr)
12761                 genlmsg_cancel(msg, hdr);
12762         nlmsg_free(msg);
12763 }
12764 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12765
12766 #ifdef CONFIG_PM
12767 static int cfg80211_net_detect_results(struct sk_buff *msg,
12768                                        struct cfg80211_wowlan_wakeup *wakeup)
12769 {
12770         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12771         struct nlattr *nl_results, *nl_match, *nl_freqs;
12772         int i, j;
12773
12774         nl_results = nla_nest_start(
12775                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12776         if (!nl_results)
12777                 return -EMSGSIZE;
12778
12779         for (i = 0; i < nd->n_matches; i++) {
12780                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12781
12782                 nl_match = nla_nest_start(msg, i);
12783                 if (!nl_match)
12784                         break;
12785
12786                 /* The SSID attribute is optional in nl80211, but for
12787                  * simplicity reasons it's always present in the
12788                  * cfg80211 structure.  If a driver can't pass the
12789                  * SSID, that needs to be changed.  A zero length SSID
12790                  * is still a valid SSID (wildcard), so it cannot be
12791                  * used for this purpose.
12792                  */
12793                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
12794                             match->ssid.ssid)) {
12795                         nla_nest_cancel(msg, nl_match);
12796                         goto out;
12797                 }
12798
12799                 if (match->n_channels) {
12800                         nl_freqs = nla_nest_start(
12801                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
12802                         if (!nl_freqs) {
12803                                 nla_nest_cancel(msg, nl_match);
12804                                 goto out;
12805                         }
12806
12807                         for (j = 0; j < match->n_channels; j++) {
12808                                 if (nla_put_u32(msg, j, match->channels[j])) {
12809                                         nla_nest_cancel(msg, nl_freqs);
12810                                         nla_nest_cancel(msg, nl_match);
12811                                         goto out;
12812                                 }
12813                         }
12814
12815                         nla_nest_end(msg, nl_freqs);
12816                 }
12817
12818                 nla_nest_end(msg, nl_match);
12819         }
12820
12821 out:
12822         nla_nest_end(msg, nl_results);
12823         return 0;
12824 }
12825
12826 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
12827                                    struct cfg80211_wowlan_wakeup *wakeup,
12828                                    gfp_t gfp)
12829 {
12830         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12831         struct sk_buff *msg;
12832         void *hdr;
12833         int size = 200;
12834
12835         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
12836
12837         if (wakeup)
12838                 size += wakeup->packet_present_len;
12839
12840         msg = nlmsg_new(size, gfp);
12841         if (!msg)
12842                 return;
12843
12844         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
12845         if (!hdr)
12846                 goto free_msg;
12847
12848         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12849             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12850                 goto free_msg;
12851
12852         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12853                                         wdev->netdev->ifindex))
12854                 goto free_msg;
12855
12856         if (wakeup) {
12857                 struct nlattr *reasons;
12858
12859                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12860                 if (!reasons)
12861                         goto free_msg;
12862
12863                 if (wakeup->disconnect &&
12864                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
12865                         goto free_msg;
12866                 if (wakeup->magic_pkt &&
12867                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
12868                         goto free_msg;
12869                 if (wakeup->gtk_rekey_failure &&
12870                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
12871                         goto free_msg;
12872                 if (wakeup->eap_identity_req &&
12873                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
12874                         goto free_msg;
12875                 if (wakeup->four_way_handshake &&
12876                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
12877                         goto free_msg;
12878                 if (wakeup->rfkill_release &&
12879                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
12880                         goto free_msg;
12881
12882                 if (wakeup->pattern_idx >= 0 &&
12883                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
12884                                 wakeup->pattern_idx))
12885                         goto free_msg;
12886
12887                 if (wakeup->tcp_match &&
12888                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
12889                         goto free_msg;
12890
12891                 if (wakeup->tcp_connlost &&
12892                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
12893                         goto free_msg;
12894
12895                 if (wakeup->tcp_nomoretokens &&
12896                     nla_put_flag(msg,
12897                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
12898                         goto free_msg;
12899
12900                 if (wakeup->packet) {
12901                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
12902                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
12903
12904                         if (!wakeup->packet_80211) {
12905                                 pkt_attr =
12906                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
12907                                 len_attr =
12908                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
12909                         }
12910
12911                         if (wakeup->packet_len &&
12912                             nla_put_u32(msg, len_attr, wakeup->packet_len))
12913                                 goto free_msg;
12914
12915                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
12916                                     wakeup->packet))
12917                                 goto free_msg;
12918                 }
12919
12920                 if (wakeup->net_detect &&
12921                     cfg80211_net_detect_results(msg, wakeup))
12922                                 goto free_msg;
12923
12924                 nla_nest_end(msg, reasons);
12925         }
12926
12927         genlmsg_end(msg, hdr);
12928
12929         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12930                                 NL80211_MCGRP_MLME, gfp);
12931         return;
12932
12933  free_msg:
12934         nlmsg_free(msg);
12935 }
12936 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12937 #endif
12938
12939 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12940                                 enum nl80211_tdls_operation oper,
12941                                 u16 reason_code, gfp_t gfp)
12942 {
12943         struct wireless_dev *wdev = dev->ieee80211_ptr;
12944         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12945         struct sk_buff *msg;
12946         void *hdr;
12947
12948         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12949                                          reason_code);
12950
12951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12952         if (!msg)
12953                 return;
12954
12955         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12956         if (!hdr) {
12957                 nlmsg_free(msg);
12958                 return;
12959         }
12960
12961         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12962             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12963             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12964             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12965             (reason_code > 0 &&
12966              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12967                 goto nla_put_failure;
12968
12969         genlmsg_end(msg, hdr);
12970
12971         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12972                                 NL80211_MCGRP_MLME, gfp);
12973         return;
12974
12975  nla_put_failure:
12976         genlmsg_cancel(msg, hdr);
12977         nlmsg_free(msg);
12978 }
12979 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12980
12981 static int nl80211_netlink_notify(struct notifier_block * nb,
12982                                   unsigned long state,
12983                                   void *_notify)
12984 {
12985         struct netlink_notify *notify = _notify;
12986         struct cfg80211_registered_device *rdev;
12987         struct wireless_dev *wdev;
12988         struct cfg80211_beacon_registration *reg, *tmp;
12989
12990         if (state != NETLINK_URELEASE)
12991                 return NOTIFY_DONE;
12992
12993         rcu_read_lock();
12994
12995         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12996                 bool schedule_destroy_work = false;
12997                 bool schedule_scan_stop = false;
12998                 struct cfg80211_sched_scan_request *sched_scan_req =
12999                         rcu_dereference(rdev->sched_scan_req);
13000
13001                 if (sched_scan_req && notify->portid &&
13002                     sched_scan_req->owner_nlportid == notify->portid)
13003                         schedule_scan_stop = true;
13004
13005                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
13006                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13007
13008                         if (wdev->owner_nlportid == notify->portid)
13009                                 schedule_destroy_work = true;
13010                 }
13011
13012                 spin_lock_bh(&rdev->beacon_registrations_lock);
13013                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13014                                          list) {
13015                         if (reg->nlportid == notify->portid) {
13016                                 list_del(&reg->list);
13017                                 kfree(reg);
13018                                 break;
13019                         }
13020                 }
13021                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13022
13023                 if (schedule_destroy_work) {
13024                         struct cfg80211_iface_destroy *destroy;
13025
13026                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13027                         if (destroy) {
13028                                 destroy->nlportid = notify->portid;
13029                                 spin_lock(&rdev->destroy_list_lock);
13030                                 list_add(&destroy->list, &rdev->destroy_list);
13031                                 spin_unlock(&rdev->destroy_list_lock);
13032                                 schedule_work(&rdev->destroy_work);
13033                         }
13034                 } else if (schedule_scan_stop) {
13035                         sched_scan_req->owner_nlportid = 0;
13036
13037                         if (rdev->ops->sched_scan_stop &&
13038                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13039                                 schedule_work(&rdev->sched_scan_stop_wk);
13040                 }
13041         }
13042
13043         rcu_read_unlock();
13044
13045         /*
13046          * It is possible that the user space process that is controlling the
13047          * indoor setting disappeared, so notify the regulatory core.
13048          */
13049         regulatory_netlink_notify(notify->portid);
13050         return NOTIFY_OK;
13051 }
13052
13053 static struct notifier_block nl80211_netlink_notifier = {
13054         .notifier_call = nl80211_netlink_notify,
13055 };
13056
13057 void cfg80211_ft_event(struct net_device *netdev,
13058                        struct cfg80211_ft_event_params *ft_event)
13059 {
13060         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13061         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13062         struct sk_buff *msg;
13063         void *hdr;
13064
13065         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13066
13067         if (!ft_event->target_ap)
13068                 return;
13069
13070         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13071         if (!msg)
13072                 return;
13073
13074         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13075         if (!hdr)
13076                 goto out;
13077
13078         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13079             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13080             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13081                 goto out;
13082
13083         if (ft_event->ies &&
13084             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13085                 goto out;
13086         if (ft_event->ric_ies &&
13087             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13088                     ft_event->ric_ies))
13089                 goto out;
13090
13091         genlmsg_end(msg, hdr);
13092
13093         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13094                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13095         return;
13096  out:
13097         nlmsg_free(msg);
13098 }
13099 EXPORT_SYMBOL(cfg80211_ft_event);
13100
13101 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13102 {
13103         struct cfg80211_registered_device *rdev;
13104         struct sk_buff *msg;
13105         void *hdr;
13106         u32 nlportid;
13107
13108         rdev = wiphy_to_rdev(wdev->wiphy);
13109         if (!rdev->crit_proto_nlportid)
13110                 return;
13111
13112         nlportid = rdev->crit_proto_nlportid;
13113         rdev->crit_proto_nlportid = 0;
13114
13115         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13116         if (!msg)
13117                 return;
13118
13119         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13120         if (!hdr)
13121                 goto nla_put_failure;
13122
13123         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13124             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13125                 goto nla_put_failure;
13126
13127         genlmsg_end(msg, hdr);
13128
13129         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13130         return;
13131
13132  nla_put_failure:
13133         if (hdr)
13134                 genlmsg_cancel(msg, hdr);
13135         nlmsg_free(msg);
13136
13137 }
13138 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13139
13140 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13141 {
13142         struct wiphy *wiphy = wdev->wiphy;
13143         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13144         struct sk_buff *msg;
13145         void *hdr;
13146
13147         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13148         if (!msg)
13149                 return;
13150
13151         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13152         if (!hdr)
13153                 goto out;
13154
13155         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13156             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13157             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13158                 goto out;
13159
13160         genlmsg_end(msg, hdr);
13161
13162         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13163                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13164         return;
13165  out:
13166         nlmsg_free(msg);
13167 }
13168
13169 /* initialisation/exit functions */
13170
13171 int nl80211_init(void)
13172 {
13173         int err;
13174
13175         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13176                                                    nl80211_mcgrps);
13177         if (err)
13178                 return err;
13179
13180         err = netlink_register_notifier(&nl80211_netlink_notifier);
13181         if (err)
13182                 goto err_out;
13183
13184         return 0;
13185  err_out:
13186         genl_unregister_family(&nl80211_fam);
13187         return err;
13188 }
13189
13190 void nl80211_exit(void)
13191 {
13192         netlink_unregister_notifier(&nl80211_netlink_notifier);
13193         genl_unregister_family(&nl80211_fam);
13194 }