net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015       Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170                 netdev = __dev_get_by_index(netns, ifindex);
 171                 if (netdev) {
 172                         if (netdev->ieee80211_ptr)
 173                                 tmp = wiphy_to_rdev(
 174                                         netdev->ieee80211_ptr->wiphy);
 175                         else
 176                                 tmp = NULL;
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 231
 232         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 235
 236         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 237         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 238
 239         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 240         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 241                                     .len = WLAN_MAX_KEY_LEN },
 242         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 243         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 244         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 245         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 246         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 249         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 250         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 251                                        .len = IEEE80211_MAX_DATA_LEN },
 252         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 255         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 256         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 258                                                .len = NL80211_MAX_SUPP_RATES },
 259         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 260         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 261         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 262         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 263                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 264         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 265
 266         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 267         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 268
 269         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 273                                            .len = NL80211_MAX_SUPP_RATES },
 274         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 275
 276         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 277         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 278
 279         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 280
 281         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 282         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 283                               .len = IEEE80211_MAX_DATA_LEN },
 284         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 286
 287         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 288                                 .len = IEEE80211_MAX_SSID_LEN },
 289         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 290         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 291         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_STA_FLAGS2] = {
 295                 .len = sizeof(struct nl80211_sta_flag_update),
 296         },
 297         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 303         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 304         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 305         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 306                                  .len = WLAN_PMKID_LEN },
 307         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 308         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 309         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 310         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 311                                  .len = IEEE80211_MAX_DATA_LEN },
 312         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 313         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 315         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 323         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 327         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 328         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 331         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 332                                          .len = IEEE80211_MAX_DATA_LEN },
 333         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 361         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 362         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 363         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 365         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 366         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 367         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 369                 .len = NL80211_VHT_CAPABILITY_LEN,
 370         },
 371         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 372         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 373                                   .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 376         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 378         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 384         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 387         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 388                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 389         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 390         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 391         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 394         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 396         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 397         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 398         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 401         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 402         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 403         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 404 };
 405
 406 /* policy for the key attributes */
 407 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 408         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 409         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 410         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 411         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 412         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 413         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 414         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 415         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 416 };
 417
 418 /* policy for the key default flags */
 419 static const struct nla_policy
 420 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 421         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 422         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 423 };
 424
 425 /* policy for WoWLAN attributes */
 426 static const struct nla_policy
 427 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 428         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 432         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 435         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 436         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 437         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 438 };
 439
 440 static const struct nla_policy
 441 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 442         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 443         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 444         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 445         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 446         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 447         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 448         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 449                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 450         },
 451         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 452                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 453         },
 454         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 455         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 456         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 457 };
 458
 459 /* policy for coalesce rule attributes */
 460 static const struct nla_policy
 461 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 462         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 463         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 464         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 465 };
 466
 467 /* policy for GTK rekey offload attributes */
 468 static const struct nla_policy
 469 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 470         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 471         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 472         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 473 };
 474
 475 static const struct nla_policy
 476 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 477         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 478                                                  .len = IEEE80211_MAX_SSID_LEN },
 479         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 480 };
 481
 482 static const struct nla_policy
 483 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 484         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 485         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 486 };
 487
 488 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 489                                      struct netlink_callback *cb,
 490                                      struct cfg80211_registered_device **rdev,
 491                                      struct wireless_dev **wdev)
 492 {
 493         int err;
 494
 495         rtnl_lock();
 496
 497         if (!cb->args[0]) {
 498                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 499                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 500                                   nl80211_policy);
 501                 if (err)
 502                         goto out_unlock;
 503
 504                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 505                                                    nl80211_fam.attrbuf);
 506                 if (IS_ERR(*wdev)) {
 507                         err = PTR_ERR(*wdev);
 508                         goto out_unlock;
 509                 }
 510                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 511                 /* 0 is the first index - add 1 to parse only once */
 512                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 513                 cb->args[1] = (*wdev)->identifier;
 514         } else {
 515                 /* subtract the 1 again here */
 516                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 517                 struct wireless_dev *tmp;
 518
 519                 if (!wiphy) {
 520                         err = -ENODEV;
 521                         goto out_unlock;
 522                 }
 523                 *rdev = wiphy_to_rdev(wiphy);
 524                 *wdev = NULL;
 525
 526                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 527                         if (tmp->identifier == cb->args[1]) {
 528                                 *wdev = tmp;
 529                                 break;
 530                         }
 531                 }
 532
 533                 if (!*wdev) {
 534                         err = -ENODEV;
 535                         goto out_unlock;
 536                 }
 537         }
 538
 539         return 0;
 540  out_unlock:
 541         rtnl_unlock();
 542         return err;
 543 }
 544
 545 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 546 {
 547         rtnl_unlock();
 548 }
 549
 550 /* IE validation */
 551 static bool is_valid_ie_attr(const struct nlattr *attr)
 552 {
 553         const u8 *pos;
 554         int len;
 555
 556         if (!attr)
 557                 return true;
 558
 559         pos = nla_data(attr);
 560         len = nla_len(attr);
 561
 562         while (len) {
 563                 u8 elemlen;
 564
 565                 if (len < 2)
 566                         return false;
 567                 len -= 2;
 568
 569                 elemlen = pos[1];
 570                 if (elemlen > len)
 571                         return false;
 572
 573                 len -= elemlen;
 574                 pos += 2 + elemlen;
 575         }
 576
 577         return true;
 578 }
 579
 580 /* message building helper */
 581 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 582                                    int flags, u8 cmd)
 583 {
 584         /* since there is no private header just add the generic one */
 585         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 586 }
 587
 588 static int nl80211_msg_put_channel(struct sk_buff *msg,
 589                                    struct ieee80211_channel *chan,
 590                                    bool large)
 591 {
 592         /* Some channels must be completely excluded from the
 593          * list to protect old user-space tools from breaking
 594          */
 595         if (!large && chan->flags &
 596             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 597                 return 0;
 598
 599         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 600                         chan->center_freq))
 601                 goto nla_put_failure;
 602
 603         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 604             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 605                 goto nla_put_failure;
 606         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 607                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 608                         goto nla_put_failure;
 609                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 610                         goto nla_put_failure;
 611         }
 612         if (chan->flags & IEEE80211_CHAN_RADAR) {
 613                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 614                         goto nla_put_failure;
 615                 if (large) {
 616                         u32 time;
 617
 618                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 619
 620                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 621                                         chan->dfs_state))
 622                                 goto nla_put_failure;
 623                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 624                                         time))
 625                                 goto nla_put_failure;
 626                         if (nla_put_u32(msg,
 627                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 628                                         chan->dfs_cac_ms))
 629                                 goto nla_put_failure;
 630                 }
 631         }
 632
 633         if (large) {
 634                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 635                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 636                         goto nla_put_failure;
 637                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 638                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 639                         goto nla_put_failure;
 640                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 641                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 642                         goto nla_put_failure;
 643                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 644                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 645                         goto nla_put_failure;
 646                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 651                         goto nla_put_failure;
 652                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 653                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 654                         goto nla_put_failure;
 655                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 656                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 657                         goto nla_put_failure;
 658         }
 659
 660         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 661                         DBM_TO_MBM(chan->max_power)))
 662                 goto nla_put_failure;
 663
 664         return 0;
 665
 666  nla_put_failure:
 667         return -ENOBUFS;
 668 }
 669
 670 /* netlink command implementations */
 671
 672 struct key_parse {
 673         struct key_params p;
 674         int idx;
 675         int type;
 676         bool def, defmgmt;
 677         bool def_uni, def_multi;
 678 };
 679
 680 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 681 {
 682         struct nlattr *tb[NL80211_KEY_MAX + 1];
 683         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 684                                    nl80211_key_policy);
 685         if (err)
 686                 return err;
 687
 688         k->def = !!tb[NL80211_KEY_DEFAULT];
 689         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 690
 691         if (k->def) {
 692                 k->def_uni = true;
 693                 k->def_multi = true;
 694         }
 695         if (k->defmgmt)
 696                 k->def_multi = true;
 697
 698         if (tb[NL80211_KEY_IDX])
 699                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 700
 701         if (tb[NL80211_KEY_DATA]) {
 702                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 703                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 704         }
 705
 706         if (tb[NL80211_KEY_SEQ]) {
 707                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 708                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 709         }
 710
 711         if (tb[NL80211_KEY_CIPHER])
 712                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 713
 714         if (tb[NL80211_KEY_TYPE]) {
 715                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 716                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 717                         return -EINVAL;
 718         }
 719
 720         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 721                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 722                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 723                                        tb[NL80211_KEY_DEFAULT_TYPES],
 724                                        nl80211_key_default_policy);
 725                 if (err)
 726                         return err;
 727
 728                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 729                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 730         }
 731
 732         return 0;
 733 }
 734
 735 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 736 {
 737         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 738                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 739                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 740         }
 741
 742         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 743                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 744                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 745         }
 746
 747         if (info->attrs[NL80211_ATTR_KEY_IDX])
 748                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 749
 750         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 751                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 752
 753         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 754         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 755
 756         if (k->def) {
 757                 k->def_uni = true;
 758                 k->def_multi = true;
 759         }
 760         if (k->defmgmt)
 761                 k->def_multi = true;
 762
 763         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 764                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 765                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 766                         return -EINVAL;
 767         }
 768
 769         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 770                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 771                 int err = nla_parse_nested(
 772                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 773                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 774                                 nl80211_key_default_policy);
 775                 if (err)
 776                         return err;
 777
 778                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 779                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 780         }
 781
 782         return 0;
 783 }
 784
 785 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 786 {
 787         int err;
 788
 789         memset(k, 0, sizeof(*k));
 790         k->idx = -1;
 791         k->type = -1;
 792
 793         if (info->attrs[NL80211_ATTR_KEY])
 794                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 795         else
 796                 err = nl80211_parse_key_old(info, k);
 797
 798         if (err)
 799                 return err;
 800
 801         if (k->def && k->defmgmt)
 802                 return -EINVAL;
 803
 804         if (k->defmgmt) {
 805                 if (k->def_uni || !k->def_multi)
 806                         return -EINVAL;
 807         }
 808
 809         if (k->idx != -1) {
 810                 if (k->defmgmt) {
 811                         if (k->idx < 4 || k->idx > 5)
 812                                 return -EINVAL;
 813                 } else if (k->def) {
 814                         if (k->idx < 0 || k->idx > 3)
 815                                 return -EINVAL;
 816                 } else {
 817                         if (k->idx < 0 || k->idx > 5)
 818                                 return -EINVAL;
 819                 }
 820         }
 821
 822         return 0;
 823 }
 824
 825 static struct cfg80211_cached_keys *
 826 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 827                        struct nlattr *keys, bool *no_ht)
 828 {
 829         struct key_parse parse;
 830         struct nlattr *key;
 831         struct cfg80211_cached_keys *result;
 832         int rem, err, def = 0;
 833
 834         result = kzalloc(sizeof(*result), GFP_KERNEL);
 835         if (!result)
 836                 return ERR_PTR(-ENOMEM);
 837
 838         result->def = -1;
 839         result->defmgmt = -1;
 840
 841         nla_for_each_nested(key, keys, rem) {
 842                 memset(&parse, 0, sizeof(parse));
 843                 parse.idx = -1;
 844
 845                 err = nl80211_parse_key_new(key, &parse);
 846                 if (err)
 847                         goto error;
 848                 err = -EINVAL;
 849                 if (!parse.p.key)
 850                         goto error;
 851                 if (parse.idx < 0 || parse.idx > 4)
 852                         goto error;
 853                 if (parse.def) {
 854                         if (def)
 855                                 goto error;
 856                         def = 1;
 857                         result->def = parse.idx;
 858                         if (!parse.def_uni || !parse.def_multi)
 859                                 goto error;
 860                 } else if (parse.defmgmt)
 861                         goto error;
 862                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 863                                                      parse.idx, false, NULL);
 864                 if (err)
 865                         goto error;
 866                 result->params[parse.idx].cipher = parse.p.cipher;
 867                 result->params[parse.idx].key_len = parse.p.key_len;
 868                 result->params[parse.idx].key = result->data[parse.idx];
 869                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 870
 871                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 872                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 873                         if (no_ht)
 874                                 *no_ht = true;
 875                 }
 876         }
 877
 878         return result;
 879  error:
 880         kfree(result);
 881         return ERR_PTR(err);
 882 }
 883
 884 static int nl80211_key_allowed(struct wireless_dev *wdev)
 885 {
 886         ASSERT_WDEV_LOCK(wdev);
 887
 888         switch (wdev->iftype) {
 889         case NL80211_IFTYPE_AP:
 890         case NL80211_IFTYPE_AP_VLAN:
 891         case NL80211_IFTYPE_P2P_GO:
 892         case NL80211_IFTYPE_MESH_POINT:
 893                 break;
 894         case NL80211_IFTYPE_ADHOC:
 895         case NL80211_IFTYPE_STATION:
 896         case NL80211_IFTYPE_P2P_CLIENT:
 897                 if (!wdev->current_bss)
 898                         return -ENOLINK;
 899                 break;
 900         case NL80211_IFTYPE_UNSPECIFIED:
 901         case NL80211_IFTYPE_OCB:
 902         case NL80211_IFTYPE_MONITOR:
 903         case NL80211_IFTYPE_P2P_DEVICE:
 904         case NL80211_IFTYPE_WDS:
 905         case NUM_NL80211_IFTYPES:
 906                 return -EINVAL;
 907         }
 908
 909         return 0;
 910 }
 911
 912 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 913                                                         struct nlattr *tb)
 914 {
 915         struct ieee80211_channel *chan;
 916
 917         if (tb == NULL)
 918                 return NULL;
 919         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 920         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 921                 return NULL;
 922         return chan;
 923 }
 924
 925 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 926 {
 927         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 928         int i;
 929
 930         if (!nl_modes)
 931                 goto nla_put_failure;
 932
 933         i = 0;
 934         while (ifmodes) {
 935                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 936                         goto nla_put_failure;
 937                 ifmodes >>= 1;
 938                 i++;
 939         }
 940
 941         nla_nest_end(msg, nl_modes);
 942         return 0;
 943
 944 nla_put_failure:
 945         return -ENOBUFS;
 946 }
 947
 948 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 949                                           struct sk_buff *msg,
 950                                           bool large)
 951 {
 952         struct nlattr *nl_combis;
 953         int i, j;
 954
 955         nl_combis = nla_nest_start(msg,
 956                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 957         if (!nl_combis)
 958                 goto nla_put_failure;
 959
 960         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 961                 const struct ieee80211_iface_combination *c;
 962                 struct nlattr *nl_combi, *nl_limits;
 963
 964                 c = &wiphy->iface_combinations[i];
 965
 966                 nl_combi = nla_nest_start(msg, i + 1);
 967                 if (!nl_combi)
 968                         goto nla_put_failure;
 969
 970                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 971                 if (!nl_limits)
 972                         goto nla_put_failure;
 973
 974                 for (j = 0; j < c->n_limits; j++) {
 975                         struct nlattr *nl_limit;
 976
 977                         nl_limit = nla_nest_start(msg, j + 1);
 978                         if (!nl_limit)
 979                                 goto nla_put_failure;
 980                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 981                                         c->limits[j].max))
 982                                 goto nla_put_failure;
 983                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 984                                                 c->limits[j].types))
 985                                 goto nla_put_failure;
 986                         nla_nest_end(msg, nl_limit);
 987                 }
 988
 989                 nla_nest_end(msg, nl_limits);
 990
 991                 if (c->beacon_int_infra_match &&
 992                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 993                         goto nla_put_failure;
 994                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 995                                 c->num_different_channels) ||
 996                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 997                                 c->max_interfaces))
 998                         goto nla_put_failure;
 999                 if (large &&
1000                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1001                                 c->radar_detect_widths) ||
1002                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1003                                 c->radar_detect_regions)))
1004                         goto nla_put_failure;
1005
1006                 nla_nest_end(msg, nl_combi);
1007         }
1008
1009         nla_nest_end(msg, nl_combis);
1010
1011         return 0;
1012 nla_put_failure:
1013         return -ENOBUFS;
1014 }
1015
1016 #ifdef CONFIG_PM
1017 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1018                                         struct sk_buff *msg)
1019 {
1020         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1021         struct nlattr *nl_tcp;
1022
1023         if (!tcp)
1024                 return 0;
1025
1026         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1027         if (!nl_tcp)
1028                 return -ENOBUFS;
1029
1030         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1031                         tcp->data_payload_max))
1032                 return -ENOBUFS;
1033
1034         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1035                         tcp->data_payload_max))
1036                 return -ENOBUFS;
1037
1038         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1039                 return -ENOBUFS;
1040
1041         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1042                                 sizeof(*tcp->tok), tcp->tok))
1043                 return -ENOBUFS;
1044
1045         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1046                         tcp->data_interval_max))
1047                 return -ENOBUFS;
1048
1049         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1050                         tcp->wake_payload_max))
1051                 return -ENOBUFS;
1052
1053         nla_nest_end(msg, nl_tcp);
1054         return 0;
1055 }
1056
1057 static int nl80211_send_wowlan(struct sk_buff *msg,
1058                                struct cfg80211_registered_device *rdev,
1059                                bool large)
1060 {
1061         struct nlattr *nl_wowlan;
1062
1063         if (!rdev->wiphy.wowlan)
1064                 return 0;
1065
1066         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1067         if (!nl_wowlan)
1068                 return -ENOBUFS;
1069
1070         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1076             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1077              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1078             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1079              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1080             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1081              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1082             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1083              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1084             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1085              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1086                 return -ENOBUFS;
1087
1088         if (rdev->wiphy.wowlan->n_patterns) {
1089                 struct nl80211_pattern_support pat = {
1090                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1091                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1092                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1093                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1094                 };
1095
1096                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1097                             sizeof(pat), &pat))
1098                         return -ENOBUFS;
1099         }
1100
1101         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1102             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1103                         rdev->wiphy.wowlan->max_nd_match_sets))
1104                 return -ENOBUFS;
1105
1106         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1107                 return -ENOBUFS;
1108
1109         nla_nest_end(msg, nl_wowlan);
1110
1111         return 0;
1112 }
1113 #endif
1114
1115 static int nl80211_send_coalesce(struct sk_buff *msg,
1116                                  struct cfg80211_registered_device *rdev)
1117 {
1118         struct nl80211_coalesce_rule_support rule;
1119
1120         if (!rdev->wiphy.coalesce)
1121                 return 0;
1122
1123         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1124         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1125         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1126         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1127         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1128         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1129
1130         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1131                 return -ENOBUFS;
1132
1133         return 0;
1134 }
1135
1136 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1137                                       struct ieee80211_supported_band *sband)
1138 {
1139         struct nlattr *nl_rates, *nl_rate;
1140         struct ieee80211_rate *rate;
1141         int i;
1142
1143         /* add HT info */
1144         if (sband->ht_cap.ht_supported &&
1145             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1146                      sizeof(sband->ht_cap.mcs),
1147                      &sband->ht_cap.mcs) ||
1148              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1149                          sband->ht_cap.cap) ||
1150              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1151                         sband->ht_cap.ampdu_factor) ||
1152              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1153                         sband->ht_cap.ampdu_density)))
1154                 return -ENOBUFS;
1155
1156         /* add VHT info */
1157         if (sband->vht_cap.vht_supported &&
1158             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1159                      sizeof(sband->vht_cap.vht_mcs),
1160                      &sband->vht_cap.vht_mcs) ||
1161              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1162                          sband->vht_cap.cap)))
1163                 return -ENOBUFS;
1164
1165         /* add bitrates */
1166         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1167         if (!nl_rates)
1168                 return -ENOBUFS;
1169
1170         for (i = 0; i < sband->n_bitrates; i++) {
1171                 nl_rate = nla_nest_start(msg, i);
1172                 if (!nl_rate)
1173                         return -ENOBUFS;
1174
1175                 rate = &sband->bitrates[i];
1176                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1177                                 rate->bitrate))
1178                         return -ENOBUFS;
1179                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1180                     nla_put_flag(msg,
1181                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1182                         return -ENOBUFS;
1183
1184                 nla_nest_end(msg, nl_rate);
1185         }
1186
1187         nla_nest_end(msg, nl_rates);
1188
1189         return 0;
1190 }
1191
1192 static int
1193 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1194                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1195 {
1196         u16 stypes;
1197         struct nlattr *nl_ftypes, *nl_ifs;
1198         enum nl80211_iftype ift;
1199         int i;
1200
1201         if (!mgmt_stypes)
1202                 return 0;
1203
1204         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1205         if (!nl_ifs)
1206                 return -ENOBUFS;
1207
1208         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1209                 nl_ftypes = nla_nest_start(msg, ift);
1210                 if (!nl_ftypes)
1211                         return -ENOBUFS;
1212                 i = 0;
1213                 stypes = mgmt_stypes[ift].tx;
1214                 while (stypes) {
1215                         if ((stypes & 1) &&
1216                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1217                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1218                                 return -ENOBUFS;
1219                         stypes >>= 1;
1220                         i++;
1221                 }
1222                 nla_nest_end(msg, nl_ftypes);
1223         }
1224
1225         nla_nest_end(msg, nl_ifs);
1226
1227         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1228         if (!nl_ifs)
1229                 return -ENOBUFS;
1230
1231         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1232                 nl_ftypes = nla_nest_start(msg, ift);
1233                 if (!nl_ftypes)
1234                         return -ENOBUFS;
1235                 i = 0;
1236                 stypes = mgmt_stypes[ift].rx;
1237                 while (stypes) {
1238                         if ((stypes & 1) &&
1239                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1240                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1241                                 return -ENOBUFS;
1242                         stypes >>= 1;
1243                         i++;
1244                 }
1245                 nla_nest_end(msg, nl_ftypes);
1246         }
1247         nla_nest_end(msg, nl_ifs);
1248
1249         return 0;
1250 }
1251
1252 struct nl80211_dump_wiphy_state {
1253         s64 filter_wiphy;
1254         long start;
1255         long split_start, band_start, chan_start;
1256         bool split;
1257 };
1258
1259 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1260                               enum nl80211_commands cmd,
1261                               struct sk_buff *msg, u32 portid, u32 seq,
1262                               int flags, struct nl80211_dump_wiphy_state *state)
1263 {
1264         void *hdr;
1265         struct nlattr *nl_bands, *nl_band;
1266         struct nlattr *nl_freqs, *nl_freq;
1267         struct nlattr *nl_cmds;
1268         enum ieee80211_band band;
1269         struct ieee80211_channel *chan;
1270         int i;
1271         const struct ieee80211_txrx_stypes *mgmt_stypes =
1272                                 rdev->wiphy.mgmt_stypes;
1273         u32 features;
1274
1275         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1276         if (!hdr)
1277                 return -ENOBUFS;
1278
1279         if (WARN_ON(!state))
1280                 return -EINVAL;
1281
1282         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1283             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1284                            wiphy_name(&rdev->wiphy)) ||
1285             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1286                         cfg80211_rdev_list_generation))
1287                 goto nla_put_failure;
1288
1289         if (cmd != NL80211_CMD_NEW_WIPHY)
1290                 goto finish;
1291
1292         switch (state->split_start) {
1293         case 0:
1294                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1295                                rdev->wiphy.retry_short) ||
1296                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1297                                rdev->wiphy.retry_long) ||
1298                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1299                                 rdev->wiphy.frag_threshold) ||
1300                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1301                                 rdev->wiphy.rts_threshold) ||
1302                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1303                                rdev->wiphy.coverage_class) ||
1304                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1305                                rdev->wiphy.max_scan_ssids) ||
1306                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1307                                rdev->wiphy.max_sched_scan_ssids) ||
1308                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1309                                 rdev->wiphy.max_scan_ie_len) ||
1310                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1311                                 rdev->wiphy.max_sched_scan_ie_len) ||
1312                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1313                                rdev->wiphy.max_match_sets) ||
1314                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1315                                 rdev->wiphy.max_sched_scan_plans) ||
1316                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1317                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1318                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1319                                 rdev->wiphy.max_sched_scan_plan_iterations))
1320                         goto nla_put_failure;
1321
1322                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1323                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1324                         goto nla_put_failure;
1325                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1326                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1327                         goto nla_put_failure;
1328                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1329                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1330                         goto nla_put_failure;
1331                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1332                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1333                         goto nla_put_failure;
1334                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1335                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1336                         goto nla_put_failure;
1337                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1338                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1339                         goto nla_put_failure;
1340                 state->split_start++;
1341                 if (state->split)
1342                         break;
1343         case 1:
1344                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1345                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1346                             rdev->wiphy.cipher_suites))
1347                         goto nla_put_failure;
1348
1349                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1350                                rdev->wiphy.max_num_pmkids))
1351                         goto nla_put_failure;
1352
1353                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1354                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1355                         goto nla_put_failure;
1356
1357                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1358                                 rdev->wiphy.available_antennas_tx) ||
1359                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1360                                 rdev->wiphy.available_antennas_rx))
1361                         goto nla_put_failure;
1362
1363                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1364                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1365                                 rdev->wiphy.probe_resp_offload))
1366                         goto nla_put_failure;
1367
1368                 if ((rdev->wiphy.available_antennas_tx ||
1369                      rdev->wiphy.available_antennas_rx) &&
1370                     rdev->ops->get_antenna) {
1371                         u32 tx_ant = 0, rx_ant = 0;
1372                         int res;
1373                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1374                         if (!res) {
1375                                 if (nla_put_u32(msg,
1376                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1377                                                 tx_ant) ||
1378                                     nla_put_u32(msg,
1379                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1380                                                 rx_ant))
1381                                         goto nla_put_failure;
1382                         }
1383                 }
1384
1385                 state->split_start++;
1386                 if (state->split)
1387                         break;
1388         case 2:
1389                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1390                                         rdev->wiphy.interface_modes))
1391                                 goto nla_put_failure;
1392                 state->split_start++;
1393                 if (state->split)
1394                         break;
1395         case 3:
1396                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1397                 if (!nl_bands)
1398                         goto nla_put_failure;
1399
1400                 for (band = state->band_start;
1401                      band < IEEE80211_NUM_BANDS; band++) {
1402                         struct ieee80211_supported_band *sband;
1403
1404                         sband = rdev->wiphy.bands[band];
1405
1406                         if (!sband)
1407                                 continue;
1408
1409                         nl_band = nla_nest_start(msg, band);
1410                         if (!nl_band)
1411                                 goto nla_put_failure;
1412
1413                         switch (state->chan_start) {
1414                         case 0:
1415                                 if (nl80211_send_band_rateinfo(msg, sband))
1416                                         goto nla_put_failure;
1417                                 state->chan_start++;
1418                                 if (state->split)
1419                                         break;
1420                         default:
1421                                 /* add frequencies */
1422                                 nl_freqs = nla_nest_start(
1423                                         msg, NL80211_BAND_ATTR_FREQS);
1424                                 if (!nl_freqs)
1425                                         goto nla_put_failure;
1426
1427                                 for (i = state->chan_start - 1;
1428                                      i < sband->n_channels;
1429                                      i++) {
1430                                         nl_freq = nla_nest_start(msg, i);
1431                                         if (!nl_freq)
1432                                                 goto nla_put_failure;
1433
1434                                         chan = &sband->channels[i];
1435
1436                                         if (nl80211_msg_put_channel(
1437                                                         msg, chan,
1438                                                         state->split))
1439                                                 goto nla_put_failure;
1440
1441                                         nla_nest_end(msg, nl_freq);
1442                                         if (state->split)
1443                                                 break;
1444                                 }
1445                                 if (i < sband->n_channels)
1446                                         state->chan_start = i + 2;
1447                                 else
1448                                         state->chan_start = 0;
1449                                 nla_nest_end(msg, nl_freqs);
1450                         }
1451
1452                         nla_nest_end(msg, nl_band);
1453
1454                         if (state->split) {
1455                                 /* start again here */
1456                                 if (state->chan_start)
1457                                         band--;
1458                                 break;
1459                         }
1460                 }
1461                 nla_nest_end(msg, nl_bands);
1462
1463                 if (band < IEEE80211_NUM_BANDS)
1464                         state->band_start = band + 1;
1465                 else
1466                         state->band_start = 0;
1467
1468                 /* if bands & channels are done, continue outside */
1469                 if (state->band_start == 0 && state->chan_start == 0)
1470                         state->split_start++;
1471                 if (state->split)
1472                         break;
1473         case 4:
1474                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1475                 if (!nl_cmds)
1476                         goto nla_put_failure;
1477
1478                 i = 0;
1479 #define CMD(op, n)                                                      \
1480                  do {                                                   \
1481                         if (rdev->ops->op) {                            \
1482                                 i++;                                    \
1483                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1484                                         goto nla_put_failure;           \
1485                         }                                               \
1486                 } while (0)
1487
1488                 CMD(add_virtual_intf, NEW_INTERFACE);
1489                 CMD(change_virtual_intf, SET_INTERFACE);
1490                 CMD(add_key, NEW_KEY);
1491                 CMD(start_ap, START_AP);
1492                 CMD(add_station, NEW_STATION);
1493                 CMD(add_mpath, NEW_MPATH);
1494                 CMD(update_mesh_config, SET_MESH_CONFIG);
1495                 CMD(change_bss, SET_BSS);
1496                 CMD(auth, AUTHENTICATE);
1497                 CMD(assoc, ASSOCIATE);
1498                 CMD(deauth, DEAUTHENTICATE);
1499                 CMD(disassoc, DISASSOCIATE);
1500                 CMD(join_ibss, JOIN_IBSS);
1501                 CMD(join_mesh, JOIN_MESH);
1502                 CMD(set_pmksa, SET_PMKSA);
1503                 CMD(del_pmksa, DEL_PMKSA);
1504                 CMD(flush_pmksa, FLUSH_PMKSA);
1505                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1506                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1507                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1508                 CMD(mgmt_tx, FRAME);
1509                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1513                                 goto nla_put_failure;
1514                 }
1515                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1516                     rdev->ops->join_mesh) {
1517                         i++;
1518                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1519                                 goto nla_put_failure;
1520                 }
1521                 CMD(set_wds_peer, SET_WDS_PEER);
1522                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1523                         CMD(tdls_mgmt, TDLS_MGMT);
1524                         CMD(tdls_oper, TDLS_OPER);
1525                 }
1526                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1527                         CMD(sched_scan_start, START_SCHED_SCAN);
1528                 CMD(probe_client, PROBE_CLIENT);
1529                 CMD(set_noack_map, SET_NOACK_MAP);
1530                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1531                         i++;
1532                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1533                                 goto nla_put_failure;
1534                 }
1535                 CMD(start_p2p_device, START_P2P_DEVICE);
1536                 CMD(set_mcast_rate, SET_MCAST_RATE);
1537 #ifdef CONFIG_NL80211_TESTMODE
1538                 CMD(testmode_cmd, TESTMODE);
1539 #endif
1540                 if (state->split) {
1541                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1542                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1543                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1544                                 CMD(channel_switch, CHANNEL_SWITCH);
1545                         CMD(set_qos_map, SET_QOS_MAP);
1546                         if (rdev->wiphy.features &
1547                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1548                                 CMD(add_tx_ts, ADD_TX_TS);
1549                 }
1550                 /* add into the if now */
1551 #undef CMD
1552
1553                 if (rdev->ops->connect || rdev->ops->auth) {
1554                         i++;
1555                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1556                                 goto nla_put_failure;
1557                 }
1558
1559                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1560                         i++;
1561                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1562                                 goto nla_put_failure;
1563                 }
1564
1565                 nla_nest_end(msg, nl_cmds);
1566                 state->split_start++;
1567                 if (state->split)
1568                         break;
1569         case 5:
1570                 if (rdev->ops->remain_on_channel &&
1571                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1572                     nla_put_u32(msg,
1573                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1574                                 rdev->wiphy.max_remain_on_channel_duration))
1575                         goto nla_put_failure;
1576
1577                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1578                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1579                         goto nla_put_failure;
1580
1581                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1582                         goto nla_put_failure;
1583                 state->split_start++;
1584                 if (state->split)
1585                         break;
1586         case 6:
1587 #ifdef CONFIG_PM
1588                 if (nl80211_send_wowlan(msg, rdev, state->split))
1589                         goto nla_put_failure;
1590                 state->split_start++;
1591                 if (state->split)
1592                         break;
1593 #else
1594                 state->split_start++;
1595 #endif
1596         case 7:
1597                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1598                                         rdev->wiphy.software_iftypes))
1599                         goto nla_put_failure;
1600
1601                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1602                                                    state->split))
1603                         goto nla_put_failure;
1604
1605                 state->split_start++;
1606                 if (state->split)
1607                         break;
1608         case 8:
1609                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1610                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1611                                 rdev->wiphy.ap_sme_capa))
1612                         goto nla_put_failure;
1613
1614                 features = rdev->wiphy.features;
1615                 /*
1616                  * We can only add the per-channel limit information if the
1617                  * dump is split, otherwise it makes it too big. Therefore
1618                  * only advertise it in that case.
1619                  */
1620                 if (state->split)
1621                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1622                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1623                         goto nla_put_failure;
1624
1625                 if (rdev->wiphy.ht_capa_mod_mask &&
1626                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1627                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1628                             rdev->wiphy.ht_capa_mod_mask))
1629                         goto nla_put_failure;
1630
1631                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1632                     rdev->wiphy.max_acl_mac_addrs &&
1633                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1634                                 rdev->wiphy.max_acl_mac_addrs))
1635                         goto nla_put_failure;
1636
1637                 /*
1638                  * Any information below this point is only available to
1639                  * applications that can deal with it being split. This
1640                  * helps ensure that newly added capabilities don't break
1641                  * older tools by overrunning their buffers.
1642                  *
1643                  * We still increment split_start so that in the split
1644                  * case we'll continue with more data in the next round,
1645                  * but break unconditionally so unsplit data stops here.
1646                  */
1647                 state->split_start++;
1648                 break;
1649         case 9:
1650                 if (rdev->wiphy.extended_capabilities &&
1651                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1652                              rdev->wiphy.extended_capabilities_len,
1653                              rdev->wiphy.extended_capabilities) ||
1654                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1655                              rdev->wiphy.extended_capabilities_len,
1656                              rdev->wiphy.extended_capabilities_mask)))
1657                         goto nla_put_failure;
1658
1659                 if (rdev->wiphy.vht_capa_mod_mask &&
1660                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1661                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1662                             rdev->wiphy.vht_capa_mod_mask))
1663                         goto nla_put_failure;
1664
1665                 state->split_start++;
1666                 break;
1667         case 10:
1668                 if (nl80211_send_coalesce(msg, rdev))
1669                         goto nla_put_failure;
1670
1671                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1672                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1673                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1674                         goto nla_put_failure;
1675
1676                 if (rdev->wiphy.max_ap_assoc_sta &&
1677                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1678                                 rdev->wiphy.max_ap_assoc_sta))
1679                         goto nla_put_failure;
1680
1681                 state->split_start++;
1682                 break;
1683         case 11:
1684                 if (rdev->wiphy.n_vendor_commands) {
1685                         const struct nl80211_vendor_cmd_info *info;
1686                         struct nlattr *nested;
1687
1688                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1689                         if (!nested)
1690                                 goto nla_put_failure;
1691
1692                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1693                                 info = &rdev->wiphy.vendor_commands[i].info;
1694                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1695                                         goto nla_put_failure;
1696                         }
1697                         nla_nest_end(msg, nested);
1698                 }
1699
1700                 if (rdev->wiphy.n_vendor_events) {
1701                         const struct nl80211_vendor_cmd_info *info;
1702                         struct nlattr *nested;
1703
1704                         nested = nla_nest_start(msg,
1705                                                 NL80211_ATTR_VENDOR_EVENTS);
1706                         if (!nested)
1707                                 goto nla_put_failure;
1708
1709                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1710                                 info = &rdev->wiphy.vendor_events[i];
1711                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1712                                         goto nla_put_failure;
1713                         }
1714                         nla_nest_end(msg, nested);
1715                 }
1716                 state->split_start++;
1717                 break;
1718         case 12:
1719                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1720                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1721                                rdev->wiphy.max_num_csa_counters))
1722                         goto nla_put_failure;
1723
1724                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1725                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1726                         goto nla_put_failure;
1727
1728                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1729                             sizeof(rdev->wiphy.ext_features),
1730                             rdev->wiphy.ext_features))
1731                         goto nla_put_failure;
1732
1733                 /* done */
1734                 state->split_start = 0;
1735                 break;
1736         }
1737  finish:
1738         genlmsg_end(msg, hdr);
1739         return 0;
1740
1741  nla_put_failure:
1742         genlmsg_cancel(msg, hdr);
1743         return -EMSGSIZE;
1744 }
1745
1746 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1747                                     struct netlink_callback *cb,
1748                                     struct nl80211_dump_wiphy_state *state)
1749 {
1750         struct nlattr **tb = nl80211_fam.attrbuf;
1751         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1752                               tb, nl80211_fam.maxattr, nl80211_policy);
1753         /* ignore parse errors for backward compatibility */
1754         if (ret)
1755                 return 0;
1756
1757         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1758         if (tb[NL80211_ATTR_WIPHY])
1759                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1760         if (tb[NL80211_ATTR_WDEV])
1761                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1762         if (tb[NL80211_ATTR_IFINDEX]) {
1763                 struct net_device *netdev;
1764                 struct cfg80211_registered_device *rdev;
1765                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1766
1767                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1768                 if (!netdev)
1769                         return -ENODEV;
1770                 if (netdev->ieee80211_ptr) {
1771                         rdev = wiphy_to_rdev(
1772                                 netdev->ieee80211_ptr->wiphy);
1773                         state->filter_wiphy = rdev->wiphy_idx;
1774                 }
1775         }
1776
1777         return 0;
1778 }
1779
1780 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1781 {
1782         int idx = 0, ret;
1783         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1784         struct cfg80211_registered_device *rdev;
1785
1786         rtnl_lock();
1787         if (!state) {
1788                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1789                 if (!state) {
1790                         rtnl_unlock();
1791                         return -ENOMEM;
1792                 }
1793                 state->filter_wiphy = -1;
1794                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1795                 if (ret) {
1796                         kfree(state);
1797                         rtnl_unlock();
1798                         return ret;
1799                 }
1800                 cb->args[0] = (long)state;
1801         }
1802
1803         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1804                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1805                         continue;
1806                 if (++idx <= state->start)
1807                         continue;
1808                 if (state->filter_wiphy != -1 &&
1809                     state->filter_wiphy != rdev->wiphy_idx)
1810                         continue;
1811                 /* attempt to fit multiple wiphy data chunks into the skb */
1812                 do {
1813                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1814                                                  skb,
1815                                                  NETLINK_CB(cb->skb).portid,
1816                                                  cb->nlh->nlmsg_seq,
1817                                                  NLM_F_MULTI, state);
1818                         if (ret < 0) {
1819                                 /*
1820                                  * If sending the wiphy data didn't fit (ENOBUFS
1821                                  * or EMSGSIZE returned), this SKB is still
1822                                  * empty (so it's not too big because another
1823                                  * wiphy dataset is already in the skb) and
1824                                  * we've not tried to adjust the dump allocation
1825                                  * yet ... then adjust the alloc size to be
1826                                  * bigger, and return 1 but with the empty skb.
1827                                  * This results in an empty message being RX'ed
1828                                  * in userspace, but that is ignored.
1829                                  *
1830                                  * We can then retry with the larger buffer.
1831                                  */
1832                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1833                                     !skb->len && !state->split &&
1834                                     cb->min_dump_alloc < 4096) {
1835                                         cb->min_dump_alloc = 4096;
1836                                         state->split_start = 0;
1837                                         rtnl_unlock();
1838                                         return 1;
1839                                 }
1840                                 idx--;
1841                                 break;
1842                         }
1843                 } while (state->split_start > 0);
1844                 break;
1845         }
1846         rtnl_unlock();
1847
1848         state->start = idx;
1849
1850         return skb->len;
1851 }
1852
1853 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1854 {
1855         kfree((void *)cb->args[0]);
1856         return 0;
1857 }
1858
1859 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1860 {
1861         struct sk_buff *msg;
1862         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1863         struct nl80211_dump_wiphy_state state = {};
1864
1865         msg = nlmsg_new(4096, GFP_KERNEL);
1866         if (!msg)
1867                 return -ENOMEM;
1868
1869         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1870                                info->snd_portid, info->snd_seq, 0,
1871                                &state) < 0) {
1872                 nlmsg_free(msg);
1873                 return -ENOBUFS;
1874         }
1875
1876         return genlmsg_reply(msg, info);
1877 }
1878
1879 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1880         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1881         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1882         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1883         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1884         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1885 };
1886
1887 static int parse_txq_params(struct nlattr *tb[],
1888                             struct ieee80211_txq_params *txq_params)
1889 {
1890         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1891             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1892             !tb[NL80211_TXQ_ATTR_AIFS])
1893                 return -EINVAL;
1894
1895         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1896         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1897         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1898         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1899         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1900
1901         if (txq_params->ac >= NL80211_NUM_ACS)
1902                 return -EINVAL;
1903
1904         return 0;
1905 }
1906
1907 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1908 {
1909         /*
1910          * You can only set the channel explicitly for WDS interfaces,
1911          * all others have their channel managed via their respective
1912          * "establish a connection" command (connect, join, ...)
1913          *
1914          * For AP/GO and mesh mode, the channel can be set with the
1915          * channel userspace API, but is only stored and passed to the
1916          * low-level driver when the AP starts or the mesh is joined.
1917          * This is for backward compatibility, userspace can also give
1918          * the channel in the start-ap or join-mesh commands instead.
1919          *
1920          * Monitors are special as they are normally slaved to
1921          * whatever else is going on, so they have their own special
1922          * operation to set the monitor channel if possible.
1923          */
1924         return !wdev ||
1925                 wdev->iftype == NL80211_IFTYPE_AP ||
1926                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1927                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1928                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1929 }
1930
1931 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1932                                  struct genl_info *info,
1933                                  struct cfg80211_chan_def *chandef)
1934 {
1935         u32 control_freq;
1936
1937         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1938                 return -EINVAL;
1939
1940         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1941
1942         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1943         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1944         chandef->center_freq1 = control_freq;
1945         chandef->center_freq2 = 0;
1946
1947         /* Primary channel not allowed */
1948         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1949                 return -EINVAL;
1950
1951         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1952                 enum nl80211_channel_type chantype;
1953
1954                 chantype = nla_get_u32(
1955                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1956
1957                 switch (chantype) {
1958                 case NL80211_CHAN_NO_HT:
1959                 case NL80211_CHAN_HT20:
1960                 case NL80211_CHAN_HT40PLUS:
1961                 case NL80211_CHAN_HT40MINUS:
1962                         cfg80211_chandef_create(chandef, chandef->chan,
1963                                                 chantype);
1964                         break;
1965                 default:
1966                         return -EINVAL;
1967                 }
1968         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1969                 chandef->width =
1970                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1971                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1972                         chandef->center_freq1 =
1973                                 nla_get_u32(
1974                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1975                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1976                         chandef->center_freq2 =
1977                                 nla_get_u32(
1978                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1979         }
1980
1981         if (!cfg80211_chandef_valid(chandef))
1982                 return -EINVAL;
1983
1984         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1985                                      IEEE80211_CHAN_DISABLED))
1986                 return -EINVAL;
1987
1988         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1989              chandef->width == NL80211_CHAN_WIDTH_10) &&
1990             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1991                 return -EINVAL;
1992
1993         return 0;
1994 }
1995
1996 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1997                                  struct net_device *dev,
1998                                  struct genl_info *info)
1999 {
2000         struct cfg80211_chan_def chandef;
2001         int result;
2002         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2003         struct wireless_dev *wdev = NULL;
2004
2005         if (dev)
2006                 wdev = dev->ieee80211_ptr;
2007         if (!nl80211_can_set_dev_channel(wdev))
2008                 return -EOPNOTSUPP;
2009         if (wdev)
2010                 iftype = wdev->iftype;
2011
2012         result = nl80211_parse_chandef(rdev, info, &chandef);
2013         if (result)
2014                 return result;
2015
2016         switch (iftype) {
2017         case NL80211_IFTYPE_AP:
2018         case NL80211_IFTYPE_P2P_GO:
2019                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2020                                                    iftype)) {
2021                         result = -EINVAL;
2022                         break;
2023                 }
2024                 if (wdev->beacon_interval) {
2025                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2026                             !(rdev->wiphy.features &
2027                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2028                                 result = -EBUSY;
2029                                 break;
2030                         }
2031
2032                         /* Only allow dynamic channel width changes */
2033                         if (chandef.chan != wdev->preset_chandef.chan) {
2034                                 result = -EBUSY;
2035                                 break;
2036                         }
2037                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2038                         if (result)
2039                                 break;
2040                 }
2041                 wdev->preset_chandef = chandef;
2042                 result = 0;
2043                 break;
2044         case NL80211_IFTYPE_MESH_POINT:
2045                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2046                 break;
2047         case NL80211_IFTYPE_MONITOR:
2048                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2049                 break;
2050         default:
2051                 result = -EINVAL;
2052         }
2053
2054         return result;
2055 }
2056
2057 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2058 {
2059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2060         struct net_device *netdev = info->user_ptr[1];
2061
2062         return __nl80211_set_channel(rdev, netdev, info);
2063 }
2064
2065 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2066 {
2067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2068         struct net_device *dev = info->user_ptr[1];
2069         struct wireless_dev *wdev = dev->ieee80211_ptr;
2070         const u8 *bssid;
2071
2072         if (!info->attrs[NL80211_ATTR_MAC])
2073                 return -EINVAL;
2074
2075         if (netif_running(dev))
2076                 return -EBUSY;
2077
2078         if (!rdev->ops->set_wds_peer)
2079                 return -EOPNOTSUPP;
2080
2081         if (wdev->iftype != NL80211_IFTYPE_WDS)
2082                 return -EOPNOTSUPP;
2083
2084         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2085         return rdev_set_wds_peer(rdev, dev, bssid);
2086 }
2087
2088
2089 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2090 {
2091         struct cfg80211_registered_device *rdev;
2092         struct net_device *netdev = NULL;
2093         struct wireless_dev *wdev;
2094         int result = 0, rem_txq_params = 0;
2095         struct nlattr *nl_txq_params;
2096         u32 changed;
2097         u8 retry_short = 0, retry_long = 0;
2098         u32 frag_threshold = 0, rts_threshold = 0;
2099         u8 coverage_class = 0;
2100
2101         ASSERT_RTNL();
2102
2103         /*
2104          * Try to find the wiphy and netdev. Normally this
2105          * function shouldn't need the netdev, but this is
2106          * done for backward compatibility -- previously
2107          * setting the channel was done per wiphy, but now
2108          * it is per netdev. Previous userland like hostapd
2109          * also passed a netdev to set_wiphy, so that it is
2110          * possible to let that go to the right netdev!
2111          */
2112
2113         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2114                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2115
2116                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2117                 if (netdev && netdev->ieee80211_ptr)
2118                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2119                 else
2120                         netdev = NULL;
2121         }
2122
2123         if (!netdev) {
2124                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2125                                                   info->attrs);
2126                 if (IS_ERR(rdev))
2127                         return PTR_ERR(rdev);
2128                 wdev = NULL;
2129                 netdev = NULL;
2130                 result = 0;
2131         } else
2132                 wdev = netdev->ieee80211_ptr;
2133
2134         /*
2135          * end workaround code, by now the rdev is available
2136          * and locked, and wdev may or may not be NULL.
2137          */
2138
2139         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2140                 result = cfg80211_dev_rename(
2141                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2142
2143         if (result)
2144                 return result;
2145
2146         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2147                 struct ieee80211_txq_params txq_params;
2148                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2149
2150                 if (!rdev->ops->set_txq_params)
2151                         return -EOPNOTSUPP;
2152
2153                 if (!netdev)
2154                         return -EINVAL;
2155
2156                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2157                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2158                         return -EINVAL;
2159
2160                 if (!netif_running(netdev))
2161                         return -ENETDOWN;
2162
2163                 nla_for_each_nested(nl_txq_params,
2164                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2165                                     rem_txq_params) {
2166                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2167                                            nla_data(nl_txq_params),
2168                                            nla_len(nl_txq_params),
2169                                            txq_params_policy);
2170                         if (result)
2171                                 return result;
2172                         result = parse_txq_params(tb, &txq_params);
2173                         if (result)
2174                                 return result;
2175
2176                         result = rdev_set_txq_params(rdev, netdev,
2177                                                      &txq_params);
2178                         if (result)
2179                                 return result;
2180                 }
2181         }
2182
2183         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2184                 result = __nl80211_set_channel(
2185                         rdev,
2186                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2187                         info);
2188                 if (result)
2189                         return result;
2190         }
2191
2192         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2193                 struct wireless_dev *txp_wdev = wdev;
2194                 enum nl80211_tx_power_setting type;
2195                 int idx, mbm = 0;
2196
2197                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2198                         txp_wdev = NULL;
2199
2200                 if (!rdev->ops->set_tx_power)
2201                         return -EOPNOTSUPP;
2202
2203                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2204                 type = nla_get_u32(info->attrs[idx]);
2205
2206                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2207                     (type != NL80211_TX_POWER_AUTOMATIC))
2208                         return -EINVAL;
2209
2210                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2211                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2212                         mbm = nla_get_u32(info->attrs[idx]);
2213                 }
2214
2215                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2216                 if (result)
2217                         return result;
2218         }
2219
2220         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2221             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2222                 u32 tx_ant, rx_ant;
2223                 if ((!rdev->wiphy.available_antennas_tx &&
2224                      !rdev->wiphy.available_antennas_rx) ||
2225                     !rdev->ops->set_antenna)
2226                         return -EOPNOTSUPP;
2227
2228                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2229                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2230
2231                 /* reject antenna configurations which don't match the
2232                  * available antenna masks, except for the "all" mask */
2233                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2234                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2235                         return -EINVAL;
2236
2237                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2238                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2239
2240                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2241                 if (result)
2242                         return result;
2243         }
2244
2245         changed = 0;
2246
2247         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2248                 retry_short = nla_get_u8(
2249                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2250                 if (retry_short == 0)
2251                         return -EINVAL;
2252
2253                 changed |= WIPHY_PARAM_RETRY_SHORT;
2254         }
2255
2256         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2257                 retry_long = nla_get_u8(
2258                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2259                 if (retry_long == 0)
2260                         return -EINVAL;
2261
2262                 changed |= WIPHY_PARAM_RETRY_LONG;
2263         }
2264
2265         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2266                 frag_threshold = nla_get_u32(
2267                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2268                 if (frag_threshold < 256)
2269                         return -EINVAL;
2270
2271                 if (frag_threshold != (u32) -1) {
2272                         /*
2273                          * Fragments (apart from the last one) are required to
2274                          * have even length. Make the fragmentation code
2275                          * simpler by stripping LSB should someone try to use
2276                          * odd threshold value.
2277                          */
2278                         frag_threshold &= ~0x1;
2279                 }
2280                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2281         }
2282
2283         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2284                 rts_threshold = nla_get_u32(
2285                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2286                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2287         }
2288
2289         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2290                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2291                         return -EINVAL;
2292
2293                 coverage_class = nla_get_u8(
2294                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2295                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2296         }
2297
2298         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2299                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2300                         return -EOPNOTSUPP;
2301
2302                 changed |= WIPHY_PARAM_DYN_ACK;
2303         }
2304
2305         if (changed) {
2306                 u8 old_retry_short, old_retry_long;
2307                 u32 old_frag_threshold, old_rts_threshold;
2308                 u8 old_coverage_class;
2309
2310                 if (!rdev->ops->set_wiphy_params)
2311                         return -EOPNOTSUPP;
2312
2313                 old_retry_short = rdev->wiphy.retry_short;
2314                 old_retry_long = rdev->wiphy.retry_long;
2315                 old_frag_threshold = rdev->wiphy.frag_threshold;
2316                 old_rts_threshold = rdev->wiphy.rts_threshold;
2317                 old_coverage_class = rdev->wiphy.coverage_class;
2318
2319                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2320                         rdev->wiphy.retry_short = retry_short;
2321                 if (changed & WIPHY_PARAM_RETRY_LONG)
2322                         rdev->wiphy.retry_long = retry_long;
2323                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2324                         rdev->wiphy.frag_threshold = frag_threshold;
2325                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2326                         rdev->wiphy.rts_threshold = rts_threshold;
2327                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2328                         rdev->wiphy.coverage_class = coverage_class;
2329
2330                 result = rdev_set_wiphy_params(rdev, changed);
2331                 if (result) {
2332                         rdev->wiphy.retry_short = old_retry_short;
2333                         rdev->wiphy.retry_long = old_retry_long;
2334                         rdev->wiphy.frag_threshold = old_frag_threshold;
2335                         rdev->wiphy.rts_threshold = old_rts_threshold;
2336                         rdev->wiphy.coverage_class = old_coverage_class;
2337                         return result;
2338                 }
2339         }
2340         return 0;
2341 }
2342
2343 static inline u64 wdev_id(struct wireless_dev *wdev)
2344 {
2345         return (u64)wdev->identifier |
2346                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2347 }
2348
2349 static int nl80211_send_chandef(struct sk_buff *msg,
2350                                 const struct cfg80211_chan_def *chandef)
2351 {
2352         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2353                 return -EINVAL;
2354
2355         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2356                         chandef->chan->center_freq))
2357                 return -ENOBUFS;
2358         switch (chandef->width) {
2359         case NL80211_CHAN_WIDTH_20_NOHT:
2360         case NL80211_CHAN_WIDTH_20:
2361         case NL80211_CHAN_WIDTH_40:
2362                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2363                                 cfg80211_get_chandef_type(chandef)))
2364                         return -ENOBUFS;
2365                 break;
2366         default:
2367                 break;
2368         }
2369         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2370                 return -ENOBUFS;
2371         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2372                 return -ENOBUFS;
2373         if (chandef->center_freq2 &&
2374             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2375                 return -ENOBUFS;
2376         return 0;
2377 }
2378
2379 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2380                               struct cfg80211_registered_device *rdev,
2381                               struct wireless_dev *wdev, bool removal)
2382 {
2383         struct net_device *dev = wdev->netdev;
2384         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2385         void *hdr;
2386
2387         if (removal)
2388                 cmd = NL80211_CMD_DEL_INTERFACE;
2389
2390         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2391         if (!hdr)
2392                 return -1;
2393
2394         if (dev &&
2395             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2396              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2397                 goto nla_put_failure;
2398
2399         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2400             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2401             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2402             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2403             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2404                         rdev->devlist_generation ^
2405                         (cfg80211_rdev_list_generation << 2)))
2406                 goto nla_put_failure;
2407
2408         if (rdev->ops->get_channel) {
2409                 int ret;
2410                 struct cfg80211_chan_def chandef;
2411
2412                 ret = rdev_get_channel(rdev, wdev, &chandef);
2413                 if (ret == 0) {
2414                         if (nl80211_send_chandef(msg, &chandef))
2415                                 goto nla_put_failure;
2416                 }
2417         }
2418
2419         if (rdev->ops->get_tx_power) {
2420                 int dbm, ret;
2421
2422                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2423                 if (ret == 0 &&
2424                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2425                                 DBM_TO_MBM(dbm)))
2426                         goto nla_put_failure;
2427         }
2428
2429         if (wdev->ssid_len) {
2430                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2431                         goto nla_put_failure;
2432         }
2433
2434         genlmsg_end(msg, hdr);
2435         return 0;
2436
2437  nla_put_failure:
2438         genlmsg_cancel(msg, hdr);
2439         return -EMSGSIZE;
2440 }
2441
2442 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2443 {
2444         int wp_idx = 0;
2445         int if_idx = 0;
2446         int wp_start = cb->args[0];
2447         int if_start = cb->args[1];
2448         struct cfg80211_registered_device *rdev;
2449         struct wireless_dev *wdev;
2450
2451         rtnl_lock();
2452         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2453                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2454                         continue;
2455                 if (wp_idx < wp_start) {
2456                         wp_idx++;
2457                         continue;
2458                 }
2459                 if_idx = 0;
2460
2461                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2462                         if (if_idx < if_start) {
2463                                 if_idx++;
2464                                 continue;
2465                         }
2466                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2467                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2468                                                rdev, wdev, false) < 0) {
2469                                 goto out;
2470                         }
2471                         if_idx++;
2472                 }
2473
2474                 wp_idx++;
2475         }
2476  out:
2477         rtnl_unlock();
2478
2479         cb->args[0] = wp_idx;
2480         cb->args[1] = if_idx;
2481
2482         return skb->len;
2483 }
2484
2485 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2486 {
2487         struct sk_buff *msg;
2488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2489         struct wireless_dev *wdev = info->user_ptr[1];
2490
2491         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2492         if (!msg)
2493                 return -ENOMEM;
2494
2495         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2496                                rdev, wdev, false) < 0) {
2497                 nlmsg_free(msg);
2498                 return -ENOBUFS;
2499         }
2500
2501         return genlmsg_reply(msg, info);
2502 }
2503
2504 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2505         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2506         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2507         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2508         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2509         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2510         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2511 };
2512
2513 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2514 {
2515         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2516         int flag;
2517
2518         *mntrflags = 0;
2519
2520         if (!nla)
2521                 return -EINVAL;
2522
2523         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2524                              nla, mntr_flags_policy))
2525                 return -EINVAL;
2526
2527         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2528                 if (flags[flag])
2529                         *mntrflags |= (1<<flag);
2530
2531         return 0;
2532 }
2533
2534 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2535                                struct net_device *netdev, u8 use_4addr,
2536                                enum nl80211_iftype iftype)
2537 {
2538         if (!use_4addr) {
2539                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2540                         return -EBUSY;
2541                 return 0;
2542         }
2543
2544         switch (iftype) {
2545         case NL80211_IFTYPE_AP_VLAN:
2546                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2547                         return 0;
2548                 break;
2549         case NL80211_IFTYPE_STATION:
2550                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2551                         return 0;
2552                 break;
2553         default:
2554                 break;
2555         }
2556
2557         return -EOPNOTSUPP;
2558 }
2559
2560 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2561 {
2562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2563         struct vif_params params;
2564         int err;
2565         enum nl80211_iftype otype, ntype;
2566         struct net_device *dev = info->user_ptr[1];
2567         u32 _flags, *flags = NULL;
2568         bool change = false;
2569
2570         memset(&params, 0, sizeof(params));
2571
2572         otype = ntype = dev->ieee80211_ptr->iftype;
2573
2574         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2575                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2576                 if (otype != ntype)
2577                         change = true;
2578                 if (ntype > NL80211_IFTYPE_MAX)
2579                         return -EINVAL;
2580         }
2581
2582         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2583                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2584
2585                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2586                         return -EINVAL;
2587                 if (netif_running(dev))
2588                         return -EBUSY;
2589
2590                 wdev_lock(wdev);
2591                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2592                              IEEE80211_MAX_MESH_ID_LEN);
2593                 wdev->mesh_id_up_len =
2594                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2595                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2596                        wdev->mesh_id_up_len);
2597                 wdev_unlock(wdev);
2598         }
2599
2600         if (info->attrs[NL80211_ATTR_4ADDR]) {
2601                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2602                 change = true;
2603                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2604                 if (err)
2605                         return err;
2606         } else {
2607                 params.use_4addr = -1;
2608         }
2609
2610         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2611                 if (ntype != NL80211_IFTYPE_MONITOR)
2612                         return -EINVAL;
2613                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2614                                           &_flags);
2615                 if (err)
2616                         return err;
2617
2618                 flags = &_flags;
2619                 change = true;
2620         }
2621
2622         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2623             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2624                 return -EOPNOTSUPP;
2625
2626         if (change)
2627                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2628         else
2629                 err = 0;
2630
2631         if (!err && params.use_4addr != -1)
2632                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2633
2634         return err;
2635 }
2636
2637 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2638 {
2639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2640         struct vif_params params;
2641         struct wireless_dev *wdev;
2642         struct sk_buff *msg, *event;
2643         int err;
2644         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2645         u32 flags;
2646
2647         /* to avoid failing a new interface creation due to pending removal */
2648         cfg80211_destroy_ifaces(rdev);
2649
2650         memset(&params, 0, sizeof(params));
2651
2652         if (!info->attrs[NL80211_ATTR_IFNAME])
2653                 return -EINVAL;
2654
2655         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2656                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2657                 if (type > NL80211_IFTYPE_MAX)
2658                         return -EINVAL;
2659         }
2660
2661         if (!rdev->ops->add_virtual_intf ||
2662             !(rdev->wiphy.interface_modes & (1 << type)))
2663                 return -EOPNOTSUPP;
2664
2665         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2666              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2667             info->attrs[NL80211_ATTR_MAC]) {
2668                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2669                            ETH_ALEN);
2670                 if (!is_valid_ether_addr(params.macaddr))
2671                         return -EADDRNOTAVAIL;
2672         }
2673
2674         if (info->attrs[NL80211_ATTR_4ADDR]) {
2675                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2676                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2677                 if (err)
2678                         return err;
2679         }
2680
2681         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2682                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2683                                   &flags);
2684
2685         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2686             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2687                 return -EOPNOTSUPP;
2688
2689         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2690         if (!msg)
2691                 return -ENOMEM;
2692
2693         wdev = rdev_add_virtual_intf(rdev,
2694                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2695                                 NET_NAME_USER, type, err ? NULL : &flags,
2696                                 &params);
2697         if (WARN_ON(!wdev)) {
2698                 nlmsg_free(msg);
2699                 return -EPROTO;
2700         } else if (IS_ERR(wdev)) {
2701                 nlmsg_free(msg);
2702                 return PTR_ERR(wdev);
2703         }
2704
2705         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2706                 wdev->owner_nlportid = info->snd_portid;
2707
2708         switch (type) {
2709         case NL80211_IFTYPE_MESH_POINT:
2710                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2711                         break;
2712                 wdev_lock(wdev);
2713                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2714                              IEEE80211_MAX_MESH_ID_LEN);
2715                 wdev->mesh_id_up_len =
2716                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2717                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2718                        wdev->mesh_id_up_len);
2719                 wdev_unlock(wdev);
2720                 break;
2721         case NL80211_IFTYPE_P2P_DEVICE:
2722                 /*
2723                  * P2P Device doesn't have a netdev, so doesn't go
2724                  * through the netdev notifier and must be added here
2725                  */
2726                 mutex_init(&wdev->mtx);
2727                 INIT_LIST_HEAD(&wdev->event_list);
2728                 spin_lock_init(&wdev->event_lock);
2729                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2730                 spin_lock_init(&wdev->mgmt_registrations_lock);
2731
2732                 wdev->identifier = ++rdev->wdev_id;
2733                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2734                 rdev->devlist_generation++;
2735                 break;
2736         default:
2737                 break;
2738         }
2739
2740         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2741                                rdev, wdev, false) < 0) {
2742                 nlmsg_free(msg);
2743                 return -ENOBUFS;
2744         }
2745
2746         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2747         if (event) {
2748                 if (nl80211_send_iface(event, 0, 0, 0,
2749                                        rdev, wdev, false) < 0) {
2750                         nlmsg_free(event);
2751                         goto out;
2752                 }
2753
2754                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2755                                         event, 0, NL80211_MCGRP_CONFIG,
2756                                         GFP_KERNEL);
2757         }
2758
2759 out:
2760         return genlmsg_reply(msg, info);
2761 }
2762
2763 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2764 {
2765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2766         struct wireless_dev *wdev = info->user_ptr[1];
2767         struct sk_buff *msg;
2768         int status;
2769
2770         if (!rdev->ops->del_virtual_intf)
2771                 return -EOPNOTSUPP;
2772
2773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2774         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2775                 nlmsg_free(msg);
2776                 msg = NULL;
2777         }
2778
2779         /*
2780          * If we remove a wireless device without a netdev then clear
2781          * user_ptr[1] so that nl80211_post_doit won't dereference it
2782          * to check if it needs to do dev_put(). Otherwise it crashes
2783          * since the wdev has been freed, unlike with a netdev where
2784          * we need the dev_put() for the netdev to really be freed.
2785          */
2786         if (!wdev->netdev)
2787                 info->user_ptr[1] = NULL;
2788
2789         status = rdev_del_virtual_intf(rdev, wdev);
2790         if (status >= 0 && msg)
2791                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2792                                         msg, 0, NL80211_MCGRP_CONFIG,
2793                                         GFP_KERNEL);
2794         else
2795                 nlmsg_free(msg);
2796
2797         return status;
2798 }
2799
2800 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2801 {
2802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2803         struct net_device *dev = info->user_ptr[1];
2804         u16 noack_map;
2805
2806         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2807                 return -EINVAL;
2808
2809         if (!rdev->ops->set_noack_map)
2810                 return -EOPNOTSUPP;
2811
2812         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2813
2814         return rdev_set_noack_map(rdev, dev, noack_map);
2815 }
2816
2817 struct get_key_cookie {
2818         struct sk_buff *msg;
2819         int error;
2820         int idx;
2821 };
2822
2823 static void get_key_callback(void *c, struct key_params *params)
2824 {
2825         struct nlattr *key;
2826         struct get_key_cookie *cookie = c;
2827
2828         if ((params->key &&
2829              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2830                      params->key_len, params->key)) ||
2831             (params->seq &&
2832              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2833                      params->seq_len, params->seq)) ||
2834             (params->cipher &&
2835              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2836                          params->cipher)))
2837                 goto nla_put_failure;
2838
2839         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2840         if (!key)
2841                 goto nla_put_failure;
2842
2843         if ((params->key &&
2844              nla_put(cookie->msg, NL80211_KEY_DATA,
2845                      params->key_len, params->key)) ||
2846             (params->seq &&
2847              nla_put(cookie->msg, NL80211_KEY_SEQ,
2848                      params->seq_len, params->seq)) ||
2849             (params->cipher &&
2850              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2851                          params->cipher)))
2852                 goto nla_put_failure;
2853
2854         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2855                 goto nla_put_failure;
2856
2857         nla_nest_end(cookie->msg, key);
2858
2859         return;
2860  nla_put_failure:
2861         cookie->error = 1;
2862 }
2863
2864 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2865 {
2866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2867         int err;
2868         struct net_device *dev = info->user_ptr[1];
2869         u8 key_idx = 0;
2870         const u8 *mac_addr = NULL;
2871         bool pairwise;
2872         struct get_key_cookie cookie = {
2873                 .error = 0,
2874         };
2875         void *hdr;
2876         struct sk_buff *msg;
2877
2878         if (info->attrs[NL80211_ATTR_KEY_IDX])
2879                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2880
2881         if (key_idx > 5)
2882                 return -EINVAL;
2883
2884         if (info->attrs[NL80211_ATTR_MAC])
2885                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2886
2887         pairwise = !!mac_addr;
2888         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2889                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2890                 if (kt >= NUM_NL80211_KEYTYPES)
2891                         return -EINVAL;
2892                 if (kt != NL80211_KEYTYPE_GROUP &&
2893                     kt != NL80211_KEYTYPE_PAIRWISE)
2894                         return -EINVAL;
2895                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2896         }
2897
2898         if (!rdev->ops->get_key)
2899                 return -EOPNOTSUPP;
2900
2901         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2902                 return -ENOENT;
2903
2904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2905         if (!msg)
2906                 return -ENOMEM;
2907
2908         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2909                              NL80211_CMD_NEW_KEY);
2910         if (!hdr)
2911                 goto nla_put_failure;
2912
2913         cookie.msg = msg;
2914         cookie.idx = key_idx;
2915
2916         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2917             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2918                 goto nla_put_failure;
2919         if (mac_addr &&
2920             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2921                 goto nla_put_failure;
2922
2923         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2924                            get_key_callback);
2925
2926         if (err)
2927                 goto free_msg;
2928
2929         if (cookie.error)
2930                 goto nla_put_failure;
2931
2932         genlmsg_end(msg, hdr);
2933         return genlmsg_reply(msg, info);
2934
2935  nla_put_failure:
2936         err = -ENOBUFS;
2937  free_msg:
2938         nlmsg_free(msg);
2939         return err;
2940 }
2941
2942 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2943 {
2944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2945         struct key_parse key;
2946         int err;
2947         struct net_device *dev = info->user_ptr[1];
2948
2949         err = nl80211_parse_key(info, &key);
2950         if (err)
2951                 return err;
2952
2953         if (key.idx < 0)
2954                 return -EINVAL;
2955
2956         /* only support setting default key */
2957         if (!key.def && !key.defmgmt)
2958                 return -EINVAL;
2959
2960         wdev_lock(dev->ieee80211_ptr);
2961
2962         if (key.def) {
2963                 if (!rdev->ops->set_default_key) {
2964                         err = -EOPNOTSUPP;
2965                         goto out;
2966                 }
2967
2968                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2969                 if (err)
2970                         goto out;
2971
2972                 err = rdev_set_default_key(rdev, dev, key.idx,
2973                                                  key.def_uni, key.def_multi);
2974
2975                 if (err)
2976                         goto out;
2977
2978 #ifdef CONFIG_CFG80211_WEXT
2979                 dev->ieee80211_ptr->wext.default_key = key.idx;
2980 #endif
2981         } else {
2982                 if (key.def_uni || !key.def_multi) {
2983                         err = -EINVAL;
2984                         goto out;
2985                 }
2986
2987                 if (!rdev->ops->set_default_mgmt_key) {
2988                         err = -EOPNOTSUPP;
2989                         goto out;
2990                 }
2991
2992                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2993                 if (err)
2994                         goto out;
2995
2996                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2997                 if (err)
2998                         goto out;
2999
3000 #ifdef CONFIG_CFG80211_WEXT
3001                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3002 #endif
3003         }
3004
3005  out:
3006         wdev_unlock(dev->ieee80211_ptr);
3007
3008         return err;
3009 }
3010
3011 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3012 {
3013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3014         int err;
3015         struct net_device *dev = info->user_ptr[1];
3016         struct key_parse key;
3017         const u8 *mac_addr = NULL;
3018
3019         err = nl80211_parse_key(info, &key);
3020         if (err)
3021                 return err;
3022
3023         if (!key.p.key)
3024                 return -EINVAL;
3025
3026         if (info->attrs[NL80211_ATTR_MAC])
3027                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3028
3029         if (key.type == -1) {
3030                 if (mac_addr)
3031                         key.type = NL80211_KEYTYPE_PAIRWISE;
3032                 else
3033                         key.type = NL80211_KEYTYPE_GROUP;
3034         }
3035
3036         /* for now */
3037         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3038             key.type != NL80211_KEYTYPE_GROUP)
3039                 return -EINVAL;
3040
3041         if (!rdev->ops->add_key)
3042                 return -EOPNOTSUPP;
3043
3044         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3045                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3046                                            mac_addr))
3047                 return -EINVAL;
3048
3049         wdev_lock(dev->ieee80211_ptr);
3050         err = nl80211_key_allowed(dev->ieee80211_ptr);
3051         if (!err)
3052                 err = rdev_add_key(rdev, dev, key.idx,
3053                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3054                                     mac_addr, &key.p);
3055         wdev_unlock(dev->ieee80211_ptr);
3056
3057         return err;
3058 }
3059
3060 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3061 {
3062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3063         int err;
3064         struct net_device *dev = info->user_ptr[1];
3065         u8 *mac_addr = NULL;
3066         struct key_parse key;
3067
3068         err = nl80211_parse_key(info, &key);
3069         if (err)
3070                 return err;
3071
3072         if (info->attrs[NL80211_ATTR_MAC])
3073                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3074
3075         if (key.type == -1) {
3076                 if (mac_addr)
3077                         key.type = NL80211_KEYTYPE_PAIRWISE;
3078                 else
3079                         key.type = NL80211_KEYTYPE_GROUP;
3080         }
3081
3082         /* for now */
3083         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3084             key.type != NL80211_KEYTYPE_GROUP)
3085                 return -EINVAL;
3086
3087         if (!rdev->ops->del_key)
3088                 return -EOPNOTSUPP;
3089
3090         wdev_lock(dev->ieee80211_ptr);
3091         err = nl80211_key_allowed(dev->ieee80211_ptr);
3092
3093         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3094             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3095                 err = -ENOENT;
3096
3097         if (!err)
3098                 err = rdev_del_key(rdev, dev, key.idx,
3099                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3100                                    mac_addr);
3101
3102 #ifdef CONFIG_CFG80211_WEXT
3103         if (!err) {
3104                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3105                         dev->ieee80211_ptr->wext.default_key = -1;
3106                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3107                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3108         }
3109 #endif
3110         wdev_unlock(dev->ieee80211_ptr);
3111
3112         return err;
3113 }
3114
3115 /* This function returns an error or the number of nested attributes */
3116 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3117 {
3118         struct nlattr *attr;
3119         int n_entries = 0, tmp;
3120
3121         nla_for_each_nested(attr, nl_attr, tmp) {
3122                 if (nla_len(attr) != ETH_ALEN)
3123                         return -EINVAL;
3124
3125                 n_entries++;
3126         }
3127
3128         return n_entries;
3129 }
3130
3131 /*
3132  * This function parses ACL information and allocates memory for ACL data.
3133  * On successful return, the calling function is responsible to free the
3134  * ACL buffer returned by this function.
3135  */
3136 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3137                                                 struct genl_info *info)
3138 {
3139         enum nl80211_acl_policy acl_policy;
3140         struct nlattr *attr;
3141         struct cfg80211_acl_data *acl;
3142         int i = 0, n_entries, tmp;
3143
3144         if (!wiphy->max_acl_mac_addrs)
3145                 return ERR_PTR(-EOPNOTSUPP);
3146
3147         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3148                 return ERR_PTR(-EINVAL);
3149
3150         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3151         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3152             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3153                 return ERR_PTR(-EINVAL);
3154
3155         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3156                 return ERR_PTR(-EINVAL);
3157
3158         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3159         if (n_entries < 0)
3160                 return ERR_PTR(n_entries);
3161
3162         if (n_entries > wiphy->max_acl_mac_addrs)
3163                 return ERR_PTR(-ENOTSUPP);
3164
3165         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3166                       GFP_KERNEL);
3167         if (!acl)
3168                 return ERR_PTR(-ENOMEM);
3169
3170         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3171                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3172                 i++;
3173         }
3174
3175         acl->n_acl_entries = n_entries;
3176         acl->acl_policy = acl_policy;
3177
3178         return acl;
3179 }
3180
3181 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3182 {
3183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3184         struct net_device *dev = info->user_ptr[1];
3185         struct cfg80211_acl_data *acl;
3186         int err;
3187
3188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3190                 return -EOPNOTSUPP;
3191
3192         if (!dev->ieee80211_ptr->beacon_interval)
3193                 return -EINVAL;
3194
3195         acl = parse_acl_data(&rdev->wiphy, info);
3196         if (IS_ERR(acl))
3197                 return PTR_ERR(acl);
3198
3199         err = rdev_set_mac_acl(rdev, dev, acl);
3200
3201         kfree(acl);
3202
3203         return err;
3204 }
3205
3206 static int nl80211_parse_beacon(struct nlattr *attrs[],
3207                                 struct cfg80211_beacon_data *bcn)
3208 {
3209         bool haveinfo = false;
3210
3211         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3212             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3213             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3214             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3215                 return -EINVAL;
3216
3217         memset(bcn, 0, sizeof(*bcn));
3218
3219         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3220                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3221                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3222                 if (!bcn->head_len)
3223                         return -EINVAL;
3224                 haveinfo = true;
3225         }
3226
3227         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3228                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3229                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3230                 haveinfo = true;
3231         }
3232
3233         if (!haveinfo)
3234                 return -EINVAL;
3235
3236         if (attrs[NL80211_ATTR_IE]) {
3237                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3238                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3239         }
3240
3241         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3242                 bcn->proberesp_ies =
3243                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3244                 bcn->proberesp_ies_len =
3245                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3246         }
3247
3248         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3249                 bcn->assocresp_ies =
3250                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3251                 bcn->assocresp_ies_len =
3252                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3253         }
3254
3255         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3256                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3257                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3258         }
3259
3260         return 0;
3261 }
3262
3263 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3264                                    struct cfg80211_ap_settings *params)
3265 {
3266         struct wireless_dev *wdev;
3267         bool ret = false;
3268
3269         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3270                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3271                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3272                         continue;
3273
3274                 if (!wdev->preset_chandef.chan)
3275                         continue;
3276
3277                 params->chandef = wdev->preset_chandef;
3278                 ret = true;
3279                 break;
3280         }
3281
3282         return ret;
3283 }
3284
3285 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3286                                     enum nl80211_auth_type auth_type,
3287                                     enum nl80211_commands cmd)
3288 {
3289         if (auth_type > NL80211_AUTHTYPE_MAX)
3290                 return false;
3291
3292         switch (cmd) {
3293         case NL80211_CMD_AUTHENTICATE:
3294                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3295                     auth_type == NL80211_AUTHTYPE_SAE)
3296                         return false;
3297                 return true;
3298         case NL80211_CMD_CONNECT:
3299         case NL80211_CMD_START_AP:
3300                 /* SAE not supported yet */
3301                 if (auth_type == NL80211_AUTHTYPE_SAE)
3302                         return false;
3303                 return true;
3304         default:
3305                 return false;
3306         }
3307 }
3308
3309 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3310 {
3311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3312         struct net_device *dev = info->user_ptr[1];
3313         struct wireless_dev *wdev = dev->ieee80211_ptr;
3314         struct cfg80211_ap_settings params;
3315         int err;
3316
3317         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3318             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3319                 return -EOPNOTSUPP;
3320
3321         if (!rdev->ops->start_ap)
3322                 return -EOPNOTSUPP;
3323
3324         if (wdev->beacon_interval)
3325                 return -EALREADY;
3326
3327         memset(&params, 0, sizeof(params));
3328
3329         /* these are required for START_AP */
3330         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3331             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3332             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3333                 return -EINVAL;
3334
3335         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3336         if (err)
3337                 return err;
3338
3339         params.beacon_interval =
3340                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3341         params.dtim_period =
3342                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3343
3344         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3345         if (err)
3346                 return err;
3347
3348         /*
3349          * In theory, some of these attributes should be required here
3350          * but since they were not used when the command was originally
3351          * added, keep them optional for old user space programs to let
3352          * them continue to work with drivers that do not need the
3353          * additional information -- drivers must check!
3354          */
3355         if (info->attrs[NL80211_ATTR_SSID]) {
3356                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3357                 params.ssid_len =
3358                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3359                 if (params.ssid_len == 0 ||
3360                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3361                         return -EINVAL;
3362         }
3363
3364         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3365                 params.hidden_ssid = nla_get_u32(
3366                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3367                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3368                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3369                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3370                         return -EINVAL;
3371         }
3372
3373         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3374
3375         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3376                 params.auth_type = nla_get_u32(
3377                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3378                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3379                                              NL80211_CMD_START_AP))
3380                         return -EINVAL;
3381         } else
3382                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3383
3384         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3385                                       NL80211_MAX_NR_CIPHER_SUITES);
3386         if (err)
3387                 return err;
3388
3389         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3390                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3391                         return -EOPNOTSUPP;
3392                 params.inactivity_timeout = nla_get_u16(
3393                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3394         }
3395
3396         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3397                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3398                         return -EINVAL;
3399                 params.p2p_ctwindow =
3400                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3401                 if (params.p2p_ctwindow > 127)
3402                         return -EINVAL;
3403                 if (params.p2p_ctwindow != 0 &&
3404                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3405                         return -EINVAL;
3406         }
3407
3408         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3409                 u8 tmp;
3410
3411                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3412                         return -EINVAL;
3413                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3414                 if (tmp > 1)
3415                         return -EINVAL;
3416                 params.p2p_opp_ps = tmp;
3417                 if (params.p2p_opp_ps != 0 &&
3418                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3419                         return -EINVAL;
3420         }
3421
3422         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3423                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3424                 if (err)
3425                         return err;
3426         } else if (wdev->preset_chandef.chan) {
3427                 params.chandef = wdev->preset_chandef;
3428         } else if (!nl80211_get_ap_channel(rdev, &params))
3429                 return -EINVAL;
3430
3431         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3432                                            wdev->iftype))
3433                 return -EINVAL;
3434
3435         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3436                 params.acl = parse_acl_data(&rdev->wiphy, info);
3437                 if (IS_ERR(params.acl))
3438                         return PTR_ERR(params.acl);
3439         }
3440
3441         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3442                 params.smps_mode =
3443                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3444                 switch (params.smps_mode) {
3445                 case NL80211_SMPS_OFF:
3446                         break;
3447                 case NL80211_SMPS_STATIC:
3448                         if (!(rdev->wiphy.features &
3449                               NL80211_FEATURE_STATIC_SMPS))
3450                                 return -EINVAL;
3451                         break;
3452                 case NL80211_SMPS_DYNAMIC:
3453                         if (!(rdev->wiphy.features &
3454                               NL80211_FEATURE_DYNAMIC_SMPS))
3455                                 return -EINVAL;
3456                         break;
3457                 default:
3458                         return -EINVAL;
3459                 }
3460         } else {
3461                 params.smps_mode = NL80211_SMPS_OFF;
3462         }
3463
3464         wdev_lock(wdev);
3465         err = rdev_start_ap(rdev, dev, &params);
3466         if (!err) {
3467                 wdev->preset_chandef = params.chandef;
3468                 wdev->beacon_interval = params.beacon_interval;
3469                 wdev->chandef = params.chandef;
3470                 wdev->ssid_len = params.ssid_len;
3471                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3472         }
3473         wdev_unlock(wdev);
3474
3475         kfree(params.acl);
3476
3477         return err;
3478 }
3479
3480 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3481 {
3482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3483         struct net_device *dev = info->user_ptr[1];
3484         struct wireless_dev *wdev = dev->ieee80211_ptr;
3485         struct cfg80211_beacon_data params;
3486         int err;
3487
3488         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3489             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3490                 return -EOPNOTSUPP;
3491
3492         if (!rdev->ops->change_beacon)
3493                 return -EOPNOTSUPP;
3494
3495         if (!wdev->beacon_interval)
3496                 return -EINVAL;
3497
3498         err = nl80211_parse_beacon(info->attrs, &params);
3499         if (err)
3500                 return err;
3501
3502         wdev_lock(wdev);
3503         err = rdev_change_beacon(rdev, dev, &params);
3504         wdev_unlock(wdev);
3505
3506         return err;
3507 }
3508
3509 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3510 {
3511         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3512         struct net_device *dev = info->user_ptr[1];
3513
3514         return cfg80211_stop_ap(rdev, dev, false);
3515 }
3516
3517 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3518         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3519         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3520         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3521         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3522         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3523         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3524 };
3525
3526 static int parse_station_flags(struct genl_info *info,
3527                                enum nl80211_iftype iftype,
3528                                struct station_parameters *params)
3529 {
3530         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3531         struct nlattr *nla;
3532         int flag;
3533
3534         /*
3535          * Try parsing the new attribute first so userspace
3536          * can specify both for older kernels.
3537          */
3538         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3539         if (nla) {
3540                 struct nl80211_sta_flag_update *sta_flags;
3541
3542                 sta_flags = nla_data(nla);
3543                 params->sta_flags_mask = sta_flags->mask;
3544                 params->sta_flags_set = sta_flags->set;
3545                 params->sta_flags_set &= params->sta_flags_mask;
3546                 if ((params->sta_flags_mask |
3547                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3548                         return -EINVAL;
3549                 return 0;
3550         }
3551
3552         /* if present, parse the old attribute */
3553
3554         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3555         if (!nla)
3556                 return 0;
3557
3558         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3559                              nla, sta_flags_policy))
3560                 return -EINVAL;
3561
3562         /*
3563          * Only allow certain flags for interface types so that
3564          * other attributes are silently ignored. Remember that
3565          * this is backward compatibility code with old userspace
3566          * and shouldn't be hit in other cases anyway.
3567          */
3568         switch (iftype) {
3569         case NL80211_IFTYPE_AP:
3570         case NL80211_IFTYPE_AP_VLAN:
3571         case NL80211_IFTYPE_P2P_GO:
3572                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3573                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3574                                          BIT(NL80211_STA_FLAG_WME) |
3575                                          BIT(NL80211_STA_FLAG_MFP);
3576                 break;
3577         case NL80211_IFTYPE_P2P_CLIENT:
3578         case NL80211_IFTYPE_STATION:
3579                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3580                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3581                 break;
3582         case NL80211_IFTYPE_MESH_POINT:
3583                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3584                                          BIT(NL80211_STA_FLAG_MFP) |
3585                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3586         default:
3587                 return -EINVAL;
3588         }
3589
3590         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3591                 if (flags[flag]) {
3592                         params->sta_flags_set |= (1<<flag);
3593
3594                         /* no longer support new API additions in old API */
3595                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3596                                 return -EINVAL;
3597                 }
3598         }
3599
3600         return 0;
3601 }
3602
3603 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3604                                  int attr)
3605 {
3606         struct nlattr *rate;
3607         u32 bitrate;
3608         u16 bitrate_compat;
3609         enum nl80211_attrs rate_flg;
3610
3611         rate = nla_nest_start(msg, attr);
3612         if (!rate)
3613                 return false;
3614
3615         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3616         bitrate = cfg80211_calculate_bitrate(info);
3617         /* report 16-bit bitrate only if we can */
3618         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3619         if (bitrate > 0 &&
3620             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3621                 return false;
3622         if (bitrate_compat > 0 &&
3623             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3624                 return false;
3625
3626         switch (info->bw) {
3627         case RATE_INFO_BW_5:
3628                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3629                 break;
3630         case RATE_INFO_BW_10:
3631                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3632                 break;
3633         default:
3634                 WARN_ON(1);
3635                 /* fall through */
3636         case RATE_INFO_BW_20:
3637                 rate_flg = 0;
3638                 break;
3639         case RATE_INFO_BW_40:
3640                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3641                 break;
3642         case RATE_INFO_BW_80:
3643                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3644                 break;
3645         case RATE_INFO_BW_160:
3646                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3647                 break;
3648         }
3649
3650         if (rate_flg && nla_put_flag(msg, rate_flg))
3651                 return false;
3652
3653         if (info->flags & RATE_INFO_FLAGS_MCS) {
3654                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3655                         return false;
3656                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3657                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3658                         return false;
3659         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3660                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3661                         return false;
3662                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3663                         return false;
3664                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3665                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3666                         return false;
3667         }
3668
3669         nla_nest_end(msg, rate);
3670         return true;
3671 }
3672
3673 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3674                                int id)
3675 {
3676         void *attr;
3677         int i = 0;
3678
3679         if (!mask)
3680                 return true;
3681
3682         attr = nla_nest_start(msg, id);
3683         if (!attr)
3684                 return false;
3685
3686         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3687                 if (!(mask & BIT(i)))
3688                         continue;
3689
3690                 if (nla_put_u8(msg, i, signal[i]))
3691                         return false;
3692         }
3693
3694         nla_nest_end(msg, attr);
3695
3696         return true;
3697 }
3698
3699 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3700                                 u32 seq, int flags,
3701                                 struct cfg80211_registered_device *rdev,
3702                                 struct net_device *dev,
3703                                 const u8 *mac_addr, struct station_info *sinfo)
3704 {
3705         void *hdr;
3706         struct nlattr *sinfoattr, *bss_param;
3707
3708         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3709         if (!hdr)
3710                 return -1;
3711
3712         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3713             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3714             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3715                 goto nla_put_failure;
3716
3717         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3718         if (!sinfoattr)
3719                 goto nla_put_failure;
3720
3721 #define PUT_SINFO(attr, memb, type) do {                                \
3722         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3723             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3724                              sinfo->memb))                              \
3725                 goto nla_put_failure;                                   \
3726         } while (0)
3727
3728         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3729         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3730
3731         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3732                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3733             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3734                         (u32)sinfo->rx_bytes))
3735                 goto nla_put_failure;
3736
3737         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3738                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3739             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3740                         (u32)sinfo->tx_bytes))
3741                 goto nla_put_failure;
3742
3743         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3744         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3745         PUT_SINFO(LLID, llid, u16);
3746         PUT_SINFO(PLID, plid, u16);
3747         PUT_SINFO(PLINK_STATE, plink_state, u8);
3748
3749         switch (rdev->wiphy.signal_type) {
3750         case CFG80211_SIGNAL_TYPE_MBM:
3751                 PUT_SINFO(SIGNAL, signal, u8);
3752                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3753                 break;
3754         default:
3755                 break;
3756         }
3757         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3758                 if (!nl80211_put_signal(msg, sinfo->chains,
3759                                         sinfo->chain_signal,
3760                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3761                         goto nla_put_failure;
3762         }
3763         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3764                 if (!nl80211_put_signal(msg, sinfo->chains,
3765                                         sinfo->chain_signal_avg,
3766                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3767                         goto nla_put_failure;
3768         }
3769         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3770                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3771                                           NL80211_STA_INFO_TX_BITRATE))
3772                         goto nla_put_failure;
3773         }
3774         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3775                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3776                                           NL80211_STA_INFO_RX_BITRATE))
3777                         goto nla_put_failure;
3778         }
3779
3780         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3781         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3782         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3783         PUT_SINFO(TX_FAILED, tx_failed, u32);
3784         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3785         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3786         PUT_SINFO(LOCAL_PM, local_pm, u32);
3787         PUT_SINFO(PEER_PM, peer_pm, u32);
3788         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3789
3790         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3791                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3792                 if (!bss_param)
3793                         goto nla_put_failure;
3794
3795                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3796                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3797                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3798                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3799                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3800                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3801                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3802                                sinfo->bss_param.dtim_period) ||
3803                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3804                                 sinfo->bss_param.beacon_interval))
3805                         goto nla_put_failure;
3806
3807                 nla_nest_end(msg, bss_param);
3808         }
3809         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3810             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3811                     sizeof(struct nl80211_sta_flag_update),
3812                     &sinfo->sta_flags))
3813                 goto nla_put_failure;
3814
3815         PUT_SINFO(T_OFFSET, t_offset, u64);
3816         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3817         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3818         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3819
3820 #undef PUT_SINFO
3821
3822         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3823                 struct nlattr *tidsattr;
3824                 int tid;
3825
3826                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3827                 if (!tidsattr)
3828                         goto nla_put_failure;
3829
3830                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3831                         struct cfg80211_tid_stats *tidstats;
3832                         struct nlattr *tidattr;
3833
3834                         tidstats = &sinfo->pertid[tid];
3835
3836                         if (!tidstats->filled)
3837                                 continue;
3838
3839                         tidattr = nla_nest_start(msg, tid + 1);
3840                         if (!tidattr)
3841                                 goto nla_put_failure;
3842
3843 #define PUT_TIDVAL(attr, memb, type) do {                               \
3844         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3845             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3846                              tidstats->memb))                           \
3847                 goto nla_put_failure;                                   \
3848         } while (0)
3849
3850                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3851                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3852                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3853                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3854
3855 #undef PUT_TIDVAL
3856                         nla_nest_end(msg, tidattr);
3857                 }
3858
3859                 nla_nest_end(msg, tidsattr);
3860         }
3861
3862         nla_nest_end(msg, sinfoattr);
3863
3864         if (sinfo->assoc_req_ies_len &&
3865             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3866                     sinfo->assoc_req_ies))
3867                 goto nla_put_failure;
3868
3869         genlmsg_end(msg, hdr);
3870         return 0;
3871
3872  nla_put_failure:
3873         genlmsg_cancel(msg, hdr);
3874         return -EMSGSIZE;
3875 }
3876
3877 static int nl80211_dump_station(struct sk_buff *skb,
3878                                 struct netlink_callback *cb)
3879 {
3880         struct station_info sinfo;
3881         struct cfg80211_registered_device *rdev;
3882         struct wireless_dev *wdev;
3883         u8 mac_addr[ETH_ALEN];
3884         int sta_idx = cb->args[2];
3885         int err;
3886
3887         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3888         if (err)
3889                 return err;
3890
3891         if (!wdev->netdev) {
3892                 err = -EINVAL;
3893                 goto out_err;
3894         }
3895
3896         if (!rdev->ops->dump_station) {
3897                 err = -EOPNOTSUPP;
3898                 goto out_err;
3899         }
3900
3901         while (1) {
3902                 memset(&sinfo, 0, sizeof(sinfo));
3903                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3904                                         mac_addr, &sinfo);
3905                 if (err == -ENOENT)
3906                         break;
3907                 if (err)
3908                         goto out_err;
3909
3910                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3911                                 NETLINK_CB(cb->skb).portid,
3912                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3913                                 rdev, wdev->netdev, mac_addr,
3914                                 &sinfo) < 0)
3915                         goto out;
3916
3917                 sta_idx++;
3918         }
3919
3920
3921  out:
3922         cb->args[2] = sta_idx;
3923         err = skb->len;
3924  out_err:
3925         nl80211_finish_wdev_dump(rdev);
3926
3927         return err;
3928 }
3929
3930 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3931 {
3932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3933         struct net_device *dev = info->user_ptr[1];
3934         struct station_info sinfo;
3935         struct sk_buff *msg;
3936         u8 *mac_addr = NULL;
3937         int err;
3938
3939         memset(&sinfo, 0, sizeof(sinfo));
3940
3941         if (!info->attrs[NL80211_ATTR_MAC])
3942                 return -EINVAL;
3943
3944         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3945
3946         if (!rdev->ops->get_station)
3947                 return -EOPNOTSUPP;
3948
3949         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3950         if (err)
3951                 return err;
3952
3953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3954         if (!msg)
3955                 return -ENOMEM;
3956
3957         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3958                                  info->snd_portid, info->snd_seq, 0,
3959                                  rdev, dev, mac_addr, &sinfo) < 0) {
3960                 nlmsg_free(msg);
3961                 return -ENOBUFS;
3962         }
3963
3964         return genlmsg_reply(msg, info);
3965 }
3966
3967 int cfg80211_check_station_change(struct wiphy *wiphy,
3968                                   struct station_parameters *params,
3969                                   enum cfg80211_station_type statype)
3970 {
3971         if (params->listen_interval != -1)
3972                 return -EINVAL;
3973         if (params->aid &&
3974             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3975                 return -EINVAL;
3976
3977         /* When you run into this, adjust the code below for the new flag */
3978         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3979
3980         switch (statype) {
3981         case CFG80211_STA_MESH_PEER_KERNEL:
3982         case CFG80211_STA_MESH_PEER_USER:
3983                 /*
3984                  * No ignoring the TDLS flag here -- the userspace mesh
3985                  * code doesn't have the bug of including TDLS in the
3986                  * mask everywhere.
3987                  */
3988                 if (params->sta_flags_mask &
3989                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3990                                   BIT(NL80211_STA_FLAG_MFP) |
3991                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3992                         return -EINVAL;
3993                 break;
3994         case CFG80211_STA_TDLS_PEER_SETUP:
3995         case CFG80211_STA_TDLS_PEER_ACTIVE:
3996                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3997                         return -EINVAL;
3998                 /* ignore since it can't change */
3999                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4000                 break;
4001         default:
4002                 /* disallow mesh-specific things */
4003                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4004                         return -EINVAL;
4005                 if (params->local_pm)
4006                         return -EINVAL;
4007                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4008                         return -EINVAL;
4009         }
4010
4011         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4012             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4013                 /* TDLS can't be set, ... */
4014                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4015                         return -EINVAL;
4016                 /*
4017                  * ... but don't bother the driver with it. This works around
4018                  * a hostapd/wpa_supplicant issue -- it always includes the
4019                  * TLDS_PEER flag in the mask even for AP mode.
4020                  */
4021                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4022         }
4023
4024         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4025             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4026                 /* reject other things that can't change */
4027                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4028                         return -EINVAL;
4029                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4030                         return -EINVAL;
4031                 if (params->supported_rates)
4032                         return -EINVAL;
4033                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4034                         return -EINVAL;
4035         }
4036
4037         if (statype != CFG80211_STA_AP_CLIENT &&
4038             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4039                 if (params->vlan)
4040                         return -EINVAL;
4041         }
4042
4043         switch (statype) {
4044         case CFG80211_STA_AP_MLME_CLIENT:
4045                 /* Use this only for authorizing/unauthorizing a station */
4046                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4047                         return -EOPNOTSUPP;
4048                 break;
4049         case CFG80211_STA_AP_CLIENT:
4050         case CFG80211_STA_AP_CLIENT_UNASSOC:
4051                 /* accept only the listed bits */
4052                 if (params->sta_flags_mask &
4053                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4054                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4055                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4056                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4057                                   BIT(NL80211_STA_FLAG_WME) |
4058                                   BIT(NL80211_STA_FLAG_MFP)))
4059                         return -EINVAL;
4060
4061                 /* but authenticated/associated only if driver handles it */
4062                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4063                     params->sta_flags_mask &
4064                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4065                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4066                         return -EINVAL;
4067                 break;
4068         case CFG80211_STA_IBSS:
4069         case CFG80211_STA_AP_STA:
4070                 /* reject any changes other than AUTHORIZED */
4071                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4072                         return -EINVAL;
4073                 break;
4074         case CFG80211_STA_TDLS_PEER_SETUP:
4075                 /* reject any changes other than AUTHORIZED or WME */
4076                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4077                                                BIT(NL80211_STA_FLAG_WME)))
4078                         return -EINVAL;
4079                 /* force (at least) rates when authorizing */
4080                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4081                     !params->supported_rates)
4082                         return -EINVAL;
4083                 break;
4084         case CFG80211_STA_TDLS_PEER_ACTIVE:
4085                 /* reject any changes */
4086                 return -EINVAL;
4087         case CFG80211_STA_MESH_PEER_KERNEL:
4088                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4089                         return -EINVAL;
4090                 break;
4091         case CFG80211_STA_MESH_PEER_USER:
4092                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4093                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4094                         return -EINVAL;
4095                 break;
4096         }
4097
4098         return 0;
4099 }
4100 EXPORT_SYMBOL(cfg80211_check_station_change);
4101
4102 /*
4103  * Get vlan interface making sure it is running and on the right wiphy.
4104  */
4105 static struct net_device *get_vlan(struct genl_info *info,
4106                                    struct cfg80211_registered_device *rdev)
4107 {
4108         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4109         struct net_device *v;
4110         int ret;
4111
4112         if (!vlanattr)
4113                 return NULL;
4114
4115         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4116         if (!v)
4117                 return ERR_PTR(-ENODEV);
4118
4119         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4120                 ret = -EINVAL;
4121                 goto error;
4122         }
4123
4124         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4125             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4126             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4127                 ret = -EINVAL;
4128                 goto error;
4129         }
4130
4131         if (!netif_running(v)) {
4132                 ret = -ENETDOWN;
4133                 goto error;
4134         }
4135
4136         return v;
4137  error:
4138         dev_put(v);
4139         return ERR_PTR(ret);
4140 }
4141
4142 static const struct nla_policy
4143 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4144         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4145         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4146 };
4147
4148 static int nl80211_parse_sta_wme(struct genl_info *info,
4149                                  struct station_parameters *params)
4150 {
4151         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4152         struct nlattr *nla;
4153         int err;
4154
4155         /* parse WME attributes if present */
4156         if (!info->attrs[NL80211_ATTR_STA_WME])
4157                 return 0;
4158
4159         nla = info->attrs[NL80211_ATTR_STA_WME];
4160         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4161                                nl80211_sta_wme_policy);
4162         if (err)
4163                 return err;
4164
4165         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4166                 params->uapsd_queues = nla_get_u8(
4167                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4168         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4169                 return -EINVAL;
4170
4171         if (tb[NL80211_STA_WME_MAX_SP])
4172                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4173
4174         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4175                 return -EINVAL;
4176
4177         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4178
4179         return 0;
4180 }
4181
4182 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4183                                       struct station_parameters *params)
4184 {
4185         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4186                 params->supported_channels =
4187                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4188                 params->supported_channels_len =
4189                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4190                 /*
4191                  * Need to include at least one (first channel, number of
4192                  * channels) tuple for each subband, and must have proper
4193                  * tuples for the rest of the data as well.
4194                  */
4195                 if (params->supported_channels_len < 2)
4196                         return -EINVAL;
4197                 if (params->supported_channels_len % 2)
4198                         return -EINVAL;
4199         }
4200
4201         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4202                 params->supported_oper_classes =
4203                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4204                 params->supported_oper_classes_len =
4205                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4206                 /*
4207                  * The value of the Length field of the Supported Operating
4208                  * Classes element is between 2 and 253.
4209                  */
4210                 if (params->supported_oper_classes_len < 2 ||
4211                     params->supported_oper_classes_len > 253)
4212                         return -EINVAL;
4213         }
4214         return 0;
4215 }
4216
4217 static int nl80211_set_station_tdls(struct genl_info *info,
4218                                     struct station_parameters *params)
4219 {
4220         int err;
4221         /* Dummy STA entry gets updated once the peer capabilities are known */
4222         if (info->attrs[NL80211_ATTR_PEER_AID])
4223                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4224         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4225                 params->ht_capa =
4226                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4227         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4228                 params->vht_capa =
4229                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4230
4231         err = nl80211_parse_sta_channel_info(info, params);
4232         if (err)
4233                 return err;
4234
4235         return nl80211_parse_sta_wme(info, params);
4236 }
4237
4238 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4239 {
4240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4241         struct net_device *dev = info->user_ptr[1];
4242         struct station_parameters params;
4243         u8 *mac_addr;
4244         int err;
4245
4246         memset(&params, 0, sizeof(params));
4247
4248         params.listen_interval = -1;
4249
4250         if (!rdev->ops->change_station)
4251                 return -EOPNOTSUPP;
4252
4253         if (info->attrs[NL80211_ATTR_STA_AID])
4254                 return -EINVAL;
4255
4256         if (!info->attrs[NL80211_ATTR_MAC])
4257                 return -EINVAL;
4258
4259         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4260
4261         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4262                 params.supported_rates =
4263                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4264                 params.supported_rates_len =
4265                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4266         }
4267
4268         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4269                 params.capability =
4270                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4271                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4272         }
4273
4274         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4275                 params.ext_capab =
4276                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4277                 params.ext_capab_len =
4278                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4279         }
4280
4281         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4282                 return -EINVAL;
4283
4284         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4285                 return -EINVAL;
4286
4287         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4288                 params.plink_action =
4289                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4290                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4291                         return -EINVAL;
4292         }
4293
4294         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4295                 params.plink_state =
4296                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4297                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4298                         return -EINVAL;
4299                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4300         }
4301
4302         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4303                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4304                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4305
4306                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4307                     pm > NL80211_MESH_POWER_MAX)
4308                         return -EINVAL;
4309
4310                 params.local_pm = pm;
4311         }
4312
4313         /* Include parameters for TDLS peer (will check later) */
4314         err = nl80211_set_station_tdls(info, &params);
4315         if (err)
4316                 return err;
4317
4318         params.vlan = get_vlan(info, rdev);
4319         if (IS_ERR(params.vlan))
4320                 return PTR_ERR(params.vlan);
4321
4322         switch (dev->ieee80211_ptr->iftype) {
4323         case NL80211_IFTYPE_AP:
4324         case NL80211_IFTYPE_AP_VLAN:
4325         case NL80211_IFTYPE_P2P_GO:
4326         case NL80211_IFTYPE_P2P_CLIENT:
4327         case NL80211_IFTYPE_STATION:
4328         case NL80211_IFTYPE_ADHOC:
4329         case NL80211_IFTYPE_MESH_POINT:
4330                 break;
4331         default:
4332                 err = -EOPNOTSUPP;
4333                 goto out_put_vlan;
4334         }
4335
4336         /* driver will call cfg80211_check_station_change() */
4337         err = rdev_change_station(rdev, dev, mac_addr, &params);
4338
4339  out_put_vlan:
4340         if (params.vlan)
4341                 dev_put(params.vlan);
4342
4343         return err;
4344 }
4345
4346 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4347 {
4348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4349         int err;
4350         struct net_device *dev = info->user_ptr[1];
4351         struct station_parameters params;
4352         u8 *mac_addr = NULL;
4353
4354         memset(&params, 0, sizeof(params));
4355
4356         if (!rdev->ops->add_station)
4357                 return -EOPNOTSUPP;
4358
4359         if (!info->attrs[NL80211_ATTR_MAC])
4360                 return -EINVAL;
4361
4362         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4363                 return -EINVAL;
4364
4365         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4366                 return -EINVAL;
4367
4368         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4369             !info->attrs[NL80211_ATTR_PEER_AID])
4370                 return -EINVAL;
4371
4372         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4373         params.supported_rates =
4374                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4375         params.supported_rates_len =
4376                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4377         params.listen_interval =
4378                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4379
4380         if (info->attrs[NL80211_ATTR_PEER_AID])
4381                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4382         else
4383                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4384         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4385                 return -EINVAL;
4386
4387         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4388                 params.capability =
4389                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4390                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4391         }
4392
4393         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4394                 params.ext_capab =
4395                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4396                 params.ext_capab_len =
4397                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4398         }
4399
4400         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4401                 params.ht_capa =
4402                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4403
4404         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4405                 params.vht_capa =
4406                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4407
4408         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4409                 params.opmode_notif_used = true;
4410                 params.opmode_notif =
4411                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4412         }
4413
4414         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4415                 params.plink_action =
4416                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4417                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4418                         return -EINVAL;
4419         }
4420
4421         err = nl80211_parse_sta_channel_info(info, &params);
4422         if (err)
4423                 return err;
4424
4425         err = nl80211_parse_sta_wme(info, &params);
4426         if (err)
4427                 return err;
4428
4429         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4430                 return -EINVAL;
4431
4432         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4433          * as userspace might just pass through the capabilities from the IEs
4434          * directly, rather than enforcing this restriction and returning an
4435          * error in this case.
4436          */
4437         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4438                 params.ht_capa = NULL;
4439                 params.vht_capa = NULL;
4440         }
4441
4442         /* When you run into this, adjust the code below for the new flag */
4443         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4444
4445         switch (dev->ieee80211_ptr->iftype) {
4446         case NL80211_IFTYPE_AP:
4447         case NL80211_IFTYPE_AP_VLAN:
4448         case NL80211_IFTYPE_P2P_GO:
4449                 /* ignore WME attributes if iface/sta is not capable */
4450                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4451                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4452                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4453
4454                 /* TDLS peers cannot be added */
4455                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4456                     info->attrs[NL80211_ATTR_PEER_AID])
4457                         return -EINVAL;
4458                 /* but don't bother the driver with it */
4459                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4460
4461                 /* allow authenticated/associated only if driver handles it */
4462                 if (!(rdev->wiphy.features &
4463                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4464                     params.sta_flags_mask &
4465                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4466                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4467                         return -EINVAL;
4468
4469                 /* must be last in here for error handling */
4470                 params.vlan = get_vlan(info, rdev);
4471                 if (IS_ERR(params.vlan))
4472                         return PTR_ERR(params.vlan);
4473                 break;
4474         case NL80211_IFTYPE_MESH_POINT:
4475                 /* ignore uAPSD data */
4476                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4477
4478                 /* associated is disallowed */
4479                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4480                         return -EINVAL;
4481                 /* TDLS peers cannot be added */
4482                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4483                     info->attrs[NL80211_ATTR_PEER_AID])
4484                         return -EINVAL;
4485                 break;
4486         case NL80211_IFTYPE_STATION:
4487         case NL80211_IFTYPE_P2P_CLIENT:
4488                 /* ignore uAPSD data */
4489                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4490
4491                 /* these are disallowed */
4492                 if (params.sta_flags_mask &
4493                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4494                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4495                         return -EINVAL;
4496                 /* Only TDLS peers can be added */
4497                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4498                         return -EINVAL;
4499                 /* Can only add if TDLS ... */
4500                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4501                         return -EOPNOTSUPP;
4502                 /* ... with external setup is supported */
4503                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4504                         return -EOPNOTSUPP;
4505                 /*
4506                  * Older wpa_supplicant versions always mark the TDLS peer
4507                  * as authorized, but it shouldn't yet be.
4508                  */
4509                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4510                 break;
4511         default:
4512                 return -EOPNOTSUPP;
4513         }
4514
4515         /* be aware of params.vlan when changing code here */
4516
4517         err = rdev_add_station(rdev, dev, mac_addr, &params);
4518
4519         if (params.vlan)
4520                 dev_put(params.vlan);
4521         return err;
4522 }
4523
4524 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4525 {
4526         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4527         struct net_device *dev = info->user_ptr[1];
4528         struct station_del_parameters params;
4529
4530         memset(&params, 0, sizeof(params));
4531
4532         if (info->attrs[NL80211_ATTR_MAC])
4533                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4534
4535         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4536             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4537             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4538             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4539                 return -EINVAL;
4540
4541         if (!rdev->ops->del_station)
4542                 return -EOPNOTSUPP;
4543
4544         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4545                 params.subtype =
4546                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4547                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4548                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4549                         return -EINVAL;
4550         } else {
4551                 /* Default to Deauthentication frame */
4552                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4553         }
4554
4555         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4556                 params.reason_code =
4557                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4558                 if (params.reason_code == 0)
4559                         return -EINVAL; /* 0 is reserved */
4560         } else {
4561                 /* Default to reason code 2 */
4562                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4563         }
4564
4565         return rdev_del_station(rdev, dev, &params);
4566 }
4567
4568 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4569                                 int flags, struct net_device *dev,
4570                                 u8 *dst, u8 *next_hop,
4571                                 struct mpath_info *pinfo)
4572 {
4573         void *hdr;
4574         struct nlattr *pinfoattr;
4575
4576         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4577         if (!hdr)
4578                 return -1;
4579
4580         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4581             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4582             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4583             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4584                 goto nla_put_failure;
4585
4586         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4587         if (!pinfoattr)
4588                 goto nla_put_failure;
4589         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4590             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4591                         pinfo->frame_qlen))
4592                 goto nla_put_failure;
4593         if (((pinfo->filled & MPATH_INFO_SN) &&
4594              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4595             ((pinfo->filled & MPATH_INFO_METRIC) &&
4596              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4597                          pinfo->metric)) ||
4598             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4599              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4600                          pinfo->exptime)) ||
4601             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4602              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4603                         pinfo->flags)) ||
4604             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4605              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4606                          pinfo->discovery_timeout)) ||
4607             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4608              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4609                         pinfo->discovery_retries)))
4610                 goto nla_put_failure;
4611
4612         nla_nest_end(msg, pinfoattr);
4613
4614         genlmsg_end(msg, hdr);
4615         return 0;
4616
4617  nla_put_failure:
4618         genlmsg_cancel(msg, hdr);
4619         return -EMSGSIZE;
4620 }
4621
4622 static int nl80211_dump_mpath(struct sk_buff *skb,
4623                               struct netlink_callback *cb)
4624 {
4625         struct mpath_info pinfo;
4626         struct cfg80211_registered_device *rdev;
4627         struct wireless_dev *wdev;
4628         u8 dst[ETH_ALEN];
4629         u8 next_hop[ETH_ALEN];
4630         int path_idx = cb->args[2];
4631         int err;
4632
4633         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4634         if (err)
4635                 return err;
4636
4637         if (!rdev->ops->dump_mpath) {
4638                 err = -EOPNOTSUPP;
4639                 goto out_err;
4640         }
4641
4642         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4643                 err = -EOPNOTSUPP;
4644                 goto out_err;
4645         }
4646
4647         while (1) {
4648                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4649                                       next_hop, &pinfo);
4650                 if (err == -ENOENT)
4651                         break;
4652                 if (err)
4653                         goto out_err;
4654
4655                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4656                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4657                                        wdev->netdev, dst, next_hop,
4658                                        &pinfo) < 0)
4659                         goto out;
4660
4661                 path_idx++;
4662         }
4663
4664
4665  out:
4666         cb->args[2] = path_idx;
4667         err = skb->len;
4668  out_err:
4669         nl80211_finish_wdev_dump(rdev);
4670         return err;
4671 }
4672
4673 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4674 {
4675         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4676         int err;
4677         struct net_device *dev = info->user_ptr[1];
4678         struct mpath_info pinfo;
4679         struct sk_buff *msg;
4680         u8 *dst = NULL;
4681         u8 next_hop[ETH_ALEN];
4682
4683         memset(&pinfo, 0, sizeof(pinfo));
4684
4685         if (!info->attrs[NL80211_ATTR_MAC])
4686                 return -EINVAL;
4687
4688         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4689
4690         if (!rdev->ops->get_mpath)
4691                 return -EOPNOTSUPP;
4692
4693         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4694                 return -EOPNOTSUPP;
4695
4696         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4697         if (err)
4698                 return err;
4699
4700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4701         if (!msg)
4702                 return -ENOMEM;
4703
4704         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4705                                  dev, dst, next_hop, &pinfo) < 0) {
4706                 nlmsg_free(msg);
4707                 return -ENOBUFS;
4708         }
4709
4710         return genlmsg_reply(msg, info);
4711 }
4712
4713 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4714 {
4715         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4716         struct net_device *dev = info->user_ptr[1];
4717         u8 *dst = NULL;
4718         u8 *next_hop = NULL;
4719
4720         if (!info->attrs[NL80211_ATTR_MAC])
4721                 return -EINVAL;
4722
4723         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4724                 return -EINVAL;
4725
4726         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4727         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4728
4729         if (!rdev->ops->change_mpath)
4730                 return -EOPNOTSUPP;
4731
4732         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4733                 return -EOPNOTSUPP;
4734
4735         return rdev_change_mpath(rdev, dev, dst, next_hop);
4736 }
4737
4738 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4739 {
4740         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4741         struct net_device *dev = info->user_ptr[1];
4742         u8 *dst = NULL;
4743         u8 *next_hop = NULL;
4744
4745         if (!info->attrs[NL80211_ATTR_MAC])
4746                 return -EINVAL;
4747
4748         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4749                 return -EINVAL;
4750
4751         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4752         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4753
4754         if (!rdev->ops->add_mpath)
4755                 return -EOPNOTSUPP;
4756
4757         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4758                 return -EOPNOTSUPP;
4759
4760         return rdev_add_mpath(rdev, dev, dst, next_hop);
4761 }
4762
4763 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4764 {
4765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4766         struct net_device *dev = info->user_ptr[1];
4767         u8 *dst = NULL;
4768
4769         if (info->attrs[NL80211_ATTR_MAC])
4770                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4771
4772         if (!rdev->ops->del_mpath)
4773                 return -EOPNOTSUPP;
4774
4775         return rdev_del_mpath(rdev, dev, dst);
4776 }
4777
4778 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4779 {
4780         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4781         int err;
4782         struct net_device *dev = info->user_ptr[1];
4783         struct mpath_info pinfo;
4784         struct sk_buff *msg;
4785         u8 *dst = NULL;
4786         u8 mpp[ETH_ALEN];
4787
4788         memset(&pinfo, 0, sizeof(pinfo));
4789
4790         if (!info->attrs[NL80211_ATTR_MAC])
4791                 return -EINVAL;
4792
4793         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4794
4795         if (!rdev->ops->get_mpp)
4796                 return -EOPNOTSUPP;
4797
4798         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4799                 return -EOPNOTSUPP;
4800
4801         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4802         if (err)
4803                 return err;
4804
4805         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4806         if (!msg)
4807                 return -ENOMEM;
4808
4809         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4810                                dev, dst, mpp, &pinfo) < 0) {
4811                 nlmsg_free(msg);
4812                 return -ENOBUFS;
4813         }
4814
4815         return genlmsg_reply(msg, info);
4816 }
4817
4818 static int nl80211_dump_mpp(struct sk_buff *skb,
4819                             struct netlink_callback *cb)
4820 {
4821         struct mpath_info pinfo;
4822         struct cfg80211_registered_device *rdev;
4823         struct wireless_dev *wdev;
4824         u8 dst[ETH_ALEN];
4825         u8 mpp[ETH_ALEN];
4826         int path_idx = cb->args[2];
4827         int err;
4828
4829         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4830         if (err)
4831                 return err;
4832
4833         if (!rdev->ops->dump_mpp) {
4834                 err = -EOPNOTSUPP;
4835                 goto out_err;
4836         }
4837
4838         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4839                 err = -EOPNOTSUPP;
4840                 goto out_err;
4841         }
4842
4843         while (1) {
4844                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4845                                     mpp, &pinfo);
4846                 if (err == -ENOENT)
4847                         break;
4848                 if (err)
4849                         goto out_err;
4850
4851                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4852                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4853                                        wdev->netdev, dst, mpp,
4854                                        &pinfo) < 0)
4855                         goto out;
4856
4857                 path_idx++;
4858         }
4859
4860  out:
4861         cb->args[2] = path_idx;
4862         err = skb->len;
4863  out_err:
4864         nl80211_finish_wdev_dump(rdev);
4865         return err;
4866 }
4867
4868 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4869 {
4870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4871         struct net_device *dev = info->user_ptr[1];
4872         struct wireless_dev *wdev = dev->ieee80211_ptr;
4873         struct bss_parameters params;
4874         int err;
4875
4876         memset(&params, 0, sizeof(params));
4877         /* default to not changing parameters */
4878         params.use_cts_prot = -1;
4879         params.use_short_preamble = -1;
4880         params.use_short_slot_time = -1;
4881         params.ap_isolate = -1;
4882         params.ht_opmode = -1;
4883         params.p2p_ctwindow = -1;
4884         params.p2p_opp_ps = -1;
4885
4886         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4887                 params.use_cts_prot =
4888                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4889         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4890                 params.use_short_preamble =
4891                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4892         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4893                 params.use_short_slot_time =
4894                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4895         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4896                 params.basic_rates =
4897                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4898                 params.basic_rates_len =
4899                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4900         }
4901         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4902                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4903         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4904                 params.ht_opmode =
4905                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4906
4907         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4908                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4909                         return -EINVAL;
4910                 params.p2p_ctwindow =
4911                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4912                 if (params.p2p_ctwindow < 0)
4913                         return -EINVAL;
4914                 if (params.p2p_ctwindow != 0 &&
4915                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4916                         return -EINVAL;
4917         }
4918
4919         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4920                 u8 tmp;
4921
4922                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4923                         return -EINVAL;
4924                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4925                 if (tmp > 1)
4926                         return -EINVAL;
4927                 params.p2p_opp_ps = tmp;
4928                 if (params.p2p_opp_ps &&
4929                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4930                         return -EINVAL;
4931         }
4932
4933         if (!rdev->ops->change_bss)
4934                 return -EOPNOTSUPP;
4935
4936         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4937             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4938                 return -EOPNOTSUPP;
4939
4940         wdev_lock(wdev);
4941         err = rdev_change_bss(rdev, dev, &params);
4942         wdev_unlock(wdev);
4943
4944         return err;
4945 }
4946
4947 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4948 {
4949         char *data = NULL;
4950         bool is_indoor;
4951         enum nl80211_user_reg_hint_type user_reg_hint_type;
4952         u32 owner_nlportid;
4953
4954
4955         /*
4956          * You should only get this when cfg80211 hasn't yet initialized
4957          * completely when built-in to the kernel right between the time
4958          * window between nl80211_init() and regulatory_init(), if that is
4959          * even possible.
4960          */
4961         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4962                 return -EINPROGRESS;
4963
4964         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4965                 user_reg_hint_type =
4966                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4967         else
4968                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4969
4970         switch (user_reg_hint_type) {
4971         case NL80211_USER_REG_HINT_USER:
4972         case NL80211_USER_REG_HINT_CELL_BASE:
4973                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4974                         return -EINVAL;
4975
4976                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4977                 return regulatory_hint_user(data, user_reg_hint_type);
4978         case NL80211_USER_REG_HINT_INDOOR:
4979                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
4980                         owner_nlportid = info->snd_portid;
4981                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
4982                 } else {
4983                         owner_nlportid = 0;
4984                         is_indoor = true;
4985                 }
4986
4987                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
4988         default:
4989                 return -EINVAL;
4990         }
4991 }
4992
4993 static int nl80211_get_mesh_config(struct sk_buff *skb,
4994                                    struct genl_info *info)
4995 {
4996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4997         struct net_device *dev = info->user_ptr[1];
4998         struct wireless_dev *wdev = dev->ieee80211_ptr;
4999         struct mesh_config cur_params;
5000         int err = 0;
5001         void *hdr;
5002         struct nlattr *pinfoattr;
5003         struct sk_buff *msg;
5004
5005         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5006                 return -EOPNOTSUPP;
5007
5008         if (!rdev->ops->get_mesh_config)
5009                 return -EOPNOTSUPP;
5010
5011         wdev_lock(wdev);
5012         /* If not connected, get default parameters */
5013         if (!wdev->mesh_id_len)
5014                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5015         else
5016                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5017         wdev_unlock(wdev);
5018
5019         if (err)
5020                 return err;
5021
5022         /* Draw up a netlink message to send back */
5023         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5024         if (!msg)
5025                 return -ENOMEM;
5026         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5027                              NL80211_CMD_GET_MESH_CONFIG);
5028         if (!hdr)
5029                 goto out;
5030         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5031         if (!pinfoattr)
5032                 goto nla_put_failure;
5033         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5034             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5035                         cur_params.dot11MeshRetryTimeout) ||
5036             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5037                         cur_params.dot11MeshConfirmTimeout) ||
5038             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5039                         cur_params.dot11MeshHoldingTimeout) ||
5040             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5041                         cur_params.dot11MeshMaxPeerLinks) ||
5042             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5043                        cur_params.dot11MeshMaxRetries) ||
5044             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5045                        cur_params.dot11MeshTTL) ||
5046             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5047                        cur_params.element_ttl) ||
5048             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5049                        cur_params.auto_open_plinks) ||
5050             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5051                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5052             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5053                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5054             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5055                         cur_params.path_refresh_time) ||
5056             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5057                         cur_params.min_discovery_timeout) ||
5058             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5059                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5060             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5061                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5062             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5063                         cur_params.dot11MeshHWMPperrMinInterval) ||
5064             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5065                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5066             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5067                        cur_params.dot11MeshHWMPRootMode) ||
5068             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5069                         cur_params.dot11MeshHWMPRannInterval) ||
5070             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5071                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5072             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5073                        cur_params.dot11MeshForwarding) ||
5074             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5075                         cur_params.rssi_threshold) ||
5076             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5077                         cur_params.ht_opmode) ||
5078             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5079                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5080             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5081                         cur_params.dot11MeshHWMProotInterval) ||
5082             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5083                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5084             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5085                         cur_params.power_mode) ||
5086             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5087                         cur_params.dot11MeshAwakeWindowDuration) ||
5088             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5089                         cur_params.plink_timeout))
5090                 goto nla_put_failure;
5091         nla_nest_end(msg, pinfoattr);
5092         genlmsg_end(msg, hdr);
5093         return genlmsg_reply(msg, info);
5094
5095  nla_put_failure:
5096         genlmsg_cancel(msg, hdr);
5097  out:
5098         nlmsg_free(msg);
5099         return -ENOBUFS;
5100 }
5101
5102 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5103         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5104         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5105         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5106         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5107         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5108         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5109         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5110         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5111         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5112         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5113         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5114         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5115         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5116         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5117         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5118         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5119         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5120         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5121         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5122         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5123         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5124         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5125         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5126         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5127         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5128         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5129         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5130         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5131 };
5132
5133 static const struct nla_policy
5134         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5135         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5136         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5137         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5138         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5139         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5140         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5141         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5142                                     .len = IEEE80211_MAX_DATA_LEN },
5143         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5144 };
5145
5146 static int nl80211_parse_mesh_config(struct genl_info *info,
5147                                      struct mesh_config *cfg,
5148                                      u32 *mask_out)
5149 {
5150         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5151         u32 mask = 0;
5152
5153 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5154 do {                                                                        \
5155         if (tb[attr]) {                                                     \
5156                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5157                         return -EINVAL;                                     \
5158                 cfg->param = fn(tb[attr]);                                  \
5159                 mask |= (1 << (attr - 1));                                  \
5160         }                                                                   \
5161 } while (0)
5162
5163
5164         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5165                 return -EINVAL;
5166         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5167                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5168                              nl80211_meshconf_params_policy))
5169                 return -EINVAL;
5170
5171         /* This makes sure that there aren't more than 32 mesh config
5172          * parameters (otherwise our bitfield scheme would not work.) */
5173         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5174
5175         /* Fill in the params struct */
5176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5177                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5178                                   nla_get_u16);
5179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5180                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5181                                   nla_get_u16);
5182         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5183                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5184                                   nla_get_u16);
5185         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5186                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5187                                   nla_get_u16);
5188         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5189                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5190                                   nla_get_u8);
5191         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5192                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5193         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5194                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5195                                   nla_get_u8);
5196         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5197                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5198                                   nla_get_u8);
5199         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5200                                   1, 255, mask,
5201                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5202                                   nla_get_u32);
5203         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5204                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5205                                   nla_get_u8);
5206         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5207                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5208                                   nla_get_u32);
5209         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5210                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5211                                   nla_get_u16);
5212         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5213                                   1, 65535, mask,
5214                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5215                                   nla_get_u32);
5216         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5217                                   1, 65535, mask,
5218                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5219                                   nla_get_u16);
5220         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5221                                   1, 65535, mask,
5222                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5223                                   nla_get_u16);
5224         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5225                                   dot11MeshHWMPnetDiameterTraversalTime,
5226                                   1, 65535, mask,
5227                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5228                                   nla_get_u16);
5229         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5230                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5231                                   nla_get_u8);
5232         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5233                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5234                                   nla_get_u16);
5235         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5236                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5237                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5238                                   nla_get_u8);
5239         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5240                                   mask, NL80211_MESHCONF_FORWARDING,
5241                                   nla_get_u8);
5242         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5243                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5244                                   nla_get_s32);
5245         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5246                                   mask, NL80211_MESHCONF_HT_OPMODE,
5247                                   nla_get_u16);
5248         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5249                                   1, 65535, mask,
5250                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5251                                   nla_get_u32);
5252         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5253                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5254                                   nla_get_u16);
5255         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5256                                   dot11MeshHWMPconfirmationInterval,
5257                                   1, 65535, mask,
5258                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5259                                   nla_get_u16);
5260         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5261                                   NL80211_MESH_POWER_ACTIVE,
5262                                   NL80211_MESH_POWER_MAX,
5263                                   mask, NL80211_MESHCONF_POWER_MODE,
5264                                   nla_get_u32);
5265         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5266                                   0, 65535, mask,
5267                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5268         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5269                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5270                                   nla_get_u32);
5271         if (mask_out)
5272                 *mask_out = mask;
5273
5274         return 0;
5275
5276 #undef FILL_IN_MESH_PARAM_IF_SET
5277 }
5278
5279 static int nl80211_parse_mesh_setup(struct genl_info *info,
5280                                      struct mesh_setup *setup)
5281 {
5282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5283         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5284
5285         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5286                 return -EINVAL;
5287         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5288                              info->attrs[NL80211_ATTR_MESH_SETUP],
5289                              nl80211_mesh_setup_params_policy))
5290                 return -EINVAL;
5291
5292         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5293                 setup->sync_method =
5294                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5295                  IEEE80211_SYNC_METHOD_VENDOR :
5296                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5297
5298         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5299                 setup->path_sel_proto =
5300                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5301                  IEEE80211_PATH_PROTOCOL_VENDOR :
5302                  IEEE80211_PATH_PROTOCOL_HWMP;
5303
5304         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5305                 setup->path_metric =
5306                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5307                  IEEE80211_PATH_METRIC_VENDOR :
5308                  IEEE80211_PATH_METRIC_AIRTIME;
5309
5310
5311         if (tb[NL80211_MESH_SETUP_IE]) {
5312                 struct nlattr *ieattr =
5313                         tb[NL80211_MESH_SETUP_IE];
5314                 if (!is_valid_ie_attr(ieattr))
5315                         return -EINVAL;
5316                 setup->ie = nla_data(ieattr);
5317                 setup->ie_len = nla_len(ieattr);
5318         }
5319         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5320             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5321                 return -EINVAL;
5322         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5323         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5324         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5325         if (setup->is_secure)
5326                 setup->user_mpm = true;
5327
5328         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5329                 if (!setup->user_mpm)
5330                         return -EINVAL;
5331                 setup->auth_id =
5332                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5333         }
5334
5335         return 0;
5336 }
5337
5338 static int nl80211_update_mesh_config(struct sk_buff *skb,
5339                                       struct genl_info *info)
5340 {
5341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5342         struct net_device *dev = info->user_ptr[1];
5343         struct wireless_dev *wdev = dev->ieee80211_ptr;
5344         struct mesh_config cfg;
5345         u32 mask;
5346         int err;
5347
5348         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5349                 return -EOPNOTSUPP;
5350
5351         if (!rdev->ops->update_mesh_config)
5352                 return -EOPNOTSUPP;
5353
5354         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5355         if (err)
5356                 return err;
5357
5358         wdev_lock(wdev);
5359         if (!wdev->mesh_id_len)
5360                 err = -ENOLINK;
5361
5362         if (!err)
5363                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5364
5365         wdev_unlock(wdev);
5366
5367         return err;
5368 }
5369
5370 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5371                               struct sk_buff *msg)
5372 {
5373         struct nlattr *nl_reg_rules;
5374         unsigned int i;
5375
5376         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5377             (regdom->dfs_region &&
5378              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5379                 goto nla_put_failure;
5380
5381         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5382         if (!nl_reg_rules)
5383                 goto nla_put_failure;
5384
5385         for (i = 0; i < regdom->n_reg_rules; i++) {
5386                 struct nlattr *nl_reg_rule;
5387                 const struct ieee80211_reg_rule *reg_rule;
5388                 const struct ieee80211_freq_range *freq_range;
5389                 const struct ieee80211_power_rule *power_rule;
5390                 unsigned int max_bandwidth_khz;
5391
5392                 reg_rule = &regdom->reg_rules[i];
5393                 freq_range = &reg_rule->freq_range;
5394                 power_rule = &reg_rule->power_rule;
5395
5396                 nl_reg_rule = nla_nest_start(msg, i);
5397                 if (!nl_reg_rule)
5398                         goto nla_put_failure;
5399
5400                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5401                 if (!max_bandwidth_khz)
5402                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5403                                                                   reg_rule);
5404
5405                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5406                                 reg_rule->flags) ||
5407                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5408                                 freq_range->start_freq_khz) ||
5409                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5410                                 freq_range->end_freq_khz) ||
5411                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5412                                 max_bandwidth_khz) ||
5413                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5414                                 power_rule->max_antenna_gain) ||
5415                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5416                                 power_rule->max_eirp) ||
5417                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5418                                 reg_rule->dfs_cac_ms))
5419                         goto nla_put_failure;
5420
5421                 nla_nest_end(msg, nl_reg_rule);
5422         }
5423
5424         nla_nest_end(msg, nl_reg_rules);
5425         return 0;
5426
5427 nla_put_failure:
5428         return -EMSGSIZE;
5429 }
5430
5431 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5432 {
5433         const struct ieee80211_regdomain *regdom = NULL;
5434         struct cfg80211_registered_device *rdev;
5435         struct wiphy *wiphy = NULL;
5436         struct sk_buff *msg;
5437         void *hdr;
5438
5439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5440         if (!msg)
5441                 return -ENOBUFS;
5442
5443         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5444                              NL80211_CMD_GET_REG);
5445         if (!hdr)
5446                 goto put_failure;
5447
5448         if (info->attrs[NL80211_ATTR_WIPHY]) {
5449                 bool self_managed;
5450
5451                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5452                 if (IS_ERR(rdev)) {
5453                         nlmsg_free(msg);
5454                         return PTR_ERR(rdev);
5455                 }
5456
5457                 wiphy = &rdev->wiphy;
5458                 self_managed = wiphy->regulatory_flags &
5459                                REGULATORY_WIPHY_SELF_MANAGED;
5460                 regdom = get_wiphy_regdom(wiphy);
5461
5462                 /* a self-managed-reg device must have a private regdom */
5463                 if (WARN_ON(!regdom && self_managed)) {
5464                         nlmsg_free(msg);
5465                         return -EINVAL;
5466                 }
5467
5468                 if (regdom &&
5469                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5470                         goto nla_put_failure;
5471         }
5472
5473         if (!wiphy && reg_last_request_cell_base() &&
5474             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5475                         NL80211_USER_REG_HINT_CELL_BASE))
5476                 goto nla_put_failure;
5477
5478         rcu_read_lock();
5479
5480         if (!regdom)
5481                 regdom = rcu_dereference(cfg80211_regdomain);
5482
5483         if (nl80211_put_regdom(regdom, msg))
5484                 goto nla_put_failure_rcu;
5485
5486         rcu_read_unlock();
5487
5488         genlmsg_end(msg, hdr);
5489         return genlmsg_reply(msg, info);
5490
5491 nla_put_failure_rcu:
5492         rcu_read_unlock();
5493 nla_put_failure:
5494         genlmsg_cancel(msg, hdr);
5495 put_failure:
5496         nlmsg_free(msg);
5497         return -EMSGSIZE;
5498 }
5499
5500 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5501                                u32 seq, int flags, struct wiphy *wiphy,
5502                                const struct ieee80211_regdomain *regdom)
5503 {
5504         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5505                                    NL80211_CMD_GET_REG);
5506
5507         if (!hdr)
5508                 return -1;
5509
5510         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5511
5512         if (nl80211_put_regdom(regdom, msg))
5513                 goto nla_put_failure;
5514
5515         if (!wiphy && reg_last_request_cell_base() &&
5516             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5517                         NL80211_USER_REG_HINT_CELL_BASE))
5518                 goto nla_put_failure;
5519
5520         if (wiphy &&
5521             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5522                 goto nla_put_failure;
5523
5524         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5525             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5526                 goto nla_put_failure;
5527
5528         genlmsg_end(msg, hdr);
5529         return 0;
5530
5531 nla_put_failure:
5532         genlmsg_cancel(msg, hdr);
5533         return -EMSGSIZE;
5534 }
5535
5536 static int nl80211_get_reg_dump(struct sk_buff *skb,
5537                                 struct netlink_callback *cb)
5538 {
5539         const struct ieee80211_regdomain *regdom = NULL;
5540         struct cfg80211_registered_device *rdev;
5541         int err, reg_idx, start = cb->args[2];
5542
5543         rtnl_lock();
5544
5545         if (cfg80211_regdomain && start == 0) {
5546                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5547                                           NLM_F_MULTI, NULL,
5548                                           rtnl_dereference(cfg80211_regdomain));
5549                 if (err < 0)
5550                         goto out_err;
5551         }
5552
5553         /* the global regdom is idx 0 */
5554         reg_idx = 1;
5555         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5556                 regdom = get_wiphy_regdom(&rdev->wiphy);
5557                 if (!regdom)
5558                         continue;
5559
5560                 if (++reg_idx <= start)
5561                         continue;
5562
5563                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5564                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5565                 if (err < 0) {
5566                         reg_idx--;
5567                         break;
5568                 }
5569         }
5570
5571         cb->args[2] = reg_idx;
5572         err = skb->len;
5573 out_err:
5574         rtnl_unlock();
5575         return err;
5576 }
5577
5578 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
5579 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
5580         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
5581         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
5582         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
5583         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
5584         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
5585         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
5586         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
5587 };
5588
5589 static int parse_reg_rule(struct nlattr *tb[],
5590         struct ieee80211_reg_rule *reg_rule)
5591 {
5592         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
5593         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
5594
5595         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
5596                 return -EINVAL;
5597         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
5598                 return -EINVAL;
5599         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
5600                 return -EINVAL;
5601         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
5602                 return -EINVAL;
5603         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
5604                 return -EINVAL;
5605
5606         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
5607
5608         freq_range->start_freq_khz =
5609                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
5610         freq_range->end_freq_khz =
5611                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
5612         freq_range->max_bandwidth_khz =
5613                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
5614
5615         power_rule->max_eirp =
5616                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
5617
5618         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
5619                 power_rule->max_antenna_gain =
5620                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
5621
5622         if (tb[NL80211_ATTR_DFS_CAC_TIME])
5623                 reg_rule->dfs_cac_ms =
5624                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
5625
5626         return 0;
5627 }
5628
5629 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5630 {
5631         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5632         struct nlattr *nl_reg_rule;
5633         char *alpha2;
5634         int rem_reg_rules, r;
5635         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5636         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5637         struct ieee80211_regdomain *rd;
5638
5639         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5640                 return -EINVAL;
5641
5642         if (!info->attrs[NL80211_ATTR_REG_RULES])
5643                 return -EINVAL;
5644
5645         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5646
5647         if (info->attrs[NL80211_ATTR_DFS_REGION])
5648                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5649
5650         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5651                             rem_reg_rules) {
5652                 num_rules++;
5653                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5654                         return -EINVAL;
5655         }
5656
5657         if (!reg_is_valid_request(alpha2))
5658                 return -EINVAL;
5659
5660         size_of_regd = sizeof(struct ieee80211_regdomain) +
5661                        num_rules * sizeof(struct ieee80211_reg_rule);
5662
5663         rd = kzalloc(size_of_regd, GFP_KERNEL);
5664         if (!rd)
5665                 return -ENOMEM;
5666
5667         rd->n_reg_rules = num_rules;
5668         rd->alpha2[0] = alpha2[0];
5669         rd->alpha2[1] = alpha2[1];
5670
5671         /*
5672          * Disable DFS master mode if the DFS region was
5673          * not supported or known on this kernel.
5674          */
5675         if (reg_supported_dfs_region(dfs_region))
5676                 rd->dfs_region = dfs_region;
5677
5678         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5679                             rem_reg_rules) {
5680                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5681                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5682                               reg_rule_policy);
5683                 if (r)
5684                         goto bad_reg;
5685                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5686                 if (r)
5687                         goto bad_reg;
5688
5689                 rule_idx++;
5690
5691                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5692                         r = -EINVAL;
5693                         goto bad_reg;
5694                 }
5695         }
5696
5697         r = set_regdom(rd, REGD_SOURCE_CRDA);
5698         /* set_regdom took ownership */
5699         rd = NULL;
5700
5701  bad_reg:
5702         kfree(rd);
5703         return r;
5704 }
5705 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
5706
5707 static int validate_scan_freqs(struct nlattr *freqs)
5708 {
5709         struct nlattr *attr1, *attr2;
5710         int n_channels = 0, tmp1, tmp2;
5711
5712         nla_for_each_nested(attr1, freqs, tmp1) {
5713                 n_channels++;
5714                 /*
5715                  * Some hardware has a limited channel list for
5716                  * scanning, and it is pretty much nonsensical
5717                  * to scan for a channel twice, so disallow that
5718                  * and don't require drivers to check that the
5719                  * channel list they get isn't longer than what
5720                  * they can scan, as long as they can scan all
5721                  * the channels they registered at once.
5722                  */
5723                 nla_for_each_nested(attr2, freqs, tmp2)
5724                         if (attr1 != attr2 &&
5725                             nla_get_u32(attr1) == nla_get_u32(attr2))
5726                                 return 0;
5727         }
5728
5729         return n_channels;
5730 }
5731
5732 static int nl80211_parse_random_mac(struct nlattr **attrs,
5733                                     u8 *mac_addr, u8 *mac_addr_mask)
5734 {
5735         int i;
5736
5737         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5738                 eth_zero_addr(mac_addr);
5739                 eth_zero_addr(mac_addr_mask);
5740                 mac_addr[0] = 0x2;
5741                 mac_addr_mask[0] = 0x3;
5742
5743                 return 0;
5744         }
5745
5746         /* need both or none */
5747         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5748                 return -EINVAL;
5749
5750         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5751         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5752
5753         /* don't allow or configure an mcast address */
5754         if (!is_multicast_ether_addr(mac_addr_mask) ||
5755             is_multicast_ether_addr(mac_addr))
5756                 return -EINVAL;
5757
5758         /*
5759          * allow users to pass a MAC address that has bits set outside
5760          * of the mask, but don't bother drivers with having to deal
5761          * with such bits
5762          */
5763         for (i = 0; i < ETH_ALEN; i++)
5764                 mac_addr[i] &= mac_addr_mask[i];
5765
5766         return 0;
5767 }
5768
5769 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5770 {
5771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5772         struct wireless_dev *wdev = info->user_ptr[1];
5773         struct cfg80211_scan_request *request;
5774         struct nlattr *attr;
5775         struct wiphy *wiphy;
5776         int err, tmp, n_ssids = 0, n_channels, i;
5777         size_t ie_len;
5778
5779         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5780                 return -EINVAL;
5781
5782         wiphy = &rdev->wiphy;
5783
5784         if (!rdev->ops->scan)
5785                 return -EOPNOTSUPP;
5786
5787         if (rdev->scan_req || rdev->scan_msg) {
5788                 err = -EBUSY;
5789                 goto unlock;
5790         }
5791
5792         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5793                 n_channels = validate_scan_freqs(
5794                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5795                 if (!n_channels) {
5796                         err = -EINVAL;
5797                         goto unlock;
5798                 }
5799         } else {
5800                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5801         }
5802
5803         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5804                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5805                         n_ssids++;
5806
5807         if (n_ssids > wiphy->max_scan_ssids) {
5808                 err = -EINVAL;
5809                 goto unlock;
5810         }
5811
5812         if (info->attrs[NL80211_ATTR_IE])
5813                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5814         else
5815                 ie_len = 0;
5816
5817         if (ie_len > wiphy->max_scan_ie_len) {
5818                 err = -EINVAL;
5819                 goto unlock;
5820         }
5821
5822         request = kzalloc(sizeof(*request)
5823                         + sizeof(*request->ssids) * n_ssids
5824                         + sizeof(*request->channels) * n_channels
5825                         + ie_len, GFP_KERNEL);
5826         if (!request) {
5827                 err = -ENOMEM;
5828                 goto unlock;
5829         }
5830
5831         if (n_ssids)
5832                 request->ssids = (void *)&request->channels[n_channels];
5833         request->n_ssids = n_ssids;
5834         if (ie_len) {
5835                 if (n_ssids)
5836                         request->ie = (void *)(request->ssids + n_ssids);
5837                 else
5838                         request->ie = (void *)(request->channels + n_channels);
5839         }
5840
5841         i = 0;
5842         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5843                 /* user specified, bail out if channel not found */
5844                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5845                         struct ieee80211_channel *chan;
5846
5847                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5848
5849                         if (!chan) {
5850                                 err = -EINVAL;
5851                                 goto out_free;
5852                         }
5853
5854                         /* ignore disabled channels */
5855                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5856                                 continue;
5857
5858                         request->channels[i] = chan;
5859                         i++;
5860                 }
5861         } else {
5862                 enum ieee80211_band band;
5863
5864                 /* all channels */
5865                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5866                         int j;
5867                         if (!wiphy->bands[band])
5868                                 continue;
5869                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5870                                 struct ieee80211_channel *chan;
5871
5872                                 chan = &wiphy->bands[band]->channels[j];
5873
5874                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5875                                         continue;
5876
5877                                 request->channels[i] = chan;
5878                                 i++;
5879                         }
5880                 }
5881         }
5882
5883         if (!i) {
5884                 err = -EINVAL;
5885                 goto out_free;
5886         }
5887
5888         request->n_channels = i;
5889
5890         i = 0;
5891         if (n_ssids) {
5892                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5893                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5894                                 err = -EINVAL;
5895                                 goto out_free;
5896                         }
5897                         request->ssids[i].ssid_len = nla_len(attr);
5898                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5899                         i++;
5900                 }
5901         }
5902
5903         if (info->attrs[NL80211_ATTR_IE]) {
5904                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5905                 memcpy((void *)request->ie,
5906                        nla_data(info->attrs[NL80211_ATTR_IE]),
5907                        request->ie_len);
5908         }
5909
5910         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5911                 if (wiphy->bands[i])
5912                         request->rates[i] =
5913                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5914
5915         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5916                 nla_for_each_nested(attr,
5917                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5918                                     tmp) {
5919                         enum ieee80211_band band = nla_type(attr);
5920
5921                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5922                                 err = -EINVAL;
5923                                 goto out_free;
5924                         }
5925
5926                         if (!wiphy->bands[band])
5927                                 continue;
5928
5929                         err = ieee80211_get_ratemask(wiphy->bands[band],
5930                                                      nla_data(attr),
5931                                                      nla_len(attr),
5932                                                      &request->rates[band]);
5933                         if (err)
5934                                 goto out_free;
5935                 }
5936         }
5937
5938         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5939                 request->flags = nla_get_u32(
5940                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5941                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5942                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5943                         err = -EOPNOTSUPP;
5944                         goto out_free;
5945                 }
5946
5947                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5948                         if (!(wiphy->features &
5949                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5950                                 err = -EOPNOTSUPP;
5951                                 goto out_free;
5952                         }
5953
5954                         if (wdev->current_bss) {
5955                                 err = -EOPNOTSUPP;
5956                                 goto out_free;
5957                         }
5958
5959                         err = nl80211_parse_random_mac(info->attrs,
5960                                                        request->mac_addr,
5961                                                        request->mac_addr_mask);
5962                         if (err)
5963                                 goto out_free;
5964                 }
5965         }
5966
5967         request->no_cck =
5968                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5969
5970         request->wdev = wdev;
5971         request->wiphy = &rdev->wiphy;
5972         request->scan_start = jiffies;
5973
5974         rdev->scan_req = request;
5975         err = rdev_scan(rdev, request);
5976
5977         if (!err) {
5978                 nl80211_send_scan_start(rdev, wdev);
5979                 if (wdev->netdev)
5980                         dev_hold(wdev->netdev);
5981         } else {
5982  out_free:
5983                 rdev->scan_req = NULL;
5984                 kfree(request);
5985         }
5986
5987  unlock:
5988         return err;
5989 }
5990
5991 static int
5992 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
5993                                struct cfg80211_sched_scan_request *request,
5994                                struct nlattr **attrs)
5995 {
5996         int tmp, err, i = 0;
5997         struct nlattr *attr;
5998
5999         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6000                 u32 interval;
6001
6002                 /*
6003                  * If scan plans are not specified,
6004                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6005                  * case one scan plan will be set with the specified scan
6006                  * interval and infinite number of iterations.
6007                  */
6008                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6009                         return -EINVAL;
6010
6011                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6012                 if (!interval)
6013                         return -EINVAL;
6014
6015                 request->scan_plans[0].interval =
6016                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6017                 if (!request->scan_plans[0].interval)
6018                         return -EINVAL;
6019
6020                 if (request->scan_plans[0].interval >
6021                     wiphy->max_sched_scan_plan_interval)
6022                         request->scan_plans[0].interval =
6023                                 wiphy->max_sched_scan_plan_interval;
6024
6025                 return 0;
6026         }
6027
6028         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6029                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6030
6031                 if (WARN_ON(i >= n_plans))
6032                         return -EINVAL;
6033
6034                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6035                                 nla_data(attr), nla_len(attr),
6036                                 nl80211_plan_policy);
6037                 if (err)
6038                         return err;
6039
6040                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6041                         return -EINVAL;
6042
6043                 request->scan_plans[i].interval =
6044                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6045                 if (!request->scan_plans[i].interval ||
6046                     request->scan_plans[i].interval >
6047                     wiphy->max_sched_scan_plan_interval)
6048                         return -EINVAL;
6049
6050                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6051                         request->scan_plans[i].iterations =
6052                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6053                         if (!request->scan_plans[i].iterations ||
6054                             (request->scan_plans[i].iterations >
6055                              wiphy->max_sched_scan_plan_iterations))
6056                                 return -EINVAL;
6057                 } else if (i < n_plans - 1) {
6058                         /*
6059                          * All scan plans but the last one must specify
6060                          * a finite number of iterations
6061                          */
6062                         return -EINVAL;
6063                 }
6064
6065                 i++;
6066         }
6067
6068         /*
6069          * The last scan plan must not specify the number of
6070          * iterations, it is supposed to run infinitely
6071          */
6072         if (request->scan_plans[n_plans - 1].iterations)
6073                 return  -EINVAL;
6074
6075         return 0;
6076 }
6077
6078 static struct cfg80211_sched_scan_request *
6079 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6080                          struct nlattr **attrs)
6081 {
6082         struct cfg80211_sched_scan_request *request;
6083         struct nlattr *attr;
6084         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6085         enum ieee80211_band band;
6086         size_t ie_len;
6087         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6088         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6089
6090         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6091                 return ERR_PTR(-EINVAL);
6092
6093         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6094                 n_channels = validate_scan_freqs(
6095                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6096                 if (!n_channels)
6097                         return ERR_PTR(-EINVAL);
6098         } else {
6099                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6100         }
6101
6102         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6103                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6104                                     tmp)
6105                         n_ssids++;
6106
6107         if (n_ssids > wiphy->max_sched_scan_ssids)
6108                 return ERR_PTR(-EINVAL);
6109
6110         /*
6111          * First, count the number of 'real' matchsets. Due to an issue with
6112          * the old implementation, matchsets containing only the RSSI attribute
6113          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6114          * RSSI for all matchsets, rather than their own matchset for reporting
6115          * all APs with a strong RSSI. This is needed to be compatible with
6116          * older userspace that treated a matchset with only the RSSI as the
6117          * global RSSI for all other matchsets - if there are other matchsets.
6118          */
6119         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6120                 nla_for_each_nested(attr,
6121                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6122                                     tmp) {
6123                         struct nlattr *rssi;
6124
6125                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6126                                         nla_data(attr), nla_len(attr),
6127                                         nl80211_match_policy);
6128                         if (err)
6129                                 return ERR_PTR(err);
6130                         /* add other standalone attributes here */
6131                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6132                                 n_match_sets++;
6133                                 continue;
6134                         }
6135                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6136                         if (rssi)
6137                                 default_match_rssi = nla_get_s32(rssi);
6138                 }
6139         }
6140
6141         /* However, if there's no other matchset, add the RSSI one */
6142         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6143                 n_match_sets = 1;
6144
6145         if (n_match_sets > wiphy->max_match_sets)
6146                 return ERR_PTR(-EINVAL);
6147
6148         if (attrs[NL80211_ATTR_IE])
6149                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6150         else
6151                 ie_len = 0;
6152
6153         if (ie_len > wiphy->max_sched_scan_ie_len)
6154                 return ERR_PTR(-EINVAL);
6155
6156         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6157                 /*
6158                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6159                  * each scan plan already specifies its own interval
6160                  */
6161                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6162                         return ERR_PTR(-EINVAL);
6163
6164                 nla_for_each_nested(attr,
6165                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6166                         n_plans++;
6167         } else {
6168                 /*
6169                  * The scan interval attribute is kept for backward
6170                  * compatibility. If no scan plans are specified and sched scan
6171                  * interval is specified, one scan plan will be set with this
6172                  * scan interval and infinite number of iterations.
6173                  */
6174                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6175                         return ERR_PTR(-EINVAL);
6176
6177                 n_plans = 1;
6178         }
6179
6180         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6181                 return ERR_PTR(-EINVAL);
6182
6183         request = kzalloc(sizeof(*request)
6184                         + sizeof(*request->ssids) * n_ssids
6185                         + sizeof(*request->match_sets) * n_match_sets
6186                         + sizeof(*request->scan_plans) * n_plans
6187                         + sizeof(*request->channels) * n_channels
6188                         + ie_len, GFP_KERNEL);
6189         if (!request)
6190                 return ERR_PTR(-ENOMEM);
6191
6192         if (n_ssids)
6193                 request->ssids = (void *)&request->channels[n_channels];
6194         request->n_ssids = n_ssids;
6195         if (ie_len) {
6196                 if (n_ssids)
6197                         request->ie = (void *)(request->ssids + n_ssids);
6198                 else
6199                         request->ie = (void *)(request->channels + n_channels);
6200         }
6201
6202         if (n_match_sets) {
6203                 if (request->ie)
6204                         request->match_sets = (void *)(request->ie + ie_len);
6205                 else if (n_ssids)
6206                         request->match_sets =
6207                                 (void *)(request->ssids + n_ssids);
6208                 else
6209                         request->match_sets =
6210                                 (void *)(request->channels + n_channels);
6211         }
6212         request->n_match_sets = n_match_sets;
6213
6214         if (n_match_sets)
6215                 request->scan_plans = (void *)(request->match_sets +
6216                                                n_match_sets);
6217         else if (request->ie)
6218                 request->scan_plans = (void *)(request->ie + ie_len);
6219         else if (n_ssids)
6220                 request->scan_plans = (void *)(request->ssids + n_ssids);
6221         else
6222                 request->scan_plans = (void *)(request->channels + n_channels);
6223
6224         request->n_scan_plans = n_plans;
6225
6226         i = 0;
6227         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6228                 /* user specified, bail out if channel not found */
6229                 nla_for_each_nested(attr,
6230                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6231                                     tmp) {
6232                         struct ieee80211_channel *chan;
6233
6234                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6235
6236                         if (!chan) {
6237                                 err = -EINVAL;
6238                                 goto out_free;
6239                         }
6240
6241                         /* ignore disabled channels */
6242                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6243                                 continue;
6244
6245                         request->channels[i] = chan;
6246                         i++;
6247                 }
6248         } else {
6249                 /* all channels */
6250                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6251                         int j;
6252                         if (!wiphy->bands[band])
6253                                 continue;
6254                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6255                                 struct ieee80211_channel *chan;
6256
6257                                 chan = &wiphy->bands[band]->channels[j];
6258
6259                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6260                                         continue;
6261
6262                                 request->channels[i] = chan;
6263                                 i++;
6264                         }
6265                 }
6266         }
6267
6268         if (!i) {
6269                 err = -EINVAL;
6270                 goto out_free;
6271         }
6272
6273         request->n_channels = i;
6274
6275         i = 0;
6276         if (n_ssids) {
6277                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6278                                     tmp) {
6279                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6280                                 err = -EINVAL;
6281                                 goto out_free;
6282                         }
6283                         request->ssids[i].ssid_len = nla_len(attr);
6284                         memcpy(request->ssids[i].ssid, nla_data(attr),
6285                                nla_len(attr));
6286                         i++;
6287                 }
6288         }
6289
6290         i = 0;
6291         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6292                 nla_for_each_nested(attr,
6293                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6294                                     tmp) {
6295                         struct nlattr *ssid, *rssi;
6296
6297                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6298                                         nla_data(attr), nla_len(attr),
6299                                         nl80211_match_policy);
6300                         if (err)
6301                                 goto out_free;
6302                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6303                         if (ssid) {
6304                                 if (WARN_ON(i >= n_match_sets)) {
6305                                         /* this indicates a programming error,
6306                                          * the loop above should have verified
6307                                          * things properly
6308                                          */
6309                                         err = -EINVAL;
6310                                         goto out_free;
6311                                 }
6312
6313                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6314                                         err = -EINVAL;
6315                                         goto out_free;
6316                                 }
6317                                 memcpy(request->match_sets[i].ssid.ssid,
6318                                        nla_data(ssid), nla_len(ssid));
6319                                 request->match_sets[i].ssid.ssid_len =
6320                                         nla_len(ssid);
6321                                 /* special attribute - old implemenation w/a */
6322                                 request->match_sets[i].rssi_thold =
6323                                         default_match_rssi;
6324                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6325                                 if (rssi)
6326                                         request->match_sets[i].rssi_thold =
6327                                                 nla_get_s32(rssi);
6328                         }
6329                         i++;
6330                 }
6331
6332                 /* there was no other matchset, so the RSSI one is alone */
6333                 if (i == 0 && n_match_sets)
6334                         request->match_sets[0].rssi_thold = default_match_rssi;
6335
6336                 request->min_rssi_thold = INT_MAX;
6337                 for (i = 0; i < n_match_sets; i++)
6338                         request->min_rssi_thold =
6339                                 min(request->match_sets[i].rssi_thold,
6340                                     request->min_rssi_thold);
6341         } else {
6342                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6343         }
6344
6345         if (ie_len) {
6346                 request->ie_len = ie_len;
6347                 memcpy((void *)request->ie,
6348                        nla_data(attrs[NL80211_ATTR_IE]),
6349                        request->ie_len);
6350         }
6351
6352         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6353                 request->flags = nla_get_u32(
6354                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6355                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6356                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6357                         err = -EOPNOTSUPP;
6358                         goto out_free;
6359                 }
6360
6361                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6362                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6363
6364                         if (!wdev) /* must be net-detect */
6365                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6366
6367                         if (!(wiphy->features & flg)) {
6368                                 err = -EOPNOTSUPP;
6369                                 goto out_free;
6370                         }
6371
6372                         if (wdev && wdev->current_bss) {
6373                                 err = -EOPNOTSUPP;
6374                                 goto out_free;
6375                         }
6376
6377                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6378                                                        request->mac_addr_mask);
6379                         if (err)
6380                                 goto out_free;
6381                 }
6382         }
6383
6384         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6385                 request->delay =
6386                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6387
6388         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6389         if (err)
6390                 goto out_free;
6391
6392         request->scan_start = jiffies;
6393
6394         return request;
6395
6396 out_free:
6397         kfree(request);
6398         return ERR_PTR(err);
6399 }
6400
6401 static int nl80211_start_sched_scan(struct sk_buff *skb,
6402                                     struct genl_info *info)
6403 {
6404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6405         struct net_device *dev = info->user_ptr[1];
6406         struct wireless_dev *wdev = dev->ieee80211_ptr;
6407         struct cfg80211_sched_scan_request *sched_scan_req;
6408         int err;
6409
6410         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6411             !rdev->ops->sched_scan_start)
6412                 return -EOPNOTSUPP;
6413
6414         if (rdev->sched_scan_req)
6415                 return -EINPROGRESS;
6416
6417         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6418                                                   info->attrs);
6419
6420         err = PTR_ERR_OR_ZERO(sched_scan_req);
6421         if (err)
6422                 goto out_err;
6423
6424         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6425         if (err)
6426                 goto out_free;
6427
6428         sched_scan_req->dev = dev;
6429         sched_scan_req->wiphy = &rdev->wiphy;
6430
6431         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6432                 sched_scan_req->owner_nlportid = info->snd_portid;
6433
6434         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6435
6436         nl80211_send_sched_scan(rdev, dev,
6437                                 NL80211_CMD_START_SCHED_SCAN);
6438         return 0;
6439
6440 out_free:
6441         kfree(sched_scan_req);
6442 out_err:
6443         return err;
6444 }
6445
6446 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6447                                    struct genl_info *info)
6448 {
6449         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6450
6451         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6452             !rdev->ops->sched_scan_stop)
6453                 return -EOPNOTSUPP;
6454
6455         return __cfg80211_stop_sched_scan(rdev, false);
6456 }
6457
6458 static int nl80211_start_radar_detection(struct sk_buff *skb,
6459                                          struct genl_info *info)
6460 {
6461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6462         struct net_device *dev = info->user_ptr[1];
6463         struct wireless_dev *wdev = dev->ieee80211_ptr;
6464         struct cfg80211_chan_def chandef;
6465         enum nl80211_dfs_regions dfs_region;
6466         unsigned int cac_time_ms;
6467         int err;
6468
6469         dfs_region = reg_get_dfs_region(wdev->wiphy);
6470         if (dfs_region == NL80211_DFS_UNSET)
6471                 return -EINVAL;
6472
6473         err = nl80211_parse_chandef(rdev, info, &chandef);
6474         if (err)
6475                 return err;
6476
6477         if (netif_carrier_ok(dev))
6478                 return -EBUSY;
6479
6480         if (wdev->cac_started)
6481                 return -EBUSY;
6482
6483         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6484                                             wdev->iftype);
6485         if (err < 0)
6486                 return err;
6487
6488         if (err == 0)
6489                 return -EINVAL;
6490
6491         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6492                 return -EINVAL;
6493
6494         if (!rdev->ops->start_radar_detection)
6495                 return -EOPNOTSUPP;
6496
6497         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6498         if (WARN_ON(!cac_time_ms))
6499                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6500
6501         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6502                                                cac_time_ms);
6503         if (!err) {
6504                 wdev->chandef = chandef;
6505                 wdev->cac_started = true;
6506                 wdev->cac_start_time = jiffies;
6507                 wdev->cac_time_ms = cac_time_ms;
6508         }
6509         return err;
6510 }
6511
6512 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6513 {
6514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6515         struct net_device *dev = info->user_ptr[1];
6516         struct wireless_dev *wdev = dev->ieee80211_ptr;
6517         struct cfg80211_csa_settings params;
6518         /* csa_attrs is defined static to avoid waste of stack size - this
6519          * function is called under RTNL lock, so this should not be a problem.
6520          */
6521         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6522         int err;
6523         bool need_new_beacon = false;
6524         int len, i;
6525         u32 cs_count;
6526
6527         if (!rdev->ops->channel_switch ||
6528             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6529                 return -EOPNOTSUPP;
6530
6531         switch (dev->ieee80211_ptr->iftype) {
6532         case NL80211_IFTYPE_AP:
6533         case NL80211_IFTYPE_P2P_GO:
6534                 need_new_beacon = true;
6535
6536                 /* useless if AP is not running */
6537                 if (!wdev->beacon_interval)
6538                         return -ENOTCONN;
6539                 break;
6540         case NL80211_IFTYPE_ADHOC:
6541                 if (!wdev->ssid_len)
6542                         return -ENOTCONN;
6543                 break;
6544         case NL80211_IFTYPE_MESH_POINT:
6545                 if (!wdev->mesh_id_len)
6546                         return -ENOTCONN;
6547                 break;
6548         default:
6549                 return -EOPNOTSUPP;
6550         }
6551
6552         memset(&params, 0, sizeof(params));
6553
6554         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6555             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6556                 return -EINVAL;
6557
6558         /* only important for AP, IBSS and mesh create IEs internally */
6559         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6560                 return -EINVAL;
6561
6562         /* Even though the attribute is u32, the specification says
6563          * u8, so let's make sure we don't overflow.
6564          */
6565         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6566         if (cs_count > 255)
6567                 return -EINVAL;
6568
6569         params.count = cs_count;
6570
6571         if (!need_new_beacon)
6572                 goto skip_beacons;
6573
6574         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6575         if (err)
6576                 return err;
6577
6578         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6579                                info->attrs[NL80211_ATTR_CSA_IES],
6580                                nl80211_policy);
6581         if (err)
6582                 return err;
6583
6584         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6585         if (err)
6586                 return err;
6587
6588         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6589                 return -EINVAL;
6590
6591         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6592         if (!len || (len % sizeof(u16)))
6593                 return -EINVAL;
6594
6595         params.n_counter_offsets_beacon = len / sizeof(u16);
6596         if (rdev->wiphy.max_num_csa_counters &&
6597             (params.n_counter_offsets_beacon >
6598              rdev->wiphy.max_num_csa_counters))
6599                 return -EINVAL;
6600
6601         params.counter_offsets_beacon =
6602                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6603
6604         /* sanity checks - counters should fit and be the same */
6605         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6606                 u16 offset = params.counter_offsets_beacon[i];
6607
6608                 if (offset >= params.beacon_csa.tail_len)
6609                         return -EINVAL;
6610
6611                 if (params.beacon_csa.tail[offset] != params.count)
6612                         return -EINVAL;
6613         }
6614
6615         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6616                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6617                 if (!len || (len % sizeof(u16)))
6618                         return -EINVAL;
6619
6620                 params.n_counter_offsets_presp = len / sizeof(u16);
6621                 if (rdev->wiphy.max_num_csa_counters &&
6622                     (params.n_counter_offsets_beacon >
6623                      rdev->wiphy.max_num_csa_counters))
6624                         return -EINVAL;
6625
6626                 params.counter_offsets_presp =
6627                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6628
6629                 /* sanity checks - counters should fit and be the same */
6630                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6631                         u16 offset = params.counter_offsets_presp[i];
6632
6633                         if (offset >= params.beacon_csa.probe_resp_len)
6634                                 return -EINVAL;
6635
6636                         if (params.beacon_csa.probe_resp[offset] !=
6637                             params.count)
6638                                 return -EINVAL;
6639                 }
6640         }
6641
6642 skip_beacons:
6643         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6644         if (err)
6645                 return err;
6646
6647         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
6648                                            wdev->iftype))
6649                 return -EINVAL;
6650
6651         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6652                                             &params.chandef,
6653                                             wdev->iftype);
6654         if (err < 0)
6655                 return err;
6656
6657         if (err > 0)
6658                 params.radar_required = true;
6659
6660         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6661                 params.block_tx = true;
6662
6663         wdev_lock(wdev);
6664         err = rdev_channel_switch(rdev, dev, &params);
6665         wdev_unlock(wdev);
6666
6667         return err;
6668 }
6669
6670 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6671                             u32 seq, int flags,
6672                             struct cfg80211_registered_device *rdev,
6673                             struct wireless_dev *wdev,
6674                             struct cfg80211_internal_bss *intbss)
6675 {
6676         struct cfg80211_bss *res = &intbss->pub;
6677         const struct cfg80211_bss_ies *ies;
6678         void *hdr;
6679         struct nlattr *bss;
6680
6681         ASSERT_WDEV_LOCK(wdev);
6682
6683         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6684                              NL80211_CMD_NEW_SCAN_RESULTS);
6685         if (!hdr)
6686                 return -1;
6687
6688         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6689
6690         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6691                 goto nla_put_failure;
6692         if (wdev->netdev &&
6693             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6694                 goto nla_put_failure;
6695         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6696                 goto nla_put_failure;
6697
6698         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6699         if (!bss)
6700                 goto nla_put_failure;
6701         if ((!is_zero_ether_addr(res->bssid) &&
6702              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6703                 goto nla_put_failure;
6704
6705         rcu_read_lock();
6706         /* indicate whether we have probe response data or not */
6707         if (rcu_access_pointer(res->proberesp_ies) &&
6708             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6709                 goto fail_unlock_rcu;
6710
6711         /* this pointer prefers to be pointed to probe response data
6712          * but is always valid
6713          */
6714         ies = rcu_dereference(res->ies);
6715         if (ies) {
6716                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6717                         goto fail_unlock_rcu;
6718                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6719                                         ies->len, ies->data))
6720                         goto fail_unlock_rcu;
6721         }
6722
6723         /* and this pointer is always (unless driver didn't know) beacon data */
6724         ies = rcu_dereference(res->beacon_ies);
6725         if (ies && ies->from_beacon) {
6726                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6727                         goto fail_unlock_rcu;
6728                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6729                                         ies->len, ies->data))
6730                         goto fail_unlock_rcu;
6731         }
6732         rcu_read_unlock();
6733
6734         if (res->beacon_interval &&
6735             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6736                 goto nla_put_failure;
6737         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6738             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6739             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6740             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6741                         jiffies_to_msecs(jiffies - intbss->ts)))
6742                 goto nla_put_failure;
6743
6744         if (intbss->ts_boottime &&
6745             nla_put_u64(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
6746                         intbss->ts_boottime))
6747                 goto nla_put_failure;
6748
6749         switch (rdev->wiphy.signal_type) {
6750         case CFG80211_SIGNAL_TYPE_MBM:
6751                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6752                         goto nla_put_failure;
6753                 break;
6754         case CFG80211_SIGNAL_TYPE_UNSPEC:
6755                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6756                         goto nla_put_failure;
6757                 break;
6758         default:
6759                 break;
6760         }
6761
6762         switch (wdev->iftype) {
6763         case NL80211_IFTYPE_P2P_CLIENT:
6764         case NL80211_IFTYPE_STATION:
6765                 if (intbss == wdev->current_bss &&
6766                     nla_put_u32(msg, NL80211_BSS_STATUS,
6767                                 NL80211_BSS_STATUS_ASSOCIATED))
6768                         goto nla_put_failure;
6769                 break;
6770         case NL80211_IFTYPE_ADHOC:
6771                 if (intbss == wdev->current_bss &&
6772                     nla_put_u32(msg, NL80211_BSS_STATUS,
6773                                 NL80211_BSS_STATUS_IBSS_JOINED))
6774                         goto nla_put_failure;
6775                 break;
6776         default:
6777                 break;
6778         }
6779
6780         nla_nest_end(msg, bss);
6781
6782         genlmsg_end(msg, hdr);
6783         return 0;
6784
6785  fail_unlock_rcu:
6786         rcu_read_unlock();
6787  nla_put_failure:
6788         genlmsg_cancel(msg, hdr);
6789         return -EMSGSIZE;
6790 }
6791
6792 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6793 {
6794         struct cfg80211_registered_device *rdev;
6795         struct cfg80211_internal_bss *scan;
6796         struct wireless_dev *wdev;
6797         int start = cb->args[2], idx = 0;
6798         int err;
6799
6800         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6801         if (err)
6802                 return err;
6803
6804         wdev_lock(wdev);
6805         spin_lock_bh(&rdev->bss_lock);
6806         cfg80211_bss_expire(rdev);
6807
6808         cb->seq = rdev->bss_generation;
6809
6810         list_for_each_entry(scan, &rdev->bss_list, list) {
6811                 if (++idx <= start)
6812                         continue;
6813                 if (nl80211_send_bss(skb, cb,
6814                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6815                                 rdev, wdev, scan) < 0) {
6816                         idx--;
6817                         break;
6818                 }
6819         }
6820
6821         spin_unlock_bh(&rdev->bss_lock);
6822         wdev_unlock(wdev);
6823
6824         cb->args[2] = idx;
6825         nl80211_finish_wdev_dump(rdev);
6826
6827         return skb->len;
6828 }
6829
6830 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6831                                int flags, struct net_device *dev,
6832                                bool allow_radio_stats,
6833                                struct survey_info *survey)
6834 {
6835         void *hdr;
6836         struct nlattr *infoattr;
6837
6838         /* skip radio stats if userspace didn't request them */
6839         if (!survey->channel && !allow_radio_stats)
6840                 return 0;
6841
6842         hdr = nl80211hdr_put(msg, portid, seq, flags,
6843                              NL80211_CMD_NEW_SURVEY_RESULTS);
6844         if (!hdr)
6845                 return -ENOMEM;
6846
6847         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6848                 goto nla_put_failure;
6849
6850         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6851         if (!infoattr)
6852                 goto nla_put_failure;
6853
6854         if (survey->channel &&
6855             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6856                         survey->channel->center_freq))
6857                 goto nla_put_failure;
6858
6859         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6860             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6861                 goto nla_put_failure;
6862         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6863             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6864                 goto nla_put_failure;
6865         if ((survey->filled & SURVEY_INFO_TIME) &&
6866             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
6867                         survey->time))
6868                 goto nla_put_failure;
6869         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
6870             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
6871                         survey->time_busy))
6872                 goto nla_put_failure;
6873         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
6874             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
6875                         survey->time_ext_busy))
6876                 goto nla_put_failure;
6877         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
6878             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
6879                         survey->time_rx))
6880                 goto nla_put_failure;
6881         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
6882             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
6883                         survey->time_tx))
6884                 goto nla_put_failure;
6885         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
6886             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
6887                         survey->time_scan))
6888                 goto nla_put_failure;
6889
6890         nla_nest_end(msg, infoattr);
6891
6892         genlmsg_end(msg, hdr);
6893         return 0;
6894
6895  nla_put_failure:
6896         genlmsg_cancel(msg, hdr);
6897         return -EMSGSIZE;
6898 }
6899
6900 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
6901 {
6902         struct survey_info survey;
6903         struct cfg80211_registered_device *rdev;
6904         struct wireless_dev *wdev;
6905         int survey_idx = cb->args[2];
6906         int res;
6907         bool radio_stats;
6908
6909         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6910         if (res)
6911                 return res;
6912
6913         /* prepare_wdev_dump parsed the attributes */
6914         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
6915
6916         if (!wdev->netdev) {
6917                 res = -EINVAL;
6918                 goto out_err;
6919         }
6920
6921         if (!rdev->ops->dump_survey) {
6922                 res = -EOPNOTSUPP;
6923                 goto out_err;
6924         }
6925
6926         while (1) {
6927                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6928                 if (res == -ENOENT)
6929                         break;
6930                 if (res)
6931                         goto out_err;
6932
6933                 /* don't send disabled channels, but do send non-channel data */
6934                 if (survey.channel &&
6935                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6936                         survey_idx++;
6937                         continue;
6938                 }
6939
6940                 if (nl80211_send_survey(skb,
6941                                 NETLINK_CB(cb->skb).portid,
6942                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6943                                 wdev->netdev, radio_stats, &survey) < 0)
6944                         goto out;
6945                 survey_idx++;
6946         }
6947
6948  out:
6949         cb->args[2] = survey_idx;
6950         res = skb->len;
6951  out_err:
6952         nl80211_finish_wdev_dump(rdev);
6953         return res;
6954 }
6955
6956 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6957 {
6958         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6959                                   NL80211_WPA_VERSION_2));
6960 }
6961
6962 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6963 {
6964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6965         struct net_device *dev = info->user_ptr[1];
6966         struct ieee80211_channel *chan;
6967         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6968         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6969         enum nl80211_auth_type auth_type;
6970         struct key_parse key;
6971         bool local_state_change;
6972
6973         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6974                 return -EINVAL;
6975
6976         if (!info->attrs[NL80211_ATTR_MAC])
6977                 return -EINVAL;
6978
6979         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6980                 return -EINVAL;
6981
6982         if (!info->attrs[NL80211_ATTR_SSID])
6983                 return -EINVAL;
6984
6985         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6986                 return -EINVAL;
6987
6988         err = nl80211_parse_key(info, &key);
6989         if (err)
6990                 return err;
6991
6992         if (key.idx >= 0) {
6993                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6994                         return -EINVAL;
6995                 if (!key.p.key || !key.p.key_len)
6996                         return -EINVAL;
6997                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6998                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6999                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7000                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7001                         return -EINVAL;
7002                 if (key.idx > 4)
7003                         return -EINVAL;
7004         } else {
7005                 key.p.key_len = 0;
7006                 key.p.key = NULL;
7007         }
7008
7009         if (key.idx >= 0) {
7010                 int i;
7011                 bool ok = false;
7012                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7013                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7014                                 ok = true;
7015                                 break;
7016                         }
7017                 }
7018                 if (!ok)
7019                         return -EINVAL;
7020         }
7021
7022         if (!rdev->ops->auth)
7023                 return -EOPNOTSUPP;
7024
7025         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7026             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7027                 return -EOPNOTSUPP;
7028
7029         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7030         chan = nl80211_get_valid_chan(&rdev->wiphy,
7031                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7032         if (!chan)
7033                 return -EINVAL;
7034
7035         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7036         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7037
7038         if (info->attrs[NL80211_ATTR_IE]) {
7039                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7040                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7041         }
7042
7043         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7044         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7045                 return -EINVAL;
7046
7047         if (auth_type == NL80211_AUTHTYPE_SAE &&
7048             !info->attrs[NL80211_ATTR_SAE_DATA])
7049                 return -EINVAL;
7050
7051         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7052                 if (auth_type != NL80211_AUTHTYPE_SAE)
7053                         return -EINVAL;
7054                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7055                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7056                 /* need to include at least Auth Transaction and Status Code */
7057                 if (sae_data_len < 4)
7058                         return -EINVAL;
7059         }
7060
7061         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7062
7063         /*
7064          * Since we no longer track auth state, ignore
7065          * requests to only change local state.
7066          */
7067         if (local_state_change)
7068                 return 0;
7069
7070         wdev_lock(dev->ieee80211_ptr);
7071         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7072                                  ssid, ssid_len, ie, ie_len,
7073                                  key.p.key, key.p.key_len, key.idx,
7074                                  sae_data, sae_data_len);
7075         wdev_unlock(dev->ieee80211_ptr);
7076         return err;
7077 }
7078
7079 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7080                                    struct genl_info *info,
7081                                    struct cfg80211_crypto_settings *settings,
7082                                    int cipher_limit)
7083 {
7084         memset(settings, 0, sizeof(*settings));
7085
7086         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7087
7088         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7089                 u16 proto;
7090                 proto = nla_get_u16(
7091                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7092                 settings->control_port_ethertype = cpu_to_be16(proto);
7093                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7094                     proto != ETH_P_PAE)
7095                         return -EINVAL;
7096                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7097                         settings->control_port_no_encrypt = true;
7098         } else
7099                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7100
7101         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7102                 void *data;
7103                 int len, i;
7104
7105                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7106                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7107                 settings->n_ciphers_pairwise = len / sizeof(u32);
7108
7109                 if (len % sizeof(u32))
7110                         return -EINVAL;
7111
7112                 if (settings->n_ciphers_pairwise > cipher_limit)
7113                         return -EINVAL;
7114
7115                 memcpy(settings->ciphers_pairwise, data, len);
7116
7117                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7118                         if (!cfg80211_supported_cipher_suite(
7119                                         &rdev->wiphy,
7120                                         settings->ciphers_pairwise[i]))
7121                                 return -EINVAL;
7122         }
7123
7124         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7125                 settings->cipher_group =
7126                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7127                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7128                                                      settings->cipher_group))
7129                         return -EINVAL;
7130         }
7131
7132         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7133                 settings->wpa_versions =
7134                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7135                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7136                         return -EINVAL;
7137         }
7138
7139         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7140                 void *data;
7141                 int len;
7142
7143                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7144                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7145                 settings->n_akm_suites = len / sizeof(u32);
7146
7147                 if (len % sizeof(u32))
7148                         return -EINVAL;
7149
7150                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7151                         return -EINVAL;
7152
7153                 memcpy(settings->akm_suites, data, len);
7154         }
7155
7156         return 0;
7157 }
7158
7159 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7160 {
7161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7162         struct net_device *dev = info->user_ptr[1];
7163         struct ieee80211_channel *chan;
7164         struct cfg80211_assoc_request req = {};
7165         const u8 *bssid, *ssid;
7166         int err, ssid_len = 0;
7167
7168         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7169                 return -EINVAL;
7170
7171         if (!info->attrs[NL80211_ATTR_MAC] ||
7172             !info->attrs[NL80211_ATTR_SSID] ||
7173             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7174                 return -EINVAL;
7175
7176         if (!rdev->ops->assoc)
7177                 return -EOPNOTSUPP;
7178
7179         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7180             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7181                 return -EOPNOTSUPP;
7182
7183         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7184
7185         chan = nl80211_get_valid_chan(&rdev->wiphy,
7186                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7187         if (!chan)
7188                 return -EINVAL;
7189
7190         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7191         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7192
7193         if (info->attrs[NL80211_ATTR_IE]) {
7194                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7195                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7196         }
7197
7198         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7199                 enum nl80211_mfp mfp =
7200                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7201                 if (mfp == NL80211_MFP_REQUIRED)
7202                         req.use_mfp = true;
7203                 else if (mfp != NL80211_MFP_NO)
7204                         return -EINVAL;
7205         }
7206
7207         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7208                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7209
7210         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7211                 req.flags |= ASSOC_REQ_DISABLE_HT;
7212
7213         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7214                 memcpy(&req.ht_capa_mask,
7215                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7216                        sizeof(req.ht_capa_mask));
7217
7218         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7219                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7220                         return -EINVAL;
7221                 memcpy(&req.ht_capa,
7222                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7223                        sizeof(req.ht_capa));
7224         }
7225
7226         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7227                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7228
7229         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7230                 memcpy(&req.vht_capa_mask,
7231                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7232                        sizeof(req.vht_capa_mask));
7233
7234         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7235                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7236                         return -EINVAL;
7237                 memcpy(&req.vht_capa,
7238                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7239                        sizeof(req.vht_capa));
7240         }
7241
7242         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7243                 if (!(rdev->wiphy.features &
7244                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7245                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7246                         return -EINVAL;
7247                 req.flags |= ASSOC_REQ_USE_RRM;
7248         }
7249
7250         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7251         if (!err) {
7252                 wdev_lock(dev->ieee80211_ptr);
7253                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7254                                           ssid, ssid_len, &req);
7255                 wdev_unlock(dev->ieee80211_ptr);
7256         }
7257
7258         return err;
7259 }
7260
7261 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7262 {
7263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7264         struct net_device *dev = info->user_ptr[1];
7265         const u8 *ie = NULL, *bssid;
7266         int ie_len = 0, err;
7267         u16 reason_code;
7268         bool local_state_change;
7269
7270         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7271                 return -EINVAL;
7272
7273         if (!info->attrs[NL80211_ATTR_MAC])
7274                 return -EINVAL;
7275
7276         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7277                 return -EINVAL;
7278
7279         if (!rdev->ops->deauth)
7280                 return -EOPNOTSUPP;
7281
7282         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7283             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7284                 return -EOPNOTSUPP;
7285
7286         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7287
7288         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7289         if (reason_code == 0) {
7290                 /* Reason Code 0 is reserved */
7291                 return -EINVAL;
7292         }
7293
7294         if (info->attrs[NL80211_ATTR_IE]) {
7295                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7296                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7297         }
7298
7299         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7300
7301         wdev_lock(dev->ieee80211_ptr);
7302         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7303                                    local_state_change);
7304         wdev_unlock(dev->ieee80211_ptr);
7305         return err;
7306 }
7307
7308 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7309 {
7310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7311         struct net_device *dev = info->user_ptr[1];
7312         const u8 *ie = NULL, *bssid;
7313         int ie_len = 0, err;
7314         u16 reason_code;
7315         bool local_state_change;
7316
7317         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7318                 return -EINVAL;
7319
7320         if (!info->attrs[NL80211_ATTR_MAC])
7321                 return -EINVAL;
7322
7323         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7324                 return -EINVAL;
7325
7326         if (!rdev->ops->disassoc)
7327                 return -EOPNOTSUPP;
7328
7329         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7330             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7331                 return -EOPNOTSUPP;
7332
7333         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7334
7335         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7336         if (reason_code == 0) {
7337                 /* Reason Code 0 is reserved */
7338                 return -EINVAL;
7339         }
7340
7341         if (info->attrs[NL80211_ATTR_IE]) {
7342                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7343                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7344         }
7345
7346         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7347
7348         wdev_lock(dev->ieee80211_ptr);
7349         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7350                                      local_state_change);
7351         wdev_unlock(dev->ieee80211_ptr);
7352         return err;
7353 }
7354
7355 static bool
7356 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7357                          int mcast_rate[IEEE80211_NUM_BANDS],
7358                          int rateval)
7359 {
7360         struct wiphy *wiphy = &rdev->wiphy;
7361         bool found = false;
7362         int band, i;
7363
7364         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7365                 struct ieee80211_supported_band *sband;
7366
7367                 sband = wiphy->bands[band];
7368                 if (!sband)
7369                         continue;
7370
7371                 for (i = 0; i < sband->n_bitrates; i++) {
7372                         if (sband->bitrates[i].bitrate == rateval) {
7373                                 mcast_rate[band] = i + 1;
7374                                 found = true;
7375                                 break;
7376                         }
7377                 }
7378         }
7379
7380         return found;
7381 }
7382
7383 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7384 {
7385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7386         struct net_device *dev = info->user_ptr[1];
7387         struct cfg80211_ibss_params ibss;
7388         struct wiphy *wiphy;
7389         struct cfg80211_cached_keys *connkeys = NULL;
7390         int err;
7391
7392         memset(&ibss, 0, sizeof(ibss));
7393
7394         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7395                 return -EINVAL;
7396
7397         if (!info->attrs[NL80211_ATTR_SSID] ||
7398             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7399                 return -EINVAL;
7400
7401         ibss.beacon_interval = 100;
7402
7403         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7404                 ibss.beacon_interval =
7405                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7406                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7407                         return -EINVAL;
7408         }
7409
7410         if (!rdev->ops->join_ibss)
7411                 return -EOPNOTSUPP;
7412
7413         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7414                 return -EOPNOTSUPP;
7415
7416         wiphy = &rdev->wiphy;
7417
7418         if (info->attrs[NL80211_ATTR_MAC]) {
7419                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7420
7421                 if (!is_valid_ether_addr(ibss.bssid))
7422                         return -EINVAL;
7423         }
7424         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7425         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7426
7427         if (info->attrs[NL80211_ATTR_IE]) {
7428                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7429                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7430         }
7431
7432         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7433         if (err)
7434                 return err;
7435
7436         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7437                                      NL80211_IFTYPE_ADHOC))
7438                 return -EINVAL;
7439
7440         switch (ibss.chandef.width) {
7441         case NL80211_CHAN_WIDTH_5:
7442         case NL80211_CHAN_WIDTH_10:
7443         case NL80211_CHAN_WIDTH_20_NOHT:
7444                 break;
7445         case NL80211_CHAN_WIDTH_20:
7446         case NL80211_CHAN_WIDTH_40:
7447                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7448                         return -EINVAL;
7449                 break;
7450         case NL80211_CHAN_WIDTH_80:
7451         case NL80211_CHAN_WIDTH_80P80:
7452         case NL80211_CHAN_WIDTH_160:
7453                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7454                         return -EINVAL;
7455                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7456                                              NL80211_EXT_FEATURE_VHT_IBSS))
7457                         return -EINVAL;
7458                 break;
7459         default:
7460                 return -EINVAL;
7461         }
7462
7463         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7464         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7465
7466         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7467                 u8 *rates =
7468                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7469                 int n_rates =
7470                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7471                 struct ieee80211_supported_band *sband =
7472                         wiphy->bands[ibss.chandef.chan->band];
7473
7474                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7475                                              &ibss.basic_rates);
7476                 if (err)
7477                         return err;
7478         }
7479
7480         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7481                 memcpy(&ibss.ht_capa_mask,
7482                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7483                        sizeof(ibss.ht_capa_mask));
7484
7485         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7486                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7487                         return -EINVAL;
7488                 memcpy(&ibss.ht_capa,
7489                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7490                        sizeof(ibss.ht_capa));
7491         }
7492
7493         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7494             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7495                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7496                 return -EINVAL;
7497
7498         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7499                 bool no_ht = false;
7500
7501                 connkeys = nl80211_parse_connkeys(rdev,
7502                                           info->attrs[NL80211_ATTR_KEYS],
7503                                           &no_ht);
7504                 if (IS_ERR(connkeys))
7505                         return PTR_ERR(connkeys);
7506
7507                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7508                     no_ht) {
7509                         kfree(connkeys);
7510                         return -EINVAL;
7511                 }
7512         }
7513
7514         ibss.control_port =
7515                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7516
7517         ibss.userspace_handles_dfs =
7518                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7519
7520         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7521         if (err)
7522                 kzfree(connkeys);
7523         return err;
7524 }
7525
7526 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7527 {
7528         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7529         struct net_device *dev = info->user_ptr[1];
7530
7531         if (!rdev->ops->leave_ibss)
7532                 return -EOPNOTSUPP;
7533
7534         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7535                 return -EOPNOTSUPP;
7536
7537         return cfg80211_leave_ibss(rdev, dev, false);
7538 }
7539
7540 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7541 {
7542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7543         struct net_device *dev = info->user_ptr[1];
7544         int mcast_rate[IEEE80211_NUM_BANDS];
7545         u32 nla_rate;
7546         int err;
7547
7548         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7549             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7550             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7551                 return -EOPNOTSUPP;
7552
7553         if (!rdev->ops->set_mcast_rate)
7554                 return -EOPNOTSUPP;
7555
7556         memset(mcast_rate, 0, sizeof(mcast_rate));
7557
7558         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7559                 return -EINVAL;
7560
7561         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7562         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7563                 return -EINVAL;
7564
7565         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7566
7567         return err;
7568 }
7569
7570 static struct sk_buff *
7571 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7572                             struct wireless_dev *wdev, int approxlen,
7573                             u32 portid, u32 seq, enum nl80211_commands cmd,
7574                             enum nl80211_attrs attr,
7575                             const struct nl80211_vendor_cmd_info *info,
7576                             gfp_t gfp)
7577 {
7578         struct sk_buff *skb;
7579         void *hdr;
7580         struct nlattr *data;
7581
7582         skb = nlmsg_new(approxlen + 100, gfp);
7583         if (!skb)
7584                 return NULL;
7585
7586         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7587         if (!hdr) {
7588                 kfree_skb(skb);
7589                 return NULL;
7590         }
7591
7592         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7593                 goto nla_put_failure;
7594
7595         if (info) {
7596                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7597                                 info->vendor_id))
7598                         goto nla_put_failure;
7599                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7600                                 info->subcmd))
7601                         goto nla_put_failure;
7602         }
7603
7604         if (wdev) {
7605                 if (nla_put_u64(skb, NL80211_ATTR_WDEV,
7606                                 wdev_id(wdev)))
7607                         goto nla_put_failure;
7608                 if (wdev->netdev &&
7609                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
7610                                 wdev->netdev->ifindex))
7611                         goto nla_put_failure;
7612         }
7613
7614         data = nla_nest_start(skb, attr);
7615
7616         ((void **)skb->cb)[0] = rdev;
7617         ((void **)skb->cb)[1] = hdr;
7618         ((void **)skb->cb)[2] = data;
7619
7620         return skb;
7621
7622  nla_put_failure:
7623         kfree_skb(skb);
7624         return NULL;
7625 }
7626
7627 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7628                                            struct wireless_dev *wdev,
7629                                            enum nl80211_commands cmd,
7630                                            enum nl80211_attrs attr,
7631                                            int vendor_event_idx,
7632                                            int approxlen, gfp_t gfp)
7633 {
7634         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7635         const struct nl80211_vendor_cmd_info *info;
7636
7637         switch (cmd) {
7638         case NL80211_CMD_TESTMODE:
7639                 if (WARN_ON(vendor_event_idx != -1))
7640                         return NULL;
7641                 info = NULL;
7642                 break;
7643         case NL80211_CMD_VENDOR:
7644                 if (WARN_ON(vendor_event_idx < 0 ||
7645                             vendor_event_idx >= wiphy->n_vendor_events))
7646                         return NULL;
7647                 info = &wiphy->vendor_events[vendor_event_idx];
7648                 break;
7649         default:
7650                 WARN_ON(1);
7651                 return NULL;
7652         }
7653
7654         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
7655                                            cmd, attr, info, gfp);
7656 }
7657 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7658
7659 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7660 {
7661         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7662         void *hdr = ((void **)skb->cb)[1];
7663         struct nlattr *data = ((void **)skb->cb)[2];
7664         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7665
7666         /* clear CB data for netlink core to own from now on */
7667         memset(skb->cb, 0, sizeof(skb->cb));
7668
7669         nla_nest_end(skb, data);
7670         genlmsg_end(skb, hdr);
7671
7672         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7673                 mcgrp = NL80211_MCGRP_VENDOR;
7674
7675         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7676                                 mcgrp, gfp);
7677 }
7678 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7679
7680 #ifdef CONFIG_NL80211_TESTMODE
7681 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7682 {
7683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7684         struct wireless_dev *wdev =
7685                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7686         int err;
7687
7688         if (!rdev->ops->testmode_cmd)
7689                 return -EOPNOTSUPP;
7690
7691         if (IS_ERR(wdev)) {
7692                 err = PTR_ERR(wdev);
7693                 if (err != -EINVAL)
7694                         return err;
7695                 wdev = NULL;
7696         } else if (wdev->wiphy != &rdev->wiphy) {
7697                 return -EINVAL;
7698         }
7699
7700         if (!info->attrs[NL80211_ATTR_TESTDATA])
7701                 return -EINVAL;
7702
7703         rdev->cur_cmd_info = info;
7704         err = rdev_testmode_cmd(rdev, wdev,
7705                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7706                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7707         rdev->cur_cmd_info = NULL;
7708
7709         return err;
7710 }
7711
7712 static int nl80211_testmode_dump(struct sk_buff *skb,
7713                                  struct netlink_callback *cb)
7714 {
7715         struct cfg80211_registered_device *rdev;
7716         int err;
7717         long phy_idx;
7718         void *data = NULL;
7719         int data_len = 0;
7720
7721         rtnl_lock();
7722
7723         if (cb->args[0]) {
7724                 /*
7725                  * 0 is a valid index, but not valid for args[0],
7726                  * so we need to offset by 1.
7727                  */
7728                 phy_idx = cb->args[0] - 1;
7729         } else {
7730                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7731                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7732                                   nl80211_policy);
7733                 if (err)
7734                         goto out_err;
7735
7736                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7737                                                   nl80211_fam.attrbuf);
7738                 if (IS_ERR(rdev)) {
7739                         err = PTR_ERR(rdev);
7740                         goto out_err;
7741                 }
7742                 phy_idx = rdev->wiphy_idx;
7743                 rdev = NULL;
7744
7745                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7746                         cb->args[1] =
7747                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7748         }
7749
7750         if (cb->args[1]) {
7751                 data = nla_data((void *)cb->args[1]);
7752                 data_len = nla_len((void *)cb->args[1]);
7753         }
7754
7755         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7756         if (!rdev) {
7757                 err = -ENOENT;
7758                 goto out_err;
7759         }
7760
7761         if (!rdev->ops->testmode_dump) {
7762                 err = -EOPNOTSUPP;
7763                 goto out_err;
7764         }
7765
7766         while (1) {
7767                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7768                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7769                                            NL80211_CMD_TESTMODE);
7770                 struct nlattr *tmdata;
7771
7772                 if (!hdr)
7773                         break;
7774
7775                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7776                         genlmsg_cancel(skb, hdr);
7777                         break;
7778                 }
7779
7780                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7781                 if (!tmdata) {
7782                         genlmsg_cancel(skb, hdr);
7783                         break;
7784                 }
7785                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7786                 nla_nest_end(skb, tmdata);
7787
7788                 if (err == -ENOBUFS || err == -ENOENT) {
7789                         genlmsg_cancel(skb, hdr);
7790                         break;
7791                 } else if (err) {
7792                         genlmsg_cancel(skb, hdr);
7793                         goto out_err;
7794                 }
7795
7796                 genlmsg_end(skb, hdr);
7797         }
7798
7799         err = skb->len;
7800         /* see above */
7801         cb->args[0] = phy_idx + 1;
7802  out_err:
7803         rtnl_unlock();
7804         return err;
7805 }
7806 #endif
7807
7808 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7809 {
7810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7811         struct net_device *dev = info->user_ptr[1];
7812         struct cfg80211_connect_params connect;
7813         struct wiphy *wiphy;
7814         struct cfg80211_cached_keys *connkeys = NULL;
7815         int err;
7816
7817         memset(&connect, 0, sizeof(connect));
7818
7819         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7820                 return -EINVAL;
7821
7822         if (!info->attrs[NL80211_ATTR_SSID] ||
7823             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7824                 return -EINVAL;
7825
7826         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7827                 connect.auth_type =
7828                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7829                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7830                                              NL80211_CMD_CONNECT))
7831                         return -EINVAL;
7832         } else
7833                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7834
7835         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7836
7837         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7838                                       NL80211_MAX_NR_CIPHER_SUITES);
7839         if (err)
7840                 return err;
7841
7842         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7843             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7844                 return -EOPNOTSUPP;
7845
7846         wiphy = &rdev->wiphy;
7847
7848         connect.bg_scan_period = -1;
7849         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7850                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7851                 connect.bg_scan_period =
7852                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7853         }
7854
7855         if (info->attrs[NL80211_ATTR_MAC])
7856                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7857         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7858                 connect.bssid_hint =
7859                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7860         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7861         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7862
7863         if (info->attrs[NL80211_ATTR_IE]) {
7864                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7865                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7866         }
7867
7868         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7869                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7870                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7871                     connect.mfp != NL80211_MFP_NO)
7872                         return -EINVAL;
7873         } else {
7874                 connect.mfp = NL80211_MFP_NO;
7875         }
7876
7877         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7878                 connect.channel = nl80211_get_valid_chan(
7879                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7880                 if (!connect.channel)
7881                         return -EINVAL;
7882         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7883                 connect.channel_hint = nl80211_get_valid_chan(
7884                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7885                 if (!connect.channel_hint)
7886                         return -EINVAL;
7887         }
7888
7889         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7890                 connkeys = nl80211_parse_connkeys(rdev,
7891                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7892                 if (IS_ERR(connkeys))
7893                         return PTR_ERR(connkeys);
7894         }
7895
7896         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7897                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7898
7899         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7900                 memcpy(&connect.ht_capa_mask,
7901                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7902                        sizeof(connect.ht_capa_mask));
7903
7904         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7905                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7906                         kzfree(connkeys);
7907                         return -EINVAL;
7908                 }
7909                 memcpy(&connect.ht_capa,
7910                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7911                        sizeof(connect.ht_capa));
7912         }
7913
7914         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7915                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7916
7917         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7918                 memcpy(&connect.vht_capa_mask,
7919                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7920                        sizeof(connect.vht_capa_mask));
7921
7922         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7923                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7924                         kzfree(connkeys);
7925                         return -EINVAL;
7926                 }
7927                 memcpy(&connect.vht_capa,
7928                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7929                        sizeof(connect.vht_capa));
7930         }
7931
7932         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7933                 if (!(rdev->wiphy.features &
7934                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7935                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7936                         return -EINVAL;
7937                 connect.flags |= ASSOC_REQ_USE_RRM;
7938         }
7939
7940         wdev_lock(dev->ieee80211_ptr);
7941         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7942         wdev_unlock(dev->ieee80211_ptr);
7943         if (err)
7944                 kzfree(connkeys);
7945         return err;
7946 }
7947
7948 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7949 {
7950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7951         struct net_device *dev = info->user_ptr[1];
7952         u16 reason;
7953         int ret;
7954
7955         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7956                 reason = WLAN_REASON_DEAUTH_LEAVING;
7957         else
7958                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7959
7960         if (reason == 0)
7961                 return -EINVAL;
7962
7963         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7964             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7965                 return -EOPNOTSUPP;
7966
7967         wdev_lock(dev->ieee80211_ptr);
7968         ret = cfg80211_disconnect(rdev, dev, reason, true);
7969         wdev_unlock(dev->ieee80211_ptr);
7970         return ret;
7971 }
7972
7973 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7974 {
7975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7976         struct net *net;
7977         int err;
7978
7979         if (info->attrs[NL80211_ATTR_PID]) {
7980                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7981
7982                 net = get_net_ns_by_pid(pid);
7983         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
7984                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
7985
7986                 net = get_net_ns_by_fd(fd);
7987         } else {
7988                 return -EINVAL;
7989         }
7990
7991         if (IS_ERR(net))
7992                 return PTR_ERR(net);
7993
7994         err = 0;
7995
7996         /* check if anything to do */
7997         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7998                 err = cfg80211_switch_netns(rdev, net);
7999
8000         put_net(net);
8001         return err;
8002 }
8003
8004 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8005 {
8006         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8007         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8008                         struct cfg80211_pmksa *pmksa) = NULL;
8009         struct net_device *dev = info->user_ptr[1];
8010         struct cfg80211_pmksa pmksa;
8011
8012         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8013
8014         if (!info->attrs[NL80211_ATTR_MAC])
8015                 return -EINVAL;
8016
8017         if (!info->attrs[NL80211_ATTR_PMKID])
8018                 return -EINVAL;
8019
8020         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8021         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8022
8023         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8024             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8025                 return -EOPNOTSUPP;
8026
8027         switch (info->genlhdr->cmd) {
8028         case NL80211_CMD_SET_PMKSA:
8029                 rdev_ops = rdev->ops->set_pmksa;
8030                 break;
8031         case NL80211_CMD_DEL_PMKSA:
8032                 rdev_ops = rdev->ops->del_pmksa;
8033                 break;
8034         default:
8035                 WARN_ON(1);
8036                 break;
8037         }
8038
8039         if (!rdev_ops)
8040                 return -EOPNOTSUPP;
8041
8042         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8043 }
8044
8045 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8046 {
8047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8048         struct net_device *dev = info->user_ptr[1];
8049
8050         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8051             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8052                 return -EOPNOTSUPP;
8053
8054         if (!rdev->ops->flush_pmksa)
8055                 return -EOPNOTSUPP;
8056
8057         return rdev_flush_pmksa(rdev, dev);
8058 }
8059
8060 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8061 {
8062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8063         struct net_device *dev = info->user_ptr[1];
8064         u8 action_code, dialog_token;
8065         u32 peer_capability = 0;
8066         u16 status_code;
8067         u8 *peer;
8068         bool initiator;
8069
8070         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8071             !rdev->ops->tdls_mgmt)
8072                 return -EOPNOTSUPP;
8073
8074         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8075             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8076             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8077             !info->attrs[NL80211_ATTR_IE] ||
8078             !info->attrs[NL80211_ATTR_MAC])
8079                 return -EINVAL;
8080
8081         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8082         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8083         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8084         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8085         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8086         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8087                 peer_capability =
8088                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8089
8090         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8091                               dialog_token, status_code, peer_capability,
8092                               initiator,
8093                               nla_data(info->attrs[NL80211_ATTR_IE]),
8094                               nla_len(info->attrs[NL80211_ATTR_IE]));
8095 }
8096
8097 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8098 {
8099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8100         struct net_device *dev = info->user_ptr[1];
8101         enum nl80211_tdls_operation operation;
8102         u8 *peer;
8103
8104         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8105             !rdev->ops->tdls_oper)
8106                 return -EOPNOTSUPP;
8107
8108         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8109             !info->attrs[NL80211_ATTR_MAC])
8110                 return -EINVAL;
8111
8112         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8113         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8114
8115         return rdev_tdls_oper(rdev, dev, peer, operation);
8116 }
8117
8118 static int nl80211_remain_on_channel(struct sk_buff *skb,
8119                                      struct genl_info *info)
8120 {
8121         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8122         struct wireless_dev *wdev = info->user_ptr[1];
8123         struct cfg80211_chan_def chandef;
8124         struct sk_buff *msg;
8125         void *hdr;
8126         u64 cookie;
8127         u32 duration;
8128         int err;
8129
8130         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8131             !info->attrs[NL80211_ATTR_DURATION])
8132                 return -EINVAL;
8133
8134         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8135
8136         if (!rdev->ops->remain_on_channel ||
8137             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8138                 return -EOPNOTSUPP;
8139
8140         /*
8141          * We should be on that channel for at least a minimum amount of
8142          * time (10ms) but no longer than the driver supports.
8143          */
8144         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8145             duration > rdev->wiphy.max_remain_on_channel_duration)
8146                 return -EINVAL;
8147
8148         err = nl80211_parse_chandef(rdev, info, &chandef);
8149         if (err)
8150                 return err;
8151
8152         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8153         if (!msg)
8154                 return -ENOMEM;
8155
8156         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8157                              NL80211_CMD_REMAIN_ON_CHANNEL);
8158         if (!hdr) {
8159                 err = -ENOBUFS;
8160                 goto free_msg;
8161         }
8162
8163         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8164                                      duration, &cookie);
8165
8166         if (err)
8167                 goto free_msg;
8168
8169         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8170                 goto nla_put_failure;
8171
8172         genlmsg_end(msg, hdr);
8173
8174         return genlmsg_reply(msg, info);
8175
8176  nla_put_failure:
8177         err = -ENOBUFS;
8178  free_msg:
8179         nlmsg_free(msg);
8180         return err;
8181 }
8182
8183 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8184                                             struct genl_info *info)
8185 {
8186         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8187         struct wireless_dev *wdev = info->user_ptr[1];
8188         u64 cookie;
8189
8190         if (!info->attrs[NL80211_ATTR_COOKIE])
8191                 return -EINVAL;
8192
8193         if (!rdev->ops->cancel_remain_on_channel)
8194                 return -EOPNOTSUPP;
8195
8196         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8197
8198         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8199 }
8200
8201 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8202                            u8 *rates, u8 rates_len)
8203 {
8204         u8 i;
8205         u32 mask = 0;
8206
8207         for (i = 0; i < rates_len; i++) {
8208                 int rate = (rates[i] & 0x7f) * 5;
8209                 int ridx;
8210                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8211                         struct ieee80211_rate *srate =
8212                                 &sband->bitrates[ridx];
8213                         if (rate == srate->bitrate) {
8214                                 mask |= 1 << ridx;
8215                                 break;
8216                         }
8217                 }
8218                 if (ridx == sband->n_bitrates)
8219                         return 0; /* rate not found */
8220         }
8221
8222         return mask;
8223 }
8224
8225 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8226                                u8 *rates, u8 rates_len,
8227                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8228 {
8229         u8 i;
8230
8231         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8232
8233         for (i = 0; i < rates_len; i++) {
8234                 int ridx, rbit;
8235
8236                 ridx = rates[i] / 8;
8237                 rbit = BIT(rates[i] % 8);
8238
8239                 /* check validity */
8240                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8241                         return false;
8242
8243                 /* check availability */
8244                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8245                         mcs[ridx] |= rbit;
8246                 else
8247                         return false;
8248         }
8249
8250         return true;
8251 }
8252
8253 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8254 {
8255         u16 mcs_mask = 0;
8256
8257         switch (vht_mcs_map) {
8258         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8259                 break;
8260         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8261                 mcs_mask = 0x00FF;
8262                 break;
8263         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8264                 mcs_mask = 0x01FF;
8265                 break;
8266         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8267                 mcs_mask = 0x03FF;
8268                 break;
8269         default:
8270                 break;
8271         }
8272
8273         return mcs_mask;
8274 }
8275
8276 static void vht_build_mcs_mask(u16 vht_mcs_map,
8277                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8278 {
8279         u8 nss;
8280
8281         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8282                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8283                 vht_mcs_map >>= 2;
8284         }
8285 }
8286
8287 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8288                              struct nl80211_txrate_vht *txrate,
8289                              u16 mcs[NL80211_VHT_NSS_MAX])
8290 {
8291         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8292         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8293         u8 i;
8294
8295         if (!sband->vht_cap.vht_supported)
8296                 return false;
8297
8298         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8299
8300         /* Build vht_mcs_mask from VHT capabilities */
8301         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8302
8303         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8304                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8305                         mcs[i] = txrate->mcs[i];
8306                 else
8307                         return false;
8308         }
8309
8310         return true;
8311 }
8312
8313 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8314         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8315                                     .len = NL80211_MAX_SUPP_RATES },
8316         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8317                                 .len = NL80211_MAX_SUPP_HT_RATES },
8318         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8319         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8320 };
8321
8322 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8323                                        struct genl_info *info)
8324 {
8325         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8327         struct cfg80211_bitrate_mask mask;
8328         int rem, i;
8329         struct net_device *dev = info->user_ptr[1];
8330         struct nlattr *tx_rates;
8331         struct ieee80211_supported_band *sband;
8332         u16 vht_tx_mcs_map;
8333
8334         if (!rdev->ops->set_bitrate_mask)
8335                 return -EOPNOTSUPP;
8336
8337         memset(&mask, 0, sizeof(mask));
8338         /* Default to all rates enabled */
8339         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
8340                 sband = rdev->wiphy.bands[i];
8341
8342                 if (!sband)
8343                         continue;
8344
8345                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8346                 memcpy(mask.control[i].ht_mcs,
8347                        sband->ht_cap.mcs.rx_mask,
8348                        sizeof(mask.control[i].ht_mcs));
8349
8350                 if (!sband->vht_cap.vht_supported)
8351                         continue;
8352
8353                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8354                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8355         }
8356
8357         /* if no rates are given set it back to the defaults */
8358         if (!info->attrs[NL80211_ATTR_TX_RATES])
8359                 goto out;
8360
8361         /*
8362          * The nested attribute uses enum nl80211_band as the index. This maps
8363          * directly to the enum ieee80211_band values used in cfg80211.
8364          */
8365         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8366         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8367                 enum ieee80211_band band = nla_type(tx_rates);
8368                 int err;
8369
8370                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
8371                         return -EINVAL;
8372                 sband = rdev->wiphy.bands[band];
8373                 if (sband == NULL)
8374                         return -EINVAL;
8375                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8376                                 nla_len(tx_rates), nl80211_txattr_policy);
8377                 if (err)
8378                         return err;
8379                 if (tb[NL80211_TXRATE_LEGACY]) {
8380                         mask.control[band].legacy = rateset_to_mask(
8381                                 sband,
8382                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8383                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8384                         if ((mask.control[band].legacy == 0) &&
8385                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8386                                 return -EINVAL;
8387                 }
8388                 if (tb[NL80211_TXRATE_HT]) {
8389                         if (!ht_rateset_to_mask(
8390                                         sband,
8391                                         nla_data(tb[NL80211_TXRATE_HT]),
8392                                         nla_len(tb[NL80211_TXRATE_HT]),
8393                                         mask.control[band].ht_mcs))
8394                                 return -EINVAL;
8395                 }
8396                 if (tb[NL80211_TXRATE_VHT]) {
8397                         if (!vht_set_mcs_mask(
8398                                         sband,
8399                                         nla_data(tb[NL80211_TXRATE_VHT]),
8400                                         mask.control[band].vht_mcs))
8401                                 return -EINVAL;
8402                 }
8403                 if (tb[NL80211_TXRATE_GI]) {
8404                         mask.control[band].gi =
8405                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8406                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8407                                 return -EINVAL;
8408                 }
8409
8410                 if (mask.control[band].legacy == 0) {
8411                         /* don't allow empty legacy rates if HT or VHT
8412                          * are not even supported.
8413                          */
8414                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8415                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8416                                 return -EINVAL;
8417
8418                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8419                                 if (mask.control[band].ht_mcs[i])
8420                                         goto out;
8421
8422                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8423                                 if (mask.control[band].vht_mcs[i])
8424                                         goto out;
8425
8426                         /* legacy and mcs rates may not be both empty */
8427                         return -EINVAL;
8428                 }
8429         }
8430
8431 out:
8432         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8433 }
8434
8435 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8436 {
8437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8438         struct wireless_dev *wdev = info->user_ptr[1];
8439         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8440
8441         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8442                 return -EINVAL;
8443
8444         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8445                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8446
8447         switch (wdev->iftype) {
8448         case NL80211_IFTYPE_STATION:
8449         case NL80211_IFTYPE_ADHOC:
8450         case NL80211_IFTYPE_P2P_CLIENT:
8451         case NL80211_IFTYPE_AP:
8452         case NL80211_IFTYPE_AP_VLAN:
8453         case NL80211_IFTYPE_MESH_POINT:
8454         case NL80211_IFTYPE_P2P_GO:
8455         case NL80211_IFTYPE_P2P_DEVICE:
8456                 break;
8457         default:
8458                 return -EOPNOTSUPP;
8459         }
8460
8461         /* not much point in registering if we can't reply */
8462         if (!rdev->ops->mgmt_tx)
8463                 return -EOPNOTSUPP;
8464
8465         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8466                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8467                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8468 }
8469
8470 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8471 {
8472         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8473         struct wireless_dev *wdev = info->user_ptr[1];
8474         struct cfg80211_chan_def chandef;
8475         int err;
8476         void *hdr = NULL;
8477         u64 cookie;
8478         struct sk_buff *msg = NULL;
8479         struct cfg80211_mgmt_tx_params params = {
8480                 .dont_wait_for_ack =
8481                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8482         };
8483
8484         if (!info->attrs[NL80211_ATTR_FRAME])
8485                 return -EINVAL;
8486
8487         if (!rdev->ops->mgmt_tx)
8488                 return -EOPNOTSUPP;
8489
8490         switch (wdev->iftype) {
8491         case NL80211_IFTYPE_P2P_DEVICE:
8492                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8493                         return -EINVAL;
8494         case NL80211_IFTYPE_STATION:
8495         case NL80211_IFTYPE_ADHOC:
8496         case NL80211_IFTYPE_P2P_CLIENT:
8497         case NL80211_IFTYPE_AP:
8498         case NL80211_IFTYPE_AP_VLAN:
8499         case NL80211_IFTYPE_MESH_POINT:
8500         case NL80211_IFTYPE_P2P_GO:
8501                 break;
8502         default:
8503                 return -EOPNOTSUPP;
8504         }
8505
8506         if (info->attrs[NL80211_ATTR_DURATION]) {
8507                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8508                         return -EINVAL;
8509                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8510
8511                 /*
8512                  * We should wait on the channel for at least a minimum amount
8513                  * of time (10ms) but no longer than the driver supports.
8514                  */
8515                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8516                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8517                         return -EINVAL;
8518
8519         }
8520
8521         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8522
8523         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8524                 return -EINVAL;
8525
8526         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8527
8528         /* get the channel if any has been specified, otherwise pass NULL to
8529          * the driver. The latter will use the current one
8530          */
8531         chandef.chan = NULL;
8532         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8533                 err = nl80211_parse_chandef(rdev, info, &chandef);
8534                 if (err)
8535                         return err;
8536         }
8537
8538         if (!chandef.chan && params.offchan)
8539                 return -EINVAL;
8540
8541         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8542         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8543
8544         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8545                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8546                 int i;
8547
8548                 if (len % sizeof(u16))
8549                         return -EINVAL;
8550
8551                 params.n_csa_offsets = len / sizeof(u16);
8552                 params.csa_offsets =
8553                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8554
8555                 /* check that all the offsets fit the frame */
8556                 for (i = 0; i < params.n_csa_offsets; i++) {
8557                         if (params.csa_offsets[i] >= params.len)
8558                                 return -EINVAL;
8559                 }
8560         }
8561
8562         if (!params.dont_wait_for_ack) {
8563                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8564                 if (!msg)
8565                         return -ENOMEM;
8566
8567                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8568                                      NL80211_CMD_FRAME);
8569                 if (!hdr) {
8570                         err = -ENOBUFS;
8571                         goto free_msg;
8572                 }
8573         }
8574
8575         params.chan = chandef.chan;
8576         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8577         if (err)
8578                 goto free_msg;
8579
8580         if (msg) {
8581                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8582                         goto nla_put_failure;
8583
8584                 genlmsg_end(msg, hdr);
8585                 return genlmsg_reply(msg, info);
8586         }
8587
8588         return 0;
8589
8590  nla_put_failure:
8591         err = -ENOBUFS;
8592  free_msg:
8593         nlmsg_free(msg);
8594         return err;
8595 }
8596
8597 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8598 {
8599         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8600         struct wireless_dev *wdev = info->user_ptr[1];
8601         u64 cookie;
8602
8603         if (!info->attrs[NL80211_ATTR_COOKIE])
8604                 return -EINVAL;
8605
8606         if (!rdev->ops->mgmt_tx_cancel_wait)
8607                 return -EOPNOTSUPP;
8608
8609         switch (wdev->iftype) {
8610         case NL80211_IFTYPE_STATION:
8611         case NL80211_IFTYPE_ADHOC:
8612         case NL80211_IFTYPE_P2P_CLIENT:
8613         case NL80211_IFTYPE_AP:
8614         case NL80211_IFTYPE_AP_VLAN:
8615         case NL80211_IFTYPE_P2P_GO:
8616         case NL80211_IFTYPE_P2P_DEVICE:
8617                 break;
8618         default:
8619                 return -EOPNOTSUPP;
8620         }
8621
8622         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8623
8624         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8625 }
8626
8627 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8628 {
8629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8630         struct wireless_dev *wdev;
8631         struct net_device *dev = info->user_ptr[1];
8632         u8 ps_state;
8633         bool state;
8634         int err;
8635
8636         if (!info->attrs[NL80211_ATTR_PS_STATE])
8637                 return -EINVAL;
8638
8639         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8640
8641         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8642                 return -EINVAL;
8643
8644         wdev = dev->ieee80211_ptr;
8645
8646         if (!rdev->ops->set_power_mgmt)
8647                 return -EOPNOTSUPP;
8648
8649         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8650
8651         if (state == wdev->ps)
8652                 return 0;
8653
8654         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8655         if (!err)
8656                 wdev->ps = state;
8657         return err;
8658 }
8659
8660 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8661 {
8662         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8663         enum nl80211_ps_state ps_state;
8664         struct wireless_dev *wdev;
8665         struct net_device *dev = info->user_ptr[1];
8666         struct sk_buff *msg;
8667         void *hdr;
8668         int err;
8669
8670         wdev = dev->ieee80211_ptr;
8671
8672         if (!rdev->ops->set_power_mgmt)
8673                 return -EOPNOTSUPP;
8674
8675         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8676         if (!msg)
8677                 return -ENOMEM;
8678
8679         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8680                              NL80211_CMD_GET_POWER_SAVE);
8681         if (!hdr) {
8682                 err = -ENOBUFS;
8683                 goto free_msg;
8684         }
8685
8686         if (wdev->ps)
8687                 ps_state = NL80211_PS_ENABLED;
8688         else
8689                 ps_state = NL80211_PS_DISABLED;
8690
8691         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8692                 goto nla_put_failure;
8693
8694         genlmsg_end(msg, hdr);
8695         return genlmsg_reply(msg, info);
8696
8697  nla_put_failure:
8698         err = -ENOBUFS;
8699  free_msg:
8700         nlmsg_free(msg);
8701         return err;
8702 }
8703
8704 static const struct nla_policy
8705 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8706         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8707         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8708         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8709         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8710         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8711         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8712 };
8713
8714 static int nl80211_set_cqm_txe(struct genl_info *info,
8715                                u32 rate, u32 pkts, u32 intvl)
8716 {
8717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8718         struct net_device *dev = info->user_ptr[1];
8719         struct wireless_dev *wdev = dev->ieee80211_ptr;
8720
8721         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8722                 return -EINVAL;
8723
8724         if (!rdev->ops->set_cqm_txe_config)
8725                 return -EOPNOTSUPP;
8726
8727         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8728             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8729                 return -EOPNOTSUPP;
8730
8731         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8732 }
8733
8734 static int nl80211_set_cqm_rssi(struct genl_info *info,
8735                                 s32 threshold, u32 hysteresis)
8736 {
8737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8738         struct net_device *dev = info->user_ptr[1];
8739         struct wireless_dev *wdev = dev->ieee80211_ptr;
8740
8741         if (threshold > 0)
8742                 return -EINVAL;
8743
8744         /* disabling - hysteresis should also be zero then */
8745         if (threshold == 0)
8746                 hysteresis = 0;
8747
8748         if (!rdev->ops->set_cqm_rssi_config)
8749                 return -EOPNOTSUPP;
8750
8751         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8752             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8753                 return -EOPNOTSUPP;
8754
8755         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8756 }
8757
8758 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8759 {
8760         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8761         struct nlattr *cqm;
8762         int err;
8763
8764         cqm = info->attrs[NL80211_ATTR_CQM];
8765         if (!cqm)
8766                 return -EINVAL;
8767
8768         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8769                                nl80211_attr_cqm_policy);
8770         if (err)
8771                 return err;
8772
8773         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8774             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8775                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8776                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8777
8778                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8779         }
8780
8781         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8782             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8783             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8784                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8785                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8786                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8787
8788                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8789         }
8790
8791         return -EINVAL;
8792 }
8793
8794 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8795 {
8796         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8797         struct net_device *dev = info->user_ptr[1];
8798         struct ocb_setup setup = {};
8799         int err;
8800
8801         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8802         if (err)
8803                 return err;
8804
8805         return cfg80211_join_ocb(rdev, dev, &setup);
8806 }
8807
8808 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8809 {
8810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8811         struct net_device *dev = info->user_ptr[1];
8812
8813         return cfg80211_leave_ocb(rdev, dev);
8814 }
8815
8816 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8817 {
8818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8819         struct net_device *dev = info->user_ptr[1];
8820         struct mesh_config cfg;
8821         struct mesh_setup setup;
8822         int err;
8823
8824         /* start with default */
8825         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8826         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8827
8828         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8829                 /* and parse parameters if given */
8830                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8831                 if (err)
8832                         return err;
8833         }
8834
8835         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8836             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8837                 return -EINVAL;
8838
8839         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8840         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8841
8842         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8843             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8844                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8845                         return -EINVAL;
8846
8847         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8848                 setup.beacon_interval =
8849                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8850                 if (setup.beacon_interval < 10 ||
8851                     setup.beacon_interval > 10000)
8852                         return -EINVAL;
8853         }
8854
8855         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8856                 setup.dtim_period =
8857                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8858                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8859                         return -EINVAL;
8860         }
8861
8862         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8863                 /* parse additional setup parameters if given */
8864                 err = nl80211_parse_mesh_setup(info, &setup);
8865                 if (err)
8866                         return err;
8867         }
8868
8869         if (setup.user_mpm)
8870                 cfg.auto_open_plinks = false;
8871
8872         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8873                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8874                 if (err)
8875                         return err;
8876         } else {
8877                 /* cfg80211_join_mesh() will sort it out */
8878                 setup.chandef.chan = NULL;
8879         }
8880
8881         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8882                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8883                 int n_rates =
8884                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8885                 struct ieee80211_supported_band *sband;
8886
8887                 if (!setup.chandef.chan)
8888                         return -EINVAL;
8889
8890                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8891
8892                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8893                                              &setup.basic_rates);
8894                 if (err)
8895                         return err;
8896         }
8897
8898         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8899 }
8900
8901 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8902 {
8903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8904         struct net_device *dev = info->user_ptr[1];
8905
8906         return cfg80211_leave_mesh(rdev, dev);
8907 }
8908
8909 #ifdef CONFIG_PM
8910 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8911                                         struct cfg80211_registered_device *rdev)
8912 {
8913         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8914         struct nlattr *nl_pats, *nl_pat;
8915         int i, pat_len;
8916
8917         if (!wowlan->n_patterns)
8918                 return 0;
8919
8920         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8921         if (!nl_pats)
8922                 return -ENOBUFS;
8923
8924         for (i = 0; i < wowlan->n_patterns; i++) {
8925                 nl_pat = nla_nest_start(msg, i + 1);
8926                 if (!nl_pat)
8927                         return -ENOBUFS;
8928                 pat_len = wowlan->patterns[i].pattern_len;
8929                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8930                             wowlan->patterns[i].mask) ||
8931                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8932                             wowlan->patterns[i].pattern) ||
8933                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8934                                 wowlan->patterns[i].pkt_offset))
8935                         return -ENOBUFS;
8936                 nla_nest_end(msg, nl_pat);
8937         }
8938         nla_nest_end(msg, nl_pats);
8939
8940         return 0;
8941 }
8942
8943 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8944                                    struct cfg80211_wowlan_tcp *tcp)
8945 {
8946         struct nlattr *nl_tcp;
8947
8948         if (!tcp)
8949                 return 0;
8950
8951         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8952         if (!nl_tcp)
8953                 return -ENOBUFS;
8954
8955         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8956             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8957             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8958             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8959             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8960             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8961                     tcp->payload_len, tcp->payload) ||
8962             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8963                         tcp->data_interval) ||
8964             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8965                     tcp->wake_len, tcp->wake_data) ||
8966             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8967                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8968                 return -ENOBUFS;
8969
8970         if (tcp->payload_seq.len &&
8971             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8972                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8973                 return -ENOBUFS;
8974
8975         if (tcp->payload_tok.len &&
8976             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8977                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8978                     &tcp->payload_tok))
8979                 return -ENOBUFS;
8980
8981         nla_nest_end(msg, nl_tcp);
8982
8983         return 0;
8984 }
8985
8986 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
8987                                   struct cfg80211_sched_scan_request *req)
8988 {
8989         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
8990         int i;
8991
8992         if (!req)
8993                 return 0;
8994
8995         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
8996         if (!nd)
8997                 return -ENOBUFS;
8998
8999         if (req->n_scan_plans == 1 &&
9000             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9001                         req->scan_plans[0].interval * 1000))
9002                 return -ENOBUFS;
9003
9004         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9005                 return -ENOBUFS;
9006
9007         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9008         if (!freqs)
9009                 return -ENOBUFS;
9010
9011         for (i = 0; i < req->n_channels; i++)
9012                 nla_put_u32(msg, i, req->channels[i]->center_freq);
9013
9014         nla_nest_end(msg, freqs);
9015
9016         if (req->n_match_sets) {
9017                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9018                 for (i = 0; i < req->n_match_sets; i++) {
9019                         match = nla_nest_start(msg, i);
9020                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9021                                 req->match_sets[i].ssid.ssid_len,
9022                                 req->match_sets[i].ssid.ssid);
9023                         nla_nest_end(msg, match);
9024                 }
9025                 nla_nest_end(msg, matches);
9026         }
9027
9028         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9029         if (!scan_plans)
9030                 return -ENOBUFS;
9031
9032         for (i = 0; i < req->n_scan_plans; i++) {
9033                 scan_plan = nla_nest_start(msg, i + 1);
9034                 if (!scan_plan ||
9035                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9036                                 req->scan_plans[i].interval) ||
9037                     (req->scan_plans[i].iterations &&
9038                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9039                                  req->scan_plans[i].iterations)))
9040                         return -ENOBUFS;
9041                 nla_nest_end(msg, scan_plan);
9042         }
9043         nla_nest_end(msg, scan_plans);
9044
9045         nla_nest_end(msg, nd);
9046
9047         return 0;
9048 }
9049
9050 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9051 {
9052         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9053         struct sk_buff *msg;
9054         void *hdr;
9055         u32 size = NLMSG_DEFAULT_SIZE;
9056
9057         if (!rdev->wiphy.wowlan)
9058                 return -EOPNOTSUPP;
9059
9060         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9061                 /* adjust size to have room for all the data */
9062                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9063                         rdev->wiphy.wowlan_config->tcp->payload_len +
9064                         rdev->wiphy.wowlan_config->tcp->wake_len +
9065                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9066         }
9067
9068         msg = nlmsg_new(size, GFP_KERNEL);
9069         if (!msg)
9070                 return -ENOMEM;
9071
9072         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9073                              NL80211_CMD_GET_WOWLAN);
9074         if (!hdr)
9075                 goto nla_put_failure;
9076
9077         if (rdev->wiphy.wowlan_config) {
9078                 struct nlattr *nl_wowlan;
9079
9080                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9081                 if (!nl_wowlan)
9082                         goto nla_put_failure;
9083
9084                 if ((rdev->wiphy.wowlan_config->any &&
9085                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9086                     (rdev->wiphy.wowlan_config->disconnect &&
9087                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9088                     (rdev->wiphy.wowlan_config->magic_pkt &&
9089                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9090                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9091                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9092                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9093                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9094                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9095                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9096                     (rdev->wiphy.wowlan_config->rfkill_release &&
9097                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9098                         goto nla_put_failure;
9099
9100                 if (nl80211_send_wowlan_patterns(msg, rdev))
9101                         goto nla_put_failure;
9102
9103                 if (nl80211_send_wowlan_tcp(msg,
9104                                             rdev->wiphy.wowlan_config->tcp))
9105                         goto nla_put_failure;
9106
9107                 if (nl80211_send_wowlan_nd(
9108                             msg,
9109                             rdev->wiphy.wowlan_config->nd_config))
9110                         goto nla_put_failure;
9111
9112                 nla_nest_end(msg, nl_wowlan);
9113         }
9114
9115         genlmsg_end(msg, hdr);
9116         return genlmsg_reply(msg, info);
9117
9118 nla_put_failure:
9119         nlmsg_free(msg);
9120         return -ENOBUFS;
9121 }
9122
9123 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9124                                     struct nlattr *attr,
9125                                     struct cfg80211_wowlan *trig)
9126 {
9127         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9128         struct cfg80211_wowlan_tcp *cfg;
9129         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9130         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9131         u32 size;
9132         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9133         int err, port;
9134
9135         if (!rdev->wiphy.wowlan->tcp)
9136                 return -EINVAL;
9137
9138         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9139                         nla_data(attr), nla_len(attr),
9140                         nl80211_wowlan_tcp_policy);
9141         if (err)
9142                 return err;
9143
9144         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9145             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9146             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9147             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9148             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9149             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9150             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9151             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9152                 return -EINVAL;
9153
9154         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9155         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9156                 return -EINVAL;
9157
9158         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9159                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9160             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9161                 return -EINVAL;
9162
9163         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9164         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9165                 return -EINVAL;
9166
9167         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9168         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9169                 return -EINVAL;
9170
9171         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9172                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9173
9174                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9175                 tokens_size = tokln - sizeof(*tok);
9176
9177                 if (!tok->len || tokens_size % tok->len)
9178                         return -EINVAL;
9179                 if (!rdev->wiphy.wowlan->tcp->tok)
9180                         return -EINVAL;
9181                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9182                         return -EINVAL;
9183                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9184                         return -EINVAL;
9185                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9186                         return -EINVAL;
9187                 if (tok->offset + tok->len > data_size)
9188                         return -EINVAL;
9189         }
9190
9191         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9192                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9193                 if (!rdev->wiphy.wowlan->tcp->seq)
9194                         return -EINVAL;
9195                 if (seq->len == 0 || seq->len > 4)
9196                         return -EINVAL;
9197                 if (seq->len + seq->offset > data_size)
9198                         return -EINVAL;
9199         }
9200
9201         size = sizeof(*cfg);
9202         size += data_size;
9203         size += wake_size + wake_mask_size;
9204         size += tokens_size;
9205
9206         cfg = kzalloc(size, GFP_KERNEL);
9207         if (!cfg)
9208                 return -ENOMEM;
9209         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9210         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9211         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9212                ETH_ALEN);
9213         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9214                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9215         else
9216                 port = 0;
9217 #ifdef CONFIG_INET
9218         /* allocate a socket and port for it and use it */
9219         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9220                             IPPROTO_TCP, &cfg->sock, 1);
9221         if (err) {
9222                 kfree(cfg);
9223                 return err;
9224         }
9225         if (inet_csk_get_port(cfg->sock->sk, port)) {
9226                 sock_release(cfg->sock);
9227                 kfree(cfg);
9228                 return -EADDRINUSE;
9229         }
9230         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9231 #else
9232         if (!port) {
9233                 kfree(cfg);
9234                 return -EINVAL;
9235         }
9236         cfg->src_port = port;
9237 #endif
9238
9239         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9240         cfg->payload_len = data_size;
9241         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9242         memcpy((void *)cfg->payload,
9243                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9244                data_size);
9245         if (seq)
9246                 cfg->payload_seq = *seq;
9247         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9248         cfg->wake_len = wake_size;
9249         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9250         memcpy((void *)cfg->wake_data,
9251                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9252                wake_size);
9253         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9254                          data_size + wake_size;
9255         memcpy((void *)cfg->wake_mask,
9256                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9257                wake_mask_size);
9258         if (tok) {
9259                 cfg->tokens_size = tokens_size;
9260                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9261         }
9262
9263         trig->tcp = cfg;
9264
9265         return 0;
9266 }
9267
9268 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9269                                    const struct wiphy_wowlan_support *wowlan,
9270                                    struct nlattr *attr,
9271                                    struct cfg80211_wowlan *trig)
9272 {
9273         struct nlattr **tb;
9274         int err;
9275
9276         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9277         if (!tb)
9278                 return -ENOMEM;
9279
9280         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9281                 err = -EOPNOTSUPP;
9282                 goto out;
9283         }
9284
9285         err = nla_parse(tb, NL80211_ATTR_MAX,
9286                         nla_data(attr), nla_len(attr),
9287                         nl80211_policy);
9288         if (err)
9289                 goto out;
9290
9291         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9292         err = PTR_ERR_OR_ZERO(trig->nd_config);
9293         if (err)
9294                 trig->nd_config = NULL;
9295
9296 out:
9297         kfree(tb);
9298         return err;
9299 }
9300
9301 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9302 {
9303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9304         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9305         struct cfg80211_wowlan new_triggers = {};
9306         struct cfg80211_wowlan *ntrig;
9307         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9308         int err, i;
9309         bool prev_enabled = rdev->wiphy.wowlan_config;
9310         bool regular = false;
9311
9312         if (!wowlan)
9313                 return -EOPNOTSUPP;
9314
9315         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9316                 cfg80211_rdev_free_wowlan(rdev);
9317                 rdev->wiphy.wowlan_config = NULL;
9318                 goto set_wakeup;
9319         }
9320
9321         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9322                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9323                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9324                         nl80211_wowlan_policy);
9325         if (err)
9326                 return err;
9327
9328         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9329                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9330                         return -EINVAL;
9331                 new_triggers.any = true;
9332         }
9333
9334         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9335                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9336                         return -EINVAL;
9337                 new_triggers.disconnect = true;
9338                 regular = true;
9339         }
9340
9341         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9342                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9343                         return -EINVAL;
9344                 new_triggers.magic_pkt = true;
9345                 regular = true;
9346         }
9347
9348         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9349                 return -EINVAL;
9350
9351         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9352                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9353                         return -EINVAL;
9354                 new_triggers.gtk_rekey_failure = true;
9355                 regular = true;
9356         }
9357
9358         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9359                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9360                         return -EINVAL;
9361                 new_triggers.eap_identity_req = true;
9362                 regular = true;
9363         }
9364
9365         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9366                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9367                         return -EINVAL;
9368                 new_triggers.four_way_handshake = true;
9369                 regular = true;
9370         }
9371
9372         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9373                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9374                         return -EINVAL;
9375                 new_triggers.rfkill_release = true;
9376                 regular = true;
9377         }
9378
9379         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9380                 struct nlattr *pat;
9381                 int n_patterns = 0;
9382                 int rem, pat_len, mask_len, pkt_offset;
9383                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9384
9385                 regular = true;
9386
9387                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9388                                     rem)
9389                         n_patterns++;
9390                 if (n_patterns > wowlan->n_patterns)
9391                         return -EINVAL;
9392
9393                 new_triggers.patterns = kcalloc(n_patterns,
9394                                                 sizeof(new_triggers.patterns[0]),
9395                                                 GFP_KERNEL);
9396                 if (!new_triggers.patterns)
9397                         return -ENOMEM;
9398
9399                 new_triggers.n_patterns = n_patterns;
9400                 i = 0;
9401
9402                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9403                                     rem) {
9404                         u8 *mask_pat;
9405
9406                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9407                                   nla_len(pat), NULL);
9408                         err = -EINVAL;
9409                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9410                             !pat_tb[NL80211_PKTPAT_PATTERN])
9411                                 goto error;
9412                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9413                         mask_len = DIV_ROUND_UP(pat_len, 8);
9414                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9415                                 goto error;
9416                         if (pat_len > wowlan->pattern_max_len ||
9417                             pat_len < wowlan->pattern_min_len)
9418                                 goto error;
9419
9420                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9421                                 pkt_offset = 0;
9422                         else
9423                                 pkt_offset = nla_get_u32(
9424                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9425                         if (pkt_offset > wowlan->max_pkt_offset)
9426                                 goto error;
9427                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9428
9429                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9430                         if (!mask_pat) {
9431                                 err = -ENOMEM;
9432                                 goto error;
9433                         }
9434                         new_triggers.patterns[i].mask = mask_pat;
9435                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9436                                mask_len);
9437                         mask_pat += mask_len;
9438                         new_triggers.patterns[i].pattern = mask_pat;
9439                         new_triggers.patterns[i].pattern_len = pat_len;
9440                         memcpy(mask_pat,
9441                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9442                                pat_len);
9443                         i++;
9444                 }
9445         }
9446
9447         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9448                 regular = true;
9449                 err = nl80211_parse_wowlan_tcp(
9450                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9451                         &new_triggers);
9452                 if (err)
9453                         goto error;
9454         }
9455
9456         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9457                 regular = true;
9458                 err = nl80211_parse_wowlan_nd(
9459                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9460                         &new_triggers);
9461                 if (err)
9462                         goto error;
9463         }
9464
9465         /* The 'any' trigger means the device continues operating more or less
9466          * as in its normal operation mode and wakes up the host on most of the
9467          * normal interrupts (like packet RX, ...)
9468          * It therefore makes little sense to combine with the more constrained
9469          * wakeup trigger modes.
9470          */
9471         if (new_triggers.any && regular) {
9472                 err = -EINVAL;
9473                 goto error;
9474         }
9475
9476         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9477         if (!ntrig) {
9478                 err = -ENOMEM;
9479                 goto error;
9480         }
9481         cfg80211_rdev_free_wowlan(rdev);
9482         rdev->wiphy.wowlan_config = ntrig;
9483
9484  set_wakeup:
9485         if (rdev->ops->set_wakeup &&
9486             prev_enabled != !!rdev->wiphy.wowlan_config)
9487                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9488
9489         return 0;
9490  error:
9491         for (i = 0; i < new_triggers.n_patterns; i++)
9492                 kfree(new_triggers.patterns[i].mask);
9493         kfree(new_triggers.patterns);
9494         if (new_triggers.tcp && new_triggers.tcp->sock)
9495                 sock_release(new_triggers.tcp->sock);
9496         kfree(new_triggers.tcp);
9497         return err;
9498 }
9499 #endif
9500
9501 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9502                                        struct cfg80211_registered_device *rdev)
9503 {
9504         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9505         int i, j, pat_len;
9506         struct cfg80211_coalesce_rules *rule;
9507
9508         if (!rdev->coalesce->n_rules)
9509                 return 0;
9510
9511         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9512         if (!nl_rules)
9513                 return -ENOBUFS;
9514
9515         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9516                 nl_rule = nla_nest_start(msg, i + 1);
9517                 if (!nl_rule)
9518                         return -ENOBUFS;
9519
9520                 rule = &rdev->coalesce->rules[i];
9521                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9522                                 rule->delay))
9523                         return -ENOBUFS;
9524
9525                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9526                                 rule->condition))
9527                         return -ENOBUFS;
9528
9529                 nl_pats = nla_nest_start(msg,
9530                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9531                 if (!nl_pats)
9532                         return -ENOBUFS;
9533
9534                 for (j = 0; j < rule->n_patterns; j++) {
9535                         nl_pat = nla_nest_start(msg, j + 1);
9536                         if (!nl_pat)
9537                                 return -ENOBUFS;
9538                         pat_len = rule->patterns[j].pattern_len;
9539                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9540                                     DIV_ROUND_UP(pat_len, 8),
9541                                     rule->patterns[j].mask) ||
9542                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9543                                     rule->patterns[j].pattern) ||
9544                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9545                                         rule->patterns[j].pkt_offset))
9546                                 return -ENOBUFS;
9547                         nla_nest_end(msg, nl_pat);
9548                 }
9549                 nla_nest_end(msg, nl_pats);
9550                 nla_nest_end(msg, nl_rule);
9551         }
9552         nla_nest_end(msg, nl_rules);
9553
9554         return 0;
9555 }
9556
9557 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9558 {
9559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9560         struct sk_buff *msg;
9561         void *hdr;
9562
9563         if (!rdev->wiphy.coalesce)
9564                 return -EOPNOTSUPP;
9565
9566         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9567         if (!msg)
9568                 return -ENOMEM;
9569
9570         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9571                              NL80211_CMD_GET_COALESCE);
9572         if (!hdr)
9573                 goto nla_put_failure;
9574
9575         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9576                 goto nla_put_failure;
9577
9578         genlmsg_end(msg, hdr);
9579         return genlmsg_reply(msg, info);
9580
9581 nla_put_failure:
9582         nlmsg_free(msg);
9583         return -ENOBUFS;
9584 }
9585
9586 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9587 {
9588         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9589         int i, j;
9590         struct cfg80211_coalesce_rules *rule;
9591
9592         if (!coalesce)
9593                 return;
9594
9595         for (i = 0; i < coalesce->n_rules; i++) {
9596                 rule = &coalesce->rules[i];
9597                 for (j = 0; j < rule->n_patterns; j++)
9598                         kfree(rule->patterns[j].mask);
9599                 kfree(rule->patterns);
9600         }
9601         kfree(coalesce->rules);
9602         kfree(coalesce);
9603         rdev->coalesce = NULL;
9604 }
9605
9606 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9607                                        struct nlattr *rule,
9608                                        struct cfg80211_coalesce_rules *new_rule)
9609 {
9610         int err, i;
9611         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9612         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9613         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9614         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9615
9616         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9617                         nla_len(rule), nl80211_coalesce_policy);
9618         if (err)
9619                 return err;
9620
9621         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9622                 new_rule->delay =
9623                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9624         if (new_rule->delay > coalesce->max_delay)
9625                 return -EINVAL;
9626
9627         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9628                 new_rule->condition =
9629                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9630         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9631             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9632                 return -EINVAL;
9633
9634         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9635                 return -EINVAL;
9636
9637         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9638                             rem)
9639                 n_patterns++;
9640         if (n_patterns > coalesce->n_patterns)
9641                 return -EINVAL;
9642
9643         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9644                                      GFP_KERNEL);
9645         if (!new_rule->patterns)
9646                 return -ENOMEM;
9647
9648         new_rule->n_patterns = n_patterns;
9649         i = 0;
9650
9651         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9652                             rem) {
9653                 u8 *mask_pat;
9654
9655                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9656                           nla_len(pat), NULL);
9657                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9658                     !pat_tb[NL80211_PKTPAT_PATTERN])
9659                         return -EINVAL;
9660                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9661                 mask_len = DIV_ROUND_UP(pat_len, 8);
9662                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9663                         return -EINVAL;
9664                 if (pat_len > coalesce->pattern_max_len ||
9665                     pat_len < coalesce->pattern_min_len)
9666                         return -EINVAL;
9667
9668                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9669                         pkt_offset = 0;
9670                 else
9671                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9672                 if (pkt_offset > coalesce->max_pkt_offset)
9673                         return -EINVAL;
9674                 new_rule->patterns[i].pkt_offset = pkt_offset;
9675
9676                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9677                 if (!mask_pat)
9678                         return -ENOMEM;
9679
9680                 new_rule->patterns[i].mask = mask_pat;
9681                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9682                        mask_len);
9683
9684                 mask_pat += mask_len;
9685                 new_rule->patterns[i].pattern = mask_pat;
9686                 new_rule->patterns[i].pattern_len = pat_len;
9687                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9688                        pat_len);
9689                 i++;
9690         }
9691
9692         return 0;
9693 }
9694
9695 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9696 {
9697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9698         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9699         struct cfg80211_coalesce new_coalesce = {};
9700         struct cfg80211_coalesce *n_coalesce;
9701         int err, rem_rule, n_rules = 0, i, j;
9702         struct nlattr *rule;
9703         struct cfg80211_coalesce_rules *tmp_rule;
9704
9705         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9706                 return -EOPNOTSUPP;
9707
9708         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9709                 cfg80211_rdev_free_coalesce(rdev);
9710                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9711                 return 0;
9712         }
9713
9714         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9715                             rem_rule)
9716                 n_rules++;
9717         if (n_rules > coalesce->n_rules)
9718                 return -EINVAL;
9719
9720         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9721                                      GFP_KERNEL);
9722         if (!new_coalesce.rules)
9723                 return -ENOMEM;
9724
9725         new_coalesce.n_rules = n_rules;
9726         i = 0;
9727
9728         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9729                             rem_rule) {
9730                 err = nl80211_parse_coalesce_rule(rdev, rule,
9731                                                   &new_coalesce.rules[i]);
9732                 if (err)
9733                         goto error;
9734
9735                 i++;
9736         }
9737
9738         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9739         if (err)
9740                 goto error;
9741
9742         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9743         if (!n_coalesce) {
9744                 err = -ENOMEM;
9745                 goto error;
9746         }
9747         cfg80211_rdev_free_coalesce(rdev);
9748         rdev->coalesce = n_coalesce;
9749
9750         return 0;
9751 error:
9752         for (i = 0; i < new_coalesce.n_rules; i++) {
9753                 tmp_rule = &new_coalesce.rules[i];
9754                 for (j = 0; j < tmp_rule->n_patterns; j++)
9755                         kfree(tmp_rule->patterns[j].mask);
9756                 kfree(tmp_rule->patterns);
9757         }
9758         kfree(new_coalesce.rules);
9759
9760         return err;
9761 }
9762
9763 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9764 {
9765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9766         struct net_device *dev = info->user_ptr[1];
9767         struct wireless_dev *wdev = dev->ieee80211_ptr;
9768         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9769         struct cfg80211_gtk_rekey_data rekey_data;
9770         int err;
9771
9772         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9773                 return -EINVAL;
9774
9775         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9776                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9777                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9778                         nl80211_rekey_policy);
9779         if (err)
9780                 return err;
9781
9782         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9783                 return -ERANGE;
9784         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9785                 return -ERANGE;
9786         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9787                 return -ERANGE;
9788
9789         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9790         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9791         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9792
9793         wdev_lock(wdev);
9794         if (!wdev->current_bss) {
9795                 err = -ENOTCONN;
9796                 goto out;
9797         }
9798
9799         if (!rdev->ops->set_rekey_data) {
9800                 err = -EOPNOTSUPP;
9801                 goto out;
9802         }
9803
9804         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9805  out:
9806         wdev_unlock(wdev);
9807         return err;
9808 }
9809
9810 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9811                                              struct genl_info *info)
9812 {
9813         struct net_device *dev = info->user_ptr[1];
9814         struct wireless_dev *wdev = dev->ieee80211_ptr;
9815
9816         if (wdev->iftype != NL80211_IFTYPE_AP &&
9817             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9818                 return -EINVAL;
9819
9820         if (wdev->ap_unexpected_nlportid)
9821                 return -EBUSY;
9822
9823         wdev->ap_unexpected_nlportid = info->snd_portid;
9824         return 0;
9825 }
9826
9827 static int nl80211_probe_client(struct sk_buff *skb,
9828                                 struct genl_info *info)
9829 {
9830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9831         struct net_device *dev = info->user_ptr[1];
9832         struct wireless_dev *wdev = dev->ieee80211_ptr;
9833         struct sk_buff *msg;
9834         void *hdr;
9835         const u8 *addr;
9836         u64 cookie;
9837         int err;
9838
9839         if (wdev->iftype != NL80211_IFTYPE_AP &&
9840             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9841                 return -EOPNOTSUPP;
9842
9843         if (!info->attrs[NL80211_ATTR_MAC])
9844                 return -EINVAL;
9845
9846         if (!rdev->ops->probe_client)
9847                 return -EOPNOTSUPP;
9848
9849         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9850         if (!msg)
9851                 return -ENOMEM;
9852
9853         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9854                              NL80211_CMD_PROBE_CLIENT);
9855         if (!hdr) {
9856                 err = -ENOBUFS;
9857                 goto free_msg;
9858         }
9859
9860         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9861
9862         err = rdev_probe_client(rdev, dev, addr, &cookie);
9863         if (err)
9864                 goto free_msg;
9865
9866         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9867                 goto nla_put_failure;
9868
9869         genlmsg_end(msg, hdr);
9870
9871         return genlmsg_reply(msg, info);
9872
9873  nla_put_failure:
9874         err = -ENOBUFS;
9875  free_msg:
9876         nlmsg_free(msg);
9877         return err;
9878 }
9879
9880 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9881 {
9882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9883         struct cfg80211_beacon_registration *reg, *nreg;
9884         int rv;
9885
9886         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9887                 return -EOPNOTSUPP;
9888
9889         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9890         if (!nreg)
9891                 return -ENOMEM;
9892
9893         /* First, check if already registered. */
9894         spin_lock_bh(&rdev->beacon_registrations_lock);
9895         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9896                 if (reg->nlportid == info->snd_portid) {
9897                         rv = -EALREADY;
9898                         goto out_err;
9899                 }
9900         }
9901         /* Add it to the list */
9902         nreg->nlportid = info->snd_portid;
9903         list_add(&nreg->list, &rdev->beacon_registrations);
9904
9905         spin_unlock_bh(&rdev->beacon_registrations_lock);
9906
9907         return 0;
9908 out_err:
9909         spin_unlock_bh(&rdev->beacon_registrations_lock);
9910         kfree(nreg);
9911         return rv;
9912 }
9913
9914 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9915 {
9916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9917         struct wireless_dev *wdev = info->user_ptr[1];
9918         int err;
9919
9920         if (!rdev->ops->start_p2p_device)
9921                 return -EOPNOTSUPP;
9922
9923         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9924                 return -EOPNOTSUPP;
9925
9926         if (wdev->p2p_started)
9927                 return 0;
9928
9929         if (rfkill_blocked(rdev->rfkill))
9930                 return -ERFKILL;
9931
9932         err = rdev_start_p2p_device(rdev, wdev);
9933         if (err)
9934                 return err;
9935
9936         wdev->p2p_started = true;
9937         rdev->opencount++;
9938
9939         return 0;
9940 }
9941
9942 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9943 {
9944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9945         struct wireless_dev *wdev = info->user_ptr[1];
9946
9947         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9948                 return -EOPNOTSUPP;
9949
9950         if (!rdev->ops->stop_p2p_device)
9951                 return -EOPNOTSUPP;
9952
9953         cfg80211_stop_p2p_device(rdev, wdev);
9954
9955         return 0;
9956 }
9957
9958 static int nl80211_get_protocol_features(struct sk_buff *skb,
9959                                          struct genl_info *info)
9960 {
9961         void *hdr;
9962         struct sk_buff *msg;
9963
9964         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9965         if (!msg)
9966                 return -ENOMEM;
9967
9968         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9969                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9970         if (!hdr)
9971                 goto nla_put_failure;
9972
9973         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9974                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9975                 goto nla_put_failure;
9976
9977         genlmsg_end(msg, hdr);
9978         return genlmsg_reply(msg, info);
9979
9980  nla_put_failure:
9981         kfree_skb(msg);
9982         return -ENOBUFS;
9983 }
9984
9985 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9986 {
9987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9988         struct cfg80211_update_ft_ies_params ft_params;
9989         struct net_device *dev = info->user_ptr[1];
9990
9991         if (!rdev->ops->update_ft_ies)
9992                 return -EOPNOTSUPP;
9993
9994         if (!info->attrs[NL80211_ATTR_MDID] ||
9995             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9996                 return -EINVAL;
9997
9998         memset(&ft_params, 0, sizeof(ft_params));
9999         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10000         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10001         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10002
10003         return rdev_update_ft_ies(rdev, dev, &ft_params);
10004 }
10005
10006 static int nl80211_crit_protocol_start(struct sk_buff *skb,
10007                                        struct genl_info *info)
10008 {
10009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10010         struct wireless_dev *wdev = info->user_ptr[1];
10011         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10012         u16 duration;
10013         int ret;
10014
10015         if (!rdev->ops->crit_proto_start)
10016                 return -EOPNOTSUPP;
10017
10018         if (WARN_ON(!rdev->ops->crit_proto_stop))
10019                 return -EINVAL;
10020
10021         if (rdev->crit_proto_nlportid)
10022                 return -EBUSY;
10023
10024         /* determine protocol if provided */
10025         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10026                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10027
10028         if (proto >= NUM_NL80211_CRIT_PROTO)
10029                 return -EINVAL;
10030
10031         /* timeout must be provided */
10032         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10033                 return -EINVAL;
10034
10035         duration =
10036                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10037
10038         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10039                 return -ERANGE;
10040
10041         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10042         if (!ret)
10043                 rdev->crit_proto_nlportid = info->snd_portid;
10044
10045         return ret;
10046 }
10047
10048 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10049                                       struct genl_info *info)
10050 {
10051         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10052         struct wireless_dev *wdev = info->user_ptr[1];
10053
10054         if (!rdev->ops->crit_proto_stop)
10055                 return -EOPNOTSUPP;
10056
10057         if (rdev->crit_proto_nlportid) {
10058                 rdev->crit_proto_nlportid = 0;
10059                 rdev_crit_proto_stop(rdev, wdev);
10060         }
10061         return 0;
10062 }
10063
10064 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10065 {
10066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10067         struct wireless_dev *wdev =
10068                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10069         int i, err;
10070         u32 vid, subcmd;
10071
10072         if (!rdev->wiphy.vendor_commands)
10073                 return -EOPNOTSUPP;
10074
10075         if (IS_ERR(wdev)) {
10076                 err = PTR_ERR(wdev);
10077                 if (err != -EINVAL)
10078                         return err;
10079                 wdev = NULL;
10080         } else if (wdev->wiphy != &rdev->wiphy) {
10081                 return -EINVAL;
10082         }
10083
10084         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10085             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10086                 return -EINVAL;
10087
10088         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10089         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10090         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10091                 const struct wiphy_vendor_command *vcmd;
10092                 void *data = NULL;
10093                 int len = 0;
10094
10095                 vcmd = &rdev->wiphy.vendor_commands[i];
10096
10097                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10098                         continue;
10099
10100                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10101                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10102                         if (!wdev)
10103                                 return -EINVAL;
10104                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10105                             !wdev->netdev)
10106                                 return -EINVAL;
10107
10108                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10109                                 if (wdev->netdev &&
10110                                     !netif_running(wdev->netdev))
10111                                         return -ENETDOWN;
10112                                 if (!wdev->netdev && !wdev->p2p_started)
10113                                         return -ENETDOWN;
10114                         }
10115
10116                         if (!vcmd->doit)
10117                                 return -EOPNOTSUPP;
10118                 } else {
10119                         wdev = NULL;
10120                 }
10121
10122                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10123                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10124                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10125                 }
10126
10127                 rdev->cur_cmd_info = info;
10128                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10129                                                           data, len);
10130                 rdev->cur_cmd_info = NULL;
10131                 return err;
10132         }
10133
10134         return -EOPNOTSUPP;
10135 }
10136
10137 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10138                                        struct netlink_callback *cb,
10139                                        struct cfg80211_registered_device **rdev,
10140                                        struct wireless_dev **wdev)
10141 {
10142         u32 vid, subcmd;
10143         unsigned int i;
10144         int vcmd_idx = -1;
10145         int err;
10146         void *data = NULL;
10147         unsigned int data_len = 0;
10148
10149         rtnl_lock();
10150
10151         if (cb->args[0]) {
10152                 /* subtract the 1 again here */
10153                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10154                 struct wireless_dev *tmp;
10155
10156                 if (!wiphy) {
10157                         err = -ENODEV;
10158                         goto out_unlock;
10159                 }
10160                 *rdev = wiphy_to_rdev(wiphy);
10161                 *wdev = NULL;
10162
10163                 if (cb->args[1]) {
10164                         list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
10165                                 if (tmp->identifier == cb->args[1] - 1) {
10166                                         *wdev = tmp;
10167                                         break;
10168                                 }
10169                         }
10170                 }
10171
10172                 /* keep rtnl locked in successful case */
10173                 return 0;
10174         }
10175
10176         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10177                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10178                           nl80211_policy);
10179         if (err)
10180                 goto out_unlock;
10181
10182         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10183             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10184                 err = -EINVAL;
10185                 goto out_unlock;
10186         }
10187
10188         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10189                                            nl80211_fam.attrbuf);
10190         if (IS_ERR(*wdev))
10191                 *wdev = NULL;
10192
10193         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10194                                            nl80211_fam.attrbuf);
10195         if (IS_ERR(*rdev)) {
10196                 err = PTR_ERR(*rdev);
10197                 goto out_unlock;
10198         }
10199
10200         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10201         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10202
10203         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10204                 const struct wiphy_vendor_command *vcmd;
10205
10206                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10207
10208                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10209                         continue;
10210
10211                 if (!vcmd->dumpit) {
10212                         err = -EOPNOTSUPP;
10213                         goto out_unlock;
10214                 }
10215
10216                 vcmd_idx = i;
10217                 break;
10218         }
10219
10220         if (vcmd_idx < 0) {
10221                 err = -EOPNOTSUPP;
10222                 goto out_unlock;
10223         }
10224
10225         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10226                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10227                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10228         }
10229
10230         /* 0 is the first index - add 1 to parse only once */
10231         cb->args[0] = (*rdev)->wiphy_idx + 1;
10232         /* add 1 to know if it was NULL */
10233         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10234         cb->args[2] = vcmd_idx;
10235         cb->args[3] = (unsigned long)data;
10236         cb->args[4] = data_len;
10237
10238         /* keep rtnl locked in successful case */
10239         return 0;
10240  out_unlock:
10241         rtnl_unlock();
10242         return err;
10243 }
10244
10245 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10246                                    struct netlink_callback *cb)
10247 {
10248         struct cfg80211_registered_device *rdev;
10249         struct wireless_dev *wdev;
10250         unsigned int vcmd_idx;
10251         const struct wiphy_vendor_command *vcmd;
10252         void *data;
10253         int data_len;
10254         int err;
10255         struct nlattr *vendor_data;
10256
10257         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10258         if (err)
10259                 return err;
10260
10261         vcmd_idx = cb->args[2];
10262         data = (void *)cb->args[3];
10263         data_len = cb->args[4];
10264         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10265
10266         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10267                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10268                 if (!wdev)
10269                         return -EINVAL;
10270                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10271                     !wdev->netdev)
10272                         return -EINVAL;
10273
10274                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10275                         if (wdev->netdev &&
10276                             !netif_running(wdev->netdev))
10277                                 return -ENETDOWN;
10278                         if (!wdev->netdev && !wdev->p2p_started)
10279                                 return -ENETDOWN;
10280                 }
10281         }
10282
10283         while (1) {
10284                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10285                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10286                                            NL80211_CMD_VENDOR);
10287                 if (!hdr)
10288                         break;
10289
10290                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10291                     (wdev && nla_put_u64(skb, NL80211_ATTR_WDEV,
10292                                          wdev_id(wdev)))) {
10293                         genlmsg_cancel(skb, hdr);
10294                         break;
10295                 }
10296
10297                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10298                 if (!vendor_data) {
10299                         genlmsg_cancel(skb, hdr);
10300                         break;
10301                 }
10302
10303                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10304                                    (unsigned long *)&cb->args[5]);
10305                 nla_nest_end(skb, vendor_data);
10306
10307                 if (err == -ENOBUFS || err == -ENOENT) {
10308                         genlmsg_cancel(skb, hdr);
10309                         break;
10310                 } else if (err) {
10311                         genlmsg_cancel(skb, hdr);
10312                         goto out;
10313                 }
10314
10315                 genlmsg_end(skb, hdr);
10316         }
10317
10318         err = skb->len;
10319  out:
10320         rtnl_unlock();
10321         return err;
10322 }
10323
10324 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10325                                            enum nl80211_commands cmd,
10326                                            enum nl80211_attrs attr,
10327                                            int approxlen)
10328 {
10329         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10330
10331         if (WARN_ON(!rdev->cur_cmd_info))
10332                 return NULL;
10333
10334         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10335                                            rdev->cur_cmd_info->snd_portid,
10336                                            rdev->cur_cmd_info->snd_seq,
10337                                            cmd, attr, NULL, GFP_KERNEL);
10338 }
10339 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10340
10341 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10342 {
10343         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10344         void *hdr = ((void **)skb->cb)[1];
10345         struct nlattr *data = ((void **)skb->cb)[2];
10346
10347         /* clear CB data for netlink core to own from now on */
10348         memset(skb->cb, 0, sizeof(skb->cb));
10349
10350         if (WARN_ON(!rdev->cur_cmd_info)) {
10351                 kfree_skb(skb);
10352                 return -EINVAL;
10353         }
10354
10355         nla_nest_end(skb, data);
10356         genlmsg_end(skb, hdr);
10357         return genlmsg_reply(skb, rdev->cur_cmd_info);
10358 }
10359 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10360
10361
10362 static int nl80211_set_qos_map(struct sk_buff *skb,
10363                                struct genl_info *info)
10364 {
10365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10366         struct cfg80211_qos_map *qos_map = NULL;
10367         struct net_device *dev = info->user_ptr[1];
10368         u8 *pos, len, num_des, des_len, des;
10369         int ret;
10370
10371         if (!rdev->ops->set_qos_map)
10372                 return -EOPNOTSUPP;
10373
10374         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10375                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10376                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10377
10378                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10379                     len > IEEE80211_QOS_MAP_LEN_MAX)
10380                         return -EINVAL;
10381
10382                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10383                 if (!qos_map)
10384                         return -ENOMEM;
10385
10386                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10387                 if (num_des) {
10388                         des_len = num_des *
10389                                 sizeof(struct cfg80211_dscp_exception);
10390                         memcpy(qos_map->dscp_exception, pos, des_len);
10391                         qos_map->num_des = num_des;
10392                         for (des = 0; des < num_des; des++) {
10393                                 if (qos_map->dscp_exception[des].up > 7) {
10394                                         kfree(qos_map);
10395                                         return -EINVAL;
10396                                 }
10397                         }
10398                         pos += des_len;
10399                 }
10400                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10401         }
10402
10403         wdev_lock(dev->ieee80211_ptr);
10404         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10405         if (!ret)
10406                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10407         wdev_unlock(dev->ieee80211_ptr);
10408
10409         kfree(qos_map);
10410         return ret;
10411 }
10412
10413 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10414 {
10415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10416         struct net_device *dev = info->user_ptr[1];
10417         struct wireless_dev *wdev = dev->ieee80211_ptr;
10418         const u8 *peer;
10419         u8 tsid, up;
10420         u16 admitted_time = 0;
10421         int err;
10422
10423         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10424                 return -EOPNOTSUPP;
10425
10426         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10427             !info->attrs[NL80211_ATTR_USER_PRIO])
10428                 return -EINVAL;
10429
10430         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10431         if (tsid >= IEEE80211_NUM_TIDS)
10432                 return -EINVAL;
10433
10434         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10435         if (up >= IEEE80211_NUM_UPS)
10436                 return -EINVAL;
10437
10438         /* WMM uses TIDs 0-7 even for TSPEC */
10439         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10440                 /* TODO: handle 802.11 TSPEC/admission control
10441                  * need more attributes for that (e.g. BA session requirement);
10442                  * change the WMM adminssion test above to allow both then
10443                  */
10444                 return -EINVAL;
10445         }
10446
10447         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10448
10449         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10450                 admitted_time =
10451                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10452                 if (!admitted_time)
10453                         return -EINVAL;
10454         }
10455
10456         wdev_lock(wdev);
10457         switch (wdev->iftype) {
10458         case NL80211_IFTYPE_STATION:
10459         case NL80211_IFTYPE_P2P_CLIENT:
10460                 if (wdev->current_bss)
10461                         break;
10462                 err = -ENOTCONN;
10463                 goto out;
10464         default:
10465                 err = -EOPNOTSUPP;
10466                 goto out;
10467         }
10468
10469         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10470
10471  out:
10472         wdev_unlock(wdev);
10473         return err;
10474 }
10475
10476 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10477 {
10478         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10479         struct net_device *dev = info->user_ptr[1];
10480         struct wireless_dev *wdev = dev->ieee80211_ptr;
10481         const u8 *peer;
10482         u8 tsid;
10483         int err;
10484
10485         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10486                 return -EINVAL;
10487
10488         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10489         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10490
10491         wdev_lock(wdev);
10492         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10493         wdev_unlock(wdev);
10494
10495         return err;
10496 }
10497
10498 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10499                                        struct genl_info *info)
10500 {
10501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10502         struct net_device *dev = info->user_ptr[1];
10503         struct wireless_dev *wdev = dev->ieee80211_ptr;
10504         struct cfg80211_chan_def chandef = {};
10505         const u8 *addr;
10506         u8 oper_class;
10507         int err;
10508
10509         if (!rdev->ops->tdls_channel_switch ||
10510             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10511                 return -EOPNOTSUPP;
10512
10513         switch (dev->ieee80211_ptr->iftype) {
10514         case NL80211_IFTYPE_STATION:
10515         case NL80211_IFTYPE_P2P_CLIENT:
10516                 break;
10517         default:
10518                 return -EOPNOTSUPP;
10519         }
10520
10521         if (!info->attrs[NL80211_ATTR_MAC] ||
10522             !info->attrs[NL80211_ATTR_OPER_CLASS])
10523                 return -EINVAL;
10524
10525         err = nl80211_parse_chandef(rdev, info, &chandef);
10526         if (err)
10527                 return err;
10528
10529         /*
10530          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10531          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10532          * specification is not defined for them.
10533          */
10534         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
10535             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10536             chandef.width != NL80211_CHAN_WIDTH_20)
10537                 return -EINVAL;
10538
10539         /* we will be active on the TDLS link */
10540         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10541                                            wdev->iftype))
10542                 return -EINVAL;
10543
10544         /* don't allow switching to DFS channels */
10545         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10546                 return -EINVAL;
10547
10548         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10549         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10550
10551         wdev_lock(wdev);
10552         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10553         wdev_unlock(wdev);
10554
10555         return err;
10556 }
10557
10558 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10559                                               struct genl_info *info)
10560 {
10561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10562         struct net_device *dev = info->user_ptr[1];
10563         struct wireless_dev *wdev = dev->ieee80211_ptr;
10564         const u8 *addr;
10565
10566         if (!rdev->ops->tdls_channel_switch ||
10567             !rdev->ops->tdls_cancel_channel_switch ||
10568             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10569                 return -EOPNOTSUPP;
10570
10571         switch (dev->ieee80211_ptr->iftype) {
10572         case NL80211_IFTYPE_STATION:
10573         case NL80211_IFTYPE_P2P_CLIENT:
10574                 break;
10575         default:
10576                 return -EOPNOTSUPP;
10577         }
10578
10579         if (!info->attrs[NL80211_ATTR_MAC])
10580                 return -EINVAL;
10581
10582         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10583
10584         wdev_lock(wdev);
10585         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10586         wdev_unlock(wdev);
10587
10588         return 0;
10589 }
10590
10591 #define NL80211_FLAG_NEED_WIPHY         0x01
10592 #define NL80211_FLAG_NEED_NETDEV        0x02
10593 #define NL80211_FLAG_NEED_RTNL          0x04
10594 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10595 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10596                                          NL80211_FLAG_CHECK_NETDEV_UP)
10597 #define NL80211_FLAG_NEED_WDEV          0x10
10598 /* If a netdev is associated, it must be UP, P2P must be started */
10599 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10600                                          NL80211_FLAG_CHECK_NETDEV_UP)
10601 #define NL80211_FLAG_CLEAR_SKB          0x20
10602
10603 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10604                             struct genl_info *info)
10605 {
10606         struct cfg80211_registered_device *rdev;
10607         struct wireless_dev *wdev;
10608         struct net_device *dev;
10609         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10610
10611         if (rtnl)
10612                 rtnl_lock();
10613
10614         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10615                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10616                 if (IS_ERR(rdev)) {
10617                         if (rtnl)
10618                                 rtnl_unlock();
10619                         return PTR_ERR(rdev);
10620                 }
10621                 info->user_ptr[0] = rdev;
10622         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10623                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10624                 ASSERT_RTNL();
10625
10626                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10627                                                   info->attrs);
10628                 if (IS_ERR(wdev)) {
10629                         if (rtnl)
10630                                 rtnl_unlock();
10631                         return PTR_ERR(wdev);
10632                 }
10633
10634                 dev = wdev->netdev;
10635                 rdev = wiphy_to_rdev(wdev->wiphy);
10636
10637                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10638                         if (!dev) {
10639                                 if (rtnl)
10640                                         rtnl_unlock();
10641                                 return -EINVAL;
10642                         }
10643
10644                         info->user_ptr[1] = dev;
10645                 } else {
10646                         info->user_ptr[1] = wdev;
10647                 }
10648
10649                 if (dev) {
10650                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10651                             !netif_running(dev)) {
10652                                 if (rtnl)
10653                                         rtnl_unlock();
10654                                 return -ENETDOWN;
10655                         }
10656
10657                         dev_hold(dev);
10658                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10659                         if (!wdev->p2p_started) {
10660                                 if (rtnl)
10661                                         rtnl_unlock();
10662                                 return -ENETDOWN;
10663                         }
10664                 }
10665
10666                 info->user_ptr[0] = rdev;
10667         }
10668
10669         return 0;
10670 }
10671
10672 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10673                               struct genl_info *info)
10674 {
10675         if (info->user_ptr[1]) {
10676                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10677                         struct wireless_dev *wdev = info->user_ptr[1];
10678
10679                         if (wdev->netdev)
10680                                 dev_put(wdev->netdev);
10681                 } else {
10682                         dev_put(info->user_ptr[1]);
10683                 }
10684         }
10685
10686         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10687                 rtnl_unlock();
10688
10689         /* If needed, clear the netlink message payload from the SKB
10690          * as it might contain key data that shouldn't stick around on
10691          * the heap after the SKB is freed. The netlink message header
10692          * is still needed for further processing, so leave it intact.
10693          */
10694         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10695                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10696
10697                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10698         }
10699 }
10700
10701 static const struct genl_ops nl80211_ops[] = {
10702         {
10703                 .cmd = NL80211_CMD_GET_WIPHY,
10704                 .doit = nl80211_get_wiphy,
10705                 .dumpit = nl80211_dump_wiphy,
10706                 .done = nl80211_dump_wiphy_done,
10707                 .policy = nl80211_policy,
10708                 /* can be retrieved by unprivileged users */
10709                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10710                                   NL80211_FLAG_NEED_RTNL,
10711         },
10712         {
10713                 .cmd = NL80211_CMD_SET_WIPHY,
10714                 .doit = nl80211_set_wiphy,
10715                 .policy = nl80211_policy,
10716                 .flags = GENL_ADMIN_PERM,
10717                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10718         },
10719         {
10720                 .cmd = NL80211_CMD_GET_INTERFACE,
10721                 .doit = nl80211_get_interface,
10722                 .dumpit = nl80211_dump_interface,
10723                 .policy = nl80211_policy,
10724                 /* can be retrieved by unprivileged users */
10725                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10726                                   NL80211_FLAG_NEED_RTNL,
10727         },
10728         {
10729                 .cmd = NL80211_CMD_SET_INTERFACE,
10730                 .doit = nl80211_set_interface,
10731                 .policy = nl80211_policy,
10732                 .flags = GENL_ADMIN_PERM,
10733                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10734                                   NL80211_FLAG_NEED_RTNL,
10735         },
10736         {
10737                 .cmd = NL80211_CMD_NEW_INTERFACE,
10738                 .doit = nl80211_new_interface,
10739                 .policy = nl80211_policy,
10740                 .flags = GENL_ADMIN_PERM,
10741                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10742                                   NL80211_FLAG_NEED_RTNL,
10743         },
10744         {
10745                 .cmd = NL80211_CMD_DEL_INTERFACE,
10746                 .doit = nl80211_del_interface,
10747                 .policy = nl80211_policy,
10748                 .flags = GENL_ADMIN_PERM,
10749                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10750                                   NL80211_FLAG_NEED_RTNL,
10751         },
10752         {
10753                 .cmd = NL80211_CMD_GET_KEY,
10754                 .doit = nl80211_get_key,
10755                 .policy = nl80211_policy,
10756                 .flags = GENL_ADMIN_PERM,
10757                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10758                                   NL80211_FLAG_NEED_RTNL,
10759         },
10760         {
10761                 .cmd = NL80211_CMD_SET_KEY,
10762                 .doit = nl80211_set_key,
10763                 .policy = nl80211_policy,
10764                 .flags = GENL_ADMIN_PERM,
10765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10766                                   NL80211_FLAG_NEED_RTNL |
10767                                   NL80211_FLAG_CLEAR_SKB,
10768         },
10769         {
10770                 .cmd = NL80211_CMD_NEW_KEY,
10771                 .doit = nl80211_new_key,
10772                 .policy = nl80211_policy,
10773                 .flags = GENL_ADMIN_PERM,
10774                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10775                                   NL80211_FLAG_NEED_RTNL |
10776                                   NL80211_FLAG_CLEAR_SKB,
10777         },
10778         {
10779                 .cmd = NL80211_CMD_DEL_KEY,
10780                 .doit = nl80211_del_key,
10781                 .policy = nl80211_policy,
10782                 .flags = GENL_ADMIN_PERM,
10783                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10784                                   NL80211_FLAG_NEED_RTNL,
10785         },
10786         {
10787                 .cmd = NL80211_CMD_SET_BEACON,
10788                 .policy = nl80211_policy,
10789                 .flags = GENL_ADMIN_PERM,
10790                 .doit = nl80211_set_beacon,
10791                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10792                                   NL80211_FLAG_NEED_RTNL,
10793         },
10794         {
10795                 .cmd = NL80211_CMD_START_AP,
10796                 .policy = nl80211_policy,
10797                 .flags = GENL_ADMIN_PERM,
10798                 .doit = nl80211_start_ap,
10799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10800                                   NL80211_FLAG_NEED_RTNL,
10801         },
10802         {
10803                 .cmd = NL80211_CMD_STOP_AP,
10804                 .policy = nl80211_policy,
10805                 .flags = GENL_ADMIN_PERM,
10806                 .doit = nl80211_stop_ap,
10807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10808                                   NL80211_FLAG_NEED_RTNL,
10809         },
10810         {
10811                 .cmd = NL80211_CMD_GET_STATION,
10812                 .doit = nl80211_get_station,
10813                 .dumpit = nl80211_dump_station,
10814                 .policy = nl80211_policy,
10815                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10816                                   NL80211_FLAG_NEED_RTNL,
10817         },
10818         {
10819                 .cmd = NL80211_CMD_SET_STATION,
10820                 .doit = nl80211_set_station,
10821                 .policy = nl80211_policy,
10822                 .flags = GENL_ADMIN_PERM,
10823                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10824                                   NL80211_FLAG_NEED_RTNL,
10825         },
10826         {
10827                 .cmd = NL80211_CMD_NEW_STATION,
10828                 .doit = nl80211_new_station,
10829                 .policy = nl80211_policy,
10830                 .flags = GENL_ADMIN_PERM,
10831                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10832                                   NL80211_FLAG_NEED_RTNL,
10833         },
10834         {
10835                 .cmd = NL80211_CMD_DEL_STATION,
10836                 .doit = nl80211_del_station,
10837                 .policy = nl80211_policy,
10838                 .flags = GENL_ADMIN_PERM,
10839                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10840                                   NL80211_FLAG_NEED_RTNL,
10841         },
10842         {
10843                 .cmd = NL80211_CMD_GET_MPATH,
10844                 .doit = nl80211_get_mpath,
10845                 .dumpit = nl80211_dump_mpath,
10846                 .policy = nl80211_policy,
10847                 .flags = GENL_ADMIN_PERM,
10848                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10849                                   NL80211_FLAG_NEED_RTNL,
10850         },
10851         {
10852                 .cmd = NL80211_CMD_GET_MPP,
10853                 .doit = nl80211_get_mpp,
10854                 .dumpit = nl80211_dump_mpp,
10855                 .policy = nl80211_policy,
10856                 .flags = GENL_ADMIN_PERM,
10857                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10858                                   NL80211_FLAG_NEED_RTNL,
10859         },
10860         {
10861                 .cmd = NL80211_CMD_SET_MPATH,
10862                 .doit = nl80211_set_mpath,
10863                 .policy = nl80211_policy,
10864                 .flags = GENL_ADMIN_PERM,
10865                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10866                                   NL80211_FLAG_NEED_RTNL,
10867         },
10868         {
10869                 .cmd = NL80211_CMD_NEW_MPATH,
10870                 .doit = nl80211_new_mpath,
10871                 .policy = nl80211_policy,
10872                 .flags = GENL_ADMIN_PERM,
10873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10874                                   NL80211_FLAG_NEED_RTNL,
10875         },
10876         {
10877                 .cmd = NL80211_CMD_DEL_MPATH,
10878                 .doit = nl80211_del_mpath,
10879                 .policy = nl80211_policy,
10880                 .flags = GENL_ADMIN_PERM,
10881                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10882                                   NL80211_FLAG_NEED_RTNL,
10883         },
10884         {
10885                 .cmd = NL80211_CMD_SET_BSS,
10886                 .doit = nl80211_set_bss,
10887                 .policy = nl80211_policy,
10888                 .flags = GENL_ADMIN_PERM,
10889                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10890                                   NL80211_FLAG_NEED_RTNL,
10891         },
10892         {
10893                 .cmd = NL80211_CMD_GET_REG,
10894                 .doit = nl80211_get_reg_do,
10895                 .dumpit = nl80211_get_reg_dump,
10896                 .policy = nl80211_policy,
10897                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10898                 /* can be retrieved by unprivileged users */
10899         },
10900 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
10901         {
10902                 .cmd = NL80211_CMD_SET_REG,
10903                 .doit = nl80211_set_reg,
10904                 .policy = nl80211_policy,
10905                 .flags = GENL_ADMIN_PERM,
10906                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10907         },
10908 #endif
10909         {
10910                 .cmd = NL80211_CMD_REQ_SET_REG,
10911                 .doit = nl80211_req_set_reg,
10912                 .policy = nl80211_policy,
10913                 .flags = GENL_ADMIN_PERM,
10914         },
10915         {
10916                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10917                 .doit = nl80211_get_mesh_config,
10918                 .policy = nl80211_policy,
10919                 /* can be retrieved by unprivileged users */
10920                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10921                                   NL80211_FLAG_NEED_RTNL,
10922         },
10923         {
10924                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10925                 .doit = nl80211_update_mesh_config,
10926                 .policy = nl80211_policy,
10927                 .flags = GENL_ADMIN_PERM,
10928                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10929                                   NL80211_FLAG_NEED_RTNL,
10930         },
10931         {
10932                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10933                 .doit = nl80211_trigger_scan,
10934                 .policy = nl80211_policy,
10935                 .flags = GENL_ADMIN_PERM,
10936                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10937                                   NL80211_FLAG_NEED_RTNL,
10938         },
10939         {
10940                 .cmd = NL80211_CMD_GET_SCAN,
10941                 .policy = nl80211_policy,
10942                 .dumpit = nl80211_dump_scan,
10943         },
10944         {
10945                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10946                 .doit = nl80211_start_sched_scan,
10947                 .policy = nl80211_policy,
10948                 .flags = GENL_ADMIN_PERM,
10949                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10950                                   NL80211_FLAG_NEED_RTNL,
10951         },
10952         {
10953                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10954                 .doit = nl80211_stop_sched_scan,
10955                 .policy = nl80211_policy,
10956                 .flags = GENL_ADMIN_PERM,
10957                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10958                                   NL80211_FLAG_NEED_RTNL,
10959         },
10960         {
10961                 .cmd = NL80211_CMD_AUTHENTICATE,
10962                 .doit = nl80211_authenticate,
10963                 .policy = nl80211_policy,
10964                 .flags = GENL_ADMIN_PERM,
10965                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10966                                   NL80211_FLAG_NEED_RTNL |
10967                                   NL80211_FLAG_CLEAR_SKB,
10968         },
10969         {
10970                 .cmd = NL80211_CMD_ASSOCIATE,
10971                 .doit = nl80211_associate,
10972                 .policy = nl80211_policy,
10973                 .flags = GENL_ADMIN_PERM,
10974                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10975                                   NL80211_FLAG_NEED_RTNL,
10976         },
10977         {
10978                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10979                 .doit = nl80211_deauthenticate,
10980                 .policy = nl80211_policy,
10981                 .flags = GENL_ADMIN_PERM,
10982                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10983                                   NL80211_FLAG_NEED_RTNL,
10984         },
10985         {
10986                 .cmd = NL80211_CMD_DISASSOCIATE,
10987                 .doit = nl80211_disassociate,
10988                 .policy = nl80211_policy,
10989                 .flags = GENL_ADMIN_PERM,
10990                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10991                                   NL80211_FLAG_NEED_RTNL,
10992         },
10993         {
10994                 .cmd = NL80211_CMD_JOIN_IBSS,
10995                 .doit = nl80211_join_ibss,
10996                 .policy = nl80211_policy,
10997                 .flags = GENL_ADMIN_PERM,
10998                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10999                                   NL80211_FLAG_NEED_RTNL,
11000         },
11001         {
11002                 .cmd = NL80211_CMD_LEAVE_IBSS,
11003                 .doit = nl80211_leave_ibss,
11004                 .policy = nl80211_policy,
11005                 .flags = GENL_ADMIN_PERM,
11006                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11007                                   NL80211_FLAG_NEED_RTNL,
11008         },
11009 #ifdef CONFIG_NL80211_TESTMODE
11010         {
11011                 .cmd = NL80211_CMD_TESTMODE,
11012                 .doit = nl80211_testmode_do,
11013                 .dumpit = nl80211_testmode_dump,
11014                 .policy = nl80211_policy,
11015                 .flags = GENL_ADMIN_PERM,
11016                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11017                                   NL80211_FLAG_NEED_RTNL,
11018         },
11019 #endif
11020         {
11021                 .cmd = NL80211_CMD_CONNECT,
11022                 .doit = nl80211_connect,
11023                 .policy = nl80211_policy,
11024                 .flags = GENL_ADMIN_PERM,
11025                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11026                                   NL80211_FLAG_NEED_RTNL,
11027         },
11028         {
11029                 .cmd = NL80211_CMD_DISCONNECT,
11030                 .doit = nl80211_disconnect,
11031                 .policy = nl80211_policy,
11032                 .flags = GENL_ADMIN_PERM,
11033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11034                                   NL80211_FLAG_NEED_RTNL,
11035         },
11036         {
11037                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
11038                 .doit = nl80211_wiphy_netns,
11039                 .policy = nl80211_policy,
11040                 .flags = GENL_ADMIN_PERM,
11041                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11042                                   NL80211_FLAG_NEED_RTNL,
11043         },
11044         {
11045                 .cmd = NL80211_CMD_GET_SURVEY,
11046                 .policy = nl80211_policy,
11047                 .dumpit = nl80211_dump_survey,
11048         },
11049         {
11050                 .cmd = NL80211_CMD_SET_PMKSA,
11051                 .doit = nl80211_setdel_pmksa,
11052                 .policy = nl80211_policy,
11053                 .flags = GENL_ADMIN_PERM,
11054                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11055                                   NL80211_FLAG_NEED_RTNL,
11056         },
11057         {
11058                 .cmd = NL80211_CMD_DEL_PMKSA,
11059                 .doit = nl80211_setdel_pmksa,
11060                 .policy = nl80211_policy,
11061                 .flags = GENL_ADMIN_PERM,
11062                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11063                                   NL80211_FLAG_NEED_RTNL,
11064         },
11065         {
11066                 .cmd = NL80211_CMD_FLUSH_PMKSA,
11067                 .doit = nl80211_flush_pmksa,
11068                 .policy = nl80211_policy,
11069                 .flags = GENL_ADMIN_PERM,
11070                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11071                                   NL80211_FLAG_NEED_RTNL,
11072         },
11073         {
11074                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11075                 .doit = nl80211_remain_on_channel,
11076                 .policy = nl80211_policy,
11077                 .flags = GENL_ADMIN_PERM,
11078                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11079                                   NL80211_FLAG_NEED_RTNL,
11080         },
11081         {
11082                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11083                 .doit = nl80211_cancel_remain_on_channel,
11084                 .policy = nl80211_policy,
11085                 .flags = GENL_ADMIN_PERM,
11086                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11087                                   NL80211_FLAG_NEED_RTNL,
11088         },
11089         {
11090                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11091                 .doit = nl80211_set_tx_bitrate_mask,
11092                 .policy = nl80211_policy,
11093                 .flags = GENL_ADMIN_PERM,
11094                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11095                                   NL80211_FLAG_NEED_RTNL,
11096         },
11097         {
11098                 .cmd = NL80211_CMD_REGISTER_FRAME,
11099                 .doit = nl80211_register_mgmt,
11100                 .policy = nl80211_policy,
11101                 .flags = GENL_ADMIN_PERM,
11102                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11103                                   NL80211_FLAG_NEED_RTNL,
11104         },
11105         {
11106                 .cmd = NL80211_CMD_FRAME,
11107                 .doit = nl80211_tx_mgmt,
11108                 .policy = nl80211_policy,
11109                 .flags = GENL_ADMIN_PERM,
11110                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11111                                   NL80211_FLAG_NEED_RTNL,
11112         },
11113         {
11114                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11115                 .doit = nl80211_tx_mgmt_cancel_wait,
11116                 .policy = nl80211_policy,
11117                 .flags = GENL_ADMIN_PERM,
11118                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11119                                   NL80211_FLAG_NEED_RTNL,
11120         },
11121         {
11122                 .cmd = NL80211_CMD_SET_POWER_SAVE,
11123                 .doit = nl80211_set_power_save,
11124                 .policy = nl80211_policy,
11125                 .flags = GENL_ADMIN_PERM,
11126                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11127                                   NL80211_FLAG_NEED_RTNL,
11128         },
11129         {
11130                 .cmd = NL80211_CMD_GET_POWER_SAVE,
11131                 .doit = nl80211_get_power_save,
11132                 .policy = nl80211_policy,
11133                 /* can be retrieved by unprivileged users */
11134                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11135                                   NL80211_FLAG_NEED_RTNL,
11136         },
11137         {
11138                 .cmd = NL80211_CMD_SET_CQM,
11139                 .doit = nl80211_set_cqm,
11140                 .policy = nl80211_policy,
11141                 .flags = GENL_ADMIN_PERM,
11142                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11143                                   NL80211_FLAG_NEED_RTNL,
11144         },
11145         {
11146                 .cmd = NL80211_CMD_SET_CHANNEL,
11147                 .doit = nl80211_set_channel,
11148                 .policy = nl80211_policy,
11149                 .flags = GENL_ADMIN_PERM,
11150                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11151                                   NL80211_FLAG_NEED_RTNL,
11152         },
11153         {
11154                 .cmd = NL80211_CMD_SET_WDS_PEER,
11155                 .doit = nl80211_set_wds_peer,
11156                 .policy = nl80211_policy,
11157                 .flags = GENL_ADMIN_PERM,
11158                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11159                                   NL80211_FLAG_NEED_RTNL,
11160         },
11161         {
11162                 .cmd = NL80211_CMD_JOIN_MESH,
11163                 .doit = nl80211_join_mesh,
11164                 .policy = nl80211_policy,
11165                 .flags = GENL_ADMIN_PERM,
11166                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11167                                   NL80211_FLAG_NEED_RTNL,
11168         },
11169         {
11170                 .cmd = NL80211_CMD_LEAVE_MESH,
11171                 .doit = nl80211_leave_mesh,
11172                 .policy = nl80211_policy,
11173                 .flags = GENL_ADMIN_PERM,
11174                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11175                                   NL80211_FLAG_NEED_RTNL,
11176         },
11177         {
11178                 .cmd = NL80211_CMD_JOIN_OCB,
11179                 .doit = nl80211_join_ocb,
11180                 .policy = nl80211_policy,
11181                 .flags = GENL_ADMIN_PERM,
11182                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11183                                   NL80211_FLAG_NEED_RTNL,
11184         },
11185         {
11186                 .cmd = NL80211_CMD_LEAVE_OCB,
11187                 .doit = nl80211_leave_ocb,
11188                 .policy = nl80211_policy,
11189                 .flags = GENL_ADMIN_PERM,
11190                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11191                                   NL80211_FLAG_NEED_RTNL,
11192         },
11193 #ifdef CONFIG_PM
11194         {
11195                 .cmd = NL80211_CMD_GET_WOWLAN,
11196                 .doit = nl80211_get_wowlan,
11197                 .policy = nl80211_policy,
11198                 /* can be retrieved by unprivileged users */
11199                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11200                                   NL80211_FLAG_NEED_RTNL,
11201         },
11202         {
11203                 .cmd = NL80211_CMD_SET_WOWLAN,
11204                 .doit = nl80211_set_wowlan,
11205                 .policy = nl80211_policy,
11206                 .flags = GENL_ADMIN_PERM,
11207                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11208                                   NL80211_FLAG_NEED_RTNL,
11209         },
11210 #endif
11211         {
11212                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11213                 .doit = nl80211_set_rekey_data,
11214                 .policy = nl80211_policy,
11215                 .flags = GENL_ADMIN_PERM,
11216                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11217                                   NL80211_FLAG_NEED_RTNL |
11218                                   NL80211_FLAG_CLEAR_SKB,
11219         },
11220         {
11221                 .cmd = NL80211_CMD_TDLS_MGMT,
11222                 .doit = nl80211_tdls_mgmt,
11223                 .policy = nl80211_policy,
11224                 .flags = GENL_ADMIN_PERM,
11225                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11226                                   NL80211_FLAG_NEED_RTNL,
11227         },
11228         {
11229                 .cmd = NL80211_CMD_TDLS_OPER,
11230                 .doit = nl80211_tdls_oper,
11231                 .policy = nl80211_policy,
11232                 .flags = GENL_ADMIN_PERM,
11233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11234                                   NL80211_FLAG_NEED_RTNL,
11235         },
11236         {
11237                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11238                 .doit = nl80211_register_unexpected_frame,
11239                 .policy = nl80211_policy,
11240                 .flags = GENL_ADMIN_PERM,
11241                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11242                                   NL80211_FLAG_NEED_RTNL,
11243         },
11244         {
11245                 .cmd = NL80211_CMD_PROBE_CLIENT,
11246                 .doit = nl80211_probe_client,
11247                 .policy = nl80211_policy,
11248                 .flags = GENL_ADMIN_PERM,
11249                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11250                                   NL80211_FLAG_NEED_RTNL,
11251         },
11252         {
11253                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11254                 .doit = nl80211_register_beacons,
11255                 .policy = nl80211_policy,
11256                 .flags = GENL_ADMIN_PERM,
11257                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11258                                   NL80211_FLAG_NEED_RTNL,
11259         },
11260         {
11261                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11262                 .doit = nl80211_set_noack_map,
11263                 .policy = nl80211_policy,
11264                 .flags = GENL_ADMIN_PERM,
11265                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11266                                   NL80211_FLAG_NEED_RTNL,
11267         },
11268         {
11269                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11270                 .doit = nl80211_start_p2p_device,
11271                 .policy = nl80211_policy,
11272                 .flags = GENL_ADMIN_PERM,
11273                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11274                                   NL80211_FLAG_NEED_RTNL,
11275         },
11276         {
11277                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11278                 .doit = nl80211_stop_p2p_device,
11279                 .policy = nl80211_policy,
11280                 .flags = GENL_ADMIN_PERM,
11281                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11282                                   NL80211_FLAG_NEED_RTNL,
11283         },
11284         {
11285                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11286                 .doit = nl80211_set_mcast_rate,
11287                 .policy = nl80211_policy,
11288                 .flags = GENL_ADMIN_PERM,
11289                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11290                                   NL80211_FLAG_NEED_RTNL,
11291         },
11292         {
11293                 .cmd = NL80211_CMD_SET_MAC_ACL,
11294                 .doit = nl80211_set_mac_acl,
11295                 .policy = nl80211_policy,
11296                 .flags = GENL_ADMIN_PERM,
11297                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11298                                   NL80211_FLAG_NEED_RTNL,
11299         },
11300         {
11301                 .cmd = NL80211_CMD_RADAR_DETECT,
11302                 .doit = nl80211_start_radar_detection,
11303                 .policy = nl80211_policy,
11304                 .flags = GENL_ADMIN_PERM,
11305                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11306                                   NL80211_FLAG_NEED_RTNL,
11307         },
11308         {
11309                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11310                 .doit = nl80211_get_protocol_features,
11311                 .policy = nl80211_policy,
11312         },
11313         {
11314                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11315                 .doit = nl80211_update_ft_ies,
11316                 .policy = nl80211_policy,
11317                 .flags = GENL_ADMIN_PERM,
11318                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11319                                   NL80211_FLAG_NEED_RTNL,
11320         },
11321         {
11322                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11323                 .doit = nl80211_crit_protocol_start,
11324                 .policy = nl80211_policy,
11325                 .flags = GENL_ADMIN_PERM,
11326                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11327                                   NL80211_FLAG_NEED_RTNL,
11328         },
11329         {
11330                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11331                 .doit = nl80211_crit_protocol_stop,
11332                 .policy = nl80211_policy,
11333                 .flags = GENL_ADMIN_PERM,
11334                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11335                                   NL80211_FLAG_NEED_RTNL,
11336         },
11337         {
11338                 .cmd = NL80211_CMD_GET_COALESCE,
11339                 .doit = nl80211_get_coalesce,
11340                 .policy = nl80211_policy,
11341                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11342                                   NL80211_FLAG_NEED_RTNL,
11343         },
11344         {
11345                 .cmd = NL80211_CMD_SET_COALESCE,
11346                 .doit = nl80211_set_coalesce,
11347                 .policy = nl80211_policy,
11348                 .flags = GENL_ADMIN_PERM,
11349                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11350                                   NL80211_FLAG_NEED_RTNL,
11351         },
11352         {
11353                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11354                 .doit = nl80211_channel_switch,
11355                 .policy = nl80211_policy,
11356                 .flags = GENL_ADMIN_PERM,
11357                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11358                                   NL80211_FLAG_NEED_RTNL,
11359         },
11360         {
11361                 .cmd = NL80211_CMD_VENDOR,
11362                 .doit = nl80211_vendor_cmd,
11363                 .dumpit = nl80211_vendor_cmd_dump,
11364                 .policy = nl80211_policy,
11365                 .flags = GENL_ADMIN_PERM,
11366                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11367                                   NL80211_FLAG_NEED_RTNL,
11368         },
11369         {
11370                 .cmd = NL80211_CMD_SET_QOS_MAP,
11371                 .doit = nl80211_set_qos_map,
11372                 .policy = nl80211_policy,
11373                 .flags = GENL_ADMIN_PERM,
11374                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11375                                   NL80211_FLAG_NEED_RTNL,
11376         },
11377         {
11378                 .cmd = NL80211_CMD_ADD_TX_TS,
11379                 .doit = nl80211_add_tx_ts,
11380                 .policy = nl80211_policy,
11381                 .flags = GENL_ADMIN_PERM,
11382                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11383                                   NL80211_FLAG_NEED_RTNL,
11384         },
11385         {
11386                 .cmd = NL80211_CMD_DEL_TX_TS,
11387                 .doit = nl80211_del_tx_ts,
11388                 .policy = nl80211_policy,
11389                 .flags = GENL_ADMIN_PERM,
11390                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11391                                   NL80211_FLAG_NEED_RTNL,
11392         },
11393         {
11394                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11395                 .doit = nl80211_tdls_channel_switch,
11396                 .policy = nl80211_policy,
11397                 .flags = GENL_ADMIN_PERM,
11398                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11399                                   NL80211_FLAG_NEED_RTNL,
11400         },
11401         {
11402                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11403                 .doit = nl80211_tdls_cancel_channel_switch,
11404                 .policy = nl80211_policy,
11405                 .flags = GENL_ADMIN_PERM,
11406                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11407                                   NL80211_FLAG_NEED_RTNL,
11408         },
11409 };
11410
11411 /* notification functions */
11412
11413 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11414                           enum nl80211_commands cmd)
11415 {
11416         struct sk_buff *msg;
11417         struct nl80211_dump_wiphy_state state = {};
11418
11419         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11420                 cmd != NL80211_CMD_DEL_WIPHY);
11421
11422         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11423         if (!msg)
11424                 return;
11425
11426         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11427                 nlmsg_free(msg);
11428                 return;
11429         }
11430
11431         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11432                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11433 }
11434
11435 static int nl80211_add_scan_req(struct sk_buff *msg,
11436                                 struct cfg80211_registered_device *rdev)
11437 {
11438         struct cfg80211_scan_request *req = rdev->scan_req;
11439         struct nlattr *nest;
11440         int i;
11441
11442         if (WARN_ON(!req))
11443                 return 0;
11444
11445         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11446         if (!nest)
11447                 goto nla_put_failure;
11448         for (i = 0; i < req->n_ssids; i++) {
11449                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11450                         goto nla_put_failure;
11451         }
11452         nla_nest_end(msg, nest);
11453
11454         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11455         if (!nest)
11456                 goto nla_put_failure;
11457         for (i = 0; i < req->n_channels; i++) {
11458                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11459                         goto nla_put_failure;
11460         }
11461         nla_nest_end(msg, nest);
11462
11463         if (req->ie &&
11464             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11465                 goto nla_put_failure;
11466
11467         if (req->flags &&
11468             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11469                 goto nla_put_failure;
11470
11471         return 0;
11472  nla_put_failure:
11473         return -ENOBUFS;
11474 }
11475
11476 static int nl80211_send_scan_msg(struct sk_buff *msg,
11477                                  struct cfg80211_registered_device *rdev,
11478                                  struct wireless_dev *wdev,
11479                                  u32 portid, u32 seq, int flags,
11480                                  u32 cmd)
11481 {
11482         void *hdr;
11483
11484         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11485         if (!hdr)
11486                 return -1;
11487
11488         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11489             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11490                                          wdev->netdev->ifindex)) ||
11491             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11492                 goto nla_put_failure;
11493
11494         /* ignore errors and send incomplete event anyway */
11495         nl80211_add_scan_req(msg, rdev);
11496
11497         genlmsg_end(msg, hdr);
11498         return 0;
11499
11500  nla_put_failure:
11501         genlmsg_cancel(msg, hdr);
11502         return -EMSGSIZE;
11503 }
11504
11505 static int
11506 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11507                             struct cfg80211_registered_device *rdev,
11508                             struct net_device *netdev,
11509                             u32 portid, u32 seq, int flags, u32 cmd)
11510 {
11511         void *hdr;
11512
11513         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11514         if (!hdr)
11515                 return -1;
11516
11517         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11518             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11519                 goto nla_put_failure;
11520
11521         genlmsg_end(msg, hdr);
11522         return 0;
11523
11524  nla_put_failure:
11525         genlmsg_cancel(msg, hdr);
11526         return -EMSGSIZE;
11527 }
11528
11529 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11530                              struct wireless_dev *wdev)
11531 {
11532         struct sk_buff *msg;
11533
11534         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11535         if (!msg)
11536                 return;
11537
11538         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11539                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11540                 nlmsg_free(msg);
11541                 return;
11542         }
11543
11544         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11545                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11546 }
11547
11548 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11549                                        struct wireless_dev *wdev, bool aborted)
11550 {
11551         struct sk_buff *msg;
11552
11553         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11554         if (!msg)
11555                 return NULL;
11556
11557         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11558                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11559                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11560                 nlmsg_free(msg);
11561                 return NULL;
11562         }
11563
11564         return msg;
11565 }
11566
11567 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11568                               struct sk_buff *msg)
11569 {
11570         if (!msg)
11571                 return;
11572
11573         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11574                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11575 }
11576
11577 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11578                                      struct net_device *netdev)
11579 {
11580         struct sk_buff *msg;
11581
11582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11583         if (!msg)
11584                 return;
11585
11586         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11587                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11588                 nlmsg_free(msg);
11589                 return;
11590         }
11591
11592         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11593                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11594 }
11595
11596 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11597                              struct net_device *netdev, u32 cmd)
11598 {
11599         struct sk_buff *msg;
11600
11601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11602         if (!msg)
11603                 return;
11604
11605         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11606                 nlmsg_free(msg);
11607                 return;
11608         }
11609
11610         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11611                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11612 }
11613
11614 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11615                                           struct regulatory_request *request)
11616 {
11617         /* Userspace can always count this one always being set */
11618         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11619                 goto nla_put_failure;
11620
11621         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11622                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11623                                NL80211_REGDOM_TYPE_WORLD))
11624                         goto nla_put_failure;
11625         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11626                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11627                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11628                         goto nla_put_failure;
11629         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11630                    request->intersect) {
11631                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11632                                NL80211_REGDOM_TYPE_INTERSECTION))
11633                         goto nla_put_failure;
11634         } else {
11635                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11636                                NL80211_REGDOM_TYPE_COUNTRY) ||
11637                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11638                                    request->alpha2))
11639                         goto nla_put_failure;
11640         }
11641
11642         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11643                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11644
11645                 if (wiphy &&
11646                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11647                         goto nla_put_failure;
11648
11649                 if (wiphy &&
11650                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11651                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11652                         goto nla_put_failure;
11653         }
11654
11655         return true;
11656
11657 nla_put_failure:
11658         return false;
11659 }
11660
11661 /*
11662  * This can happen on global regulatory changes or device specific settings
11663  * based on custom regulatory domains.
11664  */
11665 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11666                                      struct regulatory_request *request)
11667 {
11668         struct sk_buff *msg;
11669         void *hdr;
11670
11671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11672         if (!msg)
11673                 return;
11674
11675         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11676         if (!hdr) {
11677                 nlmsg_free(msg);
11678                 return;
11679         }
11680
11681         if (nl80211_reg_change_event_fill(msg, request) == false)
11682                 goto nla_put_failure;
11683
11684         genlmsg_end(msg, hdr);
11685
11686         rcu_read_lock();
11687         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11688                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11689         rcu_read_unlock();
11690
11691         return;
11692
11693 nla_put_failure:
11694         genlmsg_cancel(msg, hdr);
11695         nlmsg_free(msg);
11696 }
11697
11698 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11699                                     struct net_device *netdev,
11700                                     const u8 *buf, size_t len,
11701                                     enum nl80211_commands cmd, gfp_t gfp,
11702                                     int uapsd_queues)
11703 {
11704         struct sk_buff *msg;
11705         void *hdr;
11706
11707         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11708         if (!msg)
11709                 return;
11710
11711         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11712         if (!hdr) {
11713                 nlmsg_free(msg);
11714                 return;
11715         }
11716
11717         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11718             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11719             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11720                 goto nla_put_failure;
11721
11722         if (uapsd_queues >= 0) {
11723                 struct nlattr *nla_wmm =
11724                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11725                 if (!nla_wmm)
11726                         goto nla_put_failure;
11727
11728                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11729                                uapsd_queues))
11730                         goto nla_put_failure;
11731
11732                 nla_nest_end(msg, nla_wmm);
11733         }
11734
11735         genlmsg_end(msg, hdr);
11736
11737         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11738                                 NL80211_MCGRP_MLME, gfp);
11739         return;
11740
11741  nla_put_failure:
11742         genlmsg_cancel(msg, hdr);
11743         nlmsg_free(msg);
11744 }
11745
11746 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11747                           struct net_device *netdev, const u8 *buf,
11748                           size_t len, gfp_t gfp)
11749 {
11750         nl80211_send_mlme_event(rdev, netdev, buf, len,
11751                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11752 }
11753
11754 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11755                            struct net_device *netdev, const u8 *buf,
11756                            size_t len, gfp_t gfp, int uapsd_queues)
11757 {
11758         nl80211_send_mlme_event(rdev, netdev, buf, len,
11759                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11760 }
11761
11762 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11763                          struct net_device *netdev, const u8 *buf,
11764                          size_t len, gfp_t gfp)
11765 {
11766         nl80211_send_mlme_event(rdev, netdev, buf, len,
11767                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11768 }
11769
11770 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11771                            struct net_device *netdev, const u8 *buf,
11772                            size_t len, gfp_t gfp)
11773 {
11774         nl80211_send_mlme_event(rdev, netdev, buf, len,
11775                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11776 }
11777
11778 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11779                                   size_t len)
11780 {
11781         struct wireless_dev *wdev = dev->ieee80211_ptr;
11782         struct wiphy *wiphy = wdev->wiphy;
11783         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11784         const struct ieee80211_mgmt *mgmt = (void *)buf;
11785         u32 cmd;
11786
11787         if (WARN_ON(len < 2))
11788                 return;
11789
11790         if (ieee80211_is_deauth(mgmt->frame_control))
11791                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11792         else
11793                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11794
11795         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11796         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11797 }
11798 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11799
11800 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11801                                       struct net_device *netdev, int cmd,
11802                                       const u8 *addr, gfp_t gfp)
11803 {
11804         struct sk_buff *msg;
11805         void *hdr;
11806
11807         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11808         if (!msg)
11809                 return;
11810
11811         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11812         if (!hdr) {
11813                 nlmsg_free(msg);
11814                 return;
11815         }
11816
11817         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11818             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11819             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11820             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11821                 goto nla_put_failure;
11822
11823         genlmsg_end(msg, hdr);
11824
11825         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11826                                 NL80211_MCGRP_MLME, gfp);
11827         return;
11828
11829  nla_put_failure:
11830         genlmsg_cancel(msg, hdr);
11831         nlmsg_free(msg);
11832 }
11833
11834 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11835                                struct net_device *netdev, const u8 *addr,
11836                                gfp_t gfp)
11837 {
11838         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11839                                   addr, gfp);
11840 }
11841
11842 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11843                                 struct net_device *netdev, const u8 *addr,
11844                                 gfp_t gfp)
11845 {
11846         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11847                                   addr, gfp);
11848 }
11849
11850 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11851                                  struct net_device *netdev, const u8 *bssid,
11852                                  const u8 *req_ie, size_t req_ie_len,
11853                                  const u8 *resp_ie, size_t resp_ie_len,
11854                                  u16 status, gfp_t gfp)
11855 {
11856         struct sk_buff *msg;
11857         void *hdr;
11858
11859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11860         if (!msg)
11861                 return;
11862
11863         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11864         if (!hdr) {
11865                 nlmsg_free(msg);
11866                 return;
11867         }
11868
11869         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11870             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11871             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11872             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11873             (req_ie &&
11874              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11875             (resp_ie &&
11876              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11877                 goto nla_put_failure;
11878
11879         genlmsg_end(msg, hdr);
11880
11881         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11882                                 NL80211_MCGRP_MLME, gfp);
11883         return;
11884
11885  nla_put_failure:
11886         genlmsg_cancel(msg, hdr);
11887         nlmsg_free(msg);
11888
11889 }
11890
11891 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11892                          struct net_device *netdev, const u8 *bssid,
11893                          const u8 *req_ie, size_t req_ie_len,
11894                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11895 {
11896         struct sk_buff *msg;
11897         void *hdr;
11898
11899         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11900         if (!msg)
11901                 return;
11902
11903         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11904         if (!hdr) {
11905                 nlmsg_free(msg);
11906                 return;
11907         }
11908
11909         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11910             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11911             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11912             (req_ie &&
11913              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11914             (resp_ie &&
11915              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11916                 goto nla_put_failure;
11917
11918         genlmsg_end(msg, hdr);
11919
11920         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11921                                 NL80211_MCGRP_MLME, gfp);
11922         return;
11923
11924  nla_put_failure:
11925         genlmsg_cancel(msg, hdr);
11926         nlmsg_free(msg);
11927
11928 }
11929
11930 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11931                                struct net_device *netdev, u16 reason,
11932                                const u8 *ie, size_t ie_len, bool from_ap)
11933 {
11934         struct sk_buff *msg;
11935         void *hdr;
11936
11937         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11938         if (!msg)
11939                 return;
11940
11941         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11942         if (!hdr) {
11943                 nlmsg_free(msg);
11944                 return;
11945         }
11946
11947         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11948             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11949             (from_ap && reason &&
11950              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
11951             (from_ap &&
11952              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
11953             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
11954                 goto nla_put_failure;
11955
11956         genlmsg_end(msg, hdr);
11957
11958         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11959                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11960         return;
11961
11962  nla_put_failure:
11963         genlmsg_cancel(msg, hdr);
11964         nlmsg_free(msg);
11965
11966 }
11967
11968 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
11969                              struct net_device *netdev, const u8 *bssid,
11970                              gfp_t gfp)
11971 {
11972         struct sk_buff *msg;
11973         void *hdr;
11974
11975         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11976         if (!msg)
11977                 return;
11978
11979         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11980         if (!hdr) {
11981                 nlmsg_free(msg);
11982                 return;
11983         }
11984
11985         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11986             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11987             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11988                 goto nla_put_failure;
11989
11990         genlmsg_end(msg, hdr);
11991
11992         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11993                                 NL80211_MCGRP_MLME, gfp);
11994         return;
11995
11996  nla_put_failure:
11997         genlmsg_cancel(msg, hdr);
11998         nlmsg_free(msg);
11999 }
12000
12001 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12002                                         const u8* ie, u8 ie_len, gfp_t gfp)
12003 {
12004         struct wireless_dev *wdev = dev->ieee80211_ptr;
12005         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12006         struct sk_buff *msg;
12007         void *hdr;
12008
12009         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12010                 return;
12011
12012         trace_cfg80211_notify_new_peer_candidate(dev, addr);
12013
12014         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12015         if (!msg)
12016                 return;
12017
12018         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12019         if (!hdr) {
12020                 nlmsg_free(msg);
12021                 return;
12022         }
12023
12024         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12025             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12026             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12027             (ie_len && ie &&
12028              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12029                 goto nla_put_failure;
12030
12031         genlmsg_end(msg, hdr);
12032
12033         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12034                                 NL80211_MCGRP_MLME, gfp);
12035         return;
12036
12037  nla_put_failure:
12038         genlmsg_cancel(msg, hdr);
12039         nlmsg_free(msg);
12040 }
12041 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12042
12043 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12044                                  struct net_device *netdev, const u8 *addr,
12045                                  enum nl80211_key_type key_type, int key_id,
12046                                  const u8 *tsc, gfp_t gfp)
12047 {
12048         struct sk_buff *msg;
12049         void *hdr;
12050
12051         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12052         if (!msg)
12053                 return;
12054
12055         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12056         if (!hdr) {
12057                 nlmsg_free(msg);
12058                 return;
12059         }
12060
12061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12062             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12063             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12064             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12065             (key_id != -1 &&
12066              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12067             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12068                 goto nla_put_failure;
12069
12070         genlmsg_end(msg, hdr);
12071
12072         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12073                                 NL80211_MCGRP_MLME, gfp);
12074         return;
12075
12076  nla_put_failure:
12077         genlmsg_cancel(msg, hdr);
12078         nlmsg_free(msg);
12079 }
12080
12081 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12082                                     struct ieee80211_channel *channel_before,
12083                                     struct ieee80211_channel *channel_after)
12084 {
12085         struct sk_buff *msg;
12086         void *hdr;
12087         struct nlattr *nl_freq;
12088
12089         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12090         if (!msg)
12091                 return;
12092
12093         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12094         if (!hdr) {
12095                 nlmsg_free(msg);
12096                 return;
12097         }
12098
12099         /*
12100          * Since we are applying the beacon hint to a wiphy we know its
12101          * wiphy_idx is valid
12102          */
12103         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12104                 goto nla_put_failure;
12105
12106         /* Before */
12107         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12108         if (!nl_freq)
12109                 goto nla_put_failure;
12110         if (nl80211_msg_put_channel(msg, channel_before, false))
12111                 goto nla_put_failure;
12112         nla_nest_end(msg, nl_freq);
12113
12114         /* After */
12115         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12116         if (!nl_freq)
12117                 goto nla_put_failure;
12118         if (nl80211_msg_put_channel(msg, channel_after, false))
12119                 goto nla_put_failure;
12120         nla_nest_end(msg, nl_freq);
12121
12122         genlmsg_end(msg, hdr);
12123
12124         rcu_read_lock();
12125         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12126                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12127         rcu_read_unlock();
12128
12129         return;
12130
12131 nla_put_failure:
12132         genlmsg_cancel(msg, hdr);
12133         nlmsg_free(msg);
12134 }
12135
12136 static void nl80211_send_remain_on_chan_event(
12137         int cmd, struct cfg80211_registered_device *rdev,
12138         struct wireless_dev *wdev, u64 cookie,
12139         struct ieee80211_channel *chan,
12140         unsigned int duration, gfp_t gfp)
12141 {
12142         struct sk_buff *msg;
12143         void *hdr;
12144
12145         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12146         if (!msg)
12147                 return;
12148
12149         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12150         if (!hdr) {
12151                 nlmsg_free(msg);
12152                 return;
12153         }
12154
12155         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12156             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12157                                          wdev->netdev->ifindex)) ||
12158             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12159             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12160             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12161                         NL80211_CHAN_NO_HT) ||
12162             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
12163                 goto nla_put_failure;
12164
12165         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12166             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12167                 goto nla_put_failure;
12168
12169         genlmsg_end(msg, hdr);
12170
12171         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12172                                 NL80211_MCGRP_MLME, gfp);
12173         return;
12174
12175  nla_put_failure:
12176         genlmsg_cancel(msg, hdr);
12177         nlmsg_free(msg);
12178 }
12179
12180 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12181                                struct ieee80211_channel *chan,
12182                                unsigned int duration, gfp_t gfp)
12183 {
12184         struct wiphy *wiphy = wdev->wiphy;
12185         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12186
12187         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12188         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12189                                           rdev, wdev, cookie, chan,
12190                                           duration, gfp);
12191 }
12192 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12193
12194 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12195                                         struct ieee80211_channel *chan,
12196                                         gfp_t gfp)
12197 {
12198         struct wiphy *wiphy = wdev->wiphy;
12199         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12200
12201         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12202         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12203                                           rdev, wdev, cookie, chan, 0, gfp);
12204 }
12205 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12206
12207 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12208                       struct station_info *sinfo, gfp_t gfp)
12209 {
12210         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12211         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12212         struct sk_buff *msg;
12213
12214         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12215
12216         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12217         if (!msg)
12218                 return;
12219
12220         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12221                                  rdev, dev, mac_addr, sinfo) < 0) {
12222                 nlmsg_free(msg);
12223                 return;
12224         }
12225
12226         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12227                                 NL80211_MCGRP_MLME, gfp);
12228 }
12229 EXPORT_SYMBOL(cfg80211_new_sta);
12230
12231 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12232                             struct station_info *sinfo, gfp_t gfp)
12233 {
12234         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12235         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12236         struct sk_buff *msg;
12237         struct station_info empty_sinfo = {};
12238
12239         if (!sinfo)
12240                 sinfo = &empty_sinfo;
12241
12242         trace_cfg80211_del_sta(dev, mac_addr);
12243
12244         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12245         if (!msg)
12246                 return;
12247
12248         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12249                                  rdev, dev, mac_addr, sinfo) < 0) {
12250                 nlmsg_free(msg);
12251                 return;
12252         }
12253
12254         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12255                                 NL80211_MCGRP_MLME, gfp);
12256 }
12257 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12258
12259 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12260                           enum nl80211_connect_failed_reason reason,
12261                           gfp_t gfp)
12262 {
12263         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12264         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12265         struct sk_buff *msg;
12266         void *hdr;
12267
12268         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12269         if (!msg)
12270                 return;
12271
12272         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12273         if (!hdr) {
12274                 nlmsg_free(msg);
12275                 return;
12276         }
12277
12278         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12279             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12280             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12281                 goto nla_put_failure;
12282
12283         genlmsg_end(msg, hdr);
12284
12285         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12286                                 NL80211_MCGRP_MLME, gfp);
12287         return;
12288
12289  nla_put_failure:
12290         genlmsg_cancel(msg, hdr);
12291         nlmsg_free(msg);
12292 }
12293 EXPORT_SYMBOL(cfg80211_conn_failed);
12294
12295 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12296                                        const u8 *addr, gfp_t gfp)
12297 {
12298         struct wireless_dev *wdev = dev->ieee80211_ptr;
12299         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12300         struct sk_buff *msg;
12301         void *hdr;
12302         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12303
12304         if (!nlportid)
12305                 return false;
12306
12307         msg = nlmsg_new(100, gfp);
12308         if (!msg)
12309                 return true;
12310
12311         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12312         if (!hdr) {
12313                 nlmsg_free(msg);
12314                 return true;
12315         }
12316
12317         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12318             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12319             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12320                 goto nla_put_failure;
12321
12322         genlmsg_end(msg, hdr);
12323         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12324         return true;
12325
12326  nla_put_failure:
12327         genlmsg_cancel(msg, hdr);
12328         nlmsg_free(msg);
12329         return true;
12330 }
12331
12332 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12333                                 const u8 *addr, gfp_t gfp)
12334 {
12335         struct wireless_dev *wdev = dev->ieee80211_ptr;
12336         bool ret;
12337
12338         trace_cfg80211_rx_spurious_frame(dev, addr);
12339
12340         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12341                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12342                 trace_cfg80211_return_bool(false);
12343                 return false;
12344         }
12345         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12346                                          addr, gfp);
12347         trace_cfg80211_return_bool(ret);
12348         return ret;
12349 }
12350 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12351
12352 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12353                                         const u8 *addr, gfp_t gfp)
12354 {
12355         struct wireless_dev *wdev = dev->ieee80211_ptr;
12356         bool ret;
12357
12358         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12359
12360         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12361                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12362                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12363                 trace_cfg80211_return_bool(false);
12364                 return false;
12365         }
12366         ret = __nl80211_unexpected_frame(dev,
12367                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12368                                          addr, gfp);
12369         trace_cfg80211_return_bool(ret);
12370         return ret;
12371 }
12372 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12373
12374 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12375                       struct wireless_dev *wdev, u32 nlportid,
12376                       int freq, int sig_dbm,
12377                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12378 {
12379         struct net_device *netdev = wdev->netdev;
12380         struct sk_buff *msg;
12381         void *hdr;
12382
12383         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12384         if (!msg)
12385                 return -ENOMEM;
12386
12387         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12388         if (!hdr) {
12389                 nlmsg_free(msg);
12390                 return -ENOMEM;
12391         }
12392
12393         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12394             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12395                                         netdev->ifindex)) ||
12396             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12397             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12398             (sig_dbm &&
12399              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12400             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12401             (flags &&
12402              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12403                 goto nla_put_failure;
12404
12405         genlmsg_end(msg, hdr);
12406
12407         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12408
12409  nla_put_failure:
12410         genlmsg_cancel(msg, hdr);
12411         nlmsg_free(msg);
12412         return -ENOBUFS;
12413 }
12414
12415 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12416                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12417 {
12418         struct wiphy *wiphy = wdev->wiphy;
12419         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12420         struct net_device *netdev = wdev->netdev;
12421         struct sk_buff *msg;
12422         void *hdr;
12423
12424         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12425
12426         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12427         if (!msg)
12428                 return;
12429
12430         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12431         if (!hdr) {
12432                 nlmsg_free(msg);
12433                 return;
12434         }
12435
12436         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12437             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12438                                    netdev->ifindex)) ||
12439             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12440             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12441             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12442             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12443                 goto nla_put_failure;
12444
12445         genlmsg_end(msg, hdr);
12446
12447         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12448                                 NL80211_MCGRP_MLME, gfp);
12449         return;
12450
12451  nla_put_failure:
12452         genlmsg_cancel(msg, hdr);
12453         nlmsg_free(msg);
12454 }
12455 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12456
12457 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12458                                             const char *mac, gfp_t gfp)
12459 {
12460         struct wireless_dev *wdev = dev->ieee80211_ptr;
12461         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12462         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12463         void **cb;
12464
12465         if (!msg)
12466                 return NULL;
12467
12468         cb = (void **)msg->cb;
12469
12470         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12471         if (!cb[0]) {
12472                 nlmsg_free(msg);
12473                 return NULL;
12474         }
12475
12476         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12477             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12478                 goto nla_put_failure;
12479
12480         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12481                 goto nla_put_failure;
12482
12483         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12484         if (!cb[1])
12485                 goto nla_put_failure;
12486
12487         cb[2] = rdev;
12488
12489         return msg;
12490  nla_put_failure:
12491         nlmsg_free(msg);
12492         return NULL;
12493 }
12494
12495 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12496 {
12497         void **cb = (void **)msg->cb;
12498         struct cfg80211_registered_device *rdev = cb[2];
12499
12500         nla_nest_end(msg, cb[1]);
12501         genlmsg_end(msg, cb[0]);
12502
12503         memset(msg->cb, 0, sizeof(msg->cb));
12504
12505         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12506                                 NL80211_MCGRP_MLME, gfp);
12507 }
12508
12509 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12510                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12511                               gfp_t gfp)
12512 {
12513         struct sk_buff *msg;
12514
12515         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12516
12517         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12518                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12519                 return;
12520
12521         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12522         if (!msg)
12523                 return;
12524
12525         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12526                         rssi_event))
12527                 goto nla_put_failure;
12528
12529         cfg80211_send_cqm(msg, gfp);
12530
12531         return;
12532
12533  nla_put_failure:
12534         nlmsg_free(msg);
12535 }
12536 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12537
12538 void cfg80211_cqm_txe_notify(struct net_device *dev,
12539                              const u8 *peer, u32 num_packets,
12540                              u32 rate, u32 intvl, gfp_t gfp)
12541 {
12542         struct sk_buff *msg;
12543
12544         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12545         if (!msg)
12546                 return;
12547
12548         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12549                 goto nla_put_failure;
12550
12551         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12552                 goto nla_put_failure;
12553
12554         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12555                 goto nla_put_failure;
12556
12557         cfg80211_send_cqm(msg, gfp);
12558         return;
12559
12560  nla_put_failure:
12561         nlmsg_free(msg);
12562 }
12563 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12564
12565 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12566                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12567 {
12568         struct sk_buff *msg;
12569
12570         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12571
12572         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12573         if (!msg)
12574                 return;
12575
12576         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12577                 goto nla_put_failure;
12578
12579         cfg80211_send_cqm(msg, gfp);
12580         return;
12581
12582  nla_put_failure:
12583         nlmsg_free(msg);
12584 }
12585 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12586
12587 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12588 {
12589         struct sk_buff *msg;
12590
12591         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12592         if (!msg)
12593                 return;
12594
12595         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12596                 goto nla_put_failure;
12597
12598         cfg80211_send_cqm(msg, gfp);
12599         return;
12600
12601  nla_put_failure:
12602         nlmsg_free(msg);
12603 }
12604 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12605
12606 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12607                                      struct net_device *netdev, const u8 *bssid,
12608                                      const u8 *replay_ctr, gfp_t gfp)
12609 {
12610         struct sk_buff *msg;
12611         struct nlattr *rekey_attr;
12612         void *hdr;
12613
12614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12615         if (!msg)
12616                 return;
12617
12618         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12619         if (!hdr) {
12620                 nlmsg_free(msg);
12621                 return;
12622         }
12623
12624         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12625             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12626             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12627                 goto nla_put_failure;
12628
12629         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12630         if (!rekey_attr)
12631                 goto nla_put_failure;
12632
12633         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12634                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12635                 goto nla_put_failure;
12636
12637         nla_nest_end(msg, rekey_attr);
12638
12639         genlmsg_end(msg, hdr);
12640
12641         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12642                                 NL80211_MCGRP_MLME, gfp);
12643         return;
12644
12645  nla_put_failure:
12646         genlmsg_cancel(msg, hdr);
12647         nlmsg_free(msg);
12648 }
12649
12650 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12651                                const u8 *replay_ctr, gfp_t gfp)
12652 {
12653         struct wireless_dev *wdev = dev->ieee80211_ptr;
12654         struct wiphy *wiphy = wdev->wiphy;
12655         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12656
12657         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12658         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12659 }
12660 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12661
12662 static void
12663 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12664                                struct net_device *netdev, int index,
12665                                const u8 *bssid, bool preauth, gfp_t gfp)
12666 {
12667         struct sk_buff *msg;
12668         struct nlattr *attr;
12669         void *hdr;
12670
12671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12672         if (!msg)
12673                 return;
12674
12675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12676         if (!hdr) {
12677                 nlmsg_free(msg);
12678                 return;
12679         }
12680
12681         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12682             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12683                 goto nla_put_failure;
12684
12685         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12686         if (!attr)
12687                 goto nla_put_failure;
12688
12689         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12690             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12691             (preauth &&
12692              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12693                 goto nla_put_failure;
12694
12695         nla_nest_end(msg, attr);
12696
12697         genlmsg_end(msg, hdr);
12698
12699         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12700                                 NL80211_MCGRP_MLME, gfp);
12701         return;
12702
12703  nla_put_failure:
12704         genlmsg_cancel(msg, hdr);
12705         nlmsg_free(msg);
12706 }
12707
12708 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12709                                      const u8 *bssid, bool preauth, gfp_t gfp)
12710 {
12711         struct wireless_dev *wdev = dev->ieee80211_ptr;
12712         struct wiphy *wiphy = wdev->wiphy;
12713         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12714
12715         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12716         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12717 }
12718 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12719
12720 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12721                                      struct net_device *netdev,
12722                                      struct cfg80211_chan_def *chandef,
12723                                      gfp_t gfp,
12724                                      enum nl80211_commands notif,
12725                                      u8 count)
12726 {
12727         struct sk_buff *msg;
12728         void *hdr;
12729
12730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12731         if (!msg)
12732                 return;
12733
12734         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12735         if (!hdr) {
12736                 nlmsg_free(msg);
12737                 return;
12738         }
12739
12740         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12741                 goto nla_put_failure;
12742
12743         if (nl80211_send_chandef(msg, chandef))
12744                 goto nla_put_failure;
12745
12746         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12747             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12748                         goto nla_put_failure;
12749
12750         genlmsg_end(msg, hdr);
12751
12752         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12753                                 NL80211_MCGRP_MLME, gfp);
12754         return;
12755
12756  nla_put_failure:
12757         genlmsg_cancel(msg, hdr);
12758         nlmsg_free(msg);
12759 }
12760
12761 void cfg80211_ch_switch_notify(struct net_device *dev,
12762                                struct cfg80211_chan_def *chandef)
12763 {
12764         struct wireless_dev *wdev = dev->ieee80211_ptr;
12765         struct wiphy *wiphy = wdev->wiphy;
12766         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12767
12768         ASSERT_WDEV_LOCK(wdev);
12769
12770         trace_cfg80211_ch_switch_notify(dev, chandef);
12771
12772         wdev->chandef = *chandef;
12773         wdev->preset_chandef = *chandef;
12774         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12775                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12776 }
12777 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
12778
12779 void cfg80211_ch_switch_started_notify(struct net_device *dev,
12780                                        struct cfg80211_chan_def *chandef,
12781                                        u8 count)
12782 {
12783         struct wireless_dev *wdev = dev->ieee80211_ptr;
12784         struct wiphy *wiphy = wdev->wiphy;
12785         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12786
12787         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12788
12789         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12790                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12791 }
12792 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12793
12794 void
12795 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12796                      const struct cfg80211_chan_def *chandef,
12797                      enum nl80211_radar_event event,
12798                      struct net_device *netdev, gfp_t gfp)
12799 {
12800         struct sk_buff *msg;
12801         void *hdr;
12802
12803         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12804         if (!msg)
12805                 return;
12806
12807         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12808         if (!hdr) {
12809                 nlmsg_free(msg);
12810                 return;
12811         }
12812
12813         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12814                 goto nla_put_failure;
12815
12816         /* NOP and radar events don't need a netdev parameter */
12817         if (netdev) {
12818                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12819
12820                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12821                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12822                         goto nla_put_failure;
12823         }
12824
12825         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12826                 goto nla_put_failure;
12827
12828         if (nl80211_send_chandef(msg, chandef))
12829                 goto nla_put_failure;
12830
12831         genlmsg_end(msg, hdr);
12832
12833         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12834                                 NL80211_MCGRP_MLME, gfp);
12835         return;
12836
12837  nla_put_failure:
12838         genlmsg_cancel(msg, hdr);
12839         nlmsg_free(msg);
12840 }
12841
12842 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12843                            u64 cookie, bool acked, gfp_t gfp)
12844 {
12845         struct wireless_dev *wdev = dev->ieee80211_ptr;
12846         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12847         struct sk_buff *msg;
12848         void *hdr;
12849
12850         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12851
12852         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12853
12854         if (!msg)
12855                 return;
12856
12857         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12858         if (!hdr) {
12859                 nlmsg_free(msg);
12860                 return;
12861         }
12862
12863         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12864             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12865             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12866             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12867             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12868                 goto nla_put_failure;
12869
12870         genlmsg_end(msg, hdr);
12871
12872         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12873                                 NL80211_MCGRP_MLME, gfp);
12874         return;
12875
12876  nla_put_failure:
12877         genlmsg_cancel(msg, hdr);
12878         nlmsg_free(msg);
12879 }
12880 EXPORT_SYMBOL(cfg80211_probe_status);
12881
12882 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12883                                  const u8 *frame, size_t len,
12884                                  int freq, int sig_dbm)
12885 {
12886         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12887         struct sk_buff *msg;
12888         void *hdr;
12889         struct cfg80211_beacon_registration *reg;
12890
12891         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12892
12893         spin_lock_bh(&rdev->beacon_registrations_lock);
12894         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12895                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12896                 if (!msg) {
12897                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12898                         return;
12899                 }
12900
12901                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12902                 if (!hdr)
12903                         goto nla_put_failure;
12904
12905                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12906                     (freq &&
12907                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12908                     (sig_dbm &&
12909                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12910                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12911                         goto nla_put_failure;
12912
12913                 genlmsg_end(msg, hdr);
12914
12915                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12916         }
12917         spin_unlock_bh(&rdev->beacon_registrations_lock);
12918         return;
12919
12920  nla_put_failure:
12921         spin_unlock_bh(&rdev->beacon_registrations_lock);
12922         if (hdr)
12923                 genlmsg_cancel(msg, hdr);
12924         nlmsg_free(msg);
12925 }
12926 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12927
12928 #ifdef CONFIG_PM
12929 static int cfg80211_net_detect_results(struct sk_buff *msg,
12930                                        struct cfg80211_wowlan_wakeup *wakeup)
12931 {
12932         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12933         struct nlattr *nl_results, *nl_match, *nl_freqs;
12934         int i, j;
12935
12936         nl_results = nla_nest_start(
12937                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12938         if (!nl_results)
12939                 return -EMSGSIZE;
12940
12941         for (i = 0; i < nd->n_matches; i++) {
12942                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12943
12944                 nl_match = nla_nest_start(msg, i);
12945                 if (!nl_match)
12946                         break;
12947
12948                 /* The SSID attribute is optional in nl80211, but for
12949                  * simplicity reasons it's always present in the
12950                  * cfg80211 structure.  If a driver can't pass the
12951                  * SSID, that needs to be changed.  A zero length SSID
12952                  * is still a valid SSID (wildcard), so it cannot be
12953                  * used for this purpose.
12954                  */
12955                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
12956                             match->ssid.ssid)) {
12957                         nla_nest_cancel(msg, nl_match);
12958                         goto out;
12959                 }
12960
12961                 if (match->n_channels) {
12962                         nl_freqs = nla_nest_start(
12963                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
12964                         if (!nl_freqs) {
12965                                 nla_nest_cancel(msg, nl_match);
12966                                 goto out;
12967                         }
12968
12969                         for (j = 0; j < match->n_channels; j++) {
12970                                 if (nla_put_u32(msg, j, match->channels[j])) {
12971                                         nla_nest_cancel(msg, nl_freqs);
12972                                         nla_nest_cancel(msg, nl_match);
12973                                         goto out;
12974                                 }
12975                         }
12976
12977                         nla_nest_end(msg, nl_freqs);
12978                 }
12979
12980                 nla_nest_end(msg, nl_match);
12981         }
12982
12983 out:
12984         nla_nest_end(msg, nl_results);
12985         return 0;
12986 }
12987
12988 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
12989                                    struct cfg80211_wowlan_wakeup *wakeup,
12990                                    gfp_t gfp)
12991 {
12992         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12993         struct sk_buff *msg;
12994         void *hdr;
12995         int size = 200;
12996
12997         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
12998
12999         if (wakeup)
13000                 size += wakeup->packet_present_len;
13001
13002         msg = nlmsg_new(size, gfp);
13003         if (!msg)
13004                 return;
13005
13006         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13007         if (!hdr)
13008                 goto free_msg;
13009
13010         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13011             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13012                 goto free_msg;
13013
13014         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13015                                         wdev->netdev->ifindex))
13016                 goto free_msg;
13017
13018         if (wakeup) {
13019                 struct nlattr *reasons;
13020
13021                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13022                 if (!reasons)
13023                         goto free_msg;
13024
13025                 if (wakeup->disconnect &&
13026                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13027                         goto free_msg;
13028                 if (wakeup->magic_pkt &&
13029                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13030                         goto free_msg;
13031                 if (wakeup->gtk_rekey_failure &&
13032                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13033                         goto free_msg;
13034                 if (wakeup->eap_identity_req &&
13035                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13036                         goto free_msg;
13037                 if (wakeup->four_way_handshake &&
13038                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13039                         goto free_msg;
13040                 if (wakeup->rfkill_release &&
13041                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13042                         goto free_msg;
13043
13044                 if (wakeup->pattern_idx >= 0 &&
13045                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13046                                 wakeup->pattern_idx))
13047                         goto free_msg;
13048
13049                 if (wakeup->tcp_match &&
13050                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13051                         goto free_msg;
13052
13053                 if (wakeup->tcp_connlost &&
13054                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13055                         goto free_msg;
13056
13057                 if (wakeup->tcp_nomoretokens &&
13058                     nla_put_flag(msg,
13059                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13060                         goto free_msg;
13061
13062                 if (wakeup->packet) {
13063                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13064                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13065
13066                         if (!wakeup->packet_80211) {
13067                                 pkt_attr =
13068                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13069                                 len_attr =
13070                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13071                         }
13072
13073                         if (wakeup->packet_len &&
13074                             nla_put_u32(msg, len_attr, wakeup->packet_len))
13075                                 goto free_msg;
13076
13077                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13078                                     wakeup->packet))
13079                                 goto free_msg;
13080                 }
13081
13082                 if (wakeup->net_detect &&
13083                     cfg80211_net_detect_results(msg, wakeup))
13084                                 goto free_msg;
13085
13086                 nla_nest_end(msg, reasons);
13087         }
13088
13089         genlmsg_end(msg, hdr);
13090
13091         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13092                                 NL80211_MCGRP_MLME, gfp);
13093         return;
13094
13095  free_msg:
13096         nlmsg_free(msg);
13097 }
13098 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13099 #endif
13100
13101 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13102                                 enum nl80211_tdls_operation oper,
13103                                 u16 reason_code, gfp_t gfp)
13104 {
13105         struct wireless_dev *wdev = dev->ieee80211_ptr;
13106         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13107         struct sk_buff *msg;
13108         void *hdr;
13109
13110         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13111                                          reason_code);
13112
13113         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13114         if (!msg)
13115                 return;
13116
13117         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13118         if (!hdr) {
13119                 nlmsg_free(msg);
13120                 return;
13121         }
13122
13123         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13124             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13125             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13126             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13127             (reason_code > 0 &&
13128              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13129                 goto nla_put_failure;
13130
13131         genlmsg_end(msg, hdr);
13132
13133         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13134                                 NL80211_MCGRP_MLME, gfp);
13135         return;
13136
13137  nla_put_failure:
13138         genlmsg_cancel(msg, hdr);
13139         nlmsg_free(msg);
13140 }
13141 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13142
13143 static int nl80211_netlink_notify(struct notifier_block * nb,
13144                                   unsigned long state,
13145                                   void *_notify)
13146 {
13147         struct netlink_notify *notify = _notify;
13148         struct cfg80211_registered_device *rdev;
13149         struct wireless_dev *wdev;
13150         struct cfg80211_beacon_registration *reg, *tmp;
13151
13152         if (state != NETLINK_URELEASE)
13153                 return NOTIFY_DONE;
13154
13155         rcu_read_lock();
13156
13157         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13158                 bool schedule_destroy_work = false;
13159                 bool schedule_scan_stop = false;
13160                 struct cfg80211_sched_scan_request *sched_scan_req =
13161                         rcu_dereference(rdev->sched_scan_req);
13162
13163                 if (sched_scan_req && notify->portid &&
13164                     sched_scan_req->owner_nlportid == notify->portid)
13165                         schedule_scan_stop = true;
13166
13167                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
13168                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13169
13170                         if (wdev->owner_nlportid == notify->portid)
13171                                 schedule_destroy_work = true;
13172                 }
13173
13174                 spin_lock_bh(&rdev->beacon_registrations_lock);
13175                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13176                                          list) {
13177                         if (reg->nlportid == notify->portid) {
13178                                 list_del(&reg->list);
13179                                 kfree(reg);
13180                                 break;
13181                         }
13182                 }
13183                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13184
13185                 if (schedule_destroy_work) {
13186                         struct cfg80211_iface_destroy *destroy;
13187
13188                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13189                         if (destroy) {
13190                                 destroy->nlportid = notify->portid;
13191                                 spin_lock(&rdev->destroy_list_lock);
13192                                 list_add(&destroy->list, &rdev->destroy_list);
13193                                 spin_unlock(&rdev->destroy_list_lock);
13194                                 schedule_work(&rdev->destroy_work);
13195                         }
13196                 } else if (schedule_scan_stop) {
13197                         sched_scan_req->owner_nlportid = 0;
13198
13199                         if (rdev->ops->sched_scan_stop &&
13200                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13201                                 schedule_work(&rdev->sched_scan_stop_wk);
13202                 }
13203         }
13204
13205         rcu_read_unlock();
13206
13207         /*
13208          * It is possible that the user space process that is controlling the
13209          * indoor setting disappeared, so notify the regulatory core.
13210          */
13211         regulatory_netlink_notify(notify->portid);
13212         return NOTIFY_OK;
13213 }
13214
13215 static struct notifier_block nl80211_netlink_notifier = {
13216         .notifier_call = nl80211_netlink_notify,
13217 };
13218
13219 void cfg80211_ft_event(struct net_device *netdev,
13220                        struct cfg80211_ft_event_params *ft_event)
13221 {
13222         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13223         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13224         struct sk_buff *msg;
13225         void *hdr;
13226
13227         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13228
13229         if (!ft_event->target_ap)
13230                 return;
13231
13232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13233         if (!msg)
13234                 return;
13235
13236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13237         if (!hdr)
13238                 goto out;
13239
13240         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13241             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13242             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13243                 goto out;
13244
13245         if (ft_event->ies &&
13246             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13247                 goto out;
13248         if (ft_event->ric_ies &&
13249             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13250                     ft_event->ric_ies))
13251                 goto out;
13252
13253         genlmsg_end(msg, hdr);
13254
13255         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13256                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13257         return;
13258  out:
13259         nlmsg_free(msg);
13260 }
13261 EXPORT_SYMBOL(cfg80211_ft_event);
13262
13263 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13264 {
13265         struct cfg80211_registered_device *rdev;
13266         struct sk_buff *msg;
13267         void *hdr;
13268         u32 nlportid;
13269
13270         rdev = wiphy_to_rdev(wdev->wiphy);
13271         if (!rdev->crit_proto_nlportid)
13272                 return;
13273
13274         nlportid = rdev->crit_proto_nlportid;
13275         rdev->crit_proto_nlportid = 0;
13276
13277         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13278         if (!msg)
13279                 return;
13280
13281         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13282         if (!hdr)
13283                 goto nla_put_failure;
13284
13285         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13286             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13287                 goto nla_put_failure;
13288
13289         genlmsg_end(msg, hdr);
13290
13291         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13292         return;
13293
13294  nla_put_failure:
13295         if (hdr)
13296                 genlmsg_cancel(msg, hdr);
13297         nlmsg_free(msg);
13298
13299 }
13300 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13301
13302 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13303 {
13304         struct wiphy *wiphy = wdev->wiphy;
13305         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13306         struct sk_buff *msg;
13307         void *hdr;
13308
13309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13310         if (!msg)
13311                 return;
13312
13313         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13314         if (!hdr)
13315                 goto out;
13316
13317         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13318             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13319             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13320                 goto out;
13321
13322         genlmsg_end(msg, hdr);
13323
13324         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13325                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13326         return;
13327  out:
13328         nlmsg_free(msg);
13329 }
13330
13331 /* initialisation/exit functions */
13332
13333 int nl80211_init(void)
13334 {
13335         int err;
13336
13337         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13338                                                    nl80211_mcgrps);
13339         if (err)
13340                 return err;
13341
13342         err = netlink_register_notifier(&nl80211_netlink_notifier);
13343         if (err)
13344                 goto err_out;
13345
13346         return 0;
13347  err_out:
13348         genl_unregister_family(&nl80211_fam);
13349         return err;
13350 }
13351
13352 void nl80211_exit(void)
13353 {
13354         netlink_unregister_notifier(&nl80211_netlink_notifier);
13355         genl_unregister_family(&nl80211_fam);
13356 }