net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398 };
 399
 400 /* policy for the key attributes */
 401 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 402         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 403         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 404         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 405         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 406         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 407         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 408         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 409         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 410 };
 411
 412 /* policy for the key default flags */
 413 static const struct nla_policy
 414 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 415         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 416         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 417 };
 418
 419 /* policy for WoWLAN attributes */
 420 static const struct nla_policy
 421 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 422         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 423         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 424         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 425         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 426         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 427         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 428         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 431 };
 432
 433 static const struct nla_policy
 434 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 435         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 436         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 437         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 438         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 439         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 440         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 441         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 442                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 443         },
 444         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 445                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 446         },
 447         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 448         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 449         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 450 };
 451
 452 /* policy for coalesce rule attributes */
 453 static const struct nla_policy
 454 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 455         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 456         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 457         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 458 };
 459
 460 /* policy for GTK rekey offload attributes */
 461 static const struct nla_policy
 462 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 463         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 464         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 465         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 466 };
 467
 468 static const struct nla_policy
 469 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 470         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 471                                                  .len = IEEE80211_MAX_SSID_LEN },
 472         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 473 };
 474
 475 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 476                                      struct netlink_callback *cb,
 477                                      struct cfg80211_registered_device **rdev,
 478                                      struct wireless_dev **wdev)
 479 {
 480         int err;
 481
 482         rtnl_lock();
 483
 484         if (!cb->args[0]) {
 485                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 486                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 487                                   nl80211_policy);
 488                 if (err)
 489                         goto out_unlock;
 490
 491                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 492                                                    nl80211_fam.attrbuf);
 493                 if (IS_ERR(*wdev)) {
 494                         err = PTR_ERR(*wdev);
 495                         goto out_unlock;
 496                 }
 497                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 498                 /* 0 is the first index - add 1 to parse only once */
 499                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 500                 cb->args[1] = (*wdev)->identifier;
 501         } else {
 502                 /* subtract the 1 again here */
 503                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 504                 struct wireless_dev *tmp;
 505
 506                 if (!wiphy) {
 507                         err = -ENODEV;
 508                         goto out_unlock;
 509                 }
 510                 *rdev = wiphy_to_rdev(wiphy);
 511                 *wdev = NULL;
 512
 513                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 514                         if (tmp->identifier == cb->args[1]) {
 515                                 *wdev = tmp;
 516                                 break;
 517                         }
 518                 }
 519
 520                 if (!*wdev) {
 521                         err = -ENODEV;
 522                         goto out_unlock;
 523                 }
 524         }
 525
 526         return 0;
 527  out_unlock:
 528         rtnl_unlock();
 529         return err;
 530 }
 531
 532 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 533 {
 534         rtnl_unlock();
 535 }
 536
 537 /* IE validation */
 538 static bool is_valid_ie_attr(const struct nlattr *attr)
 539 {
 540         const u8 *pos;
 541         int len;
 542
 543         if (!attr)
 544                 return true;
 545
 546         pos = nla_data(attr);
 547         len = nla_len(attr);
 548
 549         while (len) {
 550                 u8 elemlen;
 551
 552                 if (len < 2)
 553                         return false;
 554                 len -= 2;
 555
 556                 elemlen = pos[1];
 557                 if (elemlen > len)
 558                         return false;
 559
 560                 len -= elemlen;
 561                 pos += 2 + elemlen;
 562         }
 563
 564         return true;
 565 }
 566
 567 /* message building helper */
 568 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 569                                    int flags, u8 cmd)
 570 {
 571         /* since there is no private header just add the generic one */
 572         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 573 }
 574
 575 static int nl80211_msg_put_channel(struct sk_buff *msg,
 576                                    struct ieee80211_channel *chan,
 577                                    bool large)
 578 {
 579         /* Some channels must be completely excluded from the
 580          * list to protect old user-space tools from breaking
 581          */
 582         if (!large && chan->flags &
 583             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 584                 return 0;
 585
 586         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 587                         chan->center_freq))
 588                 goto nla_put_failure;
 589
 590         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 591             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 592                 goto nla_put_failure;
 593         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 594                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 595                         goto nla_put_failure;
 596                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 597                         goto nla_put_failure;
 598         }
 599         if (chan->flags & IEEE80211_CHAN_RADAR) {
 600                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 601                         goto nla_put_failure;
 602                 if (large) {
 603                         u32 time;
 604
 605                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 606
 607                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 608                                         chan->dfs_state))
 609                                 goto nla_put_failure;
 610                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 611                                         time))
 612                                 goto nla_put_failure;
 613                         if (nla_put_u32(msg,
 614                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 615                                         chan->dfs_cac_ms))
 616                                 goto nla_put_failure;
 617                 }
 618         }
 619
 620         if (large) {
 621                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 622                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 623                         goto nla_put_failure;
 624                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 625                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 626                         goto nla_put_failure;
 627                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 628                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 629                         goto nla_put_failure;
 630                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 631                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 632                         goto nla_put_failure;
 633                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 634                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 635                         goto nla_put_failure;
 636                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 637                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 638                         goto nla_put_failure;
 639                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 640                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 641                         goto nla_put_failure;
 642                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 643                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 644                         goto nla_put_failure;
 645         }
 646
 647         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 648                         DBM_TO_MBM(chan->max_power)))
 649                 goto nla_put_failure;
 650
 651         return 0;
 652
 653  nla_put_failure:
 654         return -ENOBUFS;
 655 }
 656
 657 /* netlink command implementations */
 658
 659 struct key_parse {
 660         struct key_params p;
 661         int idx;
 662         int type;
 663         bool def, defmgmt;
 664         bool def_uni, def_multi;
 665 };
 666
 667 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 668 {
 669         struct nlattr *tb[NL80211_KEY_MAX + 1];
 670         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 671                                    nl80211_key_policy);
 672         if (err)
 673                 return err;
 674
 675         k->def = !!tb[NL80211_KEY_DEFAULT];
 676         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 677
 678         if (k->def) {
 679                 k->def_uni = true;
 680                 k->def_multi = true;
 681         }
 682         if (k->defmgmt)
 683                 k->def_multi = true;
 684
 685         if (tb[NL80211_KEY_IDX])
 686                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 687
 688         if (tb[NL80211_KEY_DATA]) {
 689                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 690                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 691         }
 692
 693         if (tb[NL80211_KEY_SEQ]) {
 694                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 695                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 696         }
 697
 698         if (tb[NL80211_KEY_CIPHER])
 699                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 700
 701         if (tb[NL80211_KEY_TYPE]) {
 702                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 703                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 704                         return -EINVAL;
 705         }
 706
 707         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 708                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 709                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 710                                        tb[NL80211_KEY_DEFAULT_TYPES],
 711                                        nl80211_key_default_policy);
 712                 if (err)
 713                         return err;
 714
 715                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 716                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 717         }
 718
 719         return 0;
 720 }
 721
 722 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 723 {
 724         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 725                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 726                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 727         }
 728
 729         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 730                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 731                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 732         }
 733
 734         if (info->attrs[NL80211_ATTR_KEY_IDX])
 735                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 736
 737         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 738                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 739
 740         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 741         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 742
 743         if (k->def) {
 744                 k->def_uni = true;
 745                 k->def_multi = true;
 746         }
 747         if (k->defmgmt)
 748                 k->def_multi = true;
 749
 750         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 751                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 752                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 753                         return -EINVAL;
 754         }
 755
 756         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 757                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 758                 int err = nla_parse_nested(
 759                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 760                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 761                                 nl80211_key_default_policy);
 762                 if (err)
 763                         return err;
 764
 765                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 766                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 767         }
 768
 769         return 0;
 770 }
 771
 772 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 773 {
 774         int err;
 775
 776         memset(k, 0, sizeof(*k));
 777         k->idx = -1;
 778         k->type = -1;
 779
 780         if (info->attrs[NL80211_ATTR_KEY])
 781                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 782         else
 783                 err = nl80211_parse_key_old(info, k);
 784
 785         if (err)
 786                 return err;
 787
 788         if (k->def && k->defmgmt)
 789                 return -EINVAL;
 790
 791         if (k->defmgmt) {
 792                 if (k->def_uni || !k->def_multi)
 793                         return -EINVAL;
 794         }
 795
 796         if (k->idx != -1) {
 797                 if (k->defmgmt) {
 798                         if (k->idx < 4 || k->idx > 5)
 799                                 return -EINVAL;
 800                 } else if (k->def) {
 801                         if (k->idx < 0 || k->idx > 3)
 802                                 return -EINVAL;
 803                 } else {
 804                         if (k->idx < 0 || k->idx > 5)
 805                                 return -EINVAL;
 806                 }
 807         }
 808
 809         return 0;
 810 }
 811
 812 static struct cfg80211_cached_keys *
 813 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 814                        struct nlattr *keys, bool *no_ht)
 815 {
 816         struct key_parse parse;
 817         struct nlattr *key;
 818         struct cfg80211_cached_keys *result;
 819         int rem, err, def = 0;
 820
 821         result = kzalloc(sizeof(*result), GFP_KERNEL);
 822         if (!result)
 823                 return ERR_PTR(-ENOMEM);
 824
 825         result->def = -1;
 826         result->defmgmt = -1;
 827
 828         nla_for_each_nested(key, keys, rem) {
 829                 memset(&parse, 0, sizeof(parse));
 830                 parse.idx = -1;
 831
 832                 err = nl80211_parse_key_new(key, &parse);
 833                 if (err)
 834                         goto error;
 835                 err = -EINVAL;
 836                 if (!parse.p.key)
 837                         goto error;
 838                 if (parse.idx < 0 || parse.idx > 4)
 839                         goto error;
 840                 if (parse.def) {
 841                         if (def)
 842                                 goto error;
 843                         def = 1;
 844                         result->def = parse.idx;
 845                         if (!parse.def_uni || !parse.def_multi)
 846                                 goto error;
 847                 } else if (parse.defmgmt)
 848                         goto error;
 849                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 850                                                      parse.idx, false, NULL);
 851                 if (err)
 852                         goto error;
 853                 result->params[parse.idx].cipher = parse.p.cipher;
 854                 result->params[parse.idx].key_len = parse.p.key_len;
 855                 result->params[parse.idx].key = result->data[parse.idx];
 856                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 857
 858                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 859                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 860                         if (no_ht)
 861                                 *no_ht = true;
 862                 }
 863         }
 864
 865         return result;
 866  error:
 867         kfree(result);
 868         return ERR_PTR(err);
 869 }
 870
 871 static int nl80211_key_allowed(struct wireless_dev *wdev)
 872 {
 873         ASSERT_WDEV_LOCK(wdev);
 874
 875         switch (wdev->iftype) {
 876         case NL80211_IFTYPE_AP:
 877         case NL80211_IFTYPE_AP_VLAN:
 878         case NL80211_IFTYPE_P2P_GO:
 879         case NL80211_IFTYPE_MESH_POINT:
 880                 break;
 881         case NL80211_IFTYPE_ADHOC:
 882         case NL80211_IFTYPE_STATION:
 883         case NL80211_IFTYPE_P2P_CLIENT:
 884                 if (!wdev->current_bss)
 885                         return -ENOLINK;
 886                 break;
 887         default:
 888                 return -EINVAL;
 889         }
 890
 891         return 0;
 892 }
 893
 894 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 895                                                         struct nlattr *tb)
 896 {
 897         struct ieee80211_channel *chan;
 898
 899         if (tb == NULL)
 900                 return NULL;
 901         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 902         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 903                 return NULL;
 904         return chan;
 905 }
 906
 907 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 908 {
 909         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 910         int i;
 911
 912         if (!nl_modes)
 913                 goto nla_put_failure;
 914
 915         i = 0;
 916         while (ifmodes) {
 917                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 918                         goto nla_put_failure;
 919                 ifmodes >>= 1;
 920                 i++;
 921         }
 922
 923         nla_nest_end(msg, nl_modes);
 924         return 0;
 925
 926 nla_put_failure:
 927         return -ENOBUFS;
 928 }
 929
 930 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 931                                           struct sk_buff *msg,
 932                                           bool large)
 933 {
 934         struct nlattr *nl_combis;
 935         int i, j;
 936
 937         nl_combis = nla_nest_start(msg,
 938                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 939         if (!nl_combis)
 940                 goto nla_put_failure;
 941
 942         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 943                 const struct ieee80211_iface_combination *c;
 944                 struct nlattr *nl_combi, *nl_limits;
 945
 946                 c = &wiphy->iface_combinations[i];
 947
 948                 nl_combi = nla_nest_start(msg, i + 1);
 949                 if (!nl_combi)
 950                         goto nla_put_failure;
 951
 952                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 953                 if (!nl_limits)
 954                         goto nla_put_failure;
 955
 956                 for (j = 0; j < c->n_limits; j++) {
 957                         struct nlattr *nl_limit;
 958
 959                         nl_limit = nla_nest_start(msg, j + 1);
 960                         if (!nl_limit)
 961                                 goto nla_put_failure;
 962                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 963                                         c->limits[j].max))
 964                                 goto nla_put_failure;
 965                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 966                                                 c->limits[j].types))
 967                                 goto nla_put_failure;
 968                         nla_nest_end(msg, nl_limit);
 969                 }
 970
 971                 nla_nest_end(msg, nl_limits);
 972
 973                 if (c->beacon_int_infra_match &&
 974                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 975                         goto nla_put_failure;
 976                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 977                                 c->num_different_channels) ||
 978                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 979                                 c->max_interfaces))
 980                         goto nla_put_failure;
 981                 if (large &&
 982                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 983                                 c->radar_detect_widths) ||
 984                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 985                                 c->radar_detect_regions)))
 986                         goto nla_put_failure;
 987
 988                 nla_nest_end(msg, nl_combi);
 989         }
 990
 991         nla_nest_end(msg, nl_combis);
 992
 993         return 0;
 994 nla_put_failure:
 995         return -ENOBUFS;
 996 }
 997
 998 #ifdef CONFIG_PM
 999 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1000                                         struct sk_buff *msg)
1001 {
1002         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1003         struct nlattr *nl_tcp;
1004
1005         if (!tcp)
1006                 return 0;
1007
1008         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1009         if (!nl_tcp)
1010                 return -ENOBUFS;
1011
1012         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1013                         tcp->data_payload_max))
1014                 return -ENOBUFS;
1015
1016         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1017                         tcp->data_payload_max))
1018                 return -ENOBUFS;
1019
1020         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1021                 return -ENOBUFS;
1022
1023         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1024                                 sizeof(*tcp->tok), tcp->tok))
1025                 return -ENOBUFS;
1026
1027         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1028                         tcp->data_interval_max))
1029                 return -ENOBUFS;
1030
1031         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1032                         tcp->wake_payload_max))
1033                 return -ENOBUFS;
1034
1035         nla_nest_end(msg, nl_tcp);
1036         return 0;
1037 }
1038
1039 static int nl80211_send_wowlan(struct sk_buff *msg,
1040                                struct cfg80211_registered_device *rdev,
1041                                bool large)
1042 {
1043         struct nlattr *nl_wowlan;
1044
1045         if (!rdev->wiphy.wowlan)
1046                 return 0;
1047
1048         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1049         if (!nl_wowlan)
1050                 return -ENOBUFS;
1051
1052         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1053              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1054             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1055              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1056             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1057              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1058             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1059              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1060             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1061              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1062             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1063              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1064             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1065              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1066             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1067              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1068                 return -ENOBUFS;
1069
1070         if (rdev->wiphy.wowlan->n_patterns) {
1071                 struct nl80211_pattern_support pat = {
1072                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1073                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1074                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1075                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1076                 };
1077
1078                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1079                             sizeof(pat), &pat))
1080                         return -ENOBUFS;
1081         }
1082
1083         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1084                 return -ENOBUFS;
1085
1086         nla_nest_end(msg, nl_wowlan);
1087
1088         return 0;
1089 }
1090 #endif
1091
1092 static int nl80211_send_coalesce(struct sk_buff *msg,
1093                                  struct cfg80211_registered_device *rdev)
1094 {
1095         struct nl80211_coalesce_rule_support rule;
1096
1097         if (!rdev->wiphy.coalesce)
1098                 return 0;
1099
1100         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1101         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1102         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1103         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1104         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1105         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1106
1107         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1108                 return -ENOBUFS;
1109
1110         return 0;
1111 }
1112
1113 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1114                                       struct ieee80211_supported_band *sband)
1115 {
1116         struct nlattr *nl_rates, *nl_rate;
1117         struct ieee80211_rate *rate;
1118         int i;
1119
1120         /* add HT info */
1121         if (sband->ht_cap.ht_supported &&
1122             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1123                      sizeof(sband->ht_cap.mcs),
1124                      &sband->ht_cap.mcs) ||
1125              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1126                          sband->ht_cap.cap) ||
1127              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1128                         sband->ht_cap.ampdu_factor) ||
1129              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1130                         sband->ht_cap.ampdu_density)))
1131                 return -ENOBUFS;
1132
1133         /* add VHT info */
1134         if (sband->vht_cap.vht_supported &&
1135             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1136                      sizeof(sband->vht_cap.vht_mcs),
1137                      &sband->vht_cap.vht_mcs) ||
1138              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1139                          sband->vht_cap.cap)))
1140                 return -ENOBUFS;
1141
1142         /* add bitrates */
1143         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1144         if (!nl_rates)
1145                 return -ENOBUFS;
1146
1147         for (i = 0; i < sband->n_bitrates; i++) {
1148                 nl_rate = nla_nest_start(msg, i);
1149                 if (!nl_rate)
1150                         return -ENOBUFS;
1151
1152                 rate = &sband->bitrates[i];
1153                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1154                                 rate->bitrate))
1155                         return -ENOBUFS;
1156                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1157                     nla_put_flag(msg,
1158                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1159                         return -ENOBUFS;
1160
1161                 nla_nest_end(msg, nl_rate);
1162         }
1163
1164         nla_nest_end(msg, nl_rates);
1165
1166         return 0;
1167 }
1168
1169 static int
1170 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1171                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1172 {
1173         u16 stypes;
1174         struct nlattr *nl_ftypes, *nl_ifs;
1175         enum nl80211_iftype ift;
1176         int i;
1177
1178         if (!mgmt_stypes)
1179                 return 0;
1180
1181         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1182         if (!nl_ifs)
1183                 return -ENOBUFS;
1184
1185         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1186                 nl_ftypes = nla_nest_start(msg, ift);
1187                 if (!nl_ftypes)
1188                         return -ENOBUFS;
1189                 i = 0;
1190                 stypes = mgmt_stypes[ift].tx;
1191                 while (stypes) {
1192                         if ((stypes & 1) &&
1193                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1194                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1195                                 return -ENOBUFS;
1196                         stypes >>= 1;
1197                         i++;
1198                 }
1199                 nla_nest_end(msg, nl_ftypes);
1200         }
1201
1202         nla_nest_end(msg, nl_ifs);
1203
1204         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1205         if (!nl_ifs)
1206                 return -ENOBUFS;
1207
1208         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1209                 nl_ftypes = nla_nest_start(msg, ift);
1210                 if (!nl_ftypes)
1211                         return -ENOBUFS;
1212                 i = 0;
1213                 stypes = mgmt_stypes[ift].rx;
1214                 while (stypes) {
1215                         if ((stypes & 1) &&
1216                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1217                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1218                                 return -ENOBUFS;
1219                         stypes >>= 1;
1220                         i++;
1221                 }
1222                 nla_nest_end(msg, nl_ftypes);
1223         }
1224         nla_nest_end(msg, nl_ifs);
1225
1226         return 0;
1227 }
1228
1229 struct nl80211_dump_wiphy_state {
1230         s64 filter_wiphy;
1231         long start;
1232         long split_start, band_start, chan_start;
1233         bool split;
1234 };
1235
1236 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1237                               enum nl80211_commands cmd,
1238                               struct sk_buff *msg, u32 portid, u32 seq,
1239                               int flags, struct nl80211_dump_wiphy_state *state)
1240 {
1241         void *hdr;
1242         struct nlattr *nl_bands, *nl_band;
1243         struct nlattr *nl_freqs, *nl_freq;
1244         struct nlattr *nl_cmds;
1245         enum ieee80211_band band;
1246         struct ieee80211_channel *chan;
1247         int i;
1248         const struct ieee80211_txrx_stypes *mgmt_stypes =
1249                                 rdev->wiphy.mgmt_stypes;
1250         u32 features;
1251
1252         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1253         if (!hdr)
1254                 return -ENOBUFS;
1255
1256         if (WARN_ON(!state))
1257                 return -EINVAL;
1258
1259         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1260             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1261                            wiphy_name(&rdev->wiphy)) ||
1262             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1263                         cfg80211_rdev_list_generation))
1264                 goto nla_put_failure;
1265
1266         if (cmd != NL80211_CMD_NEW_WIPHY)
1267                 goto finish;
1268
1269         switch (state->split_start) {
1270         case 0:
1271                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1272                                rdev->wiphy.retry_short) ||
1273                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1274                                rdev->wiphy.retry_long) ||
1275                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1276                                 rdev->wiphy.frag_threshold) ||
1277                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1278                                 rdev->wiphy.rts_threshold) ||
1279                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1280                                rdev->wiphy.coverage_class) ||
1281                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1282                                rdev->wiphy.max_scan_ssids) ||
1283                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1284                                rdev->wiphy.max_sched_scan_ssids) ||
1285                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1286                                 rdev->wiphy.max_scan_ie_len) ||
1287                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1288                                 rdev->wiphy.max_sched_scan_ie_len) ||
1289                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1290                                rdev->wiphy.max_match_sets))
1291                         goto nla_put_failure;
1292
1293                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1294                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1295                         goto nla_put_failure;
1296                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1297                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1298                         goto nla_put_failure;
1299                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1300                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1301                         goto nla_put_failure;
1302                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1303                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1304                         goto nla_put_failure;
1305                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1306                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1307                         goto nla_put_failure;
1308                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1309                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1310                         goto nla_put_failure;
1311                 state->split_start++;
1312                 if (state->split)
1313                         break;
1314         case 1:
1315                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1316                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1317                             rdev->wiphy.cipher_suites))
1318                         goto nla_put_failure;
1319
1320                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1321                                rdev->wiphy.max_num_pmkids))
1322                         goto nla_put_failure;
1323
1324                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1325                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1326                         goto nla_put_failure;
1327
1328                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1329                                 rdev->wiphy.available_antennas_tx) ||
1330                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1331                                 rdev->wiphy.available_antennas_rx))
1332                         goto nla_put_failure;
1333
1334                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1335                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1336                                 rdev->wiphy.probe_resp_offload))
1337                         goto nla_put_failure;
1338
1339                 if ((rdev->wiphy.available_antennas_tx ||
1340                      rdev->wiphy.available_antennas_rx) &&
1341                     rdev->ops->get_antenna) {
1342                         u32 tx_ant = 0, rx_ant = 0;
1343                         int res;
1344                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1345                         if (!res) {
1346                                 if (nla_put_u32(msg,
1347                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1348                                                 tx_ant) ||
1349                                     nla_put_u32(msg,
1350                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1351                                                 rx_ant))
1352                                         goto nla_put_failure;
1353                         }
1354                 }
1355
1356                 state->split_start++;
1357                 if (state->split)
1358                         break;
1359         case 2:
1360                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1361                                         rdev->wiphy.interface_modes))
1362                                 goto nla_put_failure;
1363                 state->split_start++;
1364                 if (state->split)
1365                         break;
1366         case 3:
1367                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1368                 if (!nl_bands)
1369                         goto nla_put_failure;
1370
1371                 for (band = state->band_start;
1372                      band < IEEE80211_NUM_BANDS; band++) {
1373                         struct ieee80211_supported_band *sband;
1374
1375                         sband = rdev->wiphy.bands[band];
1376
1377                         if (!sband)
1378                                 continue;
1379
1380                         nl_band = nla_nest_start(msg, band);
1381                         if (!nl_band)
1382                                 goto nla_put_failure;
1383
1384                         switch (state->chan_start) {
1385                         case 0:
1386                                 if (nl80211_send_band_rateinfo(msg, sband))
1387                                         goto nla_put_failure;
1388                                 state->chan_start++;
1389                                 if (state->split)
1390                                         break;
1391                         default:
1392                                 /* add frequencies */
1393                                 nl_freqs = nla_nest_start(
1394                                         msg, NL80211_BAND_ATTR_FREQS);
1395                                 if (!nl_freqs)
1396                                         goto nla_put_failure;
1397
1398                                 for (i = state->chan_start - 1;
1399                                      i < sband->n_channels;
1400                                      i++) {
1401                                         nl_freq = nla_nest_start(msg, i);
1402                                         if (!nl_freq)
1403                                                 goto nla_put_failure;
1404
1405                                         chan = &sband->channels[i];
1406
1407                                         if (nl80211_msg_put_channel(
1408                                                         msg, chan,
1409                                                         state->split))
1410                                                 goto nla_put_failure;
1411
1412                                         nla_nest_end(msg, nl_freq);
1413                                         if (state->split)
1414                                                 break;
1415                                 }
1416                                 if (i < sband->n_channels)
1417                                         state->chan_start = i + 2;
1418                                 else
1419                                         state->chan_start = 0;
1420                                 nla_nest_end(msg, nl_freqs);
1421                         }
1422
1423                         nla_nest_end(msg, nl_band);
1424
1425                         if (state->split) {
1426                                 /* start again here */
1427                                 if (state->chan_start)
1428                                         band--;
1429                                 break;
1430                         }
1431                 }
1432                 nla_nest_end(msg, nl_bands);
1433
1434                 if (band < IEEE80211_NUM_BANDS)
1435                         state->band_start = band + 1;
1436                 else
1437                         state->band_start = 0;
1438
1439                 /* if bands & channels are done, continue outside */
1440                 if (state->band_start == 0 && state->chan_start == 0)
1441                         state->split_start++;
1442                 if (state->split)
1443                         break;
1444         case 4:
1445                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1446                 if (!nl_cmds)
1447                         goto nla_put_failure;
1448
1449                 i = 0;
1450 #define CMD(op, n)                                                      \
1451                  do {                                                   \
1452                         if (rdev->ops->op) {                            \
1453                                 i++;                                    \
1454                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1455                                         goto nla_put_failure;           \
1456                         }                                               \
1457                 } while (0)
1458
1459                 CMD(add_virtual_intf, NEW_INTERFACE);
1460                 CMD(change_virtual_intf, SET_INTERFACE);
1461                 CMD(add_key, NEW_KEY);
1462                 CMD(start_ap, START_AP);
1463                 CMD(add_station, NEW_STATION);
1464                 CMD(add_mpath, NEW_MPATH);
1465                 CMD(update_mesh_config, SET_MESH_CONFIG);
1466                 CMD(change_bss, SET_BSS);
1467                 CMD(auth, AUTHENTICATE);
1468                 CMD(assoc, ASSOCIATE);
1469                 CMD(deauth, DEAUTHENTICATE);
1470                 CMD(disassoc, DISASSOCIATE);
1471                 CMD(join_ibss, JOIN_IBSS);
1472                 CMD(join_mesh, JOIN_MESH);
1473                 CMD(set_pmksa, SET_PMKSA);
1474                 CMD(del_pmksa, DEL_PMKSA);
1475                 CMD(flush_pmksa, FLUSH_PMKSA);
1476                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1477                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1478                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1479                 CMD(mgmt_tx, FRAME);
1480                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1481                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1482                         i++;
1483                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1484                                 goto nla_put_failure;
1485                 }
1486                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1487                     rdev->ops->join_mesh) {
1488                         i++;
1489                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1490                                 goto nla_put_failure;
1491                 }
1492                 CMD(set_wds_peer, SET_WDS_PEER);
1493                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1494                         CMD(tdls_mgmt, TDLS_MGMT);
1495                         CMD(tdls_oper, TDLS_OPER);
1496                 }
1497                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1498                         CMD(sched_scan_start, START_SCHED_SCAN);
1499                 CMD(probe_client, PROBE_CLIENT);
1500                 CMD(set_noack_map, SET_NOACK_MAP);
1501                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1502                         i++;
1503                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1504                                 goto nla_put_failure;
1505                 }
1506                 CMD(start_p2p_device, START_P2P_DEVICE);
1507                 CMD(set_mcast_rate, SET_MCAST_RATE);
1508 #ifdef CONFIG_NL80211_TESTMODE
1509                 CMD(testmode_cmd, TESTMODE);
1510 #endif
1511                 if (state->split) {
1512                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1513                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1514                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1515                                 CMD(channel_switch, CHANNEL_SWITCH);
1516                         CMD(set_qos_map, SET_QOS_MAP);
1517                         if (rdev->wiphy.flags &
1518                                         WIPHY_FLAG_SUPPORTS_WMM_ADMISSION)
1519                                 CMD(add_tx_ts, ADD_TX_TS);
1520                 }
1521                 /* add into the if now */
1522 #undef CMD
1523
1524                 if (rdev->ops->connect || rdev->ops->auth) {
1525                         i++;
1526                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1527                                 goto nla_put_failure;
1528                 }
1529
1530                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1531                         i++;
1532                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1533                                 goto nla_put_failure;
1534                 }
1535
1536                 nla_nest_end(msg, nl_cmds);
1537                 state->split_start++;
1538                 if (state->split)
1539                         break;
1540         case 5:
1541                 if (rdev->ops->remain_on_channel &&
1542                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1543                     nla_put_u32(msg,
1544                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1545                                 rdev->wiphy.max_remain_on_channel_duration))
1546                         goto nla_put_failure;
1547
1548                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1549                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1550                         goto nla_put_failure;
1551
1552                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1553                         goto nla_put_failure;
1554                 state->split_start++;
1555                 if (state->split)
1556                         break;
1557         case 6:
1558 #ifdef CONFIG_PM
1559                 if (nl80211_send_wowlan(msg, rdev, state->split))
1560                         goto nla_put_failure;
1561                 state->split_start++;
1562                 if (state->split)
1563                         break;
1564 #else
1565                 state->split_start++;
1566 #endif
1567         case 7:
1568                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1569                                         rdev->wiphy.software_iftypes))
1570                         goto nla_put_failure;
1571
1572                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1573                                                    state->split))
1574                         goto nla_put_failure;
1575
1576                 state->split_start++;
1577                 if (state->split)
1578                         break;
1579         case 8:
1580                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1581                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1582                                 rdev->wiphy.ap_sme_capa))
1583                         goto nla_put_failure;
1584
1585                 features = rdev->wiphy.features;
1586                 /*
1587                  * We can only add the per-channel limit information if the
1588                  * dump is split, otherwise it makes it too big. Therefore
1589                  * only advertise it in that case.
1590                  */
1591                 if (state->split)
1592                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1593                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1594                         goto nla_put_failure;
1595
1596                 if (rdev->wiphy.ht_capa_mod_mask &&
1597                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1598                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1599                             rdev->wiphy.ht_capa_mod_mask))
1600                         goto nla_put_failure;
1601
1602                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1603                     rdev->wiphy.max_acl_mac_addrs &&
1604                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1605                                 rdev->wiphy.max_acl_mac_addrs))
1606                         goto nla_put_failure;
1607
1608                 /*
1609                  * Any information below this point is only available to
1610                  * applications that can deal with it being split. This
1611                  * helps ensure that newly added capabilities don't break
1612                  * older tools by overrunning their buffers.
1613                  *
1614                  * We still increment split_start so that in the split
1615                  * case we'll continue with more data in the next round,
1616                  * but break unconditionally so unsplit data stops here.
1617                  */
1618                 state->split_start++;
1619                 break;
1620         case 9:
1621                 if (rdev->wiphy.extended_capabilities &&
1622                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1623                              rdev->wiphy.extended_capabilities_len,
1624                              rdev->wiphy.extended_capabilities) ||
1625                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1626                              rdev->wiphy.extended_capabilities_len,
1627                              rdev->wiphy.extended_capabilities_mask)))
1628                         goto nla_put_failure;
1629
1630                 if (rdev->wiphy.vht_capa_mod_mask &&
1631                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1632                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1633                             rdev->wiphy.vht_capa_mod_mask))
1634                         goto nla_put_failure;
1635
1636                 state->split_start++;
1637                 break;
1638         case 10:
1639                 if (nl80211_send_coalesce(msg, rdev))
1640                         goto nla_put_failure;
1641
1642                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1643                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1644                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1645                         goto nla_put_failure;
1646
1647                 if (rdev->wiphy.max_ap_assoc_sta &&
1648                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1649                                 rdev->wiphy.max_ap_assoc_sta))
1650                         goto nla_put_failure;
1651
1652                 state->split_start++;
1653                 break;
1654         case 11:
1655                 if (rdev->wiphy.n_vendor_commands) {
1656                         const struct nl80211_vendor_cmd_info *info;
1657                         struct nlattr *nested;
1658
1659                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1660                         if (!nested)
1661                                 goto nla_put_failure;
1662
1663                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1664                                 info = &rdev->wiphy.vendor_commands[i].info;
1665                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1666                                         goto nla_put_failure;
1667                         }
1668                         nla_nest_end(msg, nested);
1669                 }
1670
1671                 if (rdev->wiphy.n_vendor_events) {
1672                         const struct nl80211_vendor_cmd_info *info;
1673                         struct nlattr *nested;
1674
1675                         nested = nla_nest_start(msg,
1676                                                 NL80211_ATTR_VENDOR_EVENTS);
1677                         if (!nested)
1678                                 goto nla_put_failure;
1679
1680                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1681                                 info = &rdev->wiphy.vendor_events[i];
1682                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1683                                         goto nla_put_failure;
1684                         }
1685                         nla_nest_end(msg, nested);
1686                 }
1687                 state->split_start++;
1688                 break;
1689         case 12:
1690                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1691                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1692                                rdev->wiphy.max_num_csa_counters))
1693                         goto nla_put_failure;
1694
1695                 /* done */
1696                 state->split_start = 0;
1697                 break;
1698         }
1699  finish:
1700         return genlmsg_end(msg, hdr);
1701
1702  nla_put_failure:
1703         genlmsg_cancel(msg, hdr);
1704         return -EMSGSIZE;
1705 }
1706
1707 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1708                                     struct netlink_callback *cb,
1709                                     struct nl80211_dump_wiphy_state *state)
1710 {
1711         struct nlattr **tb = nl80211_fam.attrbuf;
1712         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1713                               tb, nl80211_fam.maxattr, nl80211_policy);
1714         /* ignore parse errors for backward compatibility */
1715         if (ret)
1716                 return 0;
1717
1718         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1719         if (tb[NL80211_ATTR_WIPHY])
1720                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1721         if (tb[NL80211_ATTR_WDEV])
1722                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1723         if (tb[NL80211_ATTR_IFINDEX]) {
1724                 struct net_device *netdev;
1725                 struct cfg80211_registered_device *rdev;
1726                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1727
1728                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1729                 if (!netdev)
1730                         return -ENODEV;
1731                 if (netdev->ieee80211_ptr) {
1732                         rdev = wiphy_to_rdev(
1733                                 netdev->ieee80211_ptr->wiphy);
1734                         state->filter_wiphy = rdev->wiphy_idx;
1735                 }
1736         }
1737
1738         return 0;
1739 }
1740
1741 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1742 {
1743         int idx = 0, ret;
1744         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1745         struct cfg80211_registered_device *rdev;
1746
1747         rtnl_lock();
1748         if (!state) {
1749                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1750                 if (!state) {
1751                         rtnl_unlock();
1752                         return -ENOMEM;
1753                 }
1754                 state->filter_wiphy = -1;
1755                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1756                 if (ret) {
1757                         kfree(state);
1758                         rtnl_unlock();
1759                         return ret;
1760                 }
1761                 cb->args[0] = (long)state;
1762         }
1763
1764         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1765                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1766                         continue;
1767                 if (++idx <= state->start)
1768                         continue;
1769                 if (state->filter_wiphy != -1 &&
1770                     state->filter_wiphy != rdev->wiphy_idx)
1771                         continue;
1772                 /* attempt to fit multiple wiphy data chunks into the skb */
1773                 do {
1774                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1775                                                  skb,
1776                                                  NETLINK_CB(cb->skb).portid,
1777                                                  cb->nlh->nlmsg_seq,
1778                                                  NLM_F_MULTI, state);
1779                         if (ret < 0) {
1780                                 /*
1781                                  * If sending the wiphy data didn't fit (ENOBUFS
1782                                  * or EMSGSIZE returned), this SKB is still
1783                                  * empty (so it's not too big because another
1784                                  * wiphy dataset is already in the skb) and
1785                                  * we've not tried to adjust the dump allocation
1786                                  * yet ... then adjust the alloc size to be
1787                                  * bigger, and return 1 but with the empty skb.
1788                                  * This results in an empty message being RX'ed
1789                                  * in userspace, but that is ignored.
1790                                  *
1791                                  * We can then retry with the larger buffer.
1792                                  */
1793                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1794                                     !skb->len && !state->split &&
1795                                     cb->min_dump_alloc < 4096) {
1796                                         cb->min_dump_alloc = 4096;
1797                                         state->split_start = 0;
1798                                         rtnl_unlock();
1799                                         return 1;
1800                                 }
1801                                 idx--;
1802                                 break;
1803                         }
1804                 } while (state->split_start > 0);
1805                 break;
1806         }
1807         rtnl_unlock();
1808
1809         state->start = idx;
1810
1811         return skb->len;
1812 }
1813
1814 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1815 {
1816         kfree((void *)cb->args[0]);
1817         return 0;
1818 }
1819
1820 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1821 {
1822         struct sk_buff *msg;
1823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1824         struct nl80211_dump_wiphy_state state = {};
1825
1826         msg = nlmsg_new(4096, GFP_KERNEL);
1827         if (!msg)
1828                 return -ENOMEM;
1829
1830         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1831                                info->snd_portid, info->snd_seq, 0,
1832                                &state) < 0) {
1833                 nlmsg_free(msg);
1834                 return -ENOBUFS;
1835         }
1836
1837         return genlmsg_reply(msg, info);
1838 }
1839
1840 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1841         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1842         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1843         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1844         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1845         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1846 };
1847
1848 static int parse_txq_params(struct nlattr *tb[],
1849                             struct ieee80211_txq_params *txq_params)
1850 {
1851         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1852             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1853             !tb[NL80211_TXQ_ATTR_AIFS])
1854                 return -EINVAL;
1855
1856         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1857         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1858         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1859         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1860         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1861
1862         if (txq_params->ac >= NL80211_NUM_ACS)
1863                 return -EINVAL;
1864
1865         return 0;
1866 }
1867
1868 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1869 {
1870         /*
1871          * You can only set the channel explicitly for WDS interfaces,
1872          * all others have their channel managed via their respective
1873          * "establish a connection" command (connect, join, ...)
1874          *
1875          * For AP/GO and mesh mode, the channel can be set with the
1876          * channel userspace API, but is only stored and passed to the
1877          * low-level driver when the AP starts or the mesh is joined.
1878          * This is for backward compatibility, userspace can also give
1879          * the channel in the start-ap or join-mesh commands instead.
1880          *
1881          * Monitors are special as they are normally slaved to
1882          * whatever else is going on, so they have their own special
1883          * operation to set the monitor channel if possible.
1884          */
1885         return !wdev ||
1886                 wdev->iftype == NL80211_IFTYPE_AP ||
1887                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1888                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1889                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1890 }
1891
1892 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1893                                  struct genl_info *info,
1894                                  struct cfg80211_chan_def *chandef)
1895 {
1896         u32 control_freq;
1897
1898         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1899                 return -EINVAL;
1900
1901         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1902
1903         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1904         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1905         chandef->center_freq1 = control_freq;
1906         chandef->center_freq2 = 0;
1907
1908         /* Primary channel not allowed */
1909         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1910                 return -EINVAL;
1911
1912         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1913                 enum nl80211_channel_type chantype;
1914
1915                 chantype = nla_get_u32(
1916                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1917
1918                 switch (chantype) {
1919                 case NL80211_CHAN_NO_HT:
1920                 case NL80211_CHAN_HT20:
1921                 case NL80211_CHAN_HT40PLUS:
1922                 case NL80211_CHAN_HT40MINUS:
1923                         cfg80211_chandef_create(chandef, chandef->chan,
1924                                                 chantype);
1925                         break;
1926                 default:
1927                         return -EINVAL;
1928                 }
1929         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1930                 chandef->width =
1931                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1932                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1933                         chandef->center_freq1 =
1934                                 nla_get_u32(
1935                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1936                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1937                         chandef->center_freq2 =
1938                                 nla_get_u32(
1939                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1940         }
1941
1942         if (!cfg80211_chandef_valid(chandef))
1943                 return -EINVAL;
1944
1945         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1946                                      IEEE80211_CHAN_DISABLED))
1947                 return -EINVAL;
1948
1949         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1950              chandef->width == NL80211_CHAN_WIDTH_10) &&
1951             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1952                 return -EINVAL;
1953
1954         return 0;
1955 }
1956
1957 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1958                                  struct net_device *dev,
1959                                  struct genl_info *info)
1960 {
1961         struct cfg80211_chan_def chandef;
1962         int result;
1963         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1964         struct wireless_dev *wdev = NULL;
1965
1966         if (dev)
1967                 wdev = dev->ieee80211_ptr;
1968         if (!nl80211_can_set_dev_channel(wdev))
1969                 return -EOPNOTSUPP;
1970         if (wdev)
1971                 iftype = wdev->iftype;
1972
1973         result = nl80211_parse_chandef(rdev, info, &chandef);
1974         if (result)
1975                 return result;
1976
1977         switch (iftype) {
1978         case NL80211_IFTYPE_AP:
1979         case NL80211_IFTYPE_P2P_GO:
1980                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1981                         result = -EINVAL;
1982                         break;
1983                 }
1984                 if (wdev->beacon_interval) {
1985                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1986                             !(rdev->wiphy.features &
1987                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1988                                 result = -EBUSY;
1989                                 break;
1990                         }
1991
1992                         /* Only allow dynamic channel width changes */
1993                         if (chandef.chan != wdev->preset_chandef.chan) {
1994                                 result = -EBUSY;
1995                                 break;
1996                         }
1997                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
1998                         if (result)
1999                                 break;
2000                 }
2001                 wdev->preset_chandef = chandef;
2002                 result = 0;
2003                 break;
2004         case NL80211_IFTYPE_MESH_POINT:
2005                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2006                 break;
2007         case NL80211_IFTYPE_MONITOR:
2008                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2009                 break;
2010         default:
2011                 result = -EINVAL;
2012         }
2013
2014         return result;
2015 }
2016
2017 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2018 {
2019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2020         struct net_device *netdev = info->user_ptr[1];
2021
2022         return __nl80211_set_channel(rdev, netdev, info);
2023 }
2024
2025 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2026 {
2027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2028         struct net_device *dev = info->user_ptr[1];
2029         struct wireless_dev *wdev = dev->ieee80211_ptr;
2030         const u8 *bssid;
2031
2032         if (!info->attrs[NL80211_ATTR_MAC])
2033                 return -EINVAL;
2034
2035         if (netif_running(dev))
2036                 return -EBUSY;
2037
2038         if (!rdev->ops->set_wds_peer)
2039                 return -EOPNOTSUPP;
2040
2041         if (wdev->iftype != NL80211_IFTYPE_WDS)
2042                 return -EOPNOTSUPP;
2043
2044         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2045         return rdev_set_wds_peer(rdev, dev, bssid);
2046 }
2047
2048
2049 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2050 {
2051         struct cfg80211_registered_device *rdev;
2052         struct net_device *netdev = NULL;
2053         struct wireless_dev *wdev;
2054         int result = 0, rem_txq_params = 0;
2055         struct nlattr *nl_txq_params;
2056         u32 changed;
2057         u8 retry_short = 0, retry_long = 0;
2058         u32 frag_threshold = 0, rts_threshold = 0;
2059         u8 coverage_class = 0;
2060
2061         ASSERT_RTNL();
2062
2063         /*
2064          * Try to find the wiphy and netdev. Normally this
2065          * function shouldn't need the netdev, but this is
2066          * done for backward compatibility -- previously
2067          * setting the channel was done per wiphy, but now
2068          * it is per netdev. Previous userland like hostapd
2069          * also passed a netdev to set_wiphy, so that it is
2070          * possible to let that go to the right netdev!
2071          */
2072
2073         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2074                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2075
2076                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2077                 if (netdev && netdev->ieee80211_ptr)
2078                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2079                 else
2080                         netdev = NULL;
2081         }
2082
2083         if (!netdev) {
2084                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2085                                                   info->attrs);
2086                 if (IS_ERR(rdev))
2087                         return PTR_ERR(rdev);
2088                 wdev = NULL;
2089                 netdev = NULL;
2090                 result = 0;
2091         } else
2092                 wdev = netdev->ieee80211_ptr;
2093
2094         /*
2095          * end workaround code, by now the rdev is available
2096          * and locked, and wdev may or may not be NULL.
2097          */
2098
2099         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2100                 result = cfg80211_dev_rename(
2101                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2102
2103         if (result)
2104                 return result;
2105
2106         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2107                 struct ieee80211_txq_params txq_params;
2108                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2109
2110                 if (!rdev->ops->set_txq_params)
2111                         return -EOPNOTSUPP;
2112
2113                 if (!netdev)
2114                         return -EINVAL;
2115
2116                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2117                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2118                         return -EINVAL;
2119
2120                 if (!netif_running(netdev))
2121                         return -ENETDOWN;
2122
2123                 nla_for_each_nested(nl_txq_params,
2124                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2125                                     rem_txq_params) {
2126                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2127                                            nla_data(nl_txq_params),
2128                                            nla_len(nl_txq_params),
2129                                            txq_params_policy);
2130                         if (result)
2131                                 return result;
2132                         result = parse_txq_params(tb, &txq_params);
2133                         if (result)
2134                                 return result;
2135
2136                         result = rdev_set_txq_params(rdev, netdev,
2137                                                      &txq_params);
2138                         if (result)
2139                                 return result;
2140                 }
2141         }
2142
2143         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2144                 result = __nl80211_set_channel(
2145                         rdev,
2146                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2147                         info);
2148                 if (result)
2149                         return result;
2150         }
2151
2152         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2153                 struct wireless_dev *txp_wdev = wdev;
2154                 enum nl80211_tx_power_setting type;
2155                 int idx, mbm = 0;
2156
2157                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2158                         txp_wdev = NULL;
2159
2160                 if (!rdev->ops->set_tx_power)
2161                         return -EOPNOTSUPP;
2162
2163                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2164                 type = nla_get_u32(info->attrs[idx]);
2165
2166                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2167                     (type != NL80211_TX_POWER_AUTOMATIC))
2168                         return -EINVAL;
2169
2170                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2171                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2172                         mbm = nla_get_u32(info->attrs[idx]);
2173                 }
2174
2175                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2176                 if (result)
2177                         return result;
2178         }
2179
2180         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2181             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2182                 u32 tx_ant, rx_ant;
2183                 if ((!rdev->wiphy.available_antennas_tx &&
2184                      !rdev->wiphy.available_antennas_rx) ||
2185                     !rdev->ops->set_antenna)
2186                         return -EOPNOTSUPP;
2187
2188                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2189                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2190
2191                 /* reject antenna configurations which don't match the
2192                  * available antenna masks, except for the "all" mask */
2193                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2194                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2195                         return -EINVAL;
2196
2197                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2198                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2199
2200                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2201                 if (result)
2202                         return result;
2203         }
2204
2205         changed = 0;
2206
2207         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2208                 retry_short = nla_get_u8(
2209                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2210                 if (retry_short == 0)
2211                         return -EINVAL;
2212
2213                 changed |= WIPHY_PARAM_RETRY_SHORT;
2214         }
2215
2216         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2217                 retry_long = nla_get_u8(
2218                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2219                 if (retry_long == 0)
2220                         return -EINVAL;
2221
2222                 changed |= WIPHY_PARAM_RETRY_LONG;
2223         }
2224
2225         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2226                 frag_threshold = nla_get_u32(
2227                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2228                 if (frag_threshold < 256)
2229                         return -EINVAL;
2230
2231                 if (frag_threshold != (u32) -1) {
2232                         /*
2233                          * Fragments (apart from the last one) are required to
2234                          * have even length. Make the fragmentation code
2235                          * simpler by stripping LSB should someone try to use
2236                          * odd threshold value.
2237                          */
2238                         frag_threshold &= ~0x1;
2239                 }
2240                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2241         }
2242
2243         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2244                 rts_threshold = nla_get_u32(
2245                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2246                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2247         }
2248
2249         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2250                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2251                         return -EINVAL;
2252
2253                 coverage_class = nla_get_u8(
2254                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2255                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2256         }
2257
2258         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2259                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2260                         return -EOPNOTSUPP;
2261
2262                 changed |= WIPHY_PARAM_DYN_ACK;
2263         }
2264
2265         if (changed) {
2266                 u8 old_retry_short, old_retry_long;
2267                 u32 old_frag_threshold, old_rts_threshold;
2268                 u8 old_coverage_class;
2269
2270                 if (!rdev->ops->set_wiphy_params)
2271                         return -EOPNOTSUPP;
2272
2273                 old_retry_short = rdev->wiphy.retry_short;
2274                 old_retry_long = rdev->wiphy.retry_long;
2275                 old_frag_threshold = rdev->wiphy.frag_threshold;
2276                 old_rts_threshold = rdev->wiphy.rts_threshold;
2277                 old_coverage_class = rdev->wiphy.coverage_class;
2278
2279                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2280                         rdev->wiphy.retry_short = retry_short;
2281                 if (changed & WIPHY_PARAM_RETRY_LONG)
2282                         rdev->wiphy.retry_long = retry_long;
2283                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2284                         rdev->wiphy.frag_threshold = frag_threshold;
2285                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2286                         rdev->wiphy.rts_threshold = rts_threshold;
2287                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2288                         rdev->wiphy.coverage_class = coverage_class;
2289
2290                 result = rdev_set_wiphy_params(rdev, changed);
2291                 if (result) {
2292                         rdev->wiphy.retry_short = old_retry_short;
2293                         rdev->wiphy.retry_long = old_retry_long;
2294                         rdev->wiphy.frag_threshold = old_frag_threshold;
2295                         rdev->wiphy.rts_threshold = old_rts_threshold;
2296                         rdev->wiphy.coverage_class = old_coverage_class;
2297                 }
2298         }
2299         return 0;
2300 }
2301
2302 static inline u64 wdev_id(struct wireless_dev *wdev)
2303 {
2304         return (u64)wdev->identifier |
2305                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2306 }
2307
2308 static int nl80211_send_chandef(struct sk_buff *msg,
2309                                 const struct cfg80211_chan_def *chandef)
2310 {
2311         WARN_ON(!cfg80211_chandef_valid(chandef));
2312
2313         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2314                         chandef->chan->center_freq))
2315                 return -ENOBUFS;
2316         switch (chandef->width) {
2317         case NL80211_CHAN_WIDTH_20_NOHT:
2318         case NL80211_CHAN_WIDTH_20:
2319         case NL80211_CHAN_WIDTH_40:
2320                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2321                                 cfg80211_get_chandef_type(chandef)))
2322                         return -ENOBUFS;
2323                 break;
2324         default:
2325                 break;
2326         }
2327         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2328                 return -ENOBUFS;
2329         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2330                 return -ENOBUFS;
2331         if (chandef->center_freq2 &&
2332             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2333                 return -ENOBUFS;
2334         return 0;
2335 }
2336
2337 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2338                               struct cfg80211_registered_device *rdev,
2339                               struct wireless_dev *wdev)
2340 {
2341         struct net_device *dev = wdev->netdev;
2342         void *hdr;
2343
2344         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2345         if (!hdr)
2346                 return -1;
2347
2348         if (dev &&
2349             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2350              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2351                 goto nla_put_failure;
2352
2353         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2354             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2355             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2356             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2357             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2358                         rdev->devlist_generation ^
2359                         (cfg80211_rdev_list_generation << 2)))
2360                 goto nla_put_failure;
2361
2362         if (rdev->ops->get_channel) {
2363                 int ret;
2364                 struct cfg80211_chan_def chandef;
2365
2366                 ret = rdev_get_channel(rdev, wdev, &chandef);
2367                 if (ret == 0) {
2368                         if (nl80211_send_chandef(msg, &chandef))
2369                                 goto nla_put_failure;
2370                 }
2371         }
2372
2373         if (wdev->ssid_len) {
2374                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2375                         goto nla_put_failure;
2376         }
2377
2378         return genlmsg_end(msg, hdr);
2379
2380  nla_put_failure:
2381         genlmsg_cancel(msg, hdr);
2382         return -EMSGSIZE;
2383 }
2384
2385 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2386 {
2387         int wp_idx = 0;
2388         int if_idx = 0;
2389         int wp_start = cb->args[0];
2390         int if_start = cb->args[1];
2391         struct cfg80211_registered_device *rdev;
2392         struct wireless_dev *wdev;
2393
2394         rtnl_lock();
2395         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2396                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2397                         continue;
2398                 if (wp_idx < wp_start) {
2399                         wp_idx++;
2400                         continue;
2401                 }
2402                 if_idx = 0;
2403
2404                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2405                         if (if_idx < if_start) {
2406                                 if_idx++;
2407                                 continue;
2408                         }
2409                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2410                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2411                                                rdev, wdev) < 0) {
2412                                 goto out;
2413                         }
2414                         if_idx++;
2415                 }
2416
2417                 wp_idx++;
2418         }
2419  out:
2420         rtnl_unlock();
2421
2422         cb->args[0] = wp_idx;
2423         cb->args[1] = if_idx;
2424
2425         return skb->len;
2426 }
2427
2428 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2429 {
2430         struct sk_buff *msg;
2431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2432         struct wireless_dev *wdev = info->user_ptr[1];
2433
2434         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2435         if (!msg)
2436                 return -ENOMEM;
2437
2438         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2439                                rdev, wdev) < 0) {
2440                 nlmsg_free(msg);
2441                 return -ENOBUFS;
2442         }
2443
2444         return genlmsg_reply(msg, info);
2445 }
2446
2447 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2448         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2449         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2450         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2451         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2452         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2453         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2454 };
2455
2456 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2457 {
2458         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2459         int flag;
2460
2461         *mntrflags = 0;
2462
2463         if (!nla)
2464                 return -EINVAL;
2465
2466         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2467                              nla, mntr_flags_policy))
2468                 return -EINVAL;
2469
2470         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2471                 if (flags[flag])
2472                         *mntrflags |= (1<<flag);
2473
2474         return 0;
2475 }
2476
2477 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2478                                struct net_device *netdev, u8 use_4addr,
2479                                enum nl80211_iftype iftype)
2480 {
2481         if (!use_4addr) {
2482                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2483                         return -EBUSY;
2484                 return 0;
2485         }
2486
2487         switch (iftype) {
2488         case NL80211_IFTYPE_AP_VLAN:
2489                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2490                         return 0;
2491                 break;
2492         case NL80211_IFTYPE_STATION:
2493                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2494                         return 0;
2495                 break;
2496         default:
2497                 break;
2498         }
2499
2500         return -EOPNOTSUPP;
2501 }
2502
2503 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2504 {
2505         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2506         struct vif_params params;
2507         int err;
2508         enum nl80211_iftype otype, ntype;
2509         struct net_device *dev = info->user_ptr[1];
2510         u32 _flags, *flags = NULL;
2511         bool change = false;
2512
2513         memset(&params, 0, sizeof(params));
2514
2515         otype = ntype = dev->ieee80211_ptr->iftype;
2516
2517         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2518                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2519                 if (otype != ntype)
2520                         change = true;
2521                 if (ntype > NL80211_IFTYPE_MAX)
2522                         return -EINVAL;
2523         }
2524
2525         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2526                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2527
2528                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2529                         return -EINVAL;
2530                 if (netif_running(dev))
2531                         return -EBUSY;
2532
2533                 wdev_lock(wdev);
2534                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2535                              IEEE80211_MAX_MESH_ID_LEN);
2536                 wdev->mesh_id_up_len =
2537                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2538                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2539                        wdev->mesh_id_up_len);
2540                 wdev_unlock(wdev);
2541         }
2542
2543         if (info->attrs[NL80211_ATTR_4ADDR]) {
2544                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2545                 change = true;
2546                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2547                 if (err)
2548                         return err;
2549         } else {
2550                 params.use_4addr = -1;
2551         }
2552
2553         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2554                 if (ntype != NL80211_IFTYPE_MONITOR)
2555                         return -EINVAL;
2556                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2557                                           &_flags);
2558                 if (err)
2559                         return err;
2560
2561                 flags = &_flags;
2562                 change = true;
2563         }
2564
2565         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2566             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2567                 return -EOPNOTSUPP;
2568
2569         if (change)
2570                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2571         else
2572                 err = 0;
2573
2574         if (!err && params.use_4addr != -1)
2575                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2576
2577         return err;
2578 }
2579
2580 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2581 {
2582         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2583         struct vif_params params;
2584         struct wireless_dev *wdev;
2585         struct sk_buff *msg;
2586         int err;
2587         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2588         u32 flags;
2589
2590         /* to avoid failing a new interface creation due to pending removal */
2591         cfg80211_destroy_ifaces(rdev);
2592
2593         memset(&params, 0, sizeof(params));
2594
2595         if (!info->attrs[NL80211_ATTR_IFNAME])
2596                 return -EINVAL;
2597
2598         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2599                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2600                 if (type > NL80211_IFTYPE_MAX)
2601                         return -EINVAL;
2602         }
2603
2604         if (!rdev->ops->add_virtual_intf ||
2605             !(rdev->wiphy.interface_modes & (1 << type)))
2606                 return -EOPNOTSUPP;
2607
2608         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2609                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2610                            ETH_ALEN);
2611                 if (!is_valid_ether_addr(params.macaddr))
2612                         return -EADDRNOTAVAIL;
2613         }
2614
2615         if (info->attrs[NL80211_ATTR_4ADDR]) {
2616                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2617                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2618                 if (err)
2619                         return err;
2620         }
2621
2622         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2623         if (!msg)
2624                 return -ENOMEM;
2625
2626         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2627                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2628                                   &flags);
2629
2630         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2631             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2632                 return -EOPNOTSUPP;
2633
2634         wdev = rdev_add_virtual_intf(rdev,
2635                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2636                                 type, err ? NULL : &flags, &params);
2637         if (IS_ERR(wdev)) {
2638                 nlmsg_free(msg);
2639                 return PTR_ERR(wdev);
2640         }
2641
2642         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2643                 wdev->owner_nlportid = info->snd_portid;
2644
2645         switch (type) {
2646         case NL80211_IFTYPE_MESH_POINT:
2647                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2648                         break;
2649                 wdev_lock(wdev);
2650                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2651                              IEEE80211_MAX_MESH_ID_LEN);
2652                 wdev->mesh_id_up_len =
2653                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2654                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2655                        wdev->mesh_id_up_len);
2656                 wdev_unlock(wdev);
2657                 break;
2658         case NL80211_IFTYPE_P2P_DEVICE:
2659                 /*
2660                  * P2P Device doesn't have a netdev, so doesn't go
2661                  * through the netdev notifier and must be added here
2662                  */
2663                 mutex_init(&wdev->mtx);
2664                 INIT_LIST_HEAD(&wdev->event_list);
2665                 spin_lock_init(&wdev->event_lock);
2666                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2667                 spin_lock_init(&wdev->mgmt_registrations_lock);
2668
2669                 wdev->identifier = ++rdev->wdev_id;
2670                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2671                 rdev->devlist_generation++;
2672                 break;
2673         default:
2674                 break;
2675         }
2676
2677         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2678                                rdev, wdev) < 0) {
2679                 nlmsg_free(msg);
2680                 return -ENOBUFS;
2681         }
2682
2683         return genlmsg_reply(msg, info);
2684 }
2685
2686 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2687 {
2688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2689         struct wireless_dev *wdev = info->user_ptr[1];
2690
2691         if (!rdev->ops->del_virtual_intf)
2692                 return -EOPNOTSUPP;
2693
2694         /*
2695          * If we remove a wireless device without a netdev then clear
2696          * user_ptr[1] so that nl80211_post_doit won't dereference it
2697          * to check if it needs to do dev_put(). Otherwise it crashes
2698          * since the wdev has been freed, unlike with a netdev where
2699          * we need the dev_put() for the netdev to really be freed.
2700          */
2701         if (!wdev->netdev)
2702                 info->user_ptr[1] = NULL;
2703
2704         return rdev_del_virtual_intf(rdev, wdev);
2705 }
2706
2707 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2708 {
2709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2710         struct net_device *dev = info->user_ptr[1];
2711         u16 noack_map;
2712
2713         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2714                 return -EINVAL;
2715
2716         if (!rdev->ops->set_noack_map)
2717                 return -EOPNOTSUPP;
2718
2719         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2720
2721         return rdev_set_noack_map(rdev, dev, noack_map);
2722 }
2723
2724 struct get_key_cookie {
2725         struct sk_buff *msg;
2726         int error;
2727         int idx;
2728 };
2729
2730 static void get_key_callback(void *c, struct key_params *params)
2731 {
2732         struct nlattr *key;
2733         struct get_key_cookie *cookie = c;
2734
2735         if ((params->key &&
2736              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2737                      params->key_len, params->key)) ||
2738             (params->seq &&
2739              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2740                      params->seq_len, params->seq)) ||
2741             (params->cipher &&
2742              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2743                          params->cipher)))
2744                 goto nla_put_failure;
2745
2746         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2747         if (!key)
2748                 goto nla_put_failure;
2749
2750         if ((params->key &&
2751              nla_put(cookie->msg, NL80211_KEY_DATA,
2752                      params->key_len, params->key)) ||
2753             (params->seq &&
2754              nla_put(cookie->msg, NL80211_KEY_SEQ,
2755                      params->seq_len, params->seq)) ||
2756             (params->cipher &&
2757              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2758                          params->cipher)))
2759                 goto nla_put_failure;
2760
2761         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2762                 goto nla_put_failure;
2763
2764         nla_nest_end(cookie->msg, key);
2765
2766         return;
2767  nla_put_failure:
2768         cookie->error = 1;
2769 }
2770
2771 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2772 {
2773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2774         int err;
2775         struct net_device *dev = info->user_ptr[1];
2776         u8 key_idx = 0;
2777         const u8 *mac_addr = NULL;
2778         bool pairwise;
2779         struct get_key_cookie cookie = {
2780                 .error = 0,
2781         };
2782         void *hdr;
2783         struct sk_buff *msg;
2784
2785         if (info->attrs[NL80211_ATTR_KEY_IDX])
2786                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2787
2788         if (key_idx > 5)
2789                 return -EINVAL;
2790
2791         if (info->attrs[NL80211_ATTR_MAC])
2792                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2793
2794         pairwise = !!mac_addr;
2795         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2796                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2797                 if (kt >= NUM_NL80211_KEYTYPES)
2798                         return -EINVAL;
2799                 if (kt != NL80211_KEYTYPE_GROUP &&
2800                     kt != NL80211_KEYTYPE_PAIRWISE)
2801                         return -EINVAL;
2802                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2803         }
2804
2805         if (!rdev->ops->get_key)
2806                 return -EOPNOTSUPP;
2807
2808         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2809         if (!msg)
2810                 return -ENOMEM;
2811
2812         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2813                              NL80211_CMD_NEW_KEY);
2814         if (!hdr)
2815                 goto nla_put_failure;
2816
2817         cookie.msg = msg;
2818         cookie.idx = key_idx;
2819
2820         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2821             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2822                 goto nla_put_failure;
2823         if (mac_addr &&
2824             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2825                 goto nla_put_failure;
2826
2827         if (pairwise && mac_addr &&
2828             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2829                 return -ENOENT;
2830
2831         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2832                            get_key_callback);
2833
2834         if (err)
2835                 goto free_msg;
2836
2837         if (cookie.error)
2838                 goto nla_put_failure;
2839
2840         genlmsg_end(msg, hdr);
2841         return genlmsg_reply(msg, info);
2842
2843  nla_put_failure:
2844         err = -ENOBUFS;
2845  free_msg:
2846         nlmsg_free(msg);
2847         return err;
2848 }
2849
2850 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2851 {
2852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2853         struct key_parse key;
2854         int err;
2855         struct net_device *dev = info->user_ptr[1];
2856
2857         err = nl80211_parse_key(info, &key);
2858         if (err)
2859                 return err;
2860
2861         if (key.idx < 0)
2862                 return -EINVAL;
2863
2864         /* only support setting default key */
2865         if (!key.def && !key.defmgmt)
2866                 return -EINVAL;
2867
2868         wdev_lock(dev->ieee80211_ptr);
2869
2870         if (key.def) {
2871                 if (!rdev->ops->set_default_key) {
2872                         err = -EOPNOTSUPP;
2873                         goto out;
2874                 }
2875
2876                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2877                 if (err)
2878                         goto out;
2879
2880                 err = rdev_set_default_key(rdev, dev, key.idx,
2881                                                  key.def_uni, key.def_multi);
2882
2883                 if (err)
2884                         goto out;
2885
2886 #ifdef CONFIG_CFG80211_WEXT
2887                 dev->ieee80211_ptr->wext.default_key = key.idx;
2888 #endif
2889         } else {
2890                 if (key.def_uni || !key.def_multi) {
2891                         err = -EINVAL;
2892                         goto out;
2893                 }
2894
2895                 if (!rdev->ops->set_default_mgmt_key) {
2896                         err = -EOPNOTSUPP;
2897                         goto out;
2898                 }
2899
2900                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2901                 if (err)
2902                         goto out;
2903
2904                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2905                 if (err)
2906                         goto out;
2907
2908 #ifdef CONFIG_CFG80211_WEXT
2909                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2910 #endif
2911         }
2912
2913  out:
2914         wdev_unlock(dev->ieee80211_ptr);
2915
2916         return err;
2917 }
2918
2919 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2920 {
2921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2922         int err;
2923         struct net_device *dev = info->user_ptr[1];
2924         struct key_parse key;
2925         const u8 *mac_addr = NULL;
2926
2927         err = nl80211_parse_key(info, &key);
2928         if (err)
2929                 return err;
2930
2931         if (!key.p.key)
2932                 return -EINVAL;
2933
2934         if (info->attrs[NL80211_ATTR_MAC])
2935                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2936
2937         if (key.type == -1) {
2938                 if (mac_addr)
2939                         key.type = NL80211_KEYTYPE_PAIRWISE;
2940                 else
2941                         key.type = NL80211_KEYTYPE_GROUP;
2942         }
2943
2944         /* for now */
2945         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2946             key.type != NL80211_KEYTYPE_GROUP)
2947                 return -EINVAL;
2948
2949         if (!rdev->ops->add_key)
2950                 return -EOPNOTSUPP;
2951
2952         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2953                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2954                                            mac_addr))
2955                 return -EINVAL;
2956
2957         wdev_lock(dev->ieee80211_ptr);
2958         err = nl80211_key_allowed(dev->ieee80211_ptr);
2959         if (!err)
2960                 err = rdev_add_key(rdev, dev, key.idx,
2961                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2962                                     mac_addr, &key.p);
2963         wdev_unlock(dev->ieee80211_ptr);
2964
2965         return err;
2966 }
2967
2968 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2969 {
2970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2971         int err;
2972         struct net_device *dev = info->user_ptr[1];
2973         u8 *mac_addr = NULL;
2974         struct key_parse key;
2975
2976         err = nl80211_parse_key(info, &key);
2977         if (err)
2978                 return err;
2979
2980         if (info->attrs[NL80211_ATTR_MAC])
2981                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2982
2983         if (key.type == -1) {
2984                 if (mac_addr)
2985                         key.type = NL80211_KEYTYPE_PAIRWISE;
2986                 else
2987                         key.type = NL80211_KEYTYPE_GROUP;
2988         }
2989
2990         /* for now */
2991         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2992             key.type != NL80211_KEYTYPE_GROUP)
2993                 return -EINVAL;
2994
2995         if (!rdev->ops->del_key)
2996                 return -EOPNOTSUPP;
2997
2998         wdev_lock(dev->ieee80211_ptr);
2999         err = nl80211_key_allowed(dev->ieee80211_ptr);
3000
3001         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
3002             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3003                 err = -ENOENT;
3004
3005         if (!err)
3006                 err = rdev_del_key(rdev, dev, key.idx,
3007                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3008                                    mac_addr);
3009
3010 #ifdef CONFIG_CFG80211_WEXT
3011         if (!err) {
3012                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3013                         dev->ieee80211_ptr->wext.default_key = -1;
3014                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3015                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3016         }
3017 #endif
3018         wdev_unlock(dev->ieee80211_ptr);
3019
3020         return err;
3021 }
3022
3023 /* This function returns an error or the number of nested attributes */
3024 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3025 {
3026         struct nlattr *attr;
3027         int n_entries = 0, tmp;
3028
3029         nla_for_each_nested(attr, nl_attr, tmp) {
3030                 if (nla_len(attr) != ETH_ALEN)
3031                         return -EINVAL;
3032
3033                 n_entries++;
3034         }
3035
3036         return n_entries;
3037 }
3038
3039 /*
3040  * This function parses ACL information and allocates memory for ACL data.
3041  * On successful return, the calling function is responsible to free the
3042  * ACL buffer returned by this function.
3043  */
3044 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3045                                                 struct genl_info *info)
3046 {
3047         enum nl80211_acl_policy acl_policy;
3048         struct nlattr *attr;
3049         struct cfg80211_acl_data *acl;
3050         int i = 0, n_entries, tmp;
3051
3052         if (!wiphy->max_acl_mac_addrs)
3053                 return ERR_PTR(-EOPNOTSUPP);
3054
3055         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3056                 return ERR_PTR(-EINVAL);
3057
3058         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3059         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3060             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3061                 return ERR_PTR(-EINVAL);
3062
3063         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3064                 return ERR_PTR(-EINVAL);
3065
3066         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3067         if (n_entries < 0)
3068                 return ERR_PTR(n_entries);
3069
3070         if (n_entries > wiphy->max_acl_mac_addrs)
3071                 return ERR_PTR(-ENOTSUPP);
3072
3073         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3074                       GFP_KERNEL);
3075         if (!acl)
3076                 return ERR_PTR(-ENOMEM);
3077
3078         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3079                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3080                 i++;
3081         }
3082
3083         acl->n_acl_entries = n_entries;
3084         acl->acl_policy = acl_policy;
3085
3086         return acl;
3087 }
3088
3089 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3090 {
3091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3092         struct net_device *dev = info->user_ptr[1];
3093         struct cfg80211_acl_data *acl;
3094         int err;
3095
3096         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3097             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3098                 return -EOPNOTSUPP;
3099
3100         if (!dev->ieee80211_ptr->beacon_interval)
3101                 return -EINVAL;
3102
3103         acl = parse_acl_data(&rdev->wiphy, info);
3104         if (IS_ERR(acl))
3105                 return PTR_ERR(acl);
3106
3107         err = rdev_set_mac_acl(rdev, dev, acl);
3108
3109         kfree(acl);
3110
3111         return err;
3112 }
3113
3114 static int nl80211_parse_beacon(struct nlattr *attrs[],
3115                                 struct cfg80211_beacon_data *bcn)
3116 {
3117         bool haveinfo = false;
3118
3119         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3120             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3121             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3122             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3123                 return -EINVAL;
3124
3125         memset(bcn, 0, sizeof(*bcn));
3126
3127         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3128                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3129                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3130                 if (!bcn->head_len)
3131                         return -EINVAL;
3132                 haveinfo = true;
3133         }
3134
3135         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3136                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3137                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3138                 haveinfo = true;
3139         }
3140
3141         if (!haveinfo)
3142                 return -EINVAL;
3143
3144         if (attrs[NL80211_ATTR_IE]) {
3145                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3146                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3147         }
3148
3149         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3150                 bcn->proberesp_ies =
3151                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3152                 bcn->proberesp_ies_len =
3153                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3154         }
3155
3156         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3157                 bcn->assocresp_ies =
3158                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3159                 bcn->assocresp_ies_len =
3160                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3161         }
3162
3163         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3164                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3165                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3166         }
3167
3168         return 0;
3169 }
3170
3171 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3172                                    struct cfg80211_ap_settings *params)
3173 {
3174         struct wireless_dev *wdev;
3175         bool ret = false;
3176
3177         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3178                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3179                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3180                         continue;
3181
3182                 if (!wdev->preset_chandef.chan)
3183                         continue;
3184
3185                 params->chandef = wdev->preset_chandef;
3186                 ret = true;
3187                 break;
3188         }
3189
3190         return ret;
3191 }
3192
3193 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3194                                     enum nl80211_auth_type auth_type,
3195                                     enum nl80211_commands cmd)
3196 {
3197         if (auth_type > NL80211_AUTHTYPE_MAX)
3198                 return false;
3199
3200         switch (cmd) {
3201         case NL80211_CMD_AUTHENTICATE:
3202                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3203                     auth_type == NL80211_AUTHTYPE_SAE)
3204                         return false;
3205                 return true;
3206         case NL80211_CMD_CONNECT:
3207         case NL80211_CMD_START_AP:
3208                 /* SAE not supported yet */
3209                 if (auth_type == NL80211_AUTHTYPE_SAE)
3210                         return false;
3211                 return true;
3212         default:
3213                 return false;
3214         }
3215 }
3216
3217 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3218 {
3219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3220         struct net_device *dev = info->user_ptr[1];
3221         struct wireless_dev *wdev = dev->ieee80211_ptr;
3222         struct cfg80211_ap_settings params;
3223         int err;
3224
3225         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3226             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3227                 return -EOPNOTSUPP;
3228
3229         if (!rdev->ops->start_ap)
3230                 return -EOPNOTSUPP;
3231
3232         if (wdev->beacon_interval)
3233                 return -EALREADY;
3234
3235         memset(&params, 0, sizeof(params));
3236
3237         /* these are required for START_AP */
3238         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3239             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3240             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3241                 return -EINVAL;
3242
3243         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3244         if (err)
3245                 return err;
3246
3247         params.beacon_interval =
3248                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3249         params.dtim_period =
3250                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3251
3252         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3253         if (err)
3254                 return err;
3255
3256         /*
3257          * In theory, some of these attributes should be required here
3258          * but since they were not used when the command was originally
3259          * added, keep them optional for old user space programs to let
3260          * them continue to work with drivers that do not need the
3261          * additional information -- drivers must check!
3262          */
3263         if (info->attrs[NL80211_ATTR_SSID]) {
3264                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3265                 params.ssid_len =
3266                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3267                 if (params.ssid_len == 0 ||
3268                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3269                         return -EINVAL;
3270         }
3271
3272         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3273                 params.hidden_ssid = nla_get_u32(
3274                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3275                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3276                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3277                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3278                         return -EINVAL;
3279         }
3280
3281         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3282
3283         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3284                 params.auth_type = nla_get_u32(
3285                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3286                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3287                                              NL80211_CMD_START_AP))
3288                         return -EINVAL;
3289         } else
3290                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3291
3292         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3293                                       NL80211_MAX_NR_CIPHER_SUITES);
3294         if (err)
3295                 return err;
3296
3297         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3298                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3299                         return -EOPNOTSUPP;
3300                 params.inactivity_timeout = nla_get_u16(
3301                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3302         }
3303
3304         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3305                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3306                         return -EINVAL;
3307                 params.p2p_ctwindow =
3308                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3309                 if (params.p2p_ctwindow > 127)
3310                         return -EINVAL;
3311                 if (params.p2p_ctwindow != 0 &&
3312                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3313                         return -EINVAL;
3314         }
3315
3316         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3317                 u8 tmp;
3318
3319                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3320                         return -EINVAL;
3321                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3322                 if (tmp > 1)
3323                         return -EINVAL;
3324                 params.p2p_opp_ps = tmp;
3325                 if (params.p2p_opp_ps != 0 &&
3326                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3327                         return -EINVAL;
3328         }
3329
3330         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3331                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3332                 if (err)
3333                         return err;
3334         } else if (wdev->preset_chandef.chan) {
3335                 params.chandef = wdev->preset_chandef;
3336         } else if (!nl80211_get_ap_channel(rdev, &params))
3337                 return -EINVAL;
3338
3339         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3340                                      wdev->iftype))
3341                 return -EINVAL;
3342
3343         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3344                 params.acl = parse_acl_data(&rdev->wiphy, info);
3345                 if (IS_ERR(params.acl))
3346                         return PTR_ERR(params.acl);
3347         }
3348
3349         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3350                 params.smps_mode =
3351                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3352                 switch (params.smps_mode) {
3353                 case NL80211_SMPS_OFF:
3354                         break;
3355                 case NL80211_SMPS_STATIC:
3356                         if (!(rdev->wiphy.features &
3357                               NL80211_FEATURE_STATIC_SMPS))
3358                                 return -EINVAL;
3359                         break;
3360                 case NL80211_SMPS_DYNAMIC:
3361                         if (!(rdev->wiphy.features &
3362                               NL80211_FEATURE_DYNAMIC_SMPS))
3363                                 return -EINVAL;
3364                         break;
3365                 default:
3366                         return -EINVAL;
3367                 }
3368         } else {
3369                 params.smps_mode = NL80211_SMPS_OFF;
3370         }
3371
3372         wdev_lock(wdev);
3373         err = rdev_start_ap(rdev, dev, &params);
3374         if (!err) {
3375                 wdev->preset_chandef = params.chandef;
3376                 wdev->beacon_interval = params.beacon_interval;
3377                 wdev->chandef = params.chandef;
3378                 wdev->ssid_len = params.ssid_len;
3379                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3380         }
3381         wdev_unlock(wdev);
3382
3383         kfree(params.acl);
3384
3385         return err;
3386 }
3387
3388 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3389 {
3390         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3391         struct net_device *dev = info->user_ptr[1];
3392         struct wireless_dev *wdev = dev->ieee80211_ptr;
3393         struct cfg80211_beacon_data params;
3394         int err;
3395
3396         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3397             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3398                 return -EOPNOTSUPP;
3399
3400         if (!rdev->ops->change_beacon)
3401                 return -EOPNOTSUPP;
3402
3403         if (!wdev->beacon_interval)
3404                 return -EINVAL;
3405
3406         err = nl80211_parse_beacon(info->attrs, &params);
3407         if (err)
3408                 return err;
3409
3410         wdev_lock(wdev);
3411         err = rdev_change_beacon(rdev, dev, &params);
3412         wdev_unlock(wdev);
3413
3414         return err;
3415 }
3416
3417 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3418 {
3419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3420         struct net_device *dev = info->user_ptr[1];
3421
3422         return cfg80211_stop_ap(rdev, dev, false);
3423 }
3424
3425 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3426         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3427         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3428         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3429         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3430         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3431         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3432 };
3433
3434 static int parse_station_flags(struct genl_info *info,
3435                                enum nl80211_iftype iftype,
3436                                struct station_parameters *params)
3437 {
3438         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3439         struct nlattr *nla;
3440         int flag;
3441
3442         /*
3443          * Try parsing the new attribute first so userspace
3444          * can specify both for older kernels.
3445          */
3446         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3447         if (nla) {
3448                 struct nl80211_sta_flag_update *sta_flags;
3449
3450                 sta_flags = nla_data(nla);
3451                 params->sta_flags_mask = sta_flags->mask;
3452                 params->sta_flags_set = sta_flags->set;
3453                 params->sta_flags_set &= params->sta_flags_mask;
3454                 if ((params->sta_flags_mask |
3455                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3456                         return -EINVAL;
3457                 return 0;
3458         }
3459
3460         /* if present, parse the old attribute */
3461
3462         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3463         if (!nla)
3464                 return 0;
3465
3466         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3467                              nla, sta_flags_policy))
3468                 return -EINVAL;
3469
3470         /*
3471          * Only allow certain flags for interface types so that
3472          * other attributes are silently ignored. Remember that
3473          * this is backward compatibility code with old userspace
3474          * and shouldn't be hit in other cases anyway.
3475          */
3476         switch (iftype) {
3477         case NL80211_IFTYPE_AP:
3478         case NL80211_IFTYPE_AP_VLAN:
3479         case NL80211_IFTYPE_P2P_GO:
3480                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3481                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3482                                          BIT(NL80211_STA_FLAG_WME) |
3483                                          BIT(NL80211_STA_FLAG_MFP);
3484                 break;
3485         case NL80211_IFTYPE_P2P_CLIENT:
3486         case NL80211_IFTYPE_STATION:
3487                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3488                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3489                 break;
3490         case NL80211_IFTYPE_MESH_POINT:
3491                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3492                                          BIT(NL80211_STA_FLAG_MFP) |
3493                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3494         default:
3495                 return -EINVAL;
3496         }
3497
3498         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3499                 if (flags[flag]) {
3500                         params->sta_flags_set |= (1<<flag);
3501
3502                         /* no longer support new API additions in old API */
3503                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3504                                 return -EINVAL;
3505                 }
3506         }
3507
3508         return 0;
3509 }
3510
3511 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3512                                  int attr)
3513 {
3514         struct nlattr *rate;
3515         u32 bitrate;
3516         u16 bitrate_compat;
3517
3518         rate = nla_nest_start(msg, attr);
3519         if (!rate)
3520                 return false;
3521
3522         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3523         bitrate = cfg80211_calculate_bitrate(info);
3524         /* report 16-bit bitrate only if we can */
3525         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3526         if (bitrate > 0 &&
3527             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3528                 return false;
3529         if (bitrate_compat > 0 &&
3530             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3531                 return false;
3532
3533         if (info->flags & RATE_INFO_FLAGS_MCS) {
3534                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3535                         return false;
3536                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3537                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3538                         return false;
3539                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3540                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3541                         return false;
3542         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3543                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3544                         return false;
3545                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3546                         return false;
3547                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3548                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3549                         return false;
3550                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3551                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3552                         return false;
3553                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3554                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3555                         return false;
3556                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3557                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3558                         return false;
3559                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3560                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3561                         return false;
3562         }
3563
3564         nla_nest_end(msg, rate);
3565         return true;
3566 }
3567
3568 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3569                                int id)
3570 {
3571         void *attr;
3572         int i = 0;
3573
3574         if (!mask)
3575                 return true;
3576
3577         attr = nla_nest_start(msg, id);
3578         if (!attr)
3579                 return false;
3580
3581         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3582                 if (!(mask & BIT(i)))
3583                         continue;
3584
3585                 if (nla_put_u8(msg, i, signal[i]))
3586                         return false;
3587         }
3588
3589         nla_nest_end(msg, attr);
3590
3591         return true;
3592 }
3593
3594 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3595                                 int flags,
3596                                 struct cfg80211_registered_device *rdev,
3597                                 struct net_device *dev,
3598                                 const u8 *mac_addr, struct station_info *sinfo)
3599 {
3600         void *hdr;
3601         struct nlattr *sinfoattr, *bss_param;
3602
3603         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3604         if (!hdr)
3605                 return -1;
3606
3607         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3608             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3609             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3610                 goto nla_put_failure;
3611
3612         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3613         if (!sinfoattr)
3614                 goto nla_put_failure;
3615         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3616             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3617                         sinfo->connected_time))
3618                 goto nla_put_failure;
3619         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3620             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3621                         sinfo->inactive_time))
3622                 goto nla_put_failure;
3623         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3624                               STATION_INFO_RX_BYTES64)) &&
3625             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3626                         (u32)sinfo->rx_bytes))
3627                 goto nla_put_failure;
3628         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3629                               STATION_INFO_TX_BYTES64)) &&
3630             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3631                         (u32)sinfo->tx_bytes))
3632                 goto nla_put_failure;
3633         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3634             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3635                         sinfo->rx_bytes))
3636                 goto nla_put_failure;
3637         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3638             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3639                         sinfo->tx_bytes))
3640                 goto nla_put_failure;
3641         if ((sinfo->filled & STATION_INFO_LLID) &&
3642             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3643                 goto nla_put_failure;
3644         if ((sinfo->filled & STATION_INFO_PLID) &&
3645             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3646                 goto nla_put_failure;
3647         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3648             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3649                        sinfo->plink_state))
3650                 goto nla_put_failure;
3651         switch (rdev->wiphy.signal_type) {
3652         case CFG80211_SIGNAL_TYPE_MBM:
3653                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3654                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3655                                sinfo->signal))
3656                         goto nla_put_failure;
3657                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3658                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3659                                sinfo->signal_avg))
3660                         goto nla_put_failure;
3661                 break;
3662         default:
3663                 break;
3664         }
3665         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3666                 if (!nl80211_put_signal(msg, sinfo->chains,
3667                                         sinfo->chain_signal,
3668                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3669                         goto nla_put_failure;
3670         }
3671         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3672                 if (!nl80211_put_signal(msg, sinfo->chains,
3673                                         sinfo->chain_signal_avg,
3674                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3675                         goto nla_put_failure;
3676         }
3677         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3678                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3679                                           NL80211_STA_INFO_TX_BITRATE))
3680                         goto nla_put_failure;
3681         }
3682         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3683                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3684                                           NL80211_STA_INFO_RX_BITRATE))
3685                         goto nla_put_failure;
3686         }
3687         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3688             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3689                         sinfo->rx_packets))
3690                 goto nla_put_failure;
3691         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3692             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3693                         sinfo->tx_packets))
3694                 goto nla_put_failure;
3695         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3696             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3697                         sinfo->tx_retries))
3698                 goto nla_put_failure;
3699         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3700             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3701                         sinfo->tx_failed))
3702                 goto nla_put_failure;
3703         if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
3704             nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
3705                         sinfo->expected_throughput))
3706                 goto nla_put_failure;
3707         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3708             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3709                         sinfo->beacon_loss_count))
3710                 goto nla_put_failure;
3711         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3712             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3713                         sinfo->local_pm))
3714                 goto nla_put_failure;
3715         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3716             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3717                         sinfo->peer_pm))
3718                 goto nla_put_failure;
3719         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3720             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3721                         sinfo->nonpeer_pm))
3722                 goto nla_put_failure;
3723         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3724                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3725                 if (!bss_param)
3726                         goto nla_put_failure;
3727
3728                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3729                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3730                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3731                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3732                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3733                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3734                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3735                                sinfo->bss_param.dtim_period) ||
3736                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3737                                 sinfo->bss_param.beacon_interval))
3738                         goto nla_put_failure;
3739
3740                 nla_nest_end(msg, bss_param);
3741         }
3742         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3743             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3744                     sizeof(struct nl80211_sta_flag_update),
3745                     &sinfo->sta_flags))
3746                 goto nla_put_failure;
3747         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3748                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3749                             sinfo->t_offset))
3750                 goto nla_put_failure;
3751         nla_nest_end(msg, sinfoattr);
3752
3753         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3754             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3755                     sinfo->assoc_req_ies))
3756                 goto nla_put_failure;
3757
3758         return genlmsg_end(msg, hdr);
3759
3760  nla_put_failure:
3761         genlmsg_cancel(msg, hdr);
3762         return -EMSGSIZE;
3763 }
3764
3765 static int nl80211_dump_station(struct sk_buff *skb,
3766                                 struct netlink_callback *cb)
3767 {
3768         struct station_info sinfo;
3769         struct cfg80211_registered_device *rdev;
3770         struct wireless_dev *wdev;
3771         u8 mac_addr[ETH_ALEN];
3772         int sta_idx = cb->args[2];
3773         int err;
3774
3775         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3776         if (err)
3777                 return err;
3778
3779         if (!wdev->netdev) {
3780                 err = -EINVAL;
3781                 goto out_err;
3782         }
3783
3784         if (!rdev->ops->dump_station) {
3785                 err = -EOPNOTSUPP;
3786                 goto out_err;
3787         }
3788
3789         while (1) {
3790                 memset(&sinfo, 0, sizeof(sinfo));
3791                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3792                                         mac_addr, &sinfo);
3793                 if (err == -ENOENT)
3794                         break;
3795                 if (err)
3796                         goto out_err;
3797
3798                 if (nl80211_send_station(skb,
3799                                 NETLINK_CB(cb->skb).portid,
3800                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3801                                 rdev, wdev->netdev, mac_addr,
3802                                 &sinfo) < 0)
3803                         goto out;
3804
3805                 sta_idx++;
3806         }
3807
3808
3809  out:
3810         cb->args[2] = sta_idx;
3811         err = skb->len;
3812  out_err:
3813         nl80211_finish_wdev_dump(rdev);
3814
3815         return err;
3816 }
3817
3818 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3819 {
3820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3821         struct net_device *dev = info->user_ptr[1];
3822         struct station_info sinfo;
3823         struct sk_buff *msg;
3824         u8 *mac_addr = NULL;
3825         int err;
3826
3827         memset(&sinfo, 0, sizeof(sinfo));
3828
3829         if (!info->attrs[NL80211_ATTR_MAC])
3830                 return -EINVAL;
3831
3832         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3833
3834         if (!rdev->ops->get_station)
3835                 return -EOPNOTSUPP;
3836
3837         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3838         if (err)
3839                 return err;
3840
3841         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3842         if (!msg)
3843                 return -ENOMEM;
3844
3845         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3846                                  rdev, dev, mac_addr, &sinfo) < 0) {
3847                 nlmsg_free(msg);
3848                 return -ENOBUFS;
3849         }
3850
3851         return genlmsg_reply(msg, info);
3852 }
3853
3854 int cfg80211_check_station_change(struct wiphy *wiphy,
3855                                   struct station_parameters *params,
3856                                   enum cfg80211_station_type statype)
3857 {
3858         if (params->listen_interval != -1)
3859                 return -EINVAL;
3860         if (params->aid &&
3861             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3862                 return -EINVAL;
3863
3864         /* When you run into this, adjust the code below for the new flag */
3865         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3866
3867         switch (statype) {
3868         case CFG80211_STA_MESH_PEER_KERNEL:
3869         case CFG80211_STA_MESH_PEER_USER:
3870                 /*
3871                  * No ignoring the TDLS flag here -- the userspace mesh
3872                  * code doesn't have the bug of including TDLS in the
3873                  * mask everywhere.
3874                  */
3875                 if (params->sta_flags_mask &
3876                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3877                                   BIT(NL80211_STA_FLAG_MFP) |
3878                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3879                         return -EINVAL;
3880                 break;
3881         case CFG80211_STA_TDLS_PEER_SETUP:
3882         case CFG80211_STA_TDLS_PEER_ACTIVE:
3883                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3884                         return -EINVAL;
3885                 /* ignore since it can't change */
3886                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3887                 break;
3888         default:
3889                 /* disallow mesh-specific things */
3890                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3891                         return -EINVAL;
3892                 if (params->local_pm)
3893                         return -EINVAL;
3894                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3895                         return -EINVAL;
3896         }
3897
3898         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3899             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3900                 /* TDLS can't be set, ... */
3901                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3902                         return -EINVAL;
3903                 /*
3904                  * ... but don't bother the driver with it. This works around
3905                  * a hostapd/wpa_supplicant issue -- it always includes the
3906                  * TLDS_PEER flag in the mask even for AP mode.
3907                  */
3908                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3909         }
3910
3911         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3912                 /* reject other things that can't change */
3913                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3914                         return -EINVAL;
3915                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3916                         return -EINVAL;
3917                 if (params->supported_rates)
3918                         return -EINVAL;
3919                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3920                         return -EINVAL;
3921         }
3922
3923         if (statype != CFG80211_STA_AP_CLIENT) {
3924                 if (params->vlan)
3925                         return -EINVAL;
3926         }
3927
3928         switch (statype) {
3929         case CFG80211_STA_AP_MLME_CLIENT:
3930                 /* Use this only for authorizing/unauthorizing a station */
3931                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3932                         return -EOPNOTSUPP;
3933                 break;
3934         case CFG80211_STA_AP_CLIENT:
3935                 /* accept only the listed bits */
3936                 if (params->sta_flags_mask &
3937                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3938                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3939                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3940                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3941                                   BIT(NL80211_STA_FLAG_WME) |
3942                                   BIT(NL80211_STA_FLAG_MFP)))
3943                         return -EINVAL;
3944
3945                 /* but authenticated/associated only if driver handles it */
3946                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3947                     params->sta_flags_mask &
3948                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3949                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3950                         return -EINVAL;
3951                 break;
3952         case CFG80211_STA_IBSS:
3953         case CFG80211_STA_AP_STA:
3954                 /* reject any changes other than AUTHORIZED */
3955                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3956                         return -EINVAL;
3957                 break;
3958         case CFG80211_STA_TDLS_PEER_SETUP:
3959                 /* reject any changes other than AUTHORIZED or WME */
3960                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3961                                                BIT(NL80211_STA_FLAG_WME)))
3962                         return -EINVAL;
3963                 /* force (at least) rates when authorizing */
3964                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3965                     !params->supported_rates)
3966                         return -EINVAL;
3967                 break;
3968         case CFG80211_STA_TDLS_PEER_ACTIVE:
3969                 /* reject any changes */
3970                 return -EINVAL;
3971         case CFG80211_STA_MESH_PEER_KERNEL:
3972                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3973                         return -EINVAL;
3974                 break;
3975         case CFG80211_STA_MESH_PEER_USER:
3976                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3977                         return -EINVAL;
3978                 break;
3979         }
3980
3981         return 0;
3982 }
3983 EXPORT_SYMBOL(cfg80211_check_station_change);
3984
3985 /*
3986  * Get vlan interface making sure it is running and on the right wiphy.
3987  */
3988 static struct net_device *get_vlan(struct genl_info *info,
3989                                    struct cfg80211_registered_device *rdev)
3990 {
3991         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3992         struct net_device *v;
3993         int ret;
3994
3995         if (!vlanattr)
3996                 return NULL;
3997
3998         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3999         if (!v)
4000                 return ERR_PTR(-ENODEV);
4001
4002         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4003                 ret = -EINVAL;
4004                 goto error;
4005         }
4006
4007         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4008             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4009             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4010                 ret = -EINVAL;
4011                 goto error;
4012         }
4013
4014         if (!netif_running(v)) {
4015                 ret = -ENETDOWN;
4016                 goto error;
4017         }
4018
4019         return v;
4020  error:
4021         dev_put(v);
4022         return ERR_PTR(ret);
4023 }
4024
4025 static const struct nla_policy
4026 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4027         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4028         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4029 };
4030
4031 static int nl80211_parse_sta_wme(struct genl_info *info,
4032                                  struct station_parameters *params)
4033 {
4034         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4035         struct nlattr *nla;
4036         int err;
4037
4038         /* parse WME attributes if present */
4039         if (!info->attrs[NL80211_ATTR_STA_WME])
4040                 return 0;
4041
4042         nla = info->attrs[NL80211_ATTR_STA_WME];
4043         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4044                                nl80211_sta_wme_policy);
4045         if (err)
4046                 return err;
4047
4048         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4049                 params->uapsd_queues = nla_get_u8(
4050                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4051         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4052                 return -EINVAL;
4053
4054         if (tb[NL80211_STA_WME_MAX_SP])
4055                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4056
4057         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4058                 return -EINVAL;
4059
4060         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4061
4062         return 0;
4063 }
4064
4065 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4066                                       struct station_parameters *params)
4067 {
4068         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4069                 params->supported_channels =
4070                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4071                 params->supported_channels_len =
4072                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4073                 /*
4074                  * Need to include at least one (first channel, number of
4075                  * channels) tuple for each subband, and must have proper
4076                  * tuples for the rest of the data as well.
4077                  */
4078                 if (params->supported_channels_len < 2)
4079                         return -EINVAL;
4080                 if (params->supported_channels_len % 2)
4081                         return -EINVAL;
4082         }
4083
4084         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4085                 params->supported_oper_classes =
4086                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4087                 params->supported_oper_classes_len =
4088                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4089                 /*
4090                  * The value of the Length field of the Supported Operating
4091                  * Classes element is between 2 and 253.
4092                  */
4093                 if (params->supported_oper_classes_len < 2 ||
4094                     params->supported_oper_classes_len > 253)
4095                         return -EINVAL;
4096         }
4097         return 0;
4098 }
4099
4100 static int nl80211_set_station_tdls(struct genl_info *info,
4101                                     struct station_parameters *params)
4102 {
4103         int err;
4104         /* Dummy STA entry gets updated once the peer capabilities are known */
4105         if (info->attrs[NL80211_ATTR_PEER_AID])
4106                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4107         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4108                 params->ht_capa =
4109                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4110         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4111                 params->vht_capa =
4112                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4113
4114         err = nl80211_parse_sta_channel_info(info, params);
4115         if (err)
4116                 return err;
4117
4118         return nl80211_parse_sta_wme(info, params);
4119 }
4120
4121 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4122 {
4123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4124         struct net_device *dev = info->user_ptr[1];
4125         struct station_parameters params;
4126         u8 *mac_addr;
4127         int err;
4128
4129         memset(&params, 0, sizeof(params));
4130
4131         params.listen_interval = -1;
4132
4133         if (!rdev->ops->change_station)
4134                 return -EOPNOTSUPP;
4135
4136         if (info->attrs[NL80211_ATTR_STA_AID])
4137                 return -EINVAL;
4138
4139         if (!info->attrs[NL80211_ATTR_MAC])
4140                 return -EINVAL;
4141
4142         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4143
4144         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4145                 params.supported_rates =
4146                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4147                 params.supported_rates_len =
4148                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4149         }
4150
4151         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4152                 params.capability =
4153                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4154                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4155         }
4156
4157         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4158                 params.ext_capab =
4159                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4160                 params.ext_capab_len =
4161                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4162         }
4163
4164         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4165                 return -EINVAL;
4166
4167         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4168                 return -EINVAL;
4169
4170         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4171                 params.plink_action =
4172                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4173                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4174                         return -EINVAL;
4175         }
4176
4177         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4178                 params.plink_state =
4179                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4180                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4181                         return -EINVAL;
4182                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4183         }
4184
4185         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4186                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4187                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4188
4189                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4190                     pm > NL80211_MESH_POWER_MAX)
4191                         return -EINVAL;
4192
4193                 params.local_pm = pm;
4194         }
4195
4196         /* Include parameters for TDLS peer (will check later) */
4197         err = nl80211_set_station_tdls(info, &params);
4198         if (err)
4199                 return err;
4200
4201         params.vlan = get_vlan(info, rdev);
4202         if (IS_ERR(params.vlan))
4203                 return PTR_ERR(params.vlan);
4204
4205         switch (dev->ieee80211_ptr->iftype) {
4206         case NL80211_IFTYPE_AP:
4207         case NL80211_IFTYPE_AP_VLAN:
4208         case NL80211_IFTYPE_P2P_GO:
4209         case NL80211_IFTYPE_P2P_CLIENT:
4210         case NL80211_IFTYPE_STATION:
4211         case NL80211_IFTYPE_ADHOC:
4212         case NL80211_IFTYPE_MESH_POINT:
4213                 break;
4214         default:
4215                 err = -EOPNOTSUPP;
4216                 goto out_put_vlan;
4217         }
4218
4219         /* driver will call cfg80211_check_station_change() */
4220         err = rdev_change_station(rdev, dev, mac_addr, &params);
4221
4222  out_put_vlan:
4223         if (params.vlan)
4224                 dev_put(params.vlan);
4225
4226         return err;
4227 }
4228
4229 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4230 {
4231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4232         int err;
4233         struct net_device *dev = info->user_ptr[1];
4234         struct station_parameters params;
4235         u8 *mac_addr = NULL;
4236
4237         memset(&params, 0, sizeof(params));
4238
4239         if (!rdev->ops->add_station)
4240                 return -EOPNOTSUPP;
4241
4242         if (!info->attrs[NL80211_ATTR_MAC])
4243                 return -EINVAL;
4244
4245         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4246                 return -EINVAL;
4247
4248         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4249                 return -EINVAL;
4250
4251         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4252             !info->attrs[NL80211_ATTR_PEER_AID])
4253                 return -EINVAL;
4254
4255         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4256         params.supported_rates =
4257                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4258         params.supported_rates_len =
4259                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4260         params.listen_interval =
4261                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4262
4263         if (info->attrs[NL80211_ATTR_PEER_AID])
4264                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4265         else
4266                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4267         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4268                 return -EINVAL;
4269
4270         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4271                 params.capability =
4272                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4273                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4274         }
4275
4276         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4277                 params.ext_capab =
4278                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4279                 params.ext_capab_len =
4280                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4281         }
4282
4283         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4284                 params.ht_capa =
4285                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4286
4287         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4288                 params.vht_capa =
4289                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4290
4291         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4292                 params.opmode_notif_used = true;
4293                 params.opmode_notif =
4294                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4295         }
4296
4297         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4298                 params.plink_action =
4299                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4300                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4301                         return -EINVAL;
4302         }
4303
4304         err = nl80211_parse_sta_channel_info(info, &params);
4305         if (err)
4306                 return err;
4307
4308         err = nl80211_parse_sta_wme(info, &params);
4309         if (err)
4310                 return err;
4311
4312         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4313                 return -EINVAL;
4314
4315         /* When you run into this, adjust the code below for the new flag */
4316         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4317
4318         switch (dev->ieee80211_ptr->iftype) {
4319         case NL80211_IFTYPE_AP:
4320         case NL80211_IFTYPE_AP_VLAN:
4321         case NL80211_IFTYPE_P2P_GO:
4322                 /* ignore WME attributes if iface/sta is not capable */
4323                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4324                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4325                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4326
4327                 /* TDLS peers cannot be added */
4328                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4329                     info->attrs[NL80211_ATTR_PEER_AID])
4330                         return -EINVAL;
4331                 /* but don't bother the driver with it */
4332                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4333
4334                 /* allow authenticated/associated only if driver handles it */
4335                 if (!(rdev->wiphy.features &
4336                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4337                     params.sta_flags_mask &
4338                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4339                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4340                         return -EINVAL;
4341
4342                 /* must be last in here for error handling */
4343                 params.vlan = get_vlan(info, rdev);
4344                 if (IS_ERR(params.vlan))
4345                         return PTR_ERR(params.vlan);
4346                 break;
4347         case NL80211_IFTYPE_MESH_POINT:
4348                 /* ignore uAPSD data */
4349                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4350
4351                 /* associated is disallowed */
4352                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4353                         return -EINVAL;
4354                 /* TDLS peers cannot be added */
4355                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4356                     info->attrs[NL80211_ATTR_PEER_AID])
4357                         return -EINVAL;
4358                 break;
4359         case NL80211_IFTYPE_STATION:
4360         case NL80211_IFTYPE_P2P_CLIENT:
4361                 /* ignore uAPSD data */
4362                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4363
4364                 /* these are disallowed */
4365                 if (params.sta_flags_mask &
4366                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4367                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4368                         return -EINVAL;
4369                 /* Only TDLS peers can be added */
4370                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4371                         return -EINVAL;
4372                 /* Can only add if TDLS ... */
4373                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4374                         return -EOPNOTSUPP;
4375                 /* ... with external setup is supported */
4376                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4377                         return -EOPNOTSUPP;
4378                 /*
4379                  * Older wpa_supplicant versions always mark the TDLS peer
4380                  * as authorized, but it shouldn't yet be.
4381                  */
4382                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4383                 break;
4384         default:
4385                 return -EOPNOTSUPP;
4386         }
4387
4388         /* be aware of params.vlan when changing code here */
4389
4390         err = rdev_add_station(rdev, dev, mac_addr, &params);
4391
4392         if (params.vlan)
4393                 dev_put(params.vlan);
4394         return err;
4395 }
4396
4397 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4398 {
4399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4400         struct net_device *dev = info->user_ptr[1];
4401         struct station_del_parameters params;
4402
4403         memset(&params, 0, sizeof(params));
4404
4405         if (info->attrs[NL80211_ATTR_MAC])
4406                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4407
4408         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4409             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4410             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4411             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4412                 return -EINVAL;
4413
4414         if (!rdev->ops->del_station)
4415                 return -EOPNOTSUPP;
4416
4417         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4418                 params.subtype =
4419                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4420                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4421                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4422                         return -EINVAL;
4423         } else {
4424                 /* Default to Deauthentication frame */
4425                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4426         }
4427
4428         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4429                 params.reason_code =
4430                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4431                 if (params.reason_code == 0)
4432                         return -EINVAL; /* 0 is reserved */
4433         } else {
4434                 /* Default to reason code 2 */
4435                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4436         }
4437
4438         return rdev_del_station(rdev, dev, &params);
4439 }
4440
4441 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4442                                 int flags, struct net_device *dev,
4443                                 u8 *dst, u8 *next_hop,
4444                                 struct mpath_info *pinfo)
4445 {
4446         void *hdr;
4447         struct nlattr *pinfoattr;
4448
4449         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4450         if (!hdr)
4451                 return -1;
4452
4453         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4454             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4455             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4456             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4457                 goto nla_put_failure;
4458
4459         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4460         if (!pinfoattr)
4461                 goto nla_put_failure;
4462         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4463             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4464                         pinfo->frame_qlen))
4465                 goto nla_put_failure;
4466         if (((pinfo->filled & MPATH_INFO_SN) &&
4467              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4468             ((pinfo->filled & MPATH_INFO_METRIC) &&
4469              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4470                          pinfo->metric)) ||
4471             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4472              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4473                          pinfo->exptime)) ||
4474             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4475              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4476                         pinfo->flags)) ||
4477             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4478              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4479                          pinfo->discovery_timeout)) ||
4480             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4481              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4482                         pinfo->discovery_retries)))
4483                 goto nla_put_failure;
4484
4485         nla_nest_end(msg, pinfoattr);
4486
4487         return genlmsg_end(msg, hdr);
4488
4489  nla_put_failure:
4490         genlmsg_cancel(msg, hdr);
4491         return -EMSGSIZE;
4492 }
4493
4494 static int nl80211_dump_mpath(struct sk_buff *skb,
4495                               struct netlink_callback *cb)
4496 {
4497         struct mpath_info pinfo;
4498         struct cfg80211_registered_device *rdev;
4499         struct wireless_dev *wdev;
4500         u8 dst[ETH_ALEN];
4501         u8 next_hop[ETH_ALEN];
4502         int path_idx = cb->args[2];
4503         int err;
4504
4505         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4506         if (err)
4507                 return err;
4508
4509         if (!rdev->ops->dump_mpath) {
4510                 err = -EOPNOTSUPP;
4511                 goto out_err;
4512         }
4513
4514         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4515                 err = -EOPNOTSUPP;
4516                 goto out_err;
4517         }
4518
4519         while (1) {
4520                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4521                                       next_hop, &pinfo);
4522                 if (err == -ENOENT)
4523                         break;
4524                 if (err)
4525                         goto out_err;
4526
4527                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4528                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4529                                        wdev->netdev, dst, next_hop,
4530                                        &pinfo) < 0)
4531                         goto out;
4532
4533                 path_idx++;
4534         }
4535
4536
4537  out:
4538         cb->args[2] = path_idx;
4539         err = skb->len;
4540  out_err:
4541         nl80211_finish_wdev_dump(rdev);
4542         return err;
4543 }
4544
4545 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4546 {
4547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4548         int err;
4549         struct net_device *dev = info->user_ptr[1];
4550         struct mpath_info pinfo;
4551         struct sk_buff *msg;
4552         u8 *dst = NULL;
4553         u8 next_hop[ETH_ALEN];
4554
4555         memset(&pinfo, 0, sizeof(pinfo));
4556
4557         if (!info->attrs[NL80211_ATTR_MAC])
4558                 return -EINVAL;
4559
4560         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4561
4562         if (!rdev->ops->get_mpath)
4563                 return -EOPNOTSUPP;
4564
4565         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4566                 return -EOPNOTSUPP;
4567
4568         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4569         if (err)
4570                 return err;
4571
4572         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4573         if (!msg)
4574                 return -ENOMEM;
4575
4576         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4577                                  dev, dst, next_hop, &pinfo) < 0) {
4578                 nlmsg_free(msg);
4579                 return -ENOBUFS;
4580         }
4581
4582         return genlmsg_reply(msg, info);
4583 }
4584
4585 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4586 {
4587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4588         struct net_device *dev = info->user_ptr[1];
4589         u8 *dst = NULL;
4590         u8 *next_hop = NULL;
4591
4592         if (!info->attrs[NL80211_ATTR_MAC])
4593                 return -EINVAL;
4594
4595         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4596                 return -EINVAL;
4597
4598         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4599         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4600
4601         if (!rdev->ops->change_mpath)
4602                 return -EOPNOTSUPP;
4603
4604         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4605                 return -EOPNOTSUPP;
4606
4607         return rdev_change_mpath(rdev, dev, dst, next_hop);
4608 }
4609
4610 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4611 {
4612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4613         struct net_device *dev = info->user_ptr[1];
4614         u8 *dst = NULL;
4615         u8 *next_hop = NULL;
4616
4617         if (!info->attrs[NL80211_ATTR_MAC])
4618                 return -EINVAL;
4619
4620         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4621                 return -EINVAL;
4622
4623         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4624         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4625
4626         if (!rdev->ops->add_mpath)
4627                 return -EOPNOTSUPP;
4628
4629         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4630                 return -EOPNOTSUPP;
4631
4632         return rdev_add_mpath(rdev, dev, dst, next_hop);
4633 }
4634
4635 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4636 {
4637         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4638         struct net_device *dev = info->user_ptr[1];
4639         u8 *dst = NULL;
4640
4641         if (info->attrs[NL80211_ATTR_MAC])
4642                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4643
4644         if (!rdev->ops->del_mpath)
4645                 return -EOPNOTSUPP;
4646
4647         return rdev_del_mpath(rdev, dev, dst);
4648 }
4649
4650 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4651 {
4652         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4653         int err;
4654         struct net_device *dev = info->user_ptr[1];
4655         struct mpath_info pinfo;
4656         struct sk_buff *msg;
4657         u8 *dst = NULL;
4658         u8 mpp[ETH_ALEN];
4659
4660         memset(&pinfo, 0, sizeof(pinfo));
4661
4662         if (!info->attrs[NL80211_ATTR_MAC])
4663                 return -EINVAL;
4664
4665         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4666
4667         if (!rdev->ops->get_mpp)
4668                 return -EOPNOTSUPP;
4669
4670         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4671                 return -EOPNOTSUPP;
4672
4673         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4674         if (err)
4675                 return err;
4676
4677         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4678         if (!msg)
4679                 return -ENOMEM;
4680
4681         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4682                                dev, dst, mpp, &pinfo) < 0) {
4683                 nlmsg_free(msg);
4684                 return -ENOBUFS;
4685         }
4686
4687         return genlmsg_reply(msg, info);
4688 }
4689
4690 static int nl80211_dump_mpp(struct sk_buff *skb,
4691                             struct netlink_callback *cb)
4692 {
4693         struct mpath_info pinfo;
4694         struct cfg80211_registered_device *rdev;
4695         struct wireless_dev *wdev;
4696         u8 dst[ETH_ALEN];
4697         u8 mpp[ETH_ALEN];
4698         int path_idx = cb->args[2];
4699         int err;
4700
4701         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4702         if (err)
4703                 return err;
4704
4705         if (!rdev->ops->dump_mpp) {
4706                 err = -EOPNOTSUPP;
4707                 goto out_err;
4708         }
4709
4710         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4711                 err = -EOPNOTSUPP;
4712                 goto out_err;
4713         }
4714
4715         while (1) {
4716                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4717                                     mpp, &pinfo);
4718                 if (err == -ENOENT)
4719                         break;
4720                 if (err)
4721                         goto out_err;
4722
4723                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4724                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4725                                        wdev->netdev, dst, mpp,
4726                                        &pinfo) < 0)
4727                         goto out;
4728
4729                 path_idx++;
4730         }
4731
4732  out:
4733         cb->args[2] = path_idx;
4734         err = skb->len;
4735  out_err:
4736         nl80211_finish_wdev_dump(rdev);
4737         return err;
4738 }
4739
4740 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4741 {
4742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4743         struct net_device *dev = info->user_ptr[1];
4744         struct wireless_dev *wdev = dev->ieee80211_ptr;
4745         struct bss_parameters params;
4746         int err;
4747
4748         memset(&params, 0, sizeof(params));
4749         /* default to not changing parameters */
4750         params.use_cts_prot = -1;
4751         params.use_short_preamble = -1;
4752         params.use_short_slot_time = -1;
4753         params.ap_isolate = -1;
4754         params.ht_opmode = -1;
4755         params.p2p_ctwindow = -1;
4756         params.p2p_opp_ps = -1;
4757
4758         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4759                 params.use_cts_prot =
4760                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4761         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4762                 params.use_short_preamble =
4763                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4764         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4765                 params.use_short_slot_time =
4766                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4767         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4768                 params.basic_rates =
4769                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4770                 params.basic_rates_len =
4771                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4772         }
4773         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4774                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4775         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4776                 params.ht_opmode =
4777                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4778
4779         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4780                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4781                         return -EINVAL;
4782                 params.p2p_ctwindow =
4783                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4784                 if (params.p2p_ctwindow < 0)
4785                         return -EINVAL;
4786                 if (params.p2p_ctwindow != 0 &&
4787                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4788                         return -EINVAL;
4789         }
4790
4791         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4792                 u8 tmp;
4793
4794                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4795                         return -EINVAL;
4796                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4797                 if (tmp > 1)
4798                         return -EINVAL;
4799                 params.p2p_opp_ps = tmp;
4800                 if (params.p2p_opp_ps &&
4801                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4802                         return -EINVAL;
4803         }
4804
4805         if (!rdev->ops->change_bss)
4806                 return -EOPNOTSUPP;
4807
4808         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4809             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4810                 return -EOPNOTSUPP;
4811
4812         wdev_lock(wdev);
4813         err = rdev_change_bss(rdev, dev, &params);
4814         wdev_unlock(wdev);
4815
4816         return err;
4817 }
4818
4819 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4820         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4821         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4822         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4823         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4824         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4825         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4826         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4827 };
4828
4829 static int parse_reg_rule(struct nlattr *tb[],
4830         struct ieee80211_reg_rule *reg_rule)
4831 {
4832         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4833         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4834
4835         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4836                 return -EINVAL;
4837         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4838                 return -EINVAL;
4839         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4840                 return -EINVAL;
4841         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4842                 return -EINVAL;
4843         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4844                 return -EINVAL;
4845
4846         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4847
4848         freq_range->start_freq_khz =
4849                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4850         freq_range->end_freq_khz =
4851                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4852         freq_range->max_bandwidth_khz =
4853                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4854
4855         power_rule->max_eirp =
4856                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4857
4858         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4859                 power_rule->max_antenna_gain =
4860                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4861
4862         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4863                 reg_rule->dfs_cac_ms =
4864                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4865
4866         return 0;
4867 }
4868
4869 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4870 {
4871         char *data = NULL;
4872         enum nl80211_user_reg_hint_type user_reg_hint_type;
4873
4874         /*
4875          * You should only get this when cfg80211 hasn't yet initialized
4876          * completely when built-in to the kernel right between the time
4877          * window between nl80211_init() and regulatory_init(), if that is
4878          * even possible.
4879          */
4880         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4881                 return -EINPROGRESS;
4882
4883         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4884                 user_reg_hint_type =
4885                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4886         else
4887                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4888
4889         switch (user_reg_hint_type) {
4890         case NL80211_USER_REG_HINT_USER:
4891         case NL80211_USER_REG_HINT_CELL_BASE:
4892                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4893                         return -EINVAL;
4894
4895                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4896                 return regulatory_hint_user(data, user_reg_hint_type);
4897         case NL80211_USER_REG_HINT_INDOOR:
4898                 return regulatory_hint_indoor_user();
4899         default:
4900                 return -EINVAL;
4901         }
4902 }
4903
4904 static int nl80211_get_mesh_config(struct sk_buff *skb,
4905                                    struct genl_info *info)
4906 {
4907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4908         struct net_device *dev = info->user_ptr[1];
4909         struct wireless_dev *wdev = dev->ieee80211_ptr;
4910         struct mesh_config cur_params;
4911         int err = 0;
4912         void *hdr;
4913         struct nlattr *pinfoattr;
4914         struct sk_buff *msg;
4915
4916         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4917                 return -EOPNOTSUPP;
4918
4919         if (!rdev->ops->get_mesh_config)
4920                 return -EOPNOTSUPP;
4921
4922         wdev_lock(wdev);
4923         /* If not connected, get default parameters */
4924         if (!wdev->mesh_id_len)
4925                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4926         else
4927                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4928         wdev_unlock(wdev);
4929
4930         if (err)
4931                 return err;
4932
4933         /* Draw up a netlink message to send back */
4934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4935         if (!msg)
4936                 return -ENOMEM;
4937         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4938                              NL80211_CMD_GET_MESH_CONFIG);
4939         if (!hdr)
4940                 goto out;
4941         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4942         if (!pinfoattr)
4943                 goto nla_put_failure;
4944         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4945             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4946                         cur_params.dot11MeshRetryTimeout) ||
4947             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4948                         cur_params.dot11MeshConfirmTimeout) ||
4949             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4950                         cur_params.dot11MeshHoldingTimeout) ||
4951             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4952                         cur_params.dot11MeshMaxPeerLinks) ||
4953             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4954                        cur_params.dot11MeshMaxRetries) ||
4955             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4956                        cur_params.dot11MeshTTL) ||
4957             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4958                        cur_params.element_ttl) ||
4959             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4960                        cur_params.auto_open_plinks) ||
4961             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4962                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4963             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4964                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4965             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4966                         cur_params.path_refresh_time) ||
4967             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4968                         cur_params.min_discovery_timeout) ||
4969             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4970                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4971             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4972                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4973             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4974                         cur_params.dot11MeshHWMPperrMinInterval) ||
4975             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4976                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4977             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4978                        cur_params.dot11MeshHWMPRootMode) ||
4979             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4980                         cur_params.dot11MeshHWMPRannInterval) ||
4981             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4982                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4983             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4984                        cur_params.dot11MeshForwarding) ||
4985             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4986                         cur_params.rssi_threshold) ||
4987             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4988                         cur_params.ht_opmode) ||
4989             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4990                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4991             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4992                         cur_params.dot11MeshHWMProotInterval) ||
4993             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4994                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4995             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4996                         cur_params.power_mode) ||
4997             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4998                         cur_params.dot11MeshAwakeWindowDuration) ||
4999             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5000                         cur_params.plink_timeout))
5001                 goto nla_put_failure;
5002         nla_nest_end(msg, pinfoattr);
5003         genlmsg_end(msg, hdr);
5004         return genlmsg_reply(msg, info);
5005
5006  nla_put_failure:
5007         genlmsg_cancel(msg, hdr);
5008  out:
5009         nlmsg_free(msg);
5010         return -ENOBUFS;
5011 }
5012
5013 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5014         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5015         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5016         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5017         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5018         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5019         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5020         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5021         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5022         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5023         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5024         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5025         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5026         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5027         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5028         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5029         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5030         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5031         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5032         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5033         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5034         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5035         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5036         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5037         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5038         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5039         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5040         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5041         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5042 };
5043
5044 static const struct nla_policy
5045         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5046         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5047         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5048         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5049         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5050         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5051         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5052         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5053                                     .len = IEEE80211_MAX_DATA_LEN },
5054         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5055 };
5056
5057 static int nl80211_parse_mesh_config(struct genl_info *info,
5058                                      struct mesh_config *cfg,
5059                                      u32 *mask_out)
5060 {
5061         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5062         u32 mask = 0;
5063
5064 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5065 do {                                                                        \
5066         if (tb[attr]) {                                                     \
5067                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5068                         return -EINVAL;                                     \
5069                 cfg->param = fn(tb[attr]);                                  \
5070                 mask |= (1 << (attr - 1));                                  \
5071         }                                                                   \
5072 } while (0)
5073
5074
5075         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5076                 return -EINVAL;
5077         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5078                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5079                              nl80211_meshconf_params_policy))
5080                 return -EINVAL;
5081
5082         /* This makes sure that there aren't more than 32 mesh config
5083          * parameters (otherwise our bitfield scheme would not work.) */
5084         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5085
5086         /* Fill in the params struct */
5087         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5088                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5089                                   nla_get_u16);
5090         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5091                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5092                                   nla_get_u16);
5093         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5094                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5095                                   nla_get_u16);
5096         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5097                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5098                                   nla_get_u16);
5099         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5100                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5101                                   nla_get_u8);
5102         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5103                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5104         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5105                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5106                                   nla_get_u8);
5107         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5108                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5109                                   nla_get_u8);
5110         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5111                                   1, 255, mask,
5112                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5113                                   nla_get_u32);
5114         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5115                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5116                                   nla_get_u8);
5117         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5118                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5119                                   nla_get_u32);
5120         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5121                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5122                                   nla_get_u16);
5123         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5124                                   1, 65535, mask,
5125                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5126                                   nla_get_u32);
5127         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5128                                   1, 65535, mask,
5129                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5130                                   nla_get_u16);
5131         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5132                                   1, 65535, mask,
5133                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5134                                   nla_get_u16);
5135         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5136                                   dot11MeshHWMPnetDiameterTraversalTime,
5137                                   1, 65535, mask,
5138                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5139                                   nla_get_u16);
5140         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5141                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5142                                   nla_get_u8);
5143         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5144                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5145                                   nla_get_u16);
5146         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5147                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5148                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5149                                   nla_get_u8);
5150         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5151                                   mask, NL80211_MESHCONF_FORWARDING,
5152                                   nla_get_u8);
5153         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5154                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5155                                   nla_get_s32);
5156         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5157                                   mask, NL80211_MESHCONF_HT_OPMODE,
5158                                   nla_get_u16);
5159         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5160                                   1, 65535, mask,
5161                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5162                                   nla_get_u32);
5163         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5164                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5165                                   nla_get_u16);
5166         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5167                                   dot11MeshHWMPconfirmationInterval,
5168                                   1, 65535, mask,
5169                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5170                                   nla_get_u16);
5171         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5172                                   NL80211_MESH_POWER_ACTIVE,
5173                                   NL80211_MESH_POWER_MAX,
5174                                   mask, NL80211_MESHCONF_POWER_MODE,
5175                                   nla_get_u32);
5176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5177                                   0, 65535, mask,
5178                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5180                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5181                                   nla_get_u32);
5182         if (mask_out)
5183                 *mask_out = mask;
5184
5185         return 0;
5186
5187 #undef FILL_IN_MESH_PARAM_IF_SET
5188 }
5189
5190 static int nl80211_parse_mesh_setup(struct genl_info *info,
5191                                      struct mesh_setup *setup)
5192 {
5193         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5194         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5195
5196         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5197                 return -EINVAL;
5198         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5199                              info->attrs[NL80211_ATTR_MESH_SETUP],
5200                              nl80211_mesh_setup_params_policy))
5201                 return -EINVAL;
5202
5203         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5204                 setup->sync_method =
5205                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5206                  IEEE80211_SYNC_METHOD_VENDOR :
5207                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5208
5209         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5210                 setup->path_sel_proto =
5211                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5212                  IEEE80211_PATH_PROTOCOL_VENDOR :
5213                  IEEE80211_PATH_PROTOCOL_HWMP;
5214
5215         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5216                 setup->path_metric =
5217                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5218                  IEEE80211_PATH_METRIC_VENDOR :
5219                  IEEE80211_PATH_METRIC_AIRTIME;
5220
5221
5222         if (tb[NL80211_MESH_SETUP_IE]) {
5223                 struct nlattr *ieattr =
5224                         tb[NL80211_MESH_SETUP_IE];
5225                 if (!is_valid_ie_attr(ieattr))
5226                         return -EINVAL;
5227                 setup->ie = nla_data(ieattr);
5228                 setup->ie_len = nla_len(ieattr);
5229         }
5230         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5231             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5232                 return -EINVAL;
5233         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5234         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5235         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5236         if (setup->is_secure)
5237                 setup->user_mpm = true;
5238
5239         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5240                 if (!setup->user_mpm)
5241                         return -EINVAL;
5242                 setup->auth_id =
5243                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5244         }
5245
5246         return 0;
5247 }
5248
5249 static int nl80211_update_mesh_config(struct sk_buff *skb,
5250                                       struct genl_info *info)
5251 {
5252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5253         struct net_device *dev = info->user_ptr[1];
5254         struct wireless_dev *wdev = dev->ieee80211_ptr;
5255         struct mesh_config cfg;
5256         u32 mask;
5257         int err;
5258
5259         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5260                 return -EOPNOTSUPP;
5261
5262         if (!rdev->ops->update_mesh_config)
5263                 return -EOPNOTSUPP;
5264
5265         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5266         if (err)
5267                 return err;
5268
5269         wdev_lock(wdev);
5270         if (!wdev->mesh_id_len)
5271                 err = -ENOLINK;
5272
5273         if (!err)
5274                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5275
5276         wdev_unlock(wdev);
5277
5278         return err;
5279 }
5280
5281 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5282 {
5283         const struct ieee80211_regdomain *regdom;
5284         struct sk_buff *msg;
5285         void *hdr = NULL;
5286         struct nlattr *nl_reg_rules;
5287         unsigned int i;
5288
5289         if (!cfg80211_regdomain)
5290                 return -EINVAL;
5291
5292         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5293         if (!msg)
5294                 return -ENOBUFS;
5295
5296         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5297                              NL80211_CMD_GET_REG);
5298         if (!hdr)
5299                 goto put_failure;
5300
5301         if (reg_last_request_cell_base() &&
5302             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5303                         NL80211_USER_REG_HINT_CELL_BASE))
5304                 goto nla_put_failure;
5305
5306         rcu_read_lock();
5307         regdom = rcu_dereference(cfg80211_regdomain);
5308
5309         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5310             (regdom->dfs_region &&
5311              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5312                 goto nla_put_failure_rcu;
5313
5314         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5315         if (!nl_reg_rules)
5316                 goto nla_put_failure_rcu;
5317
5318         for (i = 0; i < regdom->n_reg_rules; i++) {
5319                 struct nlattr *nl_reg_rule;
5320                 const struct ieee80211_reg_rule *reg_rule;
5321                 const struct ieee80211_freq_range *freq_range;
5322                 const struct ieee80211_power_rule *power_rule;
5323                 unsigned int max_bandwidth_khz;
5324
5325                 reg_rule = &regdom->reg_rules[i];
5326                 freq_range = &reg_rule->freq_range;
5327                 power_rule = &reg_rule->power_rule;
5328
5329                 nl_reg_rule = nla_nest_start(msg, i);
5330                 if (!nl_reg_rule)
5331                         goto nla_put_failure_rcu;
5332
5333                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5334                 if (!max_bandwidth_khz)
5335                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5336                                                                   reg_rule);
5337
5338                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5339                                 reg_rule->flags) ||
5340                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5341                                 freq_range->start_freq_khz) ||
5342                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5343                                 freq_range->end_freq_khz) ||
5344                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5345                                 max_bandwidth_khz) ||
5346                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5347                                 power_rule->max_antenna_gain) ||
5348                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5349                                 power_rule->max_eirp) ||
5350                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5351                                 reg_rule->dfs_cac_ms))
5352                         goto nla_put_failure_rcu;
5353
5354                 nla_nest_end(msg, nl_reg_rule);
5355         }
5356         rcu_read_unlock();
5357
5358         nla_nest_end(msg, nl_reg_rules);
5359
5360         genlmsg_end(msg, hdr);
5361         return genlmsg_reply(msg, info);
5362
5363 nla_put_failure_rcu:
5364         rcu_read_unlock();
5365 nla_put_failure:
5366         genlmsg_cancel(msg, hdr);
5367 put_failure:
5368         nlmsg_free(msg);
5369         return -EMSGSIZE;
5370 }
5371
5372 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5373 {
5374         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5375         struct nlattr *nl_reg_rule;
5376         char *alpha2 = NULL;
5377         int rem_reg_rules = 0, r = 0;
5378         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5379         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5380         struct ieee80211_regdomain *rd = NULL;
5381
5382         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5383                 return -EINVAL;
5384
5385         if (!info->attrs[NL80211_ATTR_REG_RULES])
5386                 return -EINVAL;
5387
5388         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5389
5390         if (info->attrs[NL80211_ATTR_DFS_REGION])
5391                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5392
5393         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5394                             rem_reg_rules) {
5395                 num_rules++;
5396                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5397                         return -EINVAL;
5398         }
5399
5400         if (!reg_is_valid_request(alpha2))
5401                 return -EINVAL;
5402
5403         size_of_regd = sizeof(struct ieee80211_regdomain) +
5404                        num_rules * sizeof(struct ieee80211_reg_rule);
5405
5406         rd = kzalloc(size_of_regd, GFP_KERNEL);
5407         if (!rd)
5408                 return -ENOMEM;
5409
5410         rd->n_reg_rules = num_rules;
5411         rd->alpha2[0] = alpha2[0];
5412         rd->alpha2[1] = alpha2[1];
5413
5414         /*
5415          * Disable DFS master mode if the DFS region was
5416          * not supported or known on this kernel.
5417          */
5418         if (reg_supported_dfs_region(dfs_region))
5419                 rd->dfs_region = dfs_region;
5420
5421         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5422                             rem_reg_rules) {
5423                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5424                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5425                               reg_rule_policy);
5426                 if (r)
5427                         goto bad_reg;
5428                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5429                 if (r)
5430                         goto bad_reg;
5431
5432                 rule_idx++;
5433
5434                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5435                         r = -EINVAL;
5436                         goto bad_reg;
5437                 }
5438         }
5439
5440         r = set_regdom(rd);
5441         /* set_regdom took ownership */
5442         rd = NULL;
5443
5444  bad_reg:
5445         kfree(rd);
5446         return r;
5447 }
5448
5449 static int validate_scan_freqs(struct nlattr *freqs)
5450 {
5451         struct nlattr *attr1, *attr2;
5452         int n_channels = 0, tmp1, tmp2;
5453
5454         nla_for_each_nested(attr1, freqs, tmp1) {
5455                 n_channels++;
5456                 /*
5457                  * Some hardware has a limited channel list for
5458                  * scanning, and it is pretty much nonsensical
5459                  * to scan for a channel twice, so disallow that
5460                  * and don't require drivers to check that the
5461                  * channel list they get isn't longer than what
5462                  * they can scan, as long as they can scan all
5463                  * the channels they registered at once.
5464                  */
5465                 nla_for_each_nested(attr2, freqs, tmp2)
5466                         if (attr1 != attr2 &&
5467                             nla_get_u32(attr1) == nla_get_u32(attr2))
5468                                 return 0;
5469         }
5470
5471         return n_channels;
5472 }
5473
5474 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5475 {
5476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5477         struct wireless_dev *wdev = info->user_ptr[1];
5478         struct cfg80211_scan_request *request;
5479         struct nlattr *attr;
5480         struct wiphy *wiphy;
5481         int err, tmp, n_ssids = 0, n_channels, i;
5482         size_t ie_len;
5483
5484         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5485                 return -EINVAL;
5486
5487         wiphy = &rdev->wiphy;
5488
5489         if (!rdev->ops->scan)
5490                 return -EOPNOTSUPP;
5491
5492         if (rdev->scan_req || rdev->scan_msg) {
5493                 err = -EBUSY;
5494                 goto unlock;
5495         }
5496
5497         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5498                 n_channels = validate_scan_freqs(
5499                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5500                 if (!n_channels) {
5501                         err = -EINVAL;
5502                         goto unlock;
5503                 }
5504         } else {
5505                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5506         }
5507
5508         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5509                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5510                         n_ssids++;
5511
5512         if (n_ssids > wiphy->max_scan_ssids) {
5513                 err = -EINVAL;
5514                 goto unlock;
5515         }
5516
5517         if (info->attrs[NL80211_ATTR_IE])
5518                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5519         else
5520                 ie_len = 0;
5521
5522         if (ie_len > wiphy->max_scan_ie_len) {
5523                 err = -EINVAL;
5524                 goto unlock;
5525         }
5526
5527         request = kzalloc(sizeof(*request)
5528                         + sizeof(*request->ssids) * n_ssids
5529                         + sizeof(*request->channels) * n_channels
5530                         + ie_len, GFP_KERNEL);
5531         if (!request) {
5532                 err = -ENOMEM;
5533                 goto unlock;
5534         }
5535
5536         if (n_ssids)
5537                 request->ssids = (void *)&request->channels[n_channels];
5538         request->n_ssids = n_ssids;
5539         if (ie_len) {
5540                 if (request->ssids)
5541                         request->ie = (void *)(request->ssids + n_ssids);
5542                 else
5543                         request->ie = (void *)(request->channels + n_channels);
5544         }
5545
5546         i = 0;
5547         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5548                 /* user specified, bail out if channel not found */
5549                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5550                         struct ieee80211_channel *chan;
5551
5552                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5553
5554                         if (!chan) {
5555                                 err = -EINVAL;
5556                                 goto out_free;
5557                         }
5558
5559                         /* ignore disabled channels */
5560                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5561                                 continue;
5562
5563                         request->channels[i] = chan;
5564                         i++;
5565                 }
5566         } else {
5567                 enum ieee80211_band band;
5568
5569                 /* all channels */
5570                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5571                         int j;
5572                         if (!wiphy->bands[band])
5573                                 continue;
5574                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5575                                 struct ieee80211_channel *chan;
5576
5577                                 chan = &wiphy->bands[band]->channels[j];
5578
5579                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5580                                         continue;
5581
5582                                 request->channels[i] = chan;
5583                                 i++;
5584                         }
5585                 }
5586         }
5587
5588         if (!i) {
5589                 err = -EINVAL;
5590                 goto out_free;
5591         }
5592
5593         request->n_channels = i;
5594
5595         i = 0;
5596         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5597                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5598                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5599                                 err = -EINVAL;
5600                                 goto out_free;
5601                         }
5602                         request->ssids[i].ssid_len = nla_len(attr);
5603                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5604                         i++;
5605                 }
5606         }
5607
5608         if (info->attrs[NL80211_ATTR_IE]) {
5609                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5610                 memcpy((void *)request->ie,
5611                        nla_data(info->attrs[NL80211_ATTR_IE]),
5612                        request->ie_len);
5613         }
5614
5615         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5616                 if (wiphy->bands[i])
5617                         request->rates[i] =
5618                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5619
5620         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5621                 nla_for_each_nested(attr,
5622                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5623                                     tmp) {
5624                         enum ieee80211_band band = nla_type(attr);
5625
5626                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5627                                 err = -EINVAL;
5628                                 goto out_free;
5629                         }
5630
5631                         if (!wiphy->bands[band])
5632                                 continue;
5633
5634                         err = ieee80211_get_ratemask(wiphy->bands[band],
5635                                                      nla_data(attr),
5636                                                      nla_len(attr),
5637                                                      &request->rates[band]);
5638                         if (err)
5639                                 goto out_free;
5640                 }
5641         }
5642
5643         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5644                 request->flags = nla_get_u32(
5645                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5646                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5647                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5648                         err = -EOPNOTSUPP;
5649                         goto out_free;
5650                 }
5651         }
5652
5653         request->no_cck =
5654                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5655
5656         request->wdev = wdev;
5657         request->wiphy = &rdev->wiphy;
5658         request->scan_start = jiffies;
5659
5660         rdev->scan_req = request;
5661         err = rdev_scan(rdev, request);
5662
5663         if (!err) {
5664                 nl80211_send_scan_start(rdev, wdev);
5665                 if (wdev->netdev)
5666                         dev_hold(wdev->netdev);
5667         } else {
5668  out_free:
5669                 rdev->scan_req = NULL;
5670                 kfree(request);
5671         }
5672
5673  unlock:
5674         return err;
5675 }
5676
5677 static int nl80211_start_sched_scan(struct sk_buff *skb,
5678                                     struct genl_info *info)
5679 {
5680         struct cfg80211_sched_scan_request *request;
5681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5682         struct net_device *dev = info->user_ptr[1];
5683         struct nlattr *attr;
5684         struct wiphy *wiphy;
5685         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5686         u32 interval;
5687         enum ieee80211_band band;
5688         size_t ie_len;
5689         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5690         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5691
5692         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5693             !rdev->ops->sched_scan_start)
5694                 return -EOPNOTSUPP;
5695
5696         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5697                 return -EINVAL;
5698
5699         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5700                 return -EINVAL;
5701
5702         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5703         if (interval == 0)
5704                 return -EINVAL;
5705
5706         wiphy = &rdev->wiphy;
5707
5708         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5709                 n_channels = validate_scan_freqs(
5710                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5711                 if (!n_channels)
5712                         return -EINVAL;
5713         } else {
5714                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5715         }
5716
5717         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5718                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5719                                     tmp)
5720                         n_ssids++;
5721
5722         if (n_ssids > wiphy->max_sched_scan_ssids)
5723                 return -EINVAL;
5724
5725         /*
5726          * First, count the number of 'real' matchsets. Due to an issue with
5727          * the old implementation, matchsets containing only the RSSI attribute
5728          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5729          * RSSI for all matchsets, rather than their own matchset for reporting
5730          * all APs with a strong RSSI. This is needed to be compatible with
5731          * older userspace that treated a matchset with only the RSSI as the
5732          * global RSSI for all other matchsets - if there are other matchsets.
5733          */
5734         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5735                 nla_for_each_nested(attr,
5736                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5737                                     tmp) {
5738                         struct nlattr *rssi;
5739
5740                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5741                                         nla_data(attr), nla_len(attr),
5742                                         nl80211_match_policy);
5743                         if (err)
5744                                 return err;
5745                         /* add other standalone attributes here */
5746                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5747                                 n_match_sets++;
5748                                 continue;
5749                         }
5750                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5751                         if (rssi)
5752                                 default_match_rssi = nla_get_s32(rssi);
5753                 }
5754         }
5755
5756         /* However, if there's no other matchset, add the RSSI one */
5757         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5758                 n_match_sets = 1;
5759
5760         if (n_match_sets > wiphy->max_match_sets)
5761                 return -EINVAL;
5762
5763         if (info->attrs[NL80211_ATTR_IE])
5764                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5765         else
5766                 ie_len = 0;
5767
5768         if (ie_len > wiphy->max_sched_scan_ie_len)
5769                 return -EINVAL;
5770
5771         if (rdev->sched_scan_req) {
5772                 err = -EINPROGRESS;
5773                 goto out;
5774         }
5775
5776         request = kzalloc(sizeof(*request)
5777                         + sizeof(*request->ssids) * n_ssids
5778                         + sizeof(*request->match_sets) * n_match_sets
5779                         + sizeof(*request->channels) * n_channels
5780                         + ie_len, GFP_KERNEL);
5781         if (!request) {
5782                 err = -ENOMEM;
5783                 goto out;
5784         }
5785
5786         if (n_ssids)
5787                 request->ssids = (void *)&request->channels[n_channels];
5788         request->n_ssids = n_ssids;
5789         if (ie_len) {
5790                 if (request->ssids)
5791                         request->ie = (void *)(request->ssids + n_ssids);
5792                 else
5793                         request->ie = (void *)(request->channels + n_channels);
5794         }
5795
5796         if (n_match_sets) {
5797                 if (request->ie)
5798                         request->match_sets = (void *)(request->ie + ie_len);
5799                 else if (request->ssids)
5800                         request->match_sets =
5801                                 (void *)(request->ssids + n_ssids);
5802                 else
5803                         request->match_sets =
5804                                 (void *)(request->channels + n_channels);
5805         }
5806         request->n_match_sets = n_match_sets;
5807
5808         i = 0;
5809         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5810                 /* user specified, bail out if channel not found */
5811                 nla_for_each_nested(attr,
5812                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5813                                     tmp) {
5814                         struct ieee80211_channel *chan;
5815
5816                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5817
5818                         if (!chan) {
5819                                 err = -EINVAL;
5820                                 goto out_free;
5821                         }
5822
5823                         /* ignore disabled channels */
5824                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5825                                 continue;
5826
5827                         request->channels[i] = chan;
5828                         i++;
5829                 }
5830         } else {
5831                 /* all channels */
5832                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5833                         int j;
5834                         if (!wiphy->bands[band])
5835                                 continue;
5836                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5837                                 struct ieee80211_channel *chan;
5838
5839                                 chan = &wiphy->bands[band]->channels[j];
5840
5841                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5842                                         continue;
5843
5844                                 request->channels[i] = chan;
5845                                 i++;
5846                         }
5847                 }
5848         }
5849
5850         if (!i) {
5851                 err = -EINVAL;
5852                 goto out_free;
5853         }
5854
5855         request->n_channels = i;
5856
5857         i = 0;
5858         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5859                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5860                                     tmp) {
5861                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5862                                 err = -EINVAL;
5863                                 goto out_free;
5864                         }
5865                         request->ssids[i].ssid_len = nla_len(attr);
5866                         memcpy(request->ssids[i].ssid, nla_data(attr),
5867                                nla_len(attr));
5868                         i++;
5869                 }
5870         }
5871
5872         i = 0;
5873         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5874                 nla_for_each_nested(attr,
5875                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5876                                     tmp) {
5877                         struct nlattr *ssid, *rssi;
5878
5879                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5880                                         nla_data(attr), nla_len(attr),
5881                                         nl80211_match_policy);
5882                         if (err)
5883                                 goto out_free;
5884                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5885                         if (ssid) {
5886                                 if (WARN_ON(i >= n_match_sets)) {
5887                                         /* this indicates a programming error,
5888                                          * the loop above should have verified
5889                                          * things properly
5890                                          */
5891                                         err = -EINVAL;
5892                                         goto out_free;
5893                                 }
5894
5895                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5896                                         err = -EINVAL;
5897                                         goto out_free;
5898                                 }
5899                                 memcpy(request->match_sets[i].ssid.ssid,
5900                                        nla_data(ssid), nla_len(ssid));
5901                                 request->match_sets[i].ssid.ssid_len =
5902                                         nla_len(ssid);
5903                                 /* special attribute - old implemenation w/a */
5904                                 request->match_sets[i].rssi_thold =
5905                                         default_match_rssi;
5906                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5907                                 if (rssi)
5908                                         request->match_sets[i].rssi_thold =
5909                                                 nla_get_s32(rssi);
5910                         }
5911                         i++;
5912                 }
5913
5914                 /* there was no other matchset, so the RSSI one is alone */
5915                 if (i == 0)
5916                         request->match_sets[0].rssi_thold = default_match_rssi;
5917
5918                 request->min_rssi_thold = INT_MAX;
5919                 for (i = 0; i < n_match_sets; i++)
5920                         request->min_rssi_thold =
5921                                 min(request->match_sets[i].rssi_thold,
5922                                     request->min_rssi_thold);
5923         } else {
5924                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5925         }
5926
5927         if (ie_len) {
5928                 request->ie_len = ie_len;
5929                 memcpy((void *)request->ie,
5930                        nla_data(info->attrs[NL80211_ATTR_IE]),
5931                        request->ie_len);
5932         }
5933
5934         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5935                 request->flags = nla_get_u32(
5936                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5937                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5938                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5939                         err = -EOPNOTSUPP;
5940                         goto out_free;
5941                 }
5942         }
5943
5944         request->dev = dev;
5945         request->wiphy = &rdev->wiphy;
5946         request->interval = interval;
5947         request->scan_start = jiffies;
5948
5949         err = rdev_sched_scan_start(rdev, dev, request);
5950         if (!err) {
5951                 rdev->sched_scan_req = request;
5952                 nl80211_send_sched_scan(rdev, dev,
5953                                         NL80211_CMD_START_SCHED_SCAN);
5954                 goto out;
5955         }
5956
5957 out_free:
5958         kfree(request);
5959 out:
5960         return err;
5961 }
5962
5963 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5964                                    struct genl_info *info)
5965 {
5966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5967
5968         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5969             !rdev->ops->sched_scan_stop)
5970                 return -EOPNOTSUPP;
5971
5972         return __cfg80211_stop_sched_scan(rdev, false);
5973 }
5974
5975 static int nl80211_start_radar_detection(struct sk_buff *skb,
5976                                          struct genl_info *info)
5977 {
5978         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5979         struct net_device *dev = info->user_ptr[1];
5980         struct wireless_dev *wdev = dev->ieee80211_ptr;
5981         struct cfg80211_chan_def chandef;
5982         enum nl80211_dfs_regions dfs_region;
5983         unsigned int cac_time_ms;
5984         int err;
5985
5986         dfs_region = reg_get_dfs_region(wdev->wiphy);
5987         if (dfs_region == NL80211_DFS_UNSET)
5988                 return -EINVAL;
5989
5990         err = nl80211_parse_chandef(rdev, info, &chandef);
5991         if (err)
5992                 return err;
5993
5994         if (netif_carrier_ok(dev))
5995                 return -EBUSY;
5996
5997         if (wdev->cac_started)
5998                 return -EBUSY;
5999
6000         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6001                                             wdev->iftype);
6002         if (err < 0)
6003                 return err;
6004
6005         if (err == 0)
6006                 return -EINVAL;
6007
6008         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6009                 return -EINVAL;
6010
6011         if (!rdev->ops->start_radar_detection)
6012                 return -EOPNOTSUPP;
6013
6014         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6015         if (WARN_ON(!cac_time_ms))
6016                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6017
6018         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6019                                                cac_time_ms);
6020         if (!err) {
6021                 wdev->chandef = chandef;
6022                 wdev->cac_started = true;
6023                 wdev->cac_start_time = jiffies;
6024                 wdev->cac_time_ms = cac_time_ms;
6025         }
6026         return err;
6027 }
6028
6029 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6030 {
6031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6032         struct net_device *dev = info->user_ptr[1];
6033         struct wireless_dev *wdev = dev->ieee80211_ptr;
6034         struct cfg80211_csa_settings params;
6035         /* csa_attrs is defined static to avoid waste of stack size - this
6036          * function is called under RTNL lock, so this should not be a problem.
6037          */
6038         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6039         u8 radar_detect_width = 0;
6040         int err;
6041         bool need_new_beacon = false;
6042         int len, i;
6043
6044         if (!rdev->ops->channel_switch ||
6045             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6046                 return -EOPNOTSUPP;
6047
6048         switch (dev->ieee80211_ptr->iftype) {
6049         case NL80211_IFTYPE_AP:
6050         case NL80211_IFTYPE_P2P_GO:
6051                 need_new_beacon = true;
6052
6053                 /* useless if AP is not running */
6054                 if (!wdev->beacon_interval)
6055                         return -ENOTCONN;
6056                 break;
6057         case NL80211_IFTYPE_ADHOC:
6058                 if (!wdev->ssid_len)
6059                         return -ENOTCONN;
6060                 break;
6061         case NL80211_IFTYPE_MESH_POINT:
6062                 if (!wdev->mesh_id_len)
6063                         return -ENOTCONN;
6064                 break;
6065         default:
6066                 return -EOPNOTSUPP;
6067         }
6068
6069         memset(&params, 0, sizeof(params));
6070
6071         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6072             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6073                 return -EINVAL;
6074
6075         /* only important for AP, IBSS and mesh create IEs internally */
6076         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6077                 return -EINVAL;
6078
6079         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6080
6081         if (!need_new_beacon)
6082                 goto skip_beacons;
6083
6084         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6085         if (err)
6086                 return err;
6087
6088         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6089                                info->attrs[NL80211_ATTR_CSA_IES],
6090                                nl80211_policy);
6091         if (err)
6092                 return err;
6093
6094         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6095         if (err)
6096                 return err;
6097
6098         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6099                 return -EINVAL;
6100
6101         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6102         if (!len || (len % sizeof(u16)))
6103                 return -EINVAL;
6104
6105         params.n_counter_offsets_beacon = len / sizeof(u16);
6106         if (rdev->wiphy.max_num_csa_counters &&
6107             (params.n_counter_offsets_beacon >
6108              rdev->wiphy.max_num_csa_counters))
6109                 return -EINVAL;
6110
6111         params.counter_offsets_beacon =
6112                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6113
6114         /* sanity checks - counters should fit and be the same */
6115         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6116                 u16 offset = params.counter_offsets_beacon[i];
6117
6118                 if (offset >= params.beacon_csa.tail_len)
6119                         return -EINVAL;
6120
6121                 if (params.beacon_csa.tail[offset] != params.count)
6122                         return -EINVAL;
6123         }
6124
6125         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6126                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6127                 if (!len || (len % sizeof(u16)))
6128                         return -EINVAL;
6129
6130                 params.n_counter_offsets_presp = len / sizeof(u16);
6131                 if (rdev->wiphy.max_num_csa_counters &&
6132                     (params.n_counter_offsets_beacon >
6133                      rdev->wiphy.max_num_csa_counters))
6134                         return -EINVAL;
6135
6136                 params.counter_offsets_presp =
6137                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6138
6139                 /* sanity checks - counters should fit and be the same */
6140                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6141                         u16 offset = params.counter_offsets_presp[i];
6142
6143                         if (offset >= params.beacon_csa.probe_resp_len)
6144                                 return -EINVAL;
6145
6146                         if (params.beacon_csa.probe_resp[offset] !=
6147                             params.count)
6148                                 return -EINVAL;
6149                 }
6150         }
6151
6152 skip_beacons:
6153         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6154         if (err)
6155                 return err;
6156
6157         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6158                                      wdev->iftype))
6159                 return -EINVAL;
6160
6161         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6162                                             &params.chandef,
6163                                             wdev->iftype);
6164         if (err < 0)
6165                 return err;
6166
6167         if (err > 0) {
6168                 radar_detect_width = BIT(params.chandef.width);
6169                 params.radar_required = true;
6170         }
6171
6172         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6173                 params.block_tx = true;
6174
6175         wdev_lock(wdev);
6176         err = rdev_channel_switch(rdev, dev, &params);
6177         wdev_unlock(wdev);
6178
6179         return err;
6180 }
6181
6182 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6183                             u32 seq, int flags,
6184                             struct cfg80211_registered_device *rdev,
6185                             struct wireless_dev *wdev,
6186                             struct cfg80211_internal_bss *intbss)
6187 {
6188         struct cfg80211_bss *res = &intbss->pub;
6189         const struct cfg80211_bss_ies *ies;
6190         void *hdr;
6191         struct nlattr *bss;
6192
6193         ASSERT_WDEV_LOCK(wdev);
6194
6195         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6196                              NL80211_CMD_NEW_SCAN_RESULTS);
6197         if (!hdr)
6198                 return -1;
6199
6200         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6201
6202         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6203                 goto nla_put_failure;
6204         if (wdev->netdev &&
6205             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6206                 goto nla_put_failure;
6207         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6208                 goto nla_put_failure;
6209
6210         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6211         if (!bss)
6212                 goto nla_put_failure;
6213         if ((!is_zero_ether_addr(res->bssid) &&
6214              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6215                 goto nla_put_failure;
6216
6217         rcu_read_lock();
6218         /* indicate whether we have probe response data or not */
6219         if (rcu_access_pointer(res->proberesp_ies) &&
6220             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6221                 goto fail_unlock_rcu;
6222
6223         /* this pointer prefers to be pointed to probe response data
6224          * but is always valid
6225          */
6226         ies = rcu_dereference(res->ies);
6227         if (ies) {
6228                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6229                         goto fail_unlock_rcu;
6230                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6231                                         ies->len, ies->data))
6232                         goto fail_unlock_rcu;
6233         }
6234
6235         /* and this pointer is always (unless driver didn't know) beacon data */
6236         ies = rcu_dereference(res->beacon_ies);
6237         if (ies && ies->from_beacon) {
6238                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6239                         goto fail_unlock_rcu;
6240                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6241                                         ies->len, ies->data))
6242                         goto fail_unlock_rcu;
6243         }
6244         rcu_read_unlock();
6245
6246         if (res->beacon_interval &&
6247             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6248                 goto nla_put_failure;
6249         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6250             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6251             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6252             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6253                         jiffies_to_msecs(jiffies - intbss->ts)))
6254                 goto nla_put_failure;
6255
6256         switch (rdev->wiphy.signal_type) {
6257         case CFG80211_SIGNAL_TYPE_MBM:
6258                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6259                         goto nla_put_failure;
6260                 break;
6261         case CFG80211_SIGNAL_TYPE_UNSPEC:
6262                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6263                         goto nla_put_failure;
6264                 break;
6265         default:
6266                 break;
6267         }
6268
6269         switch (wdev->iftype) {
6270         case NL80211_IFTYPE_P2P_CLIENT:
6271         case NL80211_IFTYPE_STATION:
6272                 if (intbss == wdev->current_bss &&
6273                     nla_put_u32(msg, NL80211_BSS_STATUS,
6274                                 NL80211_BSS_STATUS_ASSOCIATED))
6275                         goto nla_put_failure;
6276                 break;
6277         case NL80211_IFTYPE_ADHOC:
6278                 if (intbss == wdev->current_bss &&
6279                     nla_put_u32(msg, NL80211_BSS_STATUS,
6280                                 NL80211_BSS_STATUS_IBSS_JOINED))
6281                         goto nla_put_failure;
6282                 break;
6283         default:
6284                 break;
6285         }
6286
6287         nla_nest_end(msg, bss);
6288
6289         return genlmsg_end(msg, hdr);
6290
6291  fail_unlock_rcu:
6292         rcu_read_unlock();
6293  nla_put_failure:
6294         genlmsg_cancel(msg, hdr);
6295         return -EMSGSIZE;
6296 }
6297
6298 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6299 {
6300         struct cfg80211_registered_device *rdev;
6301         struct cfg80211_internal_bss *scan;
6302         struct wireless_dev *wdev;
6303         int start = cb->args[2], idx = 0;
6304         int err;
6305
6306         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6307         if (err)
6308                 return err;
6309
6310         wdev_lock(wdev);
6311         spin_lock_bh(&rdev->bss_lock);
6312         cfg80211_bss_expire(rdev);
6313
6314         cb->seq = rdev->bss_generation;
6315
6316         list_for_each_entry(scan, &rdev->bss_list, list) {
6317                 if (++idx <= start)
6318                         continue;
6319                 if (nl80211_send_bss(skb, cb,
6320                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6321                                 rdev, wdev, scan) < 0) {
6322                         idx--;
6323                         break;
6324                 }
6325         }
6326
6327         spin_unlock_bh(&rdev->bss_lock);
6328         wdev_unlock(wdev);
6329
6330         cb->args[2] = idx;
6331         nl80211_finish_wdev_dump(rdev);
6332
6333         return skb->len;
6334 }
6335
6336 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6337                                 int flags, struct net_device *dev,
6338                                 struct survey_info *survey)
6339 {
6340         void *hdr;
6341         struct nlattr *infoattr;
6342
6343         hdr = nl80211hdr_put(msg, portid, seq, flags,
6344                              NL80211_CMD_NEW_SURVEY_RESULTS);
6345         if (!hdr)
6346                 return -ENOMEM;
6347
6348         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6349                 goto nla_put_failure;
6350
6351         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6352         if (!infoattr)
6353                 goto nla_put_failure;
6354
6355         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6356                         survey->channel->center_freq))
6357                 goto nla_put_failure;
6358
6359         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6360             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6361                 goto nla_put_failure;
6362         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6363             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6364                 goto nla_put_failure;
6365         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6366             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6367                         survey->channel_time))
6368                 goto nla_put_failure;
6369         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6370             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6371                         survey->channel_time_busy))
6372                 goto nla_put_failure;
6373         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6374             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6375                         survey->channel_time_ext_busy))
6376                 goto nla_put_failure;
6377         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6378             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6379                         survey->channel_time_rx))
6380                 goto nla_put_failure;
6381         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6382             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6383                         survey->channel_time_tx))
6384                 goto nla_put_failure;
6385
6386         nla_nest_end(msg, infoattr);
6387
6388         return genlmsg_end(msg, hdr);
6389
6390  nla_put_failure:
6391         genlmsg_cancel(msg, hdr);
6392         return -EMSGSIZE;
6393 }
6394
6395 static int nl80211_dump_survey(struct sk_buff *skb,
6396                         struct netlink_callback *cb)
6397 {
6398         struct survey_info survey;
6399         struct cfg80211_registered_device *rdev;
6400         struct wireless_dev *wdev;
6401         int survey_idx = cb->args[2];
6402         int res;
6403
6404         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6405         if (res)
6406                 return res;
6407
6408         if (!wdev->netdev) {
6409                 res = -EINVAL;
6410                 goto out_err;
6411         }
6412
6413         if (!rdev->ops->dump_survey) {
6414                 res = -EOPNOTSUPP;
6415                 goto out_err;
6416         }
6417
6418         while (1) {
6419                 struct ieee80211_channel *chan;
6420
6421                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6422                 if (res == -ENOENT)
6423                         break;
6424                 if (res)
6425                         goto out_err;
6426
6427                 /* Survey without a channel doesn't make sense */
6428                 if (!survey.channel) {
6429                         res = -EINVAL;
6430                         goto out;
6431                 }
6432
6433                 chan = ieee80211_get_channel(&rdev->wiphy,
6434                                              survey.channel->center_freq);
6435                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6436                         survey_idx++;
6437                         continue;
6438                 }
6439
6440                 if (nl80211_send_survey(skb,
6441                                 NETLINK_CB(cb->skb).portid,
6442                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6443                                 wdev->netdev, &survey) < 0)
6444                         goto out;
6445                 survey_idx++;
6446         }
6447
6448  out:
6449         cb->args[2] = survey_idx;
6450         res = skb->len;
6451  out_err:
6452         nl80211_finish_wdev_dump(rdev);
6453         return res;
6454 }
6455
6456 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6457 {
6458         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6459                                   NL80211_WPA_VERSION_2));
6460 }
6461
6462 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6463 {
6464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6465         struct net_device *dev = info->user_ptr[1];
6466         struct ieee80211_channel *chan;
6467         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6468         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6469         enum nl80211_auth_type auth_type;
6470         struct key_parse key;
6471         bool local_state_change;
6472
6473         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6474                 return -EINVAL;
6475
6476         if (!info->attrs[NL80211_ATTR_MAC])
6477                 return -EINVAL;
6478
6479         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6480                 return -EINVAL;
6481
6482         if (!info->attrs[NL80211_ATTR_SSID])
6483                 return -EINVAL;
6484
6485         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6486                 return -EINVAL;
6487
6488         err = nl80211_parse_key(info, &key);
6489         if (err)
6490                 return err;
6491
6492         if (key.idx >= 0) {
6493                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6494                         return -EINVAL;
6495                 if (!key.p.key || !key.p.key_len)
6496                         return -EINVAL;
6497                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6498                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6499                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6500                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6501                         return -EINVAL;
6502                 if (key.idx > 4)
6503                         return -EINVAL;
6504         } else {
6505                 key.p.key_len = 0;
6506                 key.p.key = NULL;
6507         }
6508
6509         if (key.idx >= 0) {
6510                 int i;
6511                 bool ok = false;
6512                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6513                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6514                                 ok = true;
6515                                 break;
6516                         }
6517                 }
6518                 if (!ok)
6519                         return -EINVAL;
6520         }
6521
6522         if (!rdev->ops->auth)
6523                 return -EOPNOTSUPP;
6524
6525         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6526             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6527                 return -EOPNOTSUPP;
6528
6529         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6530         chan = nl80211_get_valid_chan(&rdev->wiphy,
6531                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6532         if (!chan)
6533                 return -EINVAL;
6534
6535         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6536         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6537
6538         if (info->attrs[NL80211_ATTR_IE]) {
6539                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6540                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6541         }
6542
6543         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6544         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6545                 return -EINVAL;
6546
6547         if (auth_type == NL80211_AUTHTYPE_SAE &&
6548             !info->attrs[NL80211_ATTR_SAE_DATA])
6549                 return -EINVAL;
6550
6551         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6552                 if (auth_type != NL80211_AUTHTYPE_SAE)
6553                         return -EINVAL;
6554                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6555                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6556                 /* need to include at least Auth Transaction and Status Code */
6557                 if (sae_data_len < 4)
6558                         return -EINVAL;
6559         }
6560
6561         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6562
6563         /*
6564          * Since we no longer track auth state, ignore
6565          * requests to only change local state.
6566          */
6567         if (local_state_change)
6568                 return 0;
6569
6570         wdev_lock(dev->ieee80211_ptr);
6571         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6572                                  ssid, ssid_len, ie, ie_len,
6573                                  key.p.key, key.p.key_len, key.idx,
6574                                  sae_data, sae_data_len);
6575         wdev_unlock(dev->ieee80211_ptr);
6576         return err;
6577 }
6578
6579 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6580                                    struct genl_info *info,
6581                                    struct cfg80211_crypto_settings *settings,
6582                                    int cipher_limit)
6583 {
6584         memset(settings, 0, sizeof(*settings));
6585
6586         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6587
6588         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6589                 u16 proto;
6590                 proto = nla_get_u16(
6591                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6592                 settings->control_port_ethertype = cpu_to_be16(proto);
6593                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6594                     proto != ETH_P_PAE)
6595                         return -EINVAL;
6596                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6597                         settings->control_port_no_encrypt = true;
6598         } else
6599                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6600
6601         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6602                 void *data;
6603                 int len, i;
6604
6605                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6606                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6607                 settings->n_ciphers_pairwise = len / sizeof(u32);
6608
6609                 if (len % sizeof(u32))
6610                         return -EINVAL;
6611
6612                 if (settings->n_ciphers_pairwise > cipher_limit)
6613                         return -EINVAL;
6614
6615                 memcpy(settings->ciphers_pairwise, data, len);
6616
6617                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6618                         if (!cfg80211_supported_cipher_suite(
6619                                         &rdev->wiphy,
6620                                         settings->ciphers_pairwise[i]))
6621                                 return -EINVAL;
6622         }
6623
6624         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6625                 settings->cipher_group =
6626                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6627                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6628                                                      settings->cipher_group))
6629                         return -EINVAL;
6630         }
6631
6632         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6633                 settings->wpa_versions =
6634                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6635                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6636                         return -EINVAL;
6637         }
6638
6639         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6640                 void *data;
6641                 int len;
6642
6643                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6644                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6645                 settings->n_akm_suites = len / sizeof(u32);
6646
6647                 if (len % sizeof(u32))
6648                         return -EINVAL;
6649
6650                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6651                         return -EINVAL;
6652
6653                 memcpy(settings->akm_suites, data, len);
6654         }
6655
6656         return 0;
6657 }
6658
6659 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6660 {
6661         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6662         struct net_device *dev = info->user_ptr[1];
6663         struct ieee80211_channel *chan;
6664         struct cfg80211_assoc_request req = {};
6665         const u8 *bssid, *ssid;
6666         int err, ssid_len = 0;
6667
6668         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6669                 return -EINVAL;
6670
6671         if (!info->attrs[NL80211_ATTR_MAC] ||
6672             !info->attrs[NL80211_ATTR_SSID] ||
6673             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6674                 return -EINVAL;
6675
6676         if (!rdev->ops->assoc)
6677                 return -EOPNOTSUPP;
6678
6679         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6680             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6681                 return -EOPNOTSUPP;
6682
6683         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6684
6685         chan = nl80211_get_valid_chan(&rdev->wiphy,
6686                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6687         if (!chan)
6688                 return -EINVAL;
6689
6690         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6691         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6692
6693         if (info->attrs[NL80211_ATTR_IE]) {
6694                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6695                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6696         }
6697
6698         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6699                 enum nl80211_mfp mfp =
6700                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6701                 if (mfp == NL80211_MFP_REQUIRED)
6702                         req.use_mfp = true;
6703                 else if (mfp != NL80211_MFP_NO)
6704                         return -EINVAL;
6705         }
6706
6707         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6708                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6709
6710         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6711                 req.flags |= ASSOC_REQ_DISABLE_HT;
6712
6713         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6714                 memcpy(&req.ht_capa_mask,
6715                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6716                        sizeof(req.ht_capa_mask));
6717
6718         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6719                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6720                         return -EINVAL;
6721                 memcpy(&req.ht_capa,
6722                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6723                        sizeof(req.ht_capa));
6724         }
6725
6726         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6727                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6728
6729         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6730                 memcpy(&req.vht_capa_mask,
6731                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6732                        sizeof(req.vht_capa_mask));
6733
6734         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6735                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6736                         return -EINVAL;
6737                 memcpy(&req.vht_capa,
6738                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6739                        sizeof(req.vht_capa));
6740         }
6741
6742         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
6743                 if (!(rdev->wiphy.features &
6744                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
6745                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
6746                         return -EINVAL;
6747                 req.flags |= ASSOC_REQ_USE_RRM;
6748         }
6749
6750         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6751         if (!err) {
6752                 wdev_lock(dev->ieee80211_ptr);
6753                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6754                                           ssid, ssid_len, &req);
6755                 wdev_unlock(dev->ieee80211_ptr);
6756         }
6757
6758         return err;
6759 }
6760
6761 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6762 {
6763         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6764         struct net_device *dev = info->user_ptr[1];
6765         const u8 *ie = NULL, *bssid;
6766         int ie_len = 0, err;
6767         u16 reason_code;
6768         bool local_state_change;
6769
6770         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6771                 return -EINVAL;
6772
6773         if (!info->attrs[NL80211_ATTR_MAC])
6774                 return -EINVAL;
6775
6776         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6777                 return -EINVAL;
6778
6779         if (!rdev->ops->deauth)
6780                 return -EOPNOTSUPP;
6781
6782         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6783             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6784                 return -EOPNOTSUPP;
6785
6786         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6787
6788         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6789         if (reason_code == 0) {
6790                 /* Reason Code 0 is reserved */
6791                 return -EINVAL;
6792         }
6793
6794         if (info->attrs[NL80211_ATTR_IE]) {
6795                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6796                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6797         }
6798
6799         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6800
6801         wdev_lock(dev->ieee80211_ptr);
6802         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6803                                    local_state_change);
6804         wdev_unlock(dev->ieee80211_ptr);
6805         return err;
6806 }
6807
6808 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6809 {
6810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6811         struct net_device *dev = info->user_ptr[1];
6812         const u8 *ie = NULL, *bssid;
6813         int ie_len = 0, err;
6814         u16 reason_code;
6815         bool local_state_change;
6816
6817         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6818                 return -EINVAL;
6819
6820         if (!info->attrs[NL80211_ATTR_MAC])
6821                 return -EINVAL;
6822
6823         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6824                 return -EINVAL;
6825
6826         if (!rdev->ops->disassoc)
6827                 return -EOPNOTSUPP;
6828
6829         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6830             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6831                 return -EOPNOTSUPP;
6832
6833         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6834
6835         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6836         if (reason_code == 0) {
6837                 /* Reason Code 0 is reserved */
6838                 return -EINVAL;
6839         }
6840
6841         if (info->attrs[NL80211_ATTR_IE]) {
6842                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6843                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6844         }
6845
6846         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6847
6848         wdev_lock(dev->ieee80211_ptr);
6849         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6850                                      local_state_change);
6851         wdev_unlock(dev->ieee80211_ptr);
6852         return err;
6853 }
6854
6855 static bool
6856 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6857                          int mcast_rate[IEEE80211_NUM_BANDS],
6858                          int rateval)
6859 {
6860         struct wiphy *wiphy = &rdev->wiphy;
6861         bool found = false;
6862         int band, i;
6863
6864         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6865                 struct ieee80211_supported_band *sband;
6866
6867                 sband = wiphy->bands[band];
6868                 if (!sband)
6869                         continue;
6870
6871                 for (i = 0; i < sband->n_bitrates; i++) {
6872                         if (sband->bitrates[i].bitrate == rateval) {
6873                                 mcast_rate[band] = i + 1;
6874                                 found = true;
6875                                 break;
6876                         }
6877                 }
6878         }
6879
6880         return found;
6881 }
6882
6883 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6884 {
6885         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6886         struct net_device *dev = info->user_ptr[1];
6887         struct cfg80211_ibss_params ibss;
6888         struct wiphy *wiphy;
6889         struct cfg80211_cached_keys *connkeys = NULL;
6890         int err;
6891
6892         memset(&ibss, 0, sizeof(ibss));
6893
6894         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6895                 return -EINVAL;
6896
6897         if (!info->attrs[NL80211_ATTR_SSID] ||
6898             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6899                 return -EINVAL;
6900
6901         ibss.beacon_interval = 100;
6902
6903         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6904                 ibss.beacon_interval =
6905                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6906                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6907                         return -EINVAL;
6908         }
6909
6910         if (!rdev->ops->join_ibss)
6911                 return -EOPNOTSUPP;
6912
6913         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6914                 return -EOPNOTSUPP;
6915
6916         wiphy = &rdev->wiphy;
6917
6918         if (info->attrs[NL80211_ATTR_MAC]) {
6919                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6920
6921                 if (!is_valid_ether_addr(ibss.bssid))
6922                         return -EINVAL;
6923         }
6924         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6925         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6926
6927         if (info->attrs[NL80211_ATTR_IE]) {
6928                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6929                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6930         }
6931
6932         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6933         if (err)
6934                 return err;
6935
6936         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6937                                      NL80211_IFTYPE_ADHOC))
6938                 return -EINVAL;
6939
6940         switch (ibss.chandef.width) {
6941         case NL80211_CHAN_WIDTH_5:
6942         case NL80211_CHAN_WIDTH_10:
6943         case NL80211_CHAN_WIDTH_20_NOHT:
6944                 break;
6945         case NL80211_CHAN_WIDTH_20:
6946         case NL80211_CHAN_WIDTH_40:
6947                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6948                         break;
6949         default:
6950                 return -EINVAL;
6951         }
6952
6953         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6954         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6955
6956         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6957                 u8 *rates =
6958                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6959                 int n_rates =
6960                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6961                 struct ieee80211_supported_band *sband =
6962                         wiphy->bands[ibss.chandef.chan->band];
6963
6964                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6965                                              &ibss.basic_rates);
6966                 if (err)
6967                         return err;
6968         }
6969
6970         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6971                 memcpy(&ibss.ht_capa_mask,
6972                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6973                        sizeof(ibss.ht_capa_mask));
6974
6975         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6976                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6977                         return -EINVAL;
6978                 memcpy(&ibss.ht_capa,
6979                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6980                        sizeof(ibss.ht_capa));
6981         }
6982
6983         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6984             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6985                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6986                 return -EINVAL;
6987
6988         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6989                 bool no_ht = false;
6990
6991                 connkeys = nl80211_parse_connkeys(rdev,
6992                                           info->attrs[NL80211_ATTR_KEYS],
6993                                           &no_ht);
6994                 if (IS_ERR(connkeys))
6995                         return PTR_ERR(connkeys);
6996
6997                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6998                     no_ht) {
6999                         kfree(connkeys);
7000                         return -EINVAL;
7001                 }
7002         }
7003
7004         ibss.control_port =
7005                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7006
7007         ibss.userspace_handles_dfs =
7008                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7009
7010         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7011         if (err)
7012                 kzfree(connkeys);
7013         return err;
7014 }
7015
7016 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7017 {
7018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7019         struct net_device *dev = info->user_ptr[1];
7020
7021         if (!rdev->ops->leave_ibss)
7022                 return -EOPNOTSUPP;
7023
7024         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7025                 return -EOPNOTSUPP;
7026
7027         return cfg80211_leave_ibss(rdev, dev, false);
7028 }
7029
7030 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7031 {
7032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7033         struct net_device *dev = info->user_ptr[1];
7034         int mcast_rate[IEEE80211_NUM_BANDS];
7035         u32 nla_rate;
7036         int err;
7037
7038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7040                 return -EOPNOTSUPP;
7041
7042         if (!rdev->ops->set_mcast_rate)
7043                 return -EOPNOTSUPP;
7044
7045         memset(mcast_rate, 0, sizeof(mcast_rate));
7046
7047         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7048                 return -EINVAL;
7049
7050         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7051         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7052                 return -EINVAL;
7053
7054         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7055
7056         return err;
7057 }
7058
7059 static struct sk_buff *
7060 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7061                             int approxlen, u32 portid, u32 seq,
7062                             enum nl80211_commands cmd,
7063                             enum nl80211_attrs attr,
7064                             const struct nl80211_vendor_cmd_info *info,
7065                             gfp_t gfp)
7066 {
7067         struct sk_buff *skb;
7068         void *hdr;
7069         struct nlattr *data;
7070
7071         skb = nlmsg_new(approxlen + 100, gfp);
7072         if (!skb)
7073                 return NULL;
7074
7075         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7076         if (!hdr) {
7077                 kfree_skb(skb);
7078                 return NULL;
7079         }
7080
7081         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7082                 goto nla_put_failure;
7083
7084         if (info) {
7085                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7086                                 info->vendor_id))
7087                         goto nla_put_failure;
7088                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7089                                 info->subcmd))
7090                         goto nla_put_failure;
7091         }
7092
7093         data = nla_nest_start(skb, attr);
7094
7095         ((void **)skb->cb)[0] = rdev;
7096         ((void **)skb->cb)[1] = hdr;
7097         ((void **)skb->cb)[2] = data;
7098
7099         return skb;
7100
7101  nla_put_failure:
7102         kfree_skb(skb);
7103         return NULL;
7104 }
7105
7106 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7107                                            enum nl80211_commands cmd,
7108                                            enum nl80211_attrs attr,
7109                                            int vendor_event_idx,
7110                                            int approxlen, gfp_t gfp)
7111 {
7112         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7113         const struct nl80211_vendor_cmd_info *info;
7114
7115         switch (cmd) {
7116         case NL80211_CMD_TESTMODE:
7117                 if (WARN_ON(vendor_event_idx != -1))
7118                         return NULL;
7119                 info = NULL;
7120                 break;
7121         case NL80211_CMD_VENDOR:
7122                 if (WARN_ON(vendor_event_idx < 0 ||
7123                             vendor_event_idx >= wiphy->n_vendor_events))
7124                         return NULL;
7125                 info = &wiphy->vendor_events[vendor_event_idx];
7126                 break;
7127         default:
7128                 WARN_ON(1);
7129                 return NULL;
7130         }
7131
7132         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7133                                            cmd, attr, info, gfp);
7134 }
7135 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7136
7137 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7138 {
7139         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7140         void *hdr = ((void **)skb->cb)[1];
7141         struct nlattr *data = ((void **)skb->cb)[2];
7142         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7143
7144         /* clear CB data for netlink core to own from now on */
7145         memset(skb->cb, 0, sizeof(skb->cb));
7146
7147         nla_nest_end(skb, data);
7148         genlmsg_end(skb, hdr);
7149
7150         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7151                 mcgrp = NL80211_MCGRP_VENDOR;
7152
7153         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7154                                 mcgrp, gfp);
7155 }
7156 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7157
7158 #ifdef CONFIG_NL80211_TESTMODE
7159 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7160 {
7161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7162         struct wireless_dev *wdev =
7163                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7164         int err;
7165
7166         if (!rdev->ops->testmode_cmd)
7167                 return -EOPNOTSUPP;
7168
7169         if (IS_ERR(wdev)) {
7170                 err = PTR_ERR(wdev);
7171                 if (err != -EINVAL)
7172                         return err;
7173                 wdev = NULL;
7174         } else if (wdev->wiphy != &rdev->wiphy) {
7175                 return -EINVAL;
7176         }
7177
7178         if (!info->attrs[NL80211_ATTR_TESTDATA])
7179                 return -EINVAL;
7180
7181         rdev->cur_cmd_info = info;
7182         err = rdev_testmode_cmd(rdev, wdev,
7183                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7184                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7185         rdev->cur_cmd_info = NULL;
7186
7187         return err;
7188 }
7189
7190 static int nl80211_testmode_dump(struct sk_buff *skb,
7191                                  struct netlink_callback *cb)
7192 {
7193         struct cfg80211_registered_device *rdev;
7194         int err;
7195         long phy_idx;
7196         void *data = NULL;
7197         int data_len = 0;
7198
7199         rtnl_lock();
7200
7201         if (cb->args[0]) {
7202                 /*
7203                  * 0 is a valid index, but not valid for args[0],
7204                  * so we need to offset by 1.
7205                  */
7206                 phy_idx = cb->args[0] - 1;
7207         } else {
7208                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7209                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7210                                   nl80211_policy);
7211                 if (err)
7212                         goto out_err;
7213
7214                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7215                                                   nl80211_fam.attrbuf);
7216                 if (IS_ERR(rdev)) {
7217                         err = PTR_ERR(rdev);
7218                         goto out_err;
7219                 }
7220                 phy_idx = rdev->wiphy_idx;
7221                 rdev = NULL;
7222
7223                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7224                         cb->args[1] =
7225                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7226         }
7227
7228         if (cb->args[1]) {
7229                 data = nla_data((void *)cb->args[1]);
7230                 data_len = nla_len((void *)cb->args[1]);
7231         }
7232
7233         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7234         if (!rdev) {
7235                 err = -ENOENT;
7236                 goto out_err;
7237         }
7238
7239         if (!rdev->ops->testmode_dump) {
7240                 err = -EOPNOTSUPP;
7241                 goto out_err;
7242         }
7243
7244         while (1) {
7245                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7246                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7247                                            NL80211_CMD_TESTMODE);
7248                 struct nlattr *tmdata;
7249
7250                 if (!hdr)
7251                         break;
7252
7253                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7254                         genlmsg_cancel(skb, hdr);
7255                         break;
7256                 }
7257
7258                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7259                 if (!tmdata) {
7260                         genlmsg_cancel(skb, hdr);
7261                         break;
7262                 }
7263                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7264                 nla_nest_end(skb, tmdata);
7265
7266                 if (err == -ENOBUFS || err == -ENOENT) {
7267                         genlmsg_cancel(skb, hdr);
7268                         break;
7269                 } else if (err) {
7270                         genlmsg_cancel(skb, hdr);
7271                         goto out_err;
7272                 }
7273
7274                 genlmsg_end(skb, hdr);
7275         }
7276
7277         err = skb->len;
7278         /* see above */
7279         cb->args[0] = phy_idx + 1;
7280  out_err:
7281         rtnl_unlock();
7282         return err;
7283 }
7284 #endif
7285
7286 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7287 {
7288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7289         struct net_device *dev = info->user_ptr[1];
7290         struct cfg80211_connect_params connect;
7291         struct wiphy *wiphy;
7292         struct cfg80211_cached_keys *connkeys = NULL;
7293         int err;
7294
7295         memset(&connect, 0, sizeof(connect));
7296
7297         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7298                 return -EINVAL;
7299
7300         if (!info->attrs[NL80211_ATTR_SSID] ||
7301             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7302                 return -EINVAL;
7303
7304         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7305                 connect.auth_type =
7306                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7307                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7308                                              NL80211_CMD_CONNECT))
7309                         return -EINVAL;
7310         } else
7311                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7312
7313         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7314
7315         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7316                                       NL80211_MAX_NR_CIPHER_SUITES);
7317         if (err)
7318                 return err;
7319
7320         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7321             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7322                 return -EOPNOTSUPP;
7323
7324         wiphy = &rdev->wiphy;
7325
7326         connect.bg_scan_period = -1;
7327         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7328                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7329                 connect.bg_scan_period =
7330                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7331         }
7332
7333         if (info->attrs[NL80211_ATTR_MAC])
7334                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7335         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7336                 connect.bssid_hint =
7337                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7338         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7339         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7340
7341         if (info->attrs[NL80211_ATTR_IE]) {
7342                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7343                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7344         }
7345
7346         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7347                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7348                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7349                     connect.mfp != NL80211_MFP_NO)
7350                         return -EINVAL;
7351         } else {
7352                 connect.mfp = NL80211_MFP_NO;
7353         }
7354
7355         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7356                 connect.channel = nl80211_get_valid_chan(
7357                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7358                 if (!connect.channel)
7359                         return -EINVAL;
7360         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7361                 connect.channel_hint = nl80211_get_valid_chan(
7362                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7363                 if (!connect.channel_hint)
7364                         return -EINVAL;
7365         }
7366
7367         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7368                 connkeys = nl80211_parse_connkeys(rdev,
7369                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7370                 if (IS_ERR(connkeys))
7371                         return PTR_ERR(connkeys);
7372         }
7373
7374         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7375                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7376
7377         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7378                 memcpy(&connect.ht_capa_mask,
7379                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7380                        sizeof(connect.ht_capa_mask));
7381
7382         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7383                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7384                         kzfree(connkeys);
7385                         return -EINVAL;
7386                 }
7387                 memcpy(&connect.ht_capa,
7388                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7389                        sizeof(connect.ht_capa));
7390         }
7391
7392         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7393                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7394
7395         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7396                 memcpy(&connect.vht_capa_mask,
7397                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7398                        sizeof(connect.vht_capa_mask));
7399
7400         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7401                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7402                         kzfree(connkeys);
7403                         return -EINVAL;
7404                 }
7405                 memcpy(&connect.vht_capa,
7406                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7407                        sizeof(connect.vht_capa));
7408         }
7409
7410         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7411                 if (!(rdev->wiphy.features &
7412                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7413                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7414                         return -EINVAL;
7415                 connect.flags |= ASSOC_REQ_USE_RRM;
7416         }
7417
7418         wdev_lock(dev->ieee80211_ptr);
7419         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7420         wdev_unlock(dev->ieee80211_ptr);
7421         if (err)
7422                 kzfree(connkeys);
7423         return err;
7424 }
7425
7426 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7427 {
7428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7429         struct net_device *dev = info->user_ptr[1];
7430         u16 reason;
7431         int ret;
7432
7433         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7434                 reason = WLAN_REASON_DEAUTH_LEAVING;
7435         else
7436                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7437
7438         if (reason == 0)
7439                 return -EINVAL;
7440
7441         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7442             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7443                 return -EOPNOTSUPP;
7444
7445         wdev_lock(dev->ieee80211_ptr);
7446         ret = cfg80211_disconnect(rdev, dev, reason, true);
7447         wdev_unlock(dev->ieee80211_ptr);
7448         return ret;
7449 }
7450
7451 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7452 {
7453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7454         struct net *net;
7455         int err;
7456         u32 pid;
7457
7458         if (!info->attrs[NL80211_ATTR_PID])
7459                 return -EINVAL;
7460
7461         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7462
7463         net = get_net_ns_by_pid(pid);
7464         if (IS_ERR(net))
7465                 return PTR_ERR(net);
7466
7467         err = 0;
7468
7469         /* check if anything to do */
7470         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7471                 err = cfg80211_switch_netns(rdev, net);
7472
7473         put_net(net);
7474         return err;
7475 }
7476
7477 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7478 {
7479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7480         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7481                         struct cfg80211_pmksa *pmksa) = NULL;
7482         struct net_device *dev = info->user_ptr[1];
7483         struct cfg80211_pmksa pmksa;
7484
7485         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7486
7487         if (!info->attrs[NL80211_ATTR_MAC])
7488                 return -EINVAL;
7489
7490         if (!info->attrs[NL80211_ATTR_PMKID])
7491                 return -EINVAL;
7492
7493         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7494         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7495
7496         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7497             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7498                 return -EOPNOTSUPP;
7499
7500         switch (info->genlhdr->cmd) {
7501         case NL80211_CMD_SET_PMKSA:
7502                 rdev_ops = rdev->ops->set_pmksa;
7503                 break;
7504         case NL80211_CMD_DEL_PMKSA:
7505                 rdev_ops = rdev->ops->del_pmksa;
7506                 break;
7507         default:
7508                 WARN_ON(1);
7509                 break;
7510         }
7511
7512         if (!rdev_ops)
7513                 return -EOPNOTSUPP;
7514
7515         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7516 }
7517
7518 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7519 {
7520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7521         struct net_device *dev = info->user_ptr[1];
7522
7523         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7524             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7525                 return -EOPNOTSUPP;
7526
7527         if (!rdev->ops->flush_pmksa)
7528                 return -EOPNOTSUPP;
7529
7530         return rdev_flush_pmksa(rdev, dev);
7531 }
7532
7533 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7534 {
7535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7536         struct net_device *dev = info->user_ptr[1];
7537         u8 action_code, dialog_token;
7538         u32 peer_capability = 0;
7539         u16 status_code;
7540         u8 *peer;
7541         bool initiator;
7542
7543         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7544             !rdev->ops->tdls_mgmt)
7545                 return -EOPNOTSUPP;
7546
7547         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7548             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7549             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7550             !info->attrs[NL80211_ATTR_IE] ||
7551             !info->attrs[NL80211_ATTR_MAC])
7552                 return -EINVAL;
7553
7554         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7555         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7556         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7557         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7558         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7559         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7560                 peer_capability =
7561                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7562
7563         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7564                               dialog_token, status_code, peer_capability,
7565                               initiator,
7566                               nla_data(info->attrs[NL80211_ATTR_IE]),
7567                               nla_len(info->attrs[NL80211_ATTR_IE]));
7568 }
7569
7570 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7571 {
7572         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7573         struct net_device *dev = info->user_ptr[1];
7574         enum nl80211_tdls_operation operation;
7575         u8 *peer;
7576
7577         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7578             !rdev->ops->tdls_oper)
7579                 return -EOPNOTSUPP;
7580
7581         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7582             !info->attrs[NL80211_ATTR_MAC])
7583                 return -EINVAL;
7584
7585         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7586         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7587
7588         return rdev_tdls_oper(rdev, dev, peer, operation);
7589 }
7590
7591 static int nl80211_remain_on_channel(struct sk_buff *skb,
7592                                      struct genl_info *info)
7593 {
7594         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7595         struct wireless_dev *wdev = info->user_ptr[1];
7596         struct cfg80211_chan_def chandef;
7597         struct sk_buff *msg;
7598         void *hdr;
7599         u64 cookie;
7600         u32 duration;
7601         int err;
7602
7603         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7604             !info->attrs[NL80211_ATTR_DURATION])
7605                 return -EINVAL;
7606
7607         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7608
7609         if (!rdev->ops->remain_on_channel ||
7610             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7611                 return -EOPNOTSUPP;
7612
7613         /*
7614          * We should be on that channel for at least a minimum amount of
7615          * time (10ms) but no longer than the driver supports.
7616          */
7617         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7618             duration > rdev->wiphy.max_remain_on_channel_duration)
7619                 return -EINVAL;
7620
7621         err = nl80211_parse_chandef(rdev, info, &chandef);
7622         if (err)
7623                 return err;
7624
7625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7626         if (!msg)
7627                 return -ENOMEM;
7628
7629         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7630                              NL80211_CMD_REMAIN_ON_CHANNEL);
7631         if (!hdr) {
7632                 err = -ENOBUFS;
7633                 goto free_msg;
7634         }
7635
7636         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7637                                      duration, &cookie);
7638
7639         if (err)
7640                 goto free_msg;
7641
7642         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7643                 goto nla_put_failure;
7644
7645         genlmsg_end(msg, hdr);
7646
7647         return genlmsg_reply(msg, info);
7648
7649  nla_put_failure:
7650         err = -ENOBUFS;
7651  free_msg:
7652         nlmsg_free(msg);
7653         return err;
7654 }
7655
7656 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7657                                             struct genl_info *info)
7658 {
7659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7660         struct wireless_dev *wdev = info->user_ptr[1];
7661         u64 cookie;
7662
7663         if (!info->attrs[NL80211_ATTR_COOKIE])
7664                 return -EINVAL;
7665
7666         if (!rdev->ops->cancel_remain_on_channel)
7667                 return -EOPNOTSUPP;
7668
7669         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7670
7671         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7672 }
7673
7674 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7675                            u8 *rates, u8 rates_len)
7676 {
7677         u8 i;
7678         u32 mask = 0;
7679
7680         for (i = 0; i < rates_len; i++) {
7681                 int rate = (rates[i] & 0x7f) * 5;
7682                 int ridx;
7683                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7684                         struct ieee80211_rate *srate =
7685                                 &sband->bitrates[ridx];
7686                         if (rate == srate->bitrate) {
7687                                 mask |= 1 << ridx;
7688                                 break;
7689                         }
7690                 }
7691                 if (ridx == sband->n_bitrates)
7692                         return 0; /* rate not found */
7693         }
7694
7695         return mask;
7696 }
7697
7698 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7699                                u8 *rates, u8 rates_len,
7700                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7701 {
7702         u8 i;
7703
7704         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7705
7706         for (i = 0; i < rates_len; i++) {
7707                 int ridx, rbit;
7708
7709                 ridx = rates[i] / 8;
7710                 rbit = BIT(rates[i] % 8);
7711
7712                 /* check validity */
7713                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7714                         return false;
7715
7716                 /* check availability */
7717                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7718                         mcs[ridx] |= rbit;
7719                 else
7720                         return false;
7721         }
7722
7723         return true;
7724 }
7725
7726 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7727 {
7728         u16 mcs_mask = 0;
7729
7730         switch (vht_mcs_map) {
7731         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7732                 break;
7733         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7734                 mcs_mask = 0x00FF;
7735                 break;
7736         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7737                 mcs_mask = 0x01FF;
7738                 break;
7739         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7740                 mcs_mask = 0x03FF;
7741                 break;
7742         default:
7743                 break;
7744         }
7745
7746         return mcs_mask;
7747 }
7748
7749 static void vht_build_mcs_mask(u16 vht_mcs_map,
7750                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7751 {
7752         u8 nss;
7753
7754         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7755                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7756                 vht_mcs_map >>= 2;
7757         }
7758 }
7759
7760 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7761                              struct nl80211_txrate_vht *txrate,
7762                              u16 mcs[NL80211_VHT_NSS_MAX])
7763 {
7764         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7765         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7766         u8 i;
7767
7768         if (!sband->vht_cap.vht_supported)
7769                 return false;
7770
7771         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7772
7773         /* Build vht_mcs_mask from VHT capabilities */
7774         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7775
7776         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7777                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7778                         mcs[i] = txrate->mcs[i];
7779                 else
7780                         return false;
7781         }
7782
7783         return true;
7784 }
7785
7786 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7787         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7788                                     .len = NL80211_MAX_SUPP_RATES },
7789         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7790                                 .len = NL80211_MAX_SUPP_HT_RATES },
7791         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7792         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7793 };
7794
7795 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7796                                        struct genl_info *info)
7797 {
7798         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7799         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7800         struct cfg80211_bitrate_mask mask;
7801         int rem, i;
7802         struct net_device *dev = info->user_ptr[1];
7803         struct nlattr *tx_rates;
7804         struct ieee80211_supported_band *sband;
7805         u16 vht_tx_mcs_map;
7806
7807         if (!rdev->ops->set_bitrate_mask)
7808                 return -EOPNOTSUPP;
7809
7810         memset(&mask, 0, sizeof(mask));
7811         /* Default to all rates enabled */
7812         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7813                 sband = rdev->wiphy.bands[i];
7814
7815                 if (!sband)
7816                         continue;
7817
7818                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7819                 memcpy(mask.control[i].ht_mcs,
7820                        sband->ht_cap.mcs.rx_mask,
7821                        sizeof(mask.control[i].ht_mcs));
7822
7823                 if (!sband->vht_cap.vht_supported)
7824                         continue;
7825
7826                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7827                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7828         }
7829
7830         /* if no rates are given set it back to the defaults */
7831         if (!info->attrs[NL80211_ATTR_TX_RATES])
7832                 goto out;
7833
7834         /*
7835          * The nested attribute uses enum nl80211_band as the index. This maps
7836          * directly to the enum ieee80211_band values used in cfg80211.
7837          */
7838         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7839         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7840                 enum ieee80211_band band = nla_type(tx_rates);
7841                 int err;
7842
7843                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7844                         return -EINVAL;
7845                 sband = rdev->wiphy.bands[band];
7846                 if (sband == NULL)
7847                         return -EINVAL;
7848                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7849                                 nla_len(tx_rates), nl80211_txattr_policy);
7850                 if (err)
7851                         return err;
7852                 if (tb[NL80211_TXRATE_LEGACY]) {
7853                         mask.control[band].legacy = rateset_to_mask(
7854                                 sband,
7855                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7856                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7857                         if ((mask.control[band].legacy == 0) &&
7858                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7859                                 return -EINVAL;
7860                 }
7861                 if (tb[NL80211_TXRATE_HT]) {
7862                         if (!ht_rateset_to_mask(
7863                                         sband,
7864                                         nla_data(tb[NL80211_TXRATE_HT]),
7865                                         nla_len(tb[NL80211_TXRATE_HT]),
7866                                         mask.control[band].ht_mcs))
7867                                 return -EINVAL;
7868                 }
7869                 if (tb[NL80211_TXRATE_VHT]) {
7870                         if (!vht_set_mcs_mask(
7871                                         sband,
7872                                         nla_data(tb[NL80211_TXRATE_VHT]),
7873                                         mask.control[band].vht_mcs))
7874                                 return -EINVAL;
7875                 }
7876                 if (tb[NL80211_TXRATE_GI]) {
7877                         mask.control[band].gi =
7878                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7879                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7880                                 return -EINVAL;
7881                 }
7882
7883                 if (mask.control[band].legacy == 0) {
7884                         /* don't allow empty legacy rates if HT or VHT
7885                          * are not even supported.
7886                          */
7887                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7888                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7889                                 return -EINVAL;
7890
7891                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7892                                 if (mask.control[band].ht_mcs[i])
7893                                         goto out;
7894
7895                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7896                                 if (mask.control[band].vht_mcs[i])
7897                                         goto out;
7898
7899                         /* legacy and mcs rates may not be both empty */
7900                         return -EINVAL;
7901                 }
7902         }
7903
7904 out:
7905         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7906 }
7907
7908 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7909 {
7910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7911         struct wireless_dev *wdev = info->user_ptr[1];
7912         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7913
7914         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7915                 return -EINVAL;
7916
7917         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7918                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7919
7920         switch (wdev->iftype) {
7921         case NL80211_IFTYPE_STATION:
7922         case NL80211_IFTYPE_ADHOC:
7923         case NL80211_IFTYPE_P2P_CLIENT:
7924         case NL80211_IFTYPE_AP:
7925         case NL80211_IFTYPE_AP_VLAN:
7926         case NL80211_IFTYPE_MESH_POINT:
7927         case NL80211_IFTYPE_P2P_GO:
7928         case NL80211_IFTYPE_P2P_DEVICE:
7929                 break;
7930         default:
7931                 return -EOPNOTSUPP;
7932         }
7933
7934         /* not much point in registering if we can't reply */
7935         if (!rdev->ops->mgmt_tx)
7936                 return -EOPNOTSUPP;
7937
7938         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7939                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7940                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7941 }
7942
7943 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7944 {
7945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7946         struct wireless_dev *wdev = info->user_ptr[1];
7947         struct cfg80211_chan_def chandef;
7948         int err;
7949         void *hdr = NULL;
7950         u64 cookie;
7951         struct sk_buff *msg = NULL;
7952         struct cfg80211_mgmt_tx_params params = {
7953                 .dont_wait_for_ack =
7954                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7955         };
7956
7957         if (!info->attrs[NL80211_ATTR_FRAME])
7958                 return -EINVAL;
7959
7960         if (!rdev->ops->mgmt_tx)
7961                 return -EOPNOTSUPP;
7962
7963         switch (wdev->iftype) {
7964         case NL80211_IFTYPE_P2P_DEVICE:
7965                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7966                         return -EINVAL;
7967         case NL80211_IFTYPE_STATION:
7968         case NL80211_IFTYPE_ADHOC:
7969         case NL80211_IFTYPE_P2P_CLIENT:
7970         case NL80211_IFTYPE_AP:
7971         case NL80211_IFTYPE_AP_VLAN:
7972         case NL80211_IFTYPE_MESH_POINT:
7973         case NL80211_IFTYPE_P2P_GO:
7974                 break;
7975         default:
7976                 return -EOPNOTSUPP;
7977         }
7978
7979         if (info->attrs[NL80211_ATTR_DURATION]) {
7980                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7981                         return -EINVAL;
7982                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7983
7984                 /*
7985                  * We should wait on the channel for at least a minimum amount
7986                  * of time (10ms) but no longer than the driver supports.
7987                  */
7988                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7989                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7990                         return -EINVAL;
7991
7992         }
7993
7994         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7995
7996         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7997                 return -EINVAL;
7998
7999         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8000
8001         /* get the channel if any has been specified, otherwise pass NULL to
8002          * the driver. The latter will use the current one
8003          */
8004         chandef.chan = NULL;
8005         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8006                 err = nl80211_parse_chandef(rdev, info, &chandef);
8007                 if (err)
8008                         return err;
8009         }
8010
8011         if (!chandef.chan && params.offchan)
8012                 return -EINVAL;
8013
8014         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8015         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8016
8017         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8018                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8019                 int i;
8020
8021                 if (len % sizeof(u16))
8022                         return -EINVAL;
8023
8024                 params.n_csa_offsets = len / sizeof(u16);
8025                 params.csa_offsets =
8026                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8027
8028                 /* check that all the offsets fit the frame */
8029                 for (i = 0; i < params.n_csa_offsets; i++) {
8030                         if (params.csa_offsets[i] >= params.len)
8031                                 return -EINVAL;
8032                 }
8033         }
8034
8035         if (!params.dont_wait_for_ack) {
8036                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8037                 if (!msg)
8038                         return -ENOMEM;
8039
8040                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8041                                      NL80211_CMD_FRAME);
8042                 if (!hdr) {
8043                         err = -ENOBUFS;
8044                         goto free_msg;
8045                 }
8046         }
8047
8048         params.chan = chandef.chan;
8049         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8050         if (err)
8051                 goto free_msg;
8052
8053         if (msg) {
8054                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8055                         goto nla_put_failure;
8056
8057                 genlmsg_end(msg, hdr);
8058                 return genlmsg_reply(msg, info);
8059         }
8060
8061         return 0;
8062
8063  nla_put_failure:
8064         err = -ENOBUFS;
8065  free_msg:
8066         nlmsg_free(msg);
8067         return err;
8068 }
8069
8070 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8071 {
8072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8073         struct wireless_dev *wdev = info->user_ptr[1];
8074         u64 cookie;
8075
8076         if (!info->attrs[NL80211_ATTR_COOKIE])
8077                 return -EINVAL;
8078
8079         if (!rdev->ops->mgmt_tx_cancel_wait)
8080                 return -EOPNOTSUPP;
8081
8082         switch (wdev->iftype) {
8083         case NL80211_IFTYPE_STATION:
8084         case NL80211_IFTYPE_ADHOC:
8085         case NL80211_IFTYPE_P2P_CLIENT:
8086         case NL80211_IFTYPE_AP:
8087         case NL80211_IFTYPE_AP_VLAN:
8088         case NL80211_IFTYPE_P2P_GO:
8089         case NL80211_IFTYPE_P2P_DEVICE:
8090                 break;
8091         default:
8092                 return -EOPNOTSUPP;
8093         }
8094
8095         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8096
8097         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8098 }
8099
8100 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8101 {
8102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8103         struct wireless_dev *wdev;
8104         struct net_device *dev = info->user_ptr[1];
8105         u8 ps_state;
8106         bool state;
8107         int err;
8108
8109         if (!info->attrs[NL80211_ATTR_PS_STATE])
8110                 return -EINVAL;
8111
8112         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8113
8114         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8115                 return -EINVAL;
8116
8117         wdev = dev->ieee80211_ptr;
8118
8119         if (!rdev->ops->set_power_mgmt)
8120                 return -EOPNOTSUPP;
8121
8122         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8123
8124         if (state == wdev->ps)
8125                 return 0;
8126
8127         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8128         if (!err)
8129                 wdev->ps = state;
8130         return err;
8131 }
8132
8133 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8134 {
8135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8136         enum nl80211_ps_state ps_state;
8137         struct wireless_dev *wdev;
8138         struct net_device *dev = info->user_ptr[1];
8139         struct sk_buff *msg;
8140         void *hdr;
8141         int err;
8142
8143         wdev = dev->ieee80211_ptr;
8144
8145         if (!rdev->ops->set_power_mgmt)
8146                 return -EOPNOTSUPP;
8147
8148         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8149         if (!msg)
8150                 return -ENOMEM;
8151
8152         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8153                              NL80211_CMD_GET_POWER_SAVE);
8154         if (!hdr) {
8155                 err = -ENOBUFS;
8156                 goto free_msg;
8157         }
8158
8159         if (wdev->ps)
8160                 ps_state = NL80211_PS_ENABLED;
8161         else
8162                 ps_state = NL80211_PS_DISABLED;
8163
8164         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8165                 goto nla_put_failure;
8166
8167         genlmsg_end(msg, hdr);
8168         return genlmsg_reply(msg, info);
8169
8170  nla_put_failure:
8171         err = -ENOBUFS;
8172  free_msg:
8173         nlmsg_free(msg);
8174         return err;
8175 }
8176
8177 static const struct nla_policy
8178 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8179         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8180         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8181         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8182         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8183         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8184         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8185 };
8186
8187 static int nl80211_set_cqm_txe(struct genl_info *info,
8188                                u32 rate, u32 pkts, u32 intvl)
8189 {
8190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8191         struct net_device *dev = info->user_ptr[1];
8192         struct wireless_dev *wdev = dev->ieee80211_ptr;
8193
8194         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8195                 return -EINVAL;
8196
8197         if (!rdev->ops->set_cqm_txe_config)
8198                 return -EOPNOTSUPP;
8199
8200         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8201             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8202                 return -EOPNOTSUPP;
8203
8204         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8205 }
8206
8207 static int nl80211_set_cqm_rssi(struct genl_info *info,
8208                                 s32 threshold, u32 hysteresis)
8209 {
8210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8211         struct net_device *dev = info->user_ptr[1];
8212         struct wireless_dev *wdev = dev->ieee80211_ptr;
8213
8214         if (threshold > 0)
8215                 return -EINVAL;
8216
8217         /* disabling - hysteresis should also be zero then */
8218         if (threshold == 0)
8219                 hysteresis = 0;
8220
8221         if (!rdev->ops->set_cqm_rssi_config)
8222                 return -EOPNOTSUPP;
8223
8224         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8225             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8226                 return -EOPNOTSUPP;
8227
8228         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8229 }
8230
8231 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8232 {
8233         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8234         struct nlattr *cqm;
8235         int err;
8236
8237         cqm = info->attrs[NL80211_ATTR_CQM];
8238         if (!cqm)
8239                 return -EINVAL;
8240
8241         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8242                                nl80211_attr_cqm_policy);
8243         if (err)
8244                 return err;
8245
8246         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8247             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8248                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8249                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8250
8251                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8252         }
8253
8254         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8255             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8256             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8257                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8258                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8259                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8260
8261                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8262         }
8263
8264         return -EINVAL;
8265 }
8266
8267 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8268 {
8269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8270         struct net_device *dev = info->user_ptr[1];
8271         struct mesh_config cfg;
8272         struct mesh_setup setup;
8273         int err;
8274
8275         /* start with default */
8276         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8277         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8278
8279         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8280                 /* and parse parameters if given */
8281                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8282                 if (err)
8283                         return err;
8284         }
8285
8286         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8287             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8288                 return -EINVAL;
8289
8290         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8291         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8292
8293         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8294             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8295                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8296                         return -EINVAL;
8297
8298         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8299                 setup.beacon_interval =
8300                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8301                 if (setup.beacon_interval < 10 ||
8302                     setup.beacon_interval > 10000)
8303                         return -EINVAL;
8304         }
8305
8306         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8307                 setup.dtim_period =
8308                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8309                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8310                         return -EINVAL;
8311         }
8312
8313         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8314                 /* parse additional setup parameters if given */
8315                 err = nl80211_parse_mesh_setup(info, &setup);
8316                 if (err)
8317                         return err;
8318         }
8319
8320         if (setup.user_mpm)
8321                 cfg.auto_open_plinks = false;
8322
8323         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8324                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8325                 if (err)
8326                         return err;
8327         } else {
8328                 /* cfg80211_join_mesh() will sort it out */
8329                 setup.chandef.chan = NULL;
8330         }
8331
8332         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8333                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8334                 int n_rates =
8335                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8336                 struct ieee80211_supported_band *sband;
8337
8338                 if (!setup.chandef.chan)
8339                         return -EINVAL;
8340
8341                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8342
8343                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8344                                              &setup.basic_rates);
8345                 if (err)
8346                         return err;
8347         }
8348
8349         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8350 }
8351
8352 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8353 {
8354         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8355         struct net_device *dev = info->user_ptr[1];
8356
8357         return cfg80211_leave_mesh(rdev, dev);
8358 }
8359
8360 #ifdef CONFIG_PM
8361 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8362                                         struct cfg80211_registered_device *rdev)
8363 {
8364         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8365         struct nlattr *nl_pats, *nl_pat;
8366         int i, pat_len;
8367
8368         if (!wowlan->n_patterns)
8369                 return 0;
8370
8371         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8372         if (!nl_pats)
8373                 return -ENOBUFS;
8374
8375         for (i = 0; i < wowlan->n_patterns; i++) {
8376                 nl_pat = nla_nest_start(msg, i + 1);
8377                 if (!nl_pat)
8378                         return -ENOBUFS;
8379                 pat_len = wowlan->patterns[i].pattern_len;
8380                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8381                             wowlan->patterns[i].mask) ||
8382                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8383                             wowlan->patterns[i].pattern) ||
8384                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8385                                 wowlan->patterns[i].pkt_offset))
8386                         return -ENOBUFS;
8387                 nla_nest_end(msg, nl_pat);
8388         }
8389         nla_nest_end(msg, nl_pats);
8390
8391         return 0;
8392 }
8393
8394 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8395                                    struct cfg80211_wowlan_tcp *tcp)
8396 {
8397         struct nlattr *nl_tcp;
8398
8399         if (!tcp)
8400                 return 0;
8401
8402         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8403         if (!nl_tcp)
8404                 return -ENOBUFS;
8405
8406         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8407             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8408             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8409             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8410             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8411             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8412                     tcp->payload_len, tcp->payload) ||
8413             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8414                         tcp->data_interval) ||
8415             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8416                     tcp->wake_len, tcp->wake_data) ||
8417             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8418                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8419                 return -ENOBUFS;
8420
8421         if (tcp->payload_seq.len &&
8422             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8423                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8424                 return -ENOBUFS;
8425
8426         if (tcp->payload_tok.len &&
8427             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8428                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8429                     &tcp->payload_tok))
8430                 return -ENOBUFS;
8431
8432         nla_nest_end(msg, nl_tcp);
8433
8434         return 0;
8435 }
8436
8437 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8438 {
8439         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8440         struct sk_buff *msg;
8441         void *hdr;
8442         u32 size = NLMSG_DEFAULT_SIZE;
8443
8444         if (!rdev->wiphy.wowlan)
8445                 return -EOPNOTSUPP;
8446
8447         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8448                 /* adjust size to have room for all the data */
8449                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8450                         rdev->wiphy.wowlan_config->tcp->payload_len +
8451                         rdev->wiphy.wowlan_config->tcp->wake_len +
8452                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8453         }
8454
8455         msg = nlmsg_new(size, GFP_KERNEL);
8456         if (!msg)
8457                 return -ENOMEM;
8458
8459         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8460                              NL80211_CMD_GET_WOWLAN);
8461         if (!hdr)
8462                 goto nla_put_failure;
8463
8464         if (rdev->wiphy.wowlan_config) {
8465                 struct nlattr *nl_wowlan;
8466
8467                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8468                 if (!nl_wowlan)
8469                         goto nla_put_failure;
8470
8471                 if ((rdev->wiphy.wowlan_config->any &&
8472                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8473                     (rdev->wiphy.wowlan_config->disconnect &&
8474                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8475                     (rdev->wiphy.wowlan_config->magic_pkt &&
8476                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8477                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8478                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8479                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8480                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8481                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8482                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8483                     (rdev->wiphy.wowlan_config->rfkill_release &&
8484                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8485                         goto nla_put_failure;
8486
8487                 if (nl80211_send_wowlan_patterns(msg, rdev))
8488                         goto nla_put_failure;
8489
8490                 if (nl80211_send_wowlan_tcp(msg,
8491                                             rdev->wiphy.wowlan_config->tcp))
8492                         goto nla_put_failure;
8493
8494                 nla_nest_end(msg, nl_wowlan);
8495         }
8496
8497         genlmsg_end(msg, hdr);
8498         return genlmsg_reply(msg, info);
8499
8500 nla_put_failure:
8501         nlmsg_free(msg);
8502         return -ENOBUFS;
8503 }
8504
8505 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8506                                     struct nlattr *attr,
8507                                     struct cfg80211_wowlan *trig)
8508 {
8509         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8510         struct cfg80211_wowlan_tcp *cfg;
8511         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8512         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8513         u32 size;
8514         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8515         int err, port;
8516
8517         if (!rdev->wiphy.wowlan->tcp)
8518                 return -EINVAL;
8519
8520         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8521                         nla_data(attr), nla_len(attr),
8522                         nl80211_wowlan_tcp_policy);
8523         if (err)
8524                 return err;
8525
8526         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8527             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8528             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8529             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8530             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8531             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8532             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8533             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8534                 return -EINVAL;
8535
8536         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8537         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8538                 return -EINVAL;
8539
8540         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8541                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8542             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8543                 return -EINVAL;
8544
8545         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8546         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8547                 return -EINVAL;
8548
8549         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8550         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8551                 return -EINVAL;
8552
8553         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8554                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8555
8556                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8557                 tokens_size = tokln - sizeof(*tok);
8558
8559                 if (!tok->len || tokens_size % tok->len)
8560                         return -EINVAL;
8561                 if (!rdev->wiphy.wowlan->tcp->tok)
8562                         return -EINVAL;
8563                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8564                         return -EINVAL;
8565                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8566                         return -EINVAL;
8567                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8568                         return -EINVAL;
8569                 if (tok->offset + tok->len > data_size)
8570                         return -EINVAL;
8571         }
8572
8573         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8574                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8575                 if (!rdev->wiphy.wowlan->tcp->seq)
8576                         return -EINVAL;
8577                 if (seq->len == 0 || seq->len > 4)
8578                         return -EINVAL;
8579                 if (seq->len + seq->offset > data_size)
8580                         return -EINVAL;
8581         }
8582
8583         size = sizeof(*cfg);
8584         size += data_size;
8585         size += wake_size + wake_mask_size;
8586         size += tokens_size;
8587
8588         cfg = kzalloc(size, GFP_KERNEL);
8589         if (!cfg)
8590                 return -ENOMEM;
8591         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8592         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8593         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8594                ETH_ALEN);
8595         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8596                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8597         else
8598                 port = 0;
8599 #ifdef CONFIG_INET
8600         /* allocate a socket and port for it and use it */
8601         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8602                             IPPROTO_TCP, &cfg->sock, 1);
8603         if (err) {
8604                 kfree(cfg);
8605                 return err;
8606         }
8607         if (inet_csk_get_port(cfg->sock->sk, port)) {
8608                 sock_release(cfg->sock);
8609                 kfree(cfg);
8610                 return -EADDRINUSE;
8611         }
8612         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8613 #else
8614         if (!port) {
8615                 kfree(cfg);
8616                 return -EINVAL;
8617         }
8618         cfg->src_port = port;
8619 #endif
8620
8621         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8622         cfg->payload_len = data_size;
8623         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8624         memcpy((void *)cfg->payload,
8625                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8626                data_size);
8627         if (seq)
8628                 cfg->payload_seq = *seq;
8629         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8630         cfg->wake_len = wake_size;
8631         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8632         memcpy((void *)cfg->wake_data,
8633                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8634                wake_size);
8635         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8636                          data_size + wake_size;
8637         memcpy((void *)cfg->wake_mask,
8638                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8639                wake_mask_size);
8640         if (tok) {
8641                 cfg->tokens_size = tokens_size;
8642                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8643         }
8644
8645         trig->tcp = cfg;
8646
8647         return 0;
8648 }
8649
8650 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8651 {
8652         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8653         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8654         struct cfg80211_wowlan new_triggers = {};
8655         struct cfg80211_wowlan *ntrig;
8656         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8657         int err, i;
8658         bool prev_enabled = rdev->wiphy.wowlan_config;
8659
8660         if (!wowlan)
8661                 return -EOPNOTSUPP;
8662
8663         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8664                 cfg80211_rdev_free_wowlan(rdev);
8665                 rdev->wiphy.wowlan_config = NULL;
8666                 goto set_wakeup;
8667         }
8668
8669         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8670                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8671                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8672                         nl80211_wowlan_policy);
8673         if (err)
8674                 return err;
8675
8676         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8677                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8678                         return -EINVAL;
8679                 new_triggers.any = true;
8680         }
8681
8682         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8683                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8684                         return -EINVAL;
8685                 new_triggers.disconnect = true;
8686         }
8687
8688         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8689                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8690                         return -EINVAL;
8691                 new_triggers.magic_pkt = true;
8692         }
8693
8694         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8695                 return -EINVAL;
8696
8697         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8698                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8699                         return -EINVAL;
8700                 new_triggers.gtk_rekey_failure = true;
8701         }
8702
8703         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8704                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8705                         return -EINVAL;
8706                 new_triggers.eap_identity_req = true;
8707         }
8708
8709         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8710                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8711                         return -EINVAL;
8712                 new_triggers.four_way_handshake = true;
8713         }
8714
8715         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8716                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8717                         return -EINVAL;
8718                 new_triggers.rfkill_release = true;
8719         }
8720
8721         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8722                 struct nlattr *pat;
8723                 int n_patterns = 0;
8724                 int rem, pat_len, mask_len, pkt_offset;
8725                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8726
8727                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8728                                     rem)
8729                         n_patterns++;
8730                 if (n_patterns > wowlan->n_patterns)
8731                         return -EINVAL;
8732
8733                 new_triggers.patterns = kcalloc(n_patterns,
8734                                                 sizeof(new_triggers.patterns[0]),
8735                                                 GFP_KERNEL);
8736                 if (!new_triggers.patterns)
8737                         return -ENOMEM;
8738
8739                 new_triggers.n_patterns = n_patterns;
8740                 i = 0;
8741
8742                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8743                                     rem) {
8744                         u8 *mask_pat;
8745
8746                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8747                                   nla_len(pat), NULL);
8748                         err = -EINVAL;
8749                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8750                             !pat_tb[NL80211_PKTPAT_PATTERN])
8751                                 goto error;
8752                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8753                         mask_len = DIV_ROUND_UP(pat_len, 8);
8754                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8755                                 goto error;
8756                         if (pat_len > wowlan->pattern_max_len ||
8757                             pat_len < wowlan->pattern_min_len)
8758                                 goto error;
8759
8760                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8761                                 pkt_offset = 0;
8762                         else
8763                                 pkt_offset = nla_get_u32(
8764                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8765                         if (pkt_offset > wowlan->max_pkt_offset)
8766                                 goto error;
8767                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8768
8769                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8770                         if (!mask_pat) {
8771                                 err = -ENOMEM;
8772                                 goto error;
8773                         }
8774                         new_triggers.patterns[i].mask = mask_pat;
8775                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8776                                mask_len);
8777                         mask_pat += mask_len;
8778                         new_triggers.patterns[i].pattern = mask_pat;
8779                         new_triggers.patterns[i].pattern_len = pat_len;
8780                         memcpy(mask_pat,
8781                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8782                                pat_len);
8783                         i++;
8784                 }
8785         }
8786
8787         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8788                 err = nl80211_parse_wowlan_tcp(
8789                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8790                         &new_triggers);
8791                 if (err)
8792                         goto error;
8793         }
8794
8795         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8796         if (!ntrig) {
8797                 err = -ENOMEM;
8798                 goto error;
8799         }
8800         cfg80211_rdev_free_wowlan(rdev);
8801         rdev->wiphy.wowlan_config = ntrig;
8802
8803  set_wakeup:
8804         if (rdev->ops->set_wakeup &&
8805             prev_enabled != !!rdev->wiphy.wowlan_config)
8806                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8807
8808         return 0;
8809  error:
8810         for (i = 0; i < new_triggers.n_patterns; i++)
8811                 kfree(new_triggers.patterns[i].mask);
8812         kfree(new_triggers.patterns);
8813         if (new_triggers.tcp && new_triggers.tcp->sock)
8814                 sock_release(new_triggers.tcp->sock);
8815         kfree(new_triggers.tcp);
8816         return err;
8817 }
8818 #endif
8819
8820 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8821                                        struct cfg80211_registered_device *rdev)
8822 {
8823         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8824         int i, j, pat_len;
8825         struct cfg80211_coalesce_rules *rule;
8826
8827         if (!rdev->coalesce->n_rules)
8828                 return 0;
8829
8830         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8831         if (!nl_rules)
8832                 return -ENOBUFS;
8833
8834         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8835                 nl_rule = nla_nest_start(msg, i + 1);
8836                 if (!nl_rule)
8837                         return -ENOBUFS;
8838
8839                 rule = &rdev->coalesce->rules[i];
8840                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8841                                 rule->delay))
8842                         return -ENOBUFS;
8843
8844                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8845                                 rule->condition))
8846                         return -ENOBUFS;
8847
8848                 nl_pats = nla_nest_start(msg,
8849                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8850                 if (!nl_pats)
8851                         return -ENOBUFS;
8852
8853                 for (j = 0; j < rule->n_patterns; j++) {
8854                         nl_pat = nla_nest_start(msg, j + 1);
8855                         if (!nl_pat)
8856                                 return -ENOBUFS;
8857                         pat_len = rule->patterns[j].pattern_len;
8858                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8859                                     DIV_ROUND_UP(pat_len, 8),
8860                                     rule->patterns[j].mask) ||
8861                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8862                                     rule->patterns[j].pattern) ||
8863                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8864                                         rule->patterns[j].pkt_offset))
8865                                 return -ENOBUFS;
8866                         nla_nest_end(msg, nl_pat);
8867                 }
8868                 nla_nest_end(msg, nl_pats);
8869                 nla_nest_end(msg, nl_rule);
8870         }
8871         nla_nest_end(msg, nl_rules);
8872
8873         return 0;
8874 }
8875
8876 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8877 {
8878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8879         struct sk_buff *msg;
8880         void *hdr;
8881
8882         if (!rdev->wiphy.coalesce)
8883                 return -EOPNOTSUPP;
8884
8885         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8886         if (!msg)
8887                 return -ENOMEM;
8888
8889         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8890                              NL80211_CMD_GET_COALESCE);
8891         if (!hdr)
8892                 goto nla_put_failure;
8893
8894         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8895                 goto nla_put_failure;
8896
8897         genlmsg_end(msg, hdr);
8898         return genlmsg_reply(msg, info);
8899
8900 nla_put_failure:
8901         nlmsg_free(msg);
8902         return -ENOBUFS;
8903 }
8904
8905 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8906 {
8907         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8908         int i, j;
8909         struct cfg80211_coalesce_rules *rule;
8910
8911         if (!coalesce)
8912                 return;
8913
8914         for (i = 0; i < coalesce->n_rules; i++) {
8915                 rule = &coalesce->rules[i];
8916                 for (j = 0; j < rule->n_patterns; j++)
8917                         kfree(rule->patterns[j].mask);
8918                 kfree(rule->patterns);
8919         }
8920         kfree(coalesce->rules);
8921         kfree(coalesce);
8922         rdev->coalesce = NULL;
8923 }
8924
8925 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8926                                        struct nlattr *rule,
8927                                        struct cfg80211_coalesce_rules *new_rule)
8928 {
8929         int err, i;
8930         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8931         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8932         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8933         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8934
8935         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8936                         nla_len(rule), nl80211_coalesce_policy);
8937         if (err)
8938                 return err;
8939
8940         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8941                 new_rule->delay =
8942                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8943         if (new_rule->delay > coalesce->max_delay)
8944                 return -EINVAL;
8945
8946         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8947                 new_rule->condition =
8948                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8949         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8950             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8951                 return -EINVAL;
8952
8953         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8954                 return -EINVAL;
8955
8956         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8957                             rem)
8958                 n_patterns++;
8959         if (n_patterns > coalesce->n_patterns)
8960                 return -EINVAL;
8961
8962         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8963                                      GFP_KERNEL);
8964         if (!new_rule->patterns)
8965                 return -ENOMEM;
8966
8967         new_rule->n_patterns = n_patterns;
8968         i = 0;
8969
8970         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8971                             rem) {
8972                 u8 *mask_pat;
8973
8974                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8975                           nla_len(pat), NULL);
8976                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8977                     !pat_tb[NL80211_PKTPAT_PATTERN])
8978                         return -EINVAL;
8979                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8980                 mask_len = DIV_ROUND_UP(pat_len, 8);
8981                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8982                         return -EINVAL;
8983                 if (pat_len > coalesce->pattern_max_len ||
8984                     pat_len < coalesce->pattern_min_len)
8985                         return -EINVAL;
8986
8987                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8988                         pkt_offset = 0;
8989                 else
8990                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8991                 if (pkt_offset > coalesce->max_pkt_offset)
8992                         return -EINVAL;
8993                 new_rule->patterns[i].pkt_offset = pkt_offset;
8994
8995                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8996                 if (!mask_pat)
8997                         return -ENOMEM;
8998
8999                 new_rule->patterns[i].mask = mask_pat;
9000                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9001                        mask_len);
9002
9003                 mask_pat += mask_len;
9004                 new_rule->patterns[i].pattern = mask_pat;
9005                 new_rule->patterns[i].pattern_len = pat_len;
9006                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9007                        pat_len);
9008                 i++;
9009         }
9010
9011         return 0;
9012 }
9013
9014 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9015 {
9016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9017         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9018         struct cfg80211_coalesce new_coalesce = {};
9019         struct cfg80211_coalesce *n_coalesce;
9020         int err, rem_rule, n_rules = 0, i, j;
9021         struct nlattr *rule;
9022         struct cfg80211_coalesce_rules *tmp_rule;
9023
9024         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9025                 return -EOPNOTSUPP;
9026
9027         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9028                 cfg80211_rdev_free_coalesce(rdev);
9029                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9030                 return 0;
9031         }
9032
9033         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9034                             rem_rule)
9035                 n_rules++;
9036         if (n_rules > coalesce->n_rules)
9037                 return -EINVAL;
9038
9039         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9040                                      GFP_KERNEL);
9041         if (!new_coalesce.rules)
9042                 return -ENOMEM;
9043
9044         new_coalesce.n_rules = n_rules;
9045         i = 0;
9046
9047         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9048                             rem_rule) {
9049                 err = nl80211_parse_coalesce_rule(rdev, rule,
9050                                                   &new_coalesce.rules[i]);
9051                 if (err)
9052                         goto error;
9053
9054                 i++;
9055         }
9056
9057         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9058         if (err)
9059                 goto error;
9060
9061         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9062         if (!n_coalesce) {
9063                 err = -ENOMEM;
9064                 goto error;
9065         }
9066         cfg80211_rdev_free_coalesce(rdev);
9067         rdev->coalesce = n_coalesce;
9068
9069         return 0;
9070 error:
9071         for (i = 0; i < new_coalesce.n_rules; i++) {
9072                 tmp_rule = &new_coalesce.rules[i];
9073                 for (j = 0; j < tmp_rule->n_patterns; j++)
9074                         kfree(tmp_rule->patterns[j].mask);
9075                 kfree(tmp_rule->patterns);
9076         }
9077         kfree(new_coalesce.rules);
9078
9079         return err;
9080 }
9081
9082 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9083 {
9084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9085         struct net_device *dev = info->user_ptr[1];
9086         struct wireless_dev *wdev = dev->ieee80211_ptr;
9087         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9088         struct cfg80211_gtk_rekey_data rekey_data;
9089         int err;
9090
9091         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9092                 return -EINVAL;
9093
9094         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9095                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9096                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9097                         nl80211_rekey_policy);
9098         if (err)
9099                 return err;
9100
9101         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9102                 return -ERANGE;
9103         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9104                 return -ERANGE;
9105         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9106                 return -ERANGE;
9107
9108         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9109         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9110         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9111
9112         wdev_lock(wdev);
9113         if (!wdev->current_bss) {
9114                 err = -ENOTCONN;
9115                 goto out;
9116         }
9117
9118         if (!rdev->ops->set_rekey_data) {
9119                 err = -EOPNOTSUPP;
9120                 goto out;
9121         }
9122
9123         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9124  out:
9125         wdev_unlock(wdev);
9126         return err;
9127 }
9128
9129 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9130                                              struct genl_info *info)
9131 {
9132         struct net_device *dev = info->user_ptr[1];
9133         struct wireless_dev *wdev = dev->ieee80211_ptr;
9134
9135         if (wdev->iftype != NL80211_IFTYPE_AP &&
9136             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9137                 return -EINVAL;
9138
9139         if (wdev->ap_unexpected_nlportid)
9140                 return -EBUSY;
9141
9142         wdev->ap_unexpected_nlportid = info->snd_portid;
9143         return 0;
9144 }
9145
9146 static int nl80211_probe_client(struct sk_buff *skb,
9147                                 struct genl_info *info)
9148 {
9149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9150         struct net_device *dev = info->user_ptr[1];
9151         struct wireless_dev *wdev = dev->ieee80211_ptr;
9152         struct sk_buff *msg;
9153         void *hdr;
9154         const u8 *addr;
9155         u64 cookie;
9156         int err;
9157
9158         if (wdev->iftype != NL80211_IFTYPE_AP &&
9159             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9160                 return -EOPNOTSUPP;
9161
9162         if (!info->attrs[NL80211_ATTR_MAC])
9163                 return -EINVAL;
9164
9165         if (!rdev->ops->probe_client)
9166                 return -EOPNOTSUPP;
9167
9168         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9169         if (!msg)
9170                 return -ENOMEM;
9171
9172         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9173                              NL80211_CMD_PROBE_CLIENT);
9174         if (!hdr) {
9175                 err = -ENOBUFS;
9176                 goto free_msg;
9177         }
9178
9179         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9180
9181         err = rdev_probe_client(rdev, dev, addr, &cookie);
9182         if (err)
9183                 goto free_msg;
9184
9185         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9186                 goto nla_put_failure;
9187
9188         genlmsg_end(msg, hdr);
9189
9190         return genlmsg_reply(msg, info);
9191
9192  nla_put_failure:
9193         err = -ENOBUFS;
9194  free_msg:
9195         nlmsg_free(msg);
9196         return err;
9197 }
9198
9199 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9200 {
9201         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9202         struct cfg80211_beacon_registration *reg, *nreg;
9203         int rv;
9204
9205         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9206                 return -EOPNOTSUPP;
9207
9208         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9209         if (!nreg)
9210                 return -ENOMEM;
9211
9212         /* First, check if already registered. */
9213         spin_lock_bh(&rdev->beacon_registrations_lock);
9214         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9215                 if (reg->nlportid == info->snd_portid) {
9216                         rv = -EALREADY;
9217                         goto out_err;
9218                 }
9219         }
9220         /* Add it to the list */
9221         nreg->nlportid = info->snd_portid;
9222         list_add(&nreg->list, &rdev->beacon_registrations);
9223
9224         spin_unlock_bh(&rdev->beacon_registrations_lock);
9225
9226         return 0;
9227 out_err:
9228         spin_unlock_bh(&rdev->beacon_registrations_lock);
9229         kfree(nreg);
9230         return rv;
9231 }
9232
9233 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9234 {
9235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9236         struct wireless_dev *wdev = info->user_ptr[1];
9237         int err;
9238
9239         if (!rdev->ops->start_p2p_device)
9240                 return -EOPNOTSUPP;
9241
9242         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9243                 return -EOPNOTSUPP;
9244
9245         if (wdev->p2p_started)
9246                 return 0;
9247
9248         if (rfkill_blocked(rdev->rfkill))
9249                 return -ERFKILL;
9250
9251         err = rdev_start_p2p_device(rdev, wdev);
9252         if (err)
9253                 return err;
9254
9255         wdev->p2p_started = true;
9256         rdev->opencount++;
9257
9258         return 0;
9259 }
9260
9261 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9262 {
9263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9264         struct wireless_dev *wdev = info->user_ptr[1];
9265
9266         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9267                 return -EOPNOTSUPP;
9268
9269         if (!rdev->ops->stop_p2p_device)
9270                 return -EOPNOTSUPP;
9271
9272         cfg80211_stop_p2p_device(rdev, wdev);
9273
9274         return 0;
9275 }
9276
9277 static int nl80211_get_protocol_features(struct sk_buff *skb,
9278                                          struct genl_info *info)
9279 {
9280         void *hdr;
9281         struct sk_buff *msg;
9282
9283         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9284         if (!msg)
9285                 return -ENOMEM;
9286
9287         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9288                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9289         if (!hdr)
9290                 goto nla_put_failure;
9291
9292         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9293                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9294                 goto nla_put_failure;
9295
9296         genlmsg_end(msg, hdr);
9297         return genlmsg_reply(msg, info);
9298
9299  nla_put_failure:
9300         kfree_skb(msg);
9301         return -ENOBUFS;
9302 }
9303
9304 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9305 {
9306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9307         struct cfg80211_update_ft_ies_params ft_params;
9308         struct net_device *dev = info->user_ptr[1];
9309
9310         if (!rdev->ops->update_ft_ies)
9311                 return -EOPNOTSUPP;
9312
9313         if (!info->attrs[NL80211_ATTR_MDID] ||
9314             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9315                 return -EINVAL;
9316
9317         memset(&ft_params, 0, sizeof(ft_params));
9318         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9319         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9320         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9321
9322         return rdev_update_ft_ies(rdev, dev, &ft_params);
9323 }
9324
9325 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9326                                        struct genl_info *info)
9327 {
9328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9329         struct wireless_dev *wdev = info->user_ptr[1];
9330         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9331         u16 duration;
9332         int ret;
9333
9334         if (!rdev->ops->crit_proto_start)
9335                 return -EOPNOTSUPP;
9336
9337         if (WARN_ON(!rdev->ops->crit_proto_stop))
9338                 return -EINVAL;
9339
9340         if (rdev->crit_proto_nlportid)
9341                 return -EBUSY;
9342
9343         /* determine protocol if provided */
9344         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9345                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9346
9347         if (proto >= NUM_NL80211_CRIT_PROTO)
9348                 return -EINVAL;
9349
9350         /* timeout must be provided */
9351         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9352                 return -EINVAL;
9353
9354         duration =
9355                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9356
9357         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9358                 return -ERANGE;
9359
9360         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9361         if (!ret)
9362                 rdev->crit_proto_nlportid = info->snd_portid;
9363
9364         return ret;
9365 }
9366
9367 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9368                                       struct genl_info *info)
9369 {
9370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9371         struct wireless_dev *wdev = info->user_ptr[1];
9372
9373         if (!rdev->ops->crit_proto_stop)
9374                 return -EOPNOTSUPP;
9375
9376         if (rdev->crit_proto_nlportid) {
9377                 rdev->crit_proto_nlportid = 0;
9378                 rdev_crit_proto_stop(rdev, wdev);
9379         }
9380         return 0;
9381 }
9382
9383 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9384 {
9385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9386         struct wireless_dev *wdev =
9387                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9388         int i, err;
9389         u32 vid, subcmd;
9390
9391         if (!rdev->wiphy.vendor_commands)
9392                 return -EOPNOTSUPP;
9393
9394         if (IS_ERR(wdev)) {
9395                 err = PTR_ERR(wdev);
9396                 if (err != -EINVAL)
9397                         return err;
9398                 wdev = NULL;
9399         } else if (wdev->wiphy != &rdev->wiphy) {
9400                 return -EINVAL;
9401         }
9402
9403         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9404             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9405                 return -EINVAL;
9406
9407         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9408         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9409         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9410                 const struct wiphy_vendor_command *vcmd;
9411                 void *data = NULL;
9412                 int len = 0;
9413
9414                 vcmd = &rdev->wiphy.vendor_commands[i];
9415
9416                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9417                         continue;
9418
9419                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9420                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9421                         if (!wdev)
9422                                 return -EINVAL;
9423                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9424                             !wdev->netdev)
9425                                 return -EINVAL;
9426
9427                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9428                                 if (wdev->netdev &&
9429                                     !netif_running(wdev->netdev))
9430                                         return -ENETDOWN;
9431                                 if (!wdev->netdev && !wdev->p2p_started)
9432                                         return -ENETDOWN;
9433                         }
9434                 } else {
9435                         wdev = NULL;
9436                 }
9437
9438                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9439                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9440                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9441                 }
9442
9443                 rdev->cur_cmd_info = info;
9444                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9445                                                           data, len);
9446                 rdev->cur_cmd_info = NULL;
9447                 return err;
9448         }
9449
9450         return -EOPNOTSUPP;
9451 }
9452
9453 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9454                                            enum nl80211_commands cmd,
9455                                            enum nl80211_attrs attr,
9456                                            int approxlen)
9457 {
9458         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9459
9460         if (WARN_ON(!rdev->cur_cmd_info))
9461                 return NULL;
9462
9463         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9464                                            rdev->cur_cmd_info->snd_portid,
9465                                            rdev->cur_cmd_info->snd_seq,
9466                                            cmd, attr, NULL, GFP_KERNEL);
9467 }
9468 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9469
9470 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9471 {
9472         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9473         void *hdr = ((void **)skb->cb)[1];
9474         struct nlattr *data = ((void **)skb->cb)[2];
9475
9476         /* clear CB data for netlink core to own from now on */
9477         memset(skb->cb, 0, sizeof(skb->cb));
9478
9479         if (WARN_ON(!rdev->cur_cmd_info)) {
9480                 kfree_skb(skb);
9481                 return -EINVAL;
9482         }
9483
9484         nla_nest_end(skb, data);
9485         genlmsg_end(skb, hdr);
9486         return genlmsg_reply(skb, rdev->cur_cmd_info);
9487 }
9488 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9489
9490
9491 static int nl80211_set_qos_map(struct sk_buff *skb,
9492                                struct genl_info *info)
9493 {
9494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9495         struct cfg80211_qos_map *qos_map = NULL;
9496         struct net_device *dev = info->user_ptr[1];
9497         u8 *pos, len, num_des, des_len, des;
9498         int ret;
9499
9500         if (!rdev->ops->set_qos_map)
9501                 return -EOPNOTSUPP;
9502
9503         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9504                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9505                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9506
9507                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9508                     len > IEEE80211_QOS_MAP_LEN_MAX)
9509                         return -EINVAL;
9510
9511                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9512                 if (!qos_map)
9513                         return -ENOMEM;
9514
9515                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9516                 if (num_des) {
9517                         des_len = num_des *
9518                                 sizeof(struct cfg80211_dscp_exception);
9519                         memcpy(qos_map->dscp_exception, pos, des_len);
9520                         qos_map->num_des = num_des;
9521                         for (des = 0; des < num_des; des++) {
9522                                 if (qos_map->dscp_exception[des].up > 7) {
9523                                         kfree(qos_map);
9524                                         return -EINVAL;
9525                                 }
9526                         }
9527                         pos += des_len;
9528                 }
9529                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9530         }
9531
9532         wdev_lock(dev->ieee80211_ptr);
9533         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9534         if (!ret)
9535                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9536         wdev_unlock(dev->ieee80211_ptr);
9537
9538         kfree(qos_map);
9539         return ret;
9540 }
9541
9542 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
9543 {
9544         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9545         struct net_device *dev = info->user_ptr[1];
9546         struct wireless_dev *wdev = dev->ieee80211_ptr;
9547         const u8 *peer;
9548         u8 tsid, up;
9549         u16 admitted_time = 0;
9550         int err;
9551
9552         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
9553                 return -EOPNOTSUPP;
9554
9555         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
9556             !info->attrs[NL80211_ATTR_USER_PRIO])
9557                 return -EINVAL;
9558
9559         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9560         if (tsid >= IEEE80211_NUM_TIDS)
9561                 return -EINVAL;
9562
9563         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
9564         if (up >= IEEE80211_NUM_UPS)
9565                 return -EINVAL;
9566
9567         /* WMM uses TIDs 0-7 even for TSPEC */
9568         if (tsid < IEEE80211_FIRST_TSPEC_TSID) {
9569                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
9570                         return -EINVAL;
9571         } else {
9572                 /* TODO: handle 802.11 TSPEC/admission control
9573                  * need more attributes for that (e.g. BA session requirement)
9574                  */
9575                 return -EINVAL;
9576         }
9577
9578         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9579
9580         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
9581                 admitted_time =
9582                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
9583                 if (!admitted_time)
9584                         return -EINVAL;
9585         }
9586
9587         wdev_lock(wdev);
9588         switch (wdev->iftype) {
9589         case NL80211_IFTYPE_STATION:
9590         case NL80211_IFTYPE_P2P_CLIENT:
9591                 if (wdev->current_bss)
9592                         break;
9593                 err = -ENOTCONN;
9594                 goto out;
9595         default:
9596                 err = -EOPNOTSUPP;
9597                 goto out;
9598         }
9599
9600         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
9601
9602  out:
9603         wdev_unlock(wdev);
9604         return err;
9605 }
9606
9607 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
9608 {
9609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9610         struct net_device *dev = info->user_ptr[1];
9611         struct wireless_dev *wdev = dev->ieee80211_ptr;
9612         const u8 *peer;
9613         u8 tsid;
9614         int err;
9615
9616         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
9617                 return -EINVAL;
9618
9619         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9620         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9621
9622         wdev_lock(wdev);
9623         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
9624         wdev_unlock(wdev);
9625
9626         return err;
9627 }
9628
9629 #define NL80211_FLAG_NEED_WIPHY         0x01
9630 #define NL80211_FLAG_NEED_NETDEV        0x02
9631 #define NL80211_FLAG_NEED_RTNL          0x04
9632 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9633 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9634                                          NL80211_FLAG_CHECK_NETDEV_UP)
9635 #define NL80211_FLAG_NEED_WDEV          0x10
9636 /* If a netdev is associated, it must be UP, P2P must be started */
9637 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9638                                          NL80211_FLAG_CHECK_NETDEV_UP)
9639 #define NL80211_FLAG_CLEAR_SKB          0x20
9640
9641 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9642                             struct genl_info *info)
9643 {
9644         struct cfg80211_registered_device *rdev;
9645         struct wireless_dev *wdev;
9646         struct net_device *dev;
9647         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9648
9649         if (rtnl)
9650                 rtnl_lock();
9651
9652         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9653                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9654                 if (IS_ERR(rdev)) {
9655                         if (rtnl)
9656                                 rtnl_unlock();
9657                         return PTR_ERR(rdev);
9658                 }
9659                 info->user_ptr[0] = rdev;
9660         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9661                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9662                 ASSERT_RTNL();
9663
9664                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9665                                                   info->attrs);
9666                 if (IS_ERR(wdev)) {
9667                         if (rtnl)
9668                                 rtnl_unlock();
9669                         return PTR_ERR(wdev);
9670                 }
9671
9672                 dev = wdev->netdev;
9673                 rdev = wiphy_to_rdev(wdev->wiphy);
9674
9675                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9676                         if (!dev) {
9677                                 if (rtnl)
9678                                         rtnl_unlock();
9679                                 return -EINVAL;
9680                         }
9681
9682                         info->user_ptr[1] = dev;
9683                 } else {
9684                         info->user_ptr[1] = wdev;
9685                 }
9686
9687                 if (dev) {
9688                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9689                             !netif_running(dev)) {
9690                                 if (rtnl)
9691                                         rtnl_unlock();
9692                                 return -ENETDOWN;
9693                         }
9694
9695                         dev_hold(dev);
9696                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9697                         if (!wdev->p2p_started) {
9698                                 if (rtnl)
9699                                         rtnl_unlock();
9700                                 return -ENETDOWN;
9701                         }
9702                 }
9703
9704                 info->user_ptr[0] = rdev;
9705         }
9706
9707         return 0;
9708 }
9709
9710 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9711                               struct genl_info *info)
9712 {
9713         if (info->user_ptr[1]) {
9714                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9715                         struct wireless_dev *wdev = info->user_ptr[1];
9716
9717                         if (wdev->netdev)
9718                                 dev_put(wdev->netdev);
9719                 } else {
9720                         dev_put(info->user_ptr[1]);
9721                 }
9722         }
9723
9724         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9725                 rtnl_unlock();
9726
9727         /* If needed, clear the netlink message payload from the SKB
9728          * as it might contain key data that shouldn't stick around on
9729          * the heap after the SKB is freed. The netlink message header
9730          * is still needed for further processing, so leave it intact.
9731          */
9732         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
9733                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
9734
9735                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
9736         }
9737 }
9738
9739 static const struct genl_ops nl80211_ops[] = {
9740         {
9741                 .cmd = NL80211_CMD_GET_WIPHY,
9742                 .doit = nl80211_get_wiphy,
9743                 .dumpit = nl80211_dump_wiphy,
9744                 .done = nl80211_dump_wiphy_done,
9745                 .policy = nl80211_policy,
9746                 /* can be retrieved by unprivileged users */
9747                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9748                                   NL80211_FLAG_NEED_RTNL,
9749         },
9750         {
9751                 .cmd = NL80211_CMD_SET_WIPHY,
9752                 .doit = nl80211_set_wiphy,
9753                 .policy = nl80211_policy,
9754                 .flags = GENL_ADMIN_PERM,
9755                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9756         },
9757         {
9758                 .cmd = NL80211_CMD_GET_INTERFACE,
9759                 .doit = nl80211_get_interface,
9760                 .dumpit = nl80211_dump_interface,
9761                 .policy = nl80211_policy,
9762                 /* can be retrieved by unprivileged users */
9763                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9764                                   NL80211_FLAG_NEED_RTNL,
9765         },
9766         {
9767                 .cmd = NL80211_CMD_SET_INTERFACE,
9768                 .doit = nl80211_set_interface,
9769                 .policy = nl80211_policy,
9770                 .flags = GENL_ADMIN_PERM,
9771                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9772                                   NL80211_FLAG_NEED_RTNL,
9773         },
9774         {
9775                 .cmd = NL80211_CMD_NEW_INTERFACE,
9776                 .doit = nl80211_new_interface,
9777                 .policy = nl80211_policy,
9778                 .flags = GENL_ADMIN_PERM,
9779                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9780                                   NL80211_FLAG_NEED_RTNL,
9781         },
9782         {
9783                 .cmd = NL80211_CMD_DEL_INTERFACE,
9784                 .doit = nl80211_del_interface,
9785                 .policy = nl80211_policy,
9786                 .flags = GENL_ADMIN_PERM,
9787                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9788                                   NL80211_FLAG_NEED_RTNL,
9789         },
9790         {
9791                 .cmd = NL80211_CMD_GET_KEY,
9792                 .doit = nl80211_get_key,
9793                 .policy = nl80211_policy,
9794                 .flags = GENL_ADMIN_PERM,
9795                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9796                                   NL80211_FLAG_NEED_RTNL,
9797         },
9798         {
9799                 .cmd = NL80211_CMD_SET_KEY,
9800                 .doit = nl80211_set_key,
9801                 .policy = nl80211_policy,
9802                 .flags = GENL_ADMIN_PERM,
9803                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9804                                   NL80211_FLAG_NEED_RTNL |
9805                                   NL80211_FLAG_CLEAR_SKB,
9806         },
9807         {
9808                 .cmd = NL80211_CMD_NEW_KEY,
9809                 .doit = nl80211_new_key,
9810                 .policy = nl80211_policy,
9811                 .flags = GENL_ADMIN_PERM,
9812                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9813                                   NL80211_FLAG_NEED_RTNL |
9814                                   NL80211_FLAG_CLEAR_SKB,
9815         },
9816         {
9817                 .cmd = NL80211_CMD_DEL_KEY,
9818                 .doit = nl80211_del_key,
9819                 .policy = nl80211_policy,
9820                 .flags = GENL_ADMIN_PERM,
9821                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9822                                   NL80211_FLAG_NEED_RTNL,
9823         },
9824         {
9825                 .cmd = NL80211_CMD_SET_BEACON,
9826                 .policy = nl80211_policy,
9827                 .flags = GENL_ADMIN_PERM,
9828                 .doit = nl80211_set_beacon,
9829                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9830                                   NL80211_FLAG_NEED_RTNL,
9831         },
9832         {
9833                 .cmd = NL80211_CMD_START_AP,
9834                 .policy = nl80211_policy,
9835                 .flags = GENL_ADMIN_PERM,
9836                 .doit = nl80211_start_ap,
9837                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9838                                   NL80211_FLAG_NEED_RTNL,
9839         },
9840         {
9841                 .cmd = NL80211_CMD_STOP_AP,
9842                 .policy = nl80211_policy,
9843                 .flags = GENL_ADMIN_PERM,
9844                 .doit = nl80211_stop_ap,
9845                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9846                                   NL80211_FLAG_NEED_RTNL,
9847         },
9848         {
9849                 .cmd = NL80211_CMD_GET_STATION,
9850                 .doit = nl80211_get_station,
9851                 .dumpit = nl80211_dump_station,
9852                 .policy = nl80211_policy,
9853                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9854                                   NL80211_FLAG_NEED_RTNL,
9855         },
9856         {
9857                 .cmd = NL80211_CMD_SET_STATION,
9858                 .doit = nl80211_set_station,
9859                 .policy = nl80211_policy,
9860                 .flags = GENL_ADMIN_PERM,
9861                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9862                                   NL80211_FLAG_NEED_RTNL,
9863         },
9864         {
9865                 .cmd = NL80211_CMD_NEW_STATION,
9866                 .doit = nl80211_new_station,
9867                 .policy = nl80211_policy,
9868                 .flags = GENL_ADMIN_PERM,
9869                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9870                                   NL80211_FLAG_NEED_RTNL,
9871         },
9872         {
9873                 .cmd = NL80211_CMD_DEL_STATION,
9874                 .doit = nl80211_del_station,
9875                 .policy = nl80211_policy,
9876                 .flags = GENL_ADMIN_PERM,
9877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9878                                   NL80211_FLAG_NEED_RTNL,
9879         },
9880         {
9881                 .cmd = NL80211_CMD_GET_MPATH,
9882                 .doit = nl80211_get_mpath,
9883                 .dumpit = nl80211_dump_mpath,
9884                 .policy = nl80211_policy,
9885                 .flags = GENL_ADMIN_PERM,
9886                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9887                                   NL80211_FLAG_NEED_RTNL,
9888         },
9889         {
9890                 .cmd = NL80211_CMD_GET_MPP,
9891                 .doit = nl80211_get_mpp,
9892                 .dumpit = nl80211_dump_mpp,
9893                 .policy = nl80211_policy,
9894                 .flags = GENL_ADMIN_PERM,
9895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9896                                   NL80211_FLAG_NEED_RTNL,
9897         },
9898         {
9899                 .cmd = NL80211_CMD_SET_MPATH,
9900                 .doit = nl80211_set_mpath,
9901                 .policy = nl80211_policy,
9902                 .flags = GENL_ADMIN_PERM,
9903                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9904                                   NL80211_FLAG_NEED_RTNL,
9905         },
9906         {
9907                 .cmd = NL80211_CMD_NEW_MPATH,
9908                 .doit = nl80211_new_mpath,
9909                 .policy = nl80211_policy,
9910                 .flags = GENL_ADMIN_PERM,
9911                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9912                                   NL80211_FLAG_NEED_RTNL,
9913         },
9914         {
9915                 .cmd = NL80211_CMD_DEL_MPATH,
9916                 .doit = nl80211_del_mpath,
9917                 .policy = nl80211_policy,
9918                 .flags = GENL_ADMIN_PERM,
9919                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9920                                   NL80211_FLAG_NEED_RTNL,
9921         },
9922         {
9923                 .cmd = NL80211_CMD_SET_BSS,
9924                 .doit = nl80211_set_bss,
9925                 .policy = nl80211_policy,
9926                 .flags = GENL_ADMIN_PERM,
9927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9928                                   NL80211_FLAG_NEED_RTNL,
9929         },
9930         {
9931                 .cmd = NL80211_CMD_GET_REG,
9932                 .doit = nl80211_get_reg,
9933                 .policy = nl80211_policy,
9934                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9935                 /* can be retrieved by unprivileged users */
9936         },
9937         {
9938                 .cmd = NL80211_CMD_SET_REG,
9939                 .doit = nl80211_set_reg,
9940                 .policy = nl80211_policy,
9941                 .flags = GENL_ADMIN_PERM,
9942                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9943         },
9944         {
9945                 .cmd = NL80211_CMD_REQ_SET_REG,
9946                 .doit = nl80211_req_set_reg,
9947                 .policy = nl80211_policy,
9948                 .flags = GENL_ADMIN_PERM,
9949         },
9950         {
9951                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9952                 .doit = nl80211_get_mesh_config,
9953                 .policy = nl80211_policy,
9954                 /* can be retrieved by unprivileged users */
9955                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9956                                   NL80211_FLAG_NEED_RTNL,
9957         },
9958         {
9959                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9960                 .doit = nl80211_update_mesh_config,
9961                 .policy = nl80211_policy,
9962                 .flags = GENL_ADMIN_PERM,
9963                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9964                                   NL80211_FLAG_NEED_RTNL,
9965         },
9966         {
9967                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9968                 .doit = nl80211_trigger_scan,
9969                 .policy = nl80211_policy,
9970                 .flags = GENL_ADMIN_PERM,
9971                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9972                                   NL80211_FLAG_NEED_RTNL,
9973         },
9974         {
9975                 .cmd = NL80211_CMD_GET_SCAN,
9976                 .policy = nl80211_policy,
9977                 .dumpit = nl80211_dump_scan,
9978         },
9979         {
9980                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9981                 .doit = nl80211_start_sched_scan,
9982                 .policy = nl80211_policy,
9983                 .flags = GENL_ADMIN_PERM,
9984                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9985                                   NL80211_FLAG_NEED_RTNL,
9986         },
9987         {
9988                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9989                 .doit = nl80211_stop_sched_scan,
9990                 .policy = nl80211_policy,
9991                 .flags = GENL_ADMIN_PERM,
9992                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9993                                   NL80211_FLAG_NEED_RTNL,
9994         },
9995         {
9996                 .cmd = NL80211_CMD_AUTHENTICATE,
9997                 .doit = nl80211_authenticate,
9998                 .policy = nl80211_policy,
9999                 .flags = GENL_ADMIN_PERM,
10000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10001                                   NL80211_FLAG_NEED_RTNL |
10002                                   NL80211_FLAG_CLEAR_SKB,
10003         },
10004         {
10005                 .cmd = NL80211_CMD_ASSOCIATE,
10006                 .doit = nl80211_associate,
10007                 .policy = nl80211_policy,
10008                 .flags = GENL_ADMIN_PERM,
10009                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10010                                   NL80211_FLAG_NEED_RTNL,
10011         },
10012         {
10013                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10014                 .doit = nl80211_deauthenticate,
10015                 .policy = nl80211_policy,
10016                 .flags = GENL_ADMIN_PERM,
10017                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10018                                   NL80211_FLAG_NEED_RTNL,
10019         },
10020         {
10021                 .cmd = NL80211_CMD_DISASSOCIATE,
10022                 .doit = nl80211_disassociate,
10023                 .policy = nl80211_policy,
10024                 .flags = GENL_ADMIN_PERM,
10025                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10026                                   NL80211_FLAG_NEED_RTNL,
10027         },
10028         {
10029                 .cmd = NL80211_CMD_JOIN_IBSS,
10030                 .doit = nl80211_join_ibss,
10031                 .policy = nl80211_policy,
10032                 .flags = GENL_ADMIN_PERM,
10033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10034                                   NL80211_FLAG_NEED_RTNL,
10035         },
10036         {
10037                 .cmd = NL80211_CMD_LEAVE_IBSS,
10038                 .doit = nl80211_leave_ibss,
10039                 .policy = nl80211_policy,
10040                 .flags = GENL_ADMIN_PERM,
10041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10042                                   NL80211_FLAG_NEED_RTNL,
10043         },
10044 #ifdef CONFIG_NL80211_TESTMODE
10045         {
10046                 .cmd = NL80211_CMD_TESTMODE,
10047                 .doit = nl80211_testmode_do,
10048                 .dumpit = nl80211_testmode_dump,
10049                 .policy = nl80211_policy,
10050                 .flags = GENL_ADMIN_PERM,
10051                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10052                                   NL80211_FLAG_NEED_RTNL,
10053         },
10054 #endif
10055         {
10056                 .cmd = NL80211_CMD_CONNECT,
10057                 .doit = nl80211_connect,
10058                 .policy = nl80211_policy,
10059                 .flags = GENL_ADMIN_PERM,
10060                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10061                                   NL80211_FLAG_NEED_RTNL,
10062         },
10063         {
10064                 .cmd = NL80211_CMD_DISCONNECT,
10065                 .doit = nl80211_disconnect,
10066                 .policy = nl80211_policy,
10067                 .flags = GENL_ADMIN_PERM,
10068                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10069                                   NL80211_FLAG_NEED_RTNL,
10070         },
10071         {
10072                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10073                 .doit = nl80211_wiphy_netns,
10074                 .policy = nl80211_policy,
10075                 .flags = GENL_ADMIN_PERM,
10076                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10077                                   NL80211_FLAG_NEED_RTNL,
10078         },
10079         {
10080                 .cmd = NL80211_CMD_GET_SURVEY,
10081                 .policy = nl80211_policy,
10082                 .dumpit = nl80211_dump_survey,
10083         },
10084         {
10085                 .cmd = NL80211_CMD_SET_PMKSA,
10086                 .doit = nl80211_setdel_pmksa,
10087                 .policy = nl80211_policy,
10088                 .flags = GENL_ADMIN_PERM,
10089                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10090                                   NL80211_FLAG_NEED_RTNL,
10091         },
10092         {
10093                 .cmd = NL80211_CMD_DEL_PMKSA,
10094                 .doit = nl80211_setdel_pmksa,
10095                 .policy = nl80211_policy,
10096                 .flags = GENL_ADMIN_PERM,
10097                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10098                                   NL80211_FLAG_NEED_RTNL,
10099         },
10100         {
10101                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10102                 .doit = nl80211_flush_pmksa,
10103                 .policy = nl80211_policy,
10104                 .flags = GENL_ADMIN_PERM,
10105                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10106                                   NL80211_FLAG_NEED_RTNL,
10107         },
10108         {
10109                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10110                 .doit = nl80211_remain_on_channel,
10111                 .policy = nl80211_policy,
10112                 .flags = GENL_ADMIN_PERM,
10113                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10114                                   NL80211_FLAG_NEED_RTNL,
10115         },
10116         {
10117                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10118                 .doit = nl80211_cancel_remain_on_channel,
10119                 .policy = nl80211_policy,
10120                 .flags = GENL_ADMIN_PERM,
10121                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10122                                   NL80211_FLAG_NEED_RTNL,
10123         },
10124         {
10125                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10126                 .doit = nl80211_set_tx_bitrate_mask,
10127                 .policy = nl80211_policy,
10128                 .flags = GENL_ADMIN_PERM,
10129                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10130                                   NL80211_FLAG_NEED_RTNL,
10131         },
10132         {
10133                 .cmd = NL80211_CMD_REGISTER_FRAME,
10134                 .doit = nl80211_register_mgmt,
10135                 .policy = nl80211_policy,
10136                 .flags = GENL_ADMIN_PERM,
10137                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10138                                   NL80211_FLAG_NEED_RTNL,
10139         },
10140         {
10141                 .cmd = NL80211_CMD_FRAME,
10142                 .doit = nl80211_tx_mgmt,
10143                 .policy = nl80211_policy,
10144                 .flags = GENL_ADMIN_PERM,
10145                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10146                                   NL80211_FLAG_NEED_RTNL,
10147         },
10148         {
10149                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10150                 .doit = nl80211_tx_mgmt_cancel_wait,
10151                 .policy = nl80211_policy,
10152                 .flags = GENL_ADMIN_PERM,
10153                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10154                                   NL80211_FLAG_NEED_RTNL,
10155         },
10156         {
10157                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10158                 .doit = nl80211_set_power_save,
10159                 .policy = nl80211_policy,
10160                 .flags = GENL_ADMIN_PERM,
10161                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10162                                   NL80211_FLAG_NEED_RTNL,
10163         },
10164         {
10165                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10166                 .doit = nl80211_get_power_save,
10167                 .policy = nl80211_policy,
10168                 /* can be retrieved by unprivileged users */
10169                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10170                                   NL80211_FLAG_NEED_RTNL,
10171         },
10172         {
10173                 .cmd = NL80211_CMD_SET_CQM,
10174                 .doit = nl80211_set_cqm,
10175                 .policy = nl80211_policy,
10176                 .flags = GENL_ADMIN_PERM,
10177                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10178                                   NL80211_FLAG_NEED_RTNL,
10179         },
10180         {
10181                 .cmd = NL80211_CMD_SET_CHANNEL,
10182                 .doit = nl80211_set_channel,
10183                 .policy = nl80211_policy,
10184                 .flags = GENL_ADMIN_PERM,
10185                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10186                                   NL80211_FLAG_NEED_RTNL,
10187         },
10188         {
10189                 .cmd = NL80211_CMD_SET_WDS_PEER,
10190                 .doit = nl80211_set_wds_peer,
10191                 .policy = nl80211_policy,
10192                 .flags = GENL_ADMIN_PERM,
10193                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10194                                   NL80211_FLAG_NEED_RTNL,
10195         },
10196         {
10197                 .cmd = NL80211_CMD_JOIN_MESH,
10198                 .doit = nl80211_join_mesh,
10199                 .policy = nl80211_policy,
10200                 .flags = GENL_ADMIN_PERM,
10201                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10202                                   NL80211_FLAG_NEED_RTNL,
10203         },
10204         {
10205                 .cmd = NL80211_CMD_LEAVE_MESH,
10206                 .doit = nl80211_leave_mesh,
10207                 .policy = nl80211_policy,
10208                 .flags = GENL_ADMIN_PERM,
10209                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10210                                   NL80211_FLAG_NEED_RTNL,
10211         },
10212 #ifdef CONFIG_PM
10213         {
10214                 .cmd = NL80211_CMD_GET_WOWLAN,
10215                 .doit = nl80211_get_wowlan,
10216                 .policy = nl80211_policy,
10217                 /* can be retrieved by unprivileged users */
10218                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10219                                   NL80211_FLAG_NEED_RTNL,
10220         },
10221         {
10222                 .cmd = NL80211_CMD_SET_WOWLAN,
10223                 .doit = nl80211_set_wowlan,
10224                 .policy = nl80211_policy,
10225                 .flags = GENL_ADMIN_PERM,
10226                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10227                                   NL80211_FLAG_NEED_RTNL,
10228         },
10229 #endif
10230         {
10231                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10232                 .doit = nl80211_set_rekey_data,
10233                 .policy = nl80211_policy,
10234                 .flags = GENL_ADMIN_PERM,
10235                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10236                                   NL80211_FLAG_NEED_RTNL |
10237                                   NL80211_FLAG_CLEAR_SKB,
10238         },
10239         {
10240                 .cmd = NL80211_CMD_TDLS_MGMT,
10241                 .doit = nl80211_tdls_mgmt,
10242                 .policy = nl80211_policy,
10243                 .flags = GENL_ADMIN_PERM,
10244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10245                                   NL80211_FLAG_NEED_RTNL,
10246         },
10247         {
10248                 .cmd = NL80211_CMD_TDLS_OPER,
10249                 .doit = nl80211_tdls_oper,
10250                 .policy = nl80211_policy,
10251                 .flags = GENL_ADMIN_PERM,
10252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10253                                   NL80211_FLAG_NEED_RTNL,
10254         },
10255         {
10256                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10257                 .doit = nl80211_register_unexpected_frame,
10258                 .policy = nl80211_policy,
10259                 .flags = GENL_ADMIN_PERM,
10260                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10261                                   NL80211_FLAG_NEED_RTNL,
10262         },
10263         {
10264                 .cmd = NL80211_CMD_PROBE_CLIENT,
10265                 .doit = nl80211_probe_client,
10266                 .policy = nl80211_policy,
10267                 .flags = GENL_ADMIN_PERM,
10268                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10269                                   NL80211_FLAG_NEED_RTNL,
10270         },
10271         {
10272                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10273                 .doit = nl80211_register_beacons,
10274                 .policy = nl80211_policy,
10275                 .flags = GENL_ADMIN_PERM,
10276                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10277                                   NL80211_FLAG_NEED_RTNL,
10278         },
10279         {
10280                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10281                 .doit = nl80211_set_noack_map,
10282                 .policy = nl80211_policy,
10283                 .flags = GENL_ADMIN_PERM,
10284                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10285                                   NL80211_FLAG_NEED_RTNL,
10286         },
10287         {
10288                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10289                 .doit = nl80211_start_p2p_device,
10290                 .policy = nl80211_policy,
10291                 .flags = GENL_ADMIN_PERM,
10292                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10293                                   NL80211_FLAG_NEED_RTNL,
10294         },
10295         {
10296                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10297                 .doit = nl80211_stop_p2p_device,
10298                 .policy = nl80211_policy,
10299                 .flags = GENL_ADMIN_PERM,
10300                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10301                                   NL80211_FLAG_NEED_RTNL,
10302         },
10303         {
10304                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10305                 .doit = nl80211_set_mcast_rate,
10306                 .policy = nl80211_policy,
10307                 .flags = GENL_ADMIN_PERM,
10308                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10309                                   NL80211_FLAG_NEED_RTNL,
10310         },
10311         {
10312                 .cmd = NL80211_CMD_SET_MAC_ACL,
10313                 .doit = nl80211_set_mac_acl,
10314                 .policy = nl80211_policy,
10315                 .flags = GENL_ADMIN_PERM,
10316                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10317                                   NL80211_FLAG_NEED_RTNL,
10318         },
10319         {
10320                 .cmd = NL80211_CMD_RADAR_DETECT,
10321                 .doit = nl80211_start_radar_detection,
10322                 .policy = nl80211_policy,
10323                 .flags = GENL_ADMIN_PERM,
10324                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10325                                   NL80211_FLAG_NEED_RTNL,
10326         },
10327         {
10328                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10329                 .doit = nl80211_get_protocol_features,
10330                 .policy = nl80211_policy,
10331         },
10332         {
10333                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10334                 .doit = nl80211_update_ft_ies,
10335                 .policy = nl80211_policy,
10336                 .flags = GENL_ADMIN_PERM,
10337                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10338                                   NL80211_FLAG_NEED_RTNL,
10339         },
10340         {
10341                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10342                 .doit = nl80211_crit_protocol_start,
10343                 .policy = nl80211_policy,
10344                 .flags = GENL_ADMIN_PERM,
10345                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10346                                   NL80211_FLAG_NEED_RTNL,
10347         },
10348         {
10349                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10350                 .doit = nl80211_crit_protocol_stop,
10351                 .policy = nl80211_policy,
10352                 .flags = GENL_ADMIN_PERM,
10353                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10354                                   NL80211_FLAG_NEED_RTNL,
10355         },
10356         {
10357                 .cmd = NL80211_CMD_GET_COALESCE,
10358                 .doit = nl80211_get_coalesce,
10359                 .policy = nl80211_policy,
10360                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10361                                   NL80211_FLAG_NEED_RTNL,
10362         },
10363         {
10364                 .cmd = NL80211_CMD_SET_COALESCE,
10365                 .doit = nl80211_set_coalesce,
10366                 .policy = nl80211_policy,
10367                 .flags = GENL_ADMIN_PERM,
10368                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10369                                   NL80211_FLAG_NEED_RTNL,
10370         },
10371         {
10372                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10373                 .doit = nl80211_channel_switch,
10374                 .policy = nl80211_policy,
10375                 .flags = GENL_ADMIN_PERM,
10376                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10377                                   NL80211_FLAG_NEED_RTNL,
10378         },
10379         {
10380                 .cmd = NL80211_CMD_VENDOR,
10381                 .doit = nl80211_vendor_cmd,
10382                 .policy = nl80211_policy,
10383                 .flags = GENL_ADMIN_PERM,
10384                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10385                                   NL80211_FLAG_NEED_RTNL,
10386         },
10387         {
10388                 .cmd = NL80211_CMD_SET_QOS_MAP,
10389                 .doit = nl80211_set_qos_map,
10390                 .policy = nl80211_policy,
10391                 .flags = GENL_ADMIN_PERM,
10392                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10393                                   NL80211_FLAG_NEED_RTNL,
10394         },
10395         {
10396                 .cmd = NL80211_CMD_ADD_TX_TS,
10397                 .doit = nl80211_add_tx_ts,
10398                 .policy = nl80211_policy,
10399                 .flags = GENL_ADMIN_PERM,
10400                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10401                                   NL80211_FLAG_NEED_RTNL,
10402         },
10403         {
10404                 .cmd = NL80211_CMD_DEL_TX_TS,
10405                 .doit = nl80211_del_tx_ts,
10406                 .policy = nl80211_policy,
10407                 .flags = GENL_ADMIN_PERM,
10408                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10409                                   NL80211_FLAG_NEED_RTNL,
10410         },
10411 };
10412
10413 /* notification functions */
10414
10415 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10416                           enum nl80211_commands cmd)
10417 {
10418         struct sk_buff *msg;
10419         struct nl80211_dump_wiphy_state state = {};
10420
10421         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10422                 cmd != NL80211_CMD_DEL_WIPHY);
10423
10424         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10425         if (!msg)
10426                 return;
10427
10428         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10429                 nlmsg_free(msg);
10430                 return;
10431         }
10432
10433         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10434                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10435 }
10436
10437 static int nl80211_add_scan_req(struct sk_buff *msg,
10438                                 struct cfg80211_registered_device *rdev)
10439 {
10440         struct cfg80211_scan_request *req = rdev->scan_req;
10441         struct nlattr *nest;
10442         int i;
10443
10444         if (WARN_ON(!req))
10445                 return 0;
10446
10447         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10448         if (!nest)
10449                 goto nla_put_failure;
10450         for (i = 0; i < req->n_ssids; i++) {
10451                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10452                         goto nla_put_failure;
10453         }
10454         nla_nest_end(msg, nest);
10455
10456         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10457         if (!nest)
10458                 goto nla_put_failure;
10459         for (i = 0; i < req->n_channels; i++) {
10460                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10461                         goto nla_put_failure;
10462         }
10463         nla_nest_end(msg, nest);
10464
10465         if (req->ie &&
10466             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10467                 goto nla_put_failure;
10468
10469         if (req->flags &&
10470             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10471                 goto nla_put_failure;
10472
10473         return 0;
10474  nla_put_failure:
10475         return -ENOBUFS;
10476 }
10477
10478 static int nl80211_send_scan_msg(struct sk_buff *msg,
10479                                  struct cfg80211_registered_device *rdev,
10480                                  struct wireless_dev *wdev,
10481                                  u32 portid, u32 seq, int flags,
10482                                  u32 cmd)
10483 {
10484         void *hdr;
10485
10486         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10487         if (!hdr)
10488                 return -1;
10489
10490         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10491             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10492                                          wdev->netdev->ifindex)) ||
10493             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10494                 goto nla_put_failure;
10495
10496         /* ignore errors and send incomplete event anyway */
10497         nl80211_add_scan_req(msg, rdev);
10498
10499         return genlmsg_end(msg, hdr);
10500
10501  nla_put_failure:
10502         genlmsg_cancel(msg, hdr);
10503         return -EMSGSIZE;
10504 }
10505
10506 static int
10507 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10508                             struct cfg80211_registered_device *rdev,
10509                             struct net_device *netdev,
10510                             u32 portid, u32 seq, int flags, u32 cmd)
10511 {
10512         void *hdr;
10513
10514         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10515         if (!hdr)
10516                 return -1;
10517
10518         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10519             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10520                 goto nla_put_failure;
10521
10522         return genlmsg_end(msg, hdr);
10523
10524  nla_put_failure:
10525         genlmsg_cancel(msg, hdr);
10526         return -EMSGSIZE;
10527 }
10528
10529 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10530                              struct wireless_dev *wdev)
10531 {
10532         struct sk_buff *msg;
10533
10534         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10535         if (!msg)
10536                 return;
10537
10538         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10539                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10540                 nlmsg_free(msg);
10541                 return;
10542         }
10543
10544         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10545                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10546 }
10547
10548 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10549                                        struct wireless_dev *wdev, bool aborted)
10550 {
10551         struct sk_buff *msg;
10552
10553         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10554         if (!msg)
10555                 return NULL;
10556
10557         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10558                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10559                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10560                 nlmsg_free(msg);
10561                 return NULL;
10562         }
10563
10564         return msg;
10565 }
10566
10567 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10568                               struct sk_buff *msg)
10569 {
10570         if (!msg)
10571                 return;
10572
10573         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10574                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10575 }
10576
10577 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10578                                      struct net_device *netdev)
10579 {
10580         struct sk_buff *msg;
10581
10582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10583         if (!msg)
10584                 return;
10585
10586         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10587                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10588                 nlmsg_free(msg);
10589                 return;
10590         }
10591
10592         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10593                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10594 }
10595
10596 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10597                              struct net_device *netdev, u32 cmd)
10598 {
10599         struct sk_buff *msg;
10600
10601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10602         if (!msg)
10603                 return;
10604
10605         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10606                 nlmsg_free(msg);
10607                 return;
10608         }
10609
10610         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10611                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10612 }
10613
10614 /*
10615  * This can happen on global regulatory changes or device specific settings
10616  * based on custom world regulatory domains.
10617  */
10618 void nl80211_send_reg_change_event(struct regulatory_request *request)
10619 {
10620         struct sk_buff *msg;
10621         void *hdr;
10622
10623         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10624         if (!msg)
10625                 return;
10626
10627         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10628         if (!hdr) {
10629                 nlmsg_free(msg);
10630                 return;
10631         }
10632
10633         /* Userspace can always count this one always being set */
10634         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10635                 goto nla_put_failure;
10636
10637         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10638                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10639                                NL80211_REGDOM_TYPE_WORLD))
10640                         goto nla_put_failure;
10641         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10642                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10643                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10644                         goto nla_put_failure;
10645         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10646                    request->intersect) {
10647                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10648                                NL80211_REGDOM_TYPE_INTERSECTION))
10649                         goto nla_put_failure;
10650         } else {
10651                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10652                                NL80211_REGDOM_TYPE_COUNTRY) ||
10653                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10654                                    request->alpha2))
10655                         goto nla_put_failure;
10656         }
10657
10658         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10659             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10660                 goto nla_put_failure;
10661
10662         genlmsg_end(msg, hdr);
10663
10664         rcu_read_lock();
10665         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10666                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10667         rcu_read_unlock();
10668
10669         return;
10670
10671 nla_put_failure:
10672         genlmsg_cancel(msg, hdr);
10673         nlmsg_free(msg);
10674 }
10675
10676 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10677                                     struct net_device *netdev,
10678                                     const u8 *buf, size_t len,
10679                                     enum nl80211_commands cmd, gfp_t gfp,
10680                                     int uapsd_queues)
10681 {
10682         struct sk_buff *msg;
10683         void *hdr;
10684
10685         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10686         if (!msg)
10687                 return;
10688
10689         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10690         if (!hdr) {
10691                 nlmsg_free(msg);
10692                 return;
10693         }
10694
10695         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10696             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10697             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10698                 goto nla_put_failure;
10699
10700         if (uapsd_queues >= 0) {
10701                 struct nlattr *nla_wmm =
10702                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
10703                 if (!nla_wmm)
10704                         goto nla_put_failure;
10705
10706                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
10707                                uapsd_queues))
10708                         goto nla_put_failure;
10709
10710                 nla_nest_end(msg, nla_wmm);
10711         }
10712
10713         genlmsg_end(msg, hdr);
10714
10715         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10716                                 NL80211_MCGRP_MLME, gfp);
10717         return;
10718
10719  nla_put_failure:
10720         genlmsg_cancel(msg, hdr);
10721         nlmsg_free(msg);
10722 }
10723
10724 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10725                           struct net_device *netdev, const u8 *buf,
10726                           size_t len, gfp_t gfp)
10727 {
10728         nl80211_send_mlme_event(rdev, netdev, buf, len,
10729                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
10730 }
10731
10732 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10733                            struct net_device *netdev, const u8 *buf,
10734                            size_t len, gfp_t gfp, int uapsd_queues)
10735 {
10736         nl80211_send_mlme_event(rdev, netdev, buf, len,
10737                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
10738 }
10739
10740 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10741                          struct net_device *netdev, const u8 *buf,
10742                          size_t len, gfp_t gfp)
10743 {
10744         nl80211_send_mlme_event(rdev, netdev, buf, len,
10745                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
10746 }
10747
10748 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10749                            struct net_device *netdev, const u8 *buf,
10750                            size_t len, gfp_t gfp)
10751 {
10752         nl80211_send_mlme_event(rdev, netdev, buf, len,
10753                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
10754 }
10755
10756 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10757                                   size_t len)
10758 {
10759         struct wireless_dev *wdev = dev->ieee80211_ptr;
10760         struct wiphy *wiphy = wdev->wiphy;
10761         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10762         const struct ieee80211_mgmt *mgmt = (void *)buf;
10763         u32 cmd;
10764
10765         if (WARN_ON(len < 2))
10766                 return;
10767
10768         if (ieee80211_is_deauth(mgmt->frame_control))
10769                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10770         else
10771                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10772
10773         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10774         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
10775 }
10776 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10777
10778 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10779                                       struct net_device *netdev, int cmd,
10780                                       const u8 *addr, gfp_t gfp)
10781 {
10782         struct sk_buff *msg;
10783         void *hdr;
10784
10785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10786         if (!msg)
10787                 return;
10788
10789         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10790         if (!hdr) {
10791                 nlmsg_free(msg);
10792                 return;
10793         }
10794
10795         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10796             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10797             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10798             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10799                 goto nla_put_failure;
10800
10801         genlmsg_end(msg, hdr);
10802
10803         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10804                                 NL80211_MCGRP_MLME, gfp);
10805         return;
10806
10807  nla_put_failure:
10808         genlmsg_cancel(msg, hdr);
10809         nlmsg_free(msg);
10810 }
10811
10812 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10813                                struct net_device *netdev, const u8 *addr,
10814                                gfp_t gfp)
10815 {
10816         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10817                                   addr, gfp);
10818 }
10819
10820 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10821                                 struct net_device *netdev, const u8 *addr,
10822                                 gfp_t gfp)
10823 {
10824         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10825                                   addr, gfp);
10826 }
10827
10828 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10829                                  struct net_device *netdev, const u8 *bssid,
10830                                  const u8 *req_ie, size_t req_ie_len,
10831                                  const u8 *resp_ie, size_t resp_ie_len,
10832                                  u16 status, gfp_t gfp)
10833 {
10834         struct sk_buff *msg;
10835         void *hdr;
10836
10837         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10838         if (!msg)
10839                 return;
10840
10841         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10842         if (!hdr) {
10843                 nlmsg_free(msg);
10844                 return;
10845         }
10846
10847         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10848             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10849             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10850             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10851             (req_ie &&
10852              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10853             (resp_ie &&
10854              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10855                 goto nla_put_failure;
10856
10857         genlmsg_end(msg, hdr);
10858
10859         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10860                                 NL80211_MCGRP_MLME, gfp);
10861         return;
10862
10863  nla_put_failure:
10864         genlmsg_cancel(msg, hdr);
10865         nlmsg_free(msg);
10866
10867 }
10868
10869 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10870                          struct net_device *netdev, const u8 *bssid,
10871                          const u8 *req_ie, size_t req_ie_len,
10872                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10873 {
10874         struct sk_buff *msg;
10875         void *hdr;
10876
10877         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10878         if (!msg)
10879                 return;
10880
10881         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10882         if (!hdr) {
10883                 nlmsg_free(msg);
10884                 return;
10885         }
10886
10887         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10888             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10889             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10890             (req_ie &&
10891              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10892             (resp_ie &&
10893              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10894                 goto nla_put_failure;
10895
10896         genlmsg_end(msg, hdr);
10897
10898         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10899                                 NL80211_MCGRP_MLME, gfp);
10900         return;
10901
10902  nla_put_failure:
10903         genlmsg_cancel(msg, hdr);
10904         nlmsg_free(msg);
10905
10906 }
10907
10908 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10909                                struct net_device *netdev, u16 reason,
10910                                const u8 *ie, size_t ie_len, bool from_ap)
10911 {
10912         struct sk_buff *msg;
10913         void *hdr;
10914
10915         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10916         if (!msg)
10917                 return;
10918
10919         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10920         if (!hdr) {
10921                 nlmsg_free(msg);
10922                 return;
10923         }
10924
10925         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10926             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10927             (from_ap && reason &&
10928              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10929             (from_ap &&
10930              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10931             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10932                 goto nla_put_failure;
10933
10934         genlmsg_end(msg, hdr);
10935
10936         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10937                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10938         return;
10939
10940  nla_put_failure:
10941         genlmsg_cancel(msg, hdr);
10942         nlmsg_free(msg);
10943
10944 }
10945
10946 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10947                              struct net_device *netdev, const u8 *bssid,
10948                              gfp_t gfp)
10949 {
10950         struct sk_buff *msg;
10951         void *hdr;
10952
10953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10954         if (!msg)
10955                 return;
10956
10957         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10958         if (!hdr) {
10959                 nlmsg_free(msg);
10960                 return;
10961         }
10962
10963         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10964             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10965             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10966                 goto nla_put_failure;
10967
10968         genlmsg_end(msg, hdr);
10969
10970         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10971                                 NL80211_MCGRP_MLME, gfp);
10972         return;
10973
10974  nla_put_failure:
10975         genlmsg_cancel(msg, hdr);
10976         nlmsg_free(msg);
10977 }
10978
10979 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10980                                         const u8* ie, u8 ie_len, gfp_t gfp)
10981 {
10982         struct wireless_dev *wdev = dev->ieee80211_ptr;
10983         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10984         struct sk_buff *msg;
10985         void *hdr;
10986
10987         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10988                 return;
10989
10990         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10991
10992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10993         if (!msg)
10994                 return;
10995
10996         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10997         if (!hdr) {
10998                 nlmsg_free(msg);
10999                 return;
11000         }
11001
11002         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11003             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11004             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11005             (ie_len && ie &&
11006              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11007                 goto nla_put_failure;
11008
11009         genlmsg_end(msg, hdr);
11010
11011         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11012                                 NL80211_MCGRP_MLME, gfp);
11013         return;
11014
11015  nla_put_failure:
11016         genlmsg_cancel(msg, hdr);
11017         nlmsg_free(msg);
11018 }
11019 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11020
11021 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11022                                  struct net_device *netdev, const u8 *addr,
11023                                  enum nl80211_key_type key_type, int key_id,
11024                                  const u8 *tsc, gfp_t gfp)
11025 {
11026         struct sk_buff *msg;
11027         void *hdr;
11028
11029         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11030         if (!msg)
11031                 return;
11032
11033         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11034         if (!hdr) {
11035                 nlmsg_free(msg);
11036                 return;
11037         }
11038
11039         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11040             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11041             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11042             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11043             (key_id != -1 &&
11044              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11045             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11046                 goto nla_put_failure;
11047
11048         genlmsg_end(msg, hdr);
11049
11050         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11051                                 NL80211_MCGRP_MLME, gfp);
11052         return;
11053
11054  nla_put_failure:
11055         genlmsg_cancel(msg, hdr);
11056         nlmsg_free(msg);
11057 }
11058
11059 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11060                                     struct ieee80211_channel *channel_before,
11061                                     struct ieee80211_channel *channel_after)
11062 {
11063         struct sk_buff *msg;
11064         void *hdr;
11065         struct nlattr *nl_freq;
11066
11067         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11068         if (!msg)
11069                 return;
11070
11071         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11072         if (!hdr) {
11073                 nlmsg_free(msg);
11074                 return;
11075         }
11076
11077         /*
11078          * Since we are applying the beacon hint to a wiphy we know its
11079          * wiphy_idx is valid
11080          */
11081         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11082                 goto nla_put_failure;
11083
11084         /* Before */
11085         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11086         if (!nl_freq)
11087                 goto nla_put_failure;
11088         if (nl80211_msg_put_channel(msg, channel_before, false))
11089                 goto nla_put_failure;
11090         nla_nest_end(msg, nl_freq);
11091
11092         /* After */
11093         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11094         if (!nl_freq)
11095                 goto nla_put_failure;
11096         if (nl80211_msg_put_channel(msg, channel_after, false))
11097                 goto nla_put_failure;
11098         nla_nest_end(msg, nl_freq);
11099
11100         genlmsg_end(msg, hdr);
11101
11102         rcu_read_lock();
11103         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11104                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11105         rcu_read_unlock();
11106
11107         return;
11108
11109 nla_put_failure:
11110         genlmsg_cancel(msg, hdr);
11111         nlmsg_free(msg);
11112 }
11113
11114 static void nl80211_send_remain_on_chan_event(
11115         int cmd, struct cfg80211_registered_device *rdev,
11116         struct wireless_dev *wdev, u64 cookie,
11117         struct ieee80211_channel *chan,
11118         unsigned int duration, gfp_t gfp)
11119 {
11120         struct sk_buff *msg;
11121         void *hdr;
11122
11123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11124         if (!msg)
11125                 return;
11126
11127         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11128         if (!hdr) {
11129                 nlmsg_free(msg);
11130                 return;
11131         }
11132
11133         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11134             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11135                                          wdev->netdev->ifindex)) ||
11136             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11137             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11138             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11139                         NL80211_CHAN_NO_HT) ||
11140             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
11141                 goto nla_put_failure;
11142
11143         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
11144             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
11145                 goto nla_put_failure;
11146
11147         genlmsg_end(msg, hdr);
11148
11149         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11150                                 NL80211_MCGRP_MLME, gfp);
11151         return;
11152
11153  nla_put_failure:
11154         genlmsg_cancel(msg, hdr);
11155         nlmsg_free(msg);
11156 }
11157
11158 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
11159                                struct ieee80211_channel *chan,
11160                                unsigned int duration, gfp_t gfp)
11161 {
11162         struct wiphy *wiphy = wdev->wiphy;
11163         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11164
11165         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11166         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11167                                           rdev, wdev, cookie, chan,
11168                                           duration, gfp);
11169 }
11170 EXPORT_SYMBOL(cfg80211_ready_on_channel);
11171
11172 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
11173                                         struct ieee80211_channel *chan,
11174                                         gfp_t gfp)
11175 {
11176         struct wiphy *wiphy = wdev->wiphy;
11177         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11178
11179         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11180         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11181                                           rdev, wdev, cookie, chan, 0, gfp);
11182 }
11183 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11184
11185 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
11186                       struct station_info *sinfo, gfp_t gfp)
11187 {
11188         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11189         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11190         struct sk_buff *msg;
11191
11192         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
11193
11194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11195         if (!msg)
11196                 return;
11197
11198         if (nl80211_send_station(msg, 0, 0, 0,
11199                                  rdev, dev, mac_addr, sinfo) < 0) {
11200                 nlmsg_free(msg);
11201                 return;
11202         }
11203
11204         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11205                                 NL80211_MCGRP_MLME, gfp);
11206 }
11207 EXPORT_SYMBOL(cfg80211_new_sta);
11208
11209 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
11210 {
11211         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11212         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11213         struct sk_buff *msg;
11214         void *hdr;
11215
11216         trace_cfg80211_del_sta(dev, mac_addr);
11217
11218         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11219         if (!msg)
11220                 return;
11221
11222         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
11223         if (!hdr) {
11224                 nlmsg_free(msg);
11225                 return;
11226         }
11227
11228         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11229             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
11230                 goto nla_put_failure;
11231
11232         genlmsg_end(msg, hdr);
11233
11234         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11235                                 NL80211_MCGRP_MLME, gfp);
11236         return;
11237
11238  nla_put_failure:
11239         genlmsg_cancel(msg, hdr);
11240         nlmsg_free(msg);
11241 }
11242 EXPORT_SYMBOL(cfg80211_del_sta);
11243
11244 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11245                           enum nl80211_connect_failed_reason reason,
11246                           gfp_t gfp)
11247 {
11248         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11249         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11250         struct sk_buff *msg;
11251         void *hdr;
11252
11253         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11254         if (!msg)
11255                 return;
11256
11257         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11258         if (!hdr) {
11259                 nlmsg_free(msg);
11260                 return;
11261         }
11262
11263         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11264             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11265             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11266                 goto nla_put_failure;
11267
11268         genlmsg_end(msg, hdr);
11269
11270         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11271                                 NL80211_MCGRP_MLME, gfp);
11272         return;
11273
11274  nla_put_failure:
11275         genlmsg_cancel(msg, hdr);
11276         nlmsg_free(msg);
11277 }
11278 EXPORT_SYMBOL(cfg80211_conn_failed);
11279
11280 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11281                                        const u8 *addr, gfp_t gfp)
11282 {
11283         struct wireless_dev *wdev = dev->ieee80211_ptr;
11284         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11285         struct sk_buff *msg;
11286         void *hdr;
11287         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11288
11289         if (!nlportid)
11290                 return false;
11291
11292         msg = nlmsg_new(100, gfp);
11293         if (!msg)
11294                 return true;
11295
11296         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11297         if (!hdr) {
11298                 nlmsg_free(msg);
11299                 return true;
11300         }
11301
11302         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11303             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11304             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11305                 goto nla_put_failure;
11306
11307         genlmsg_end(msg, hdr);
11308         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11309         return true;
11310
11311  nla_put_failure:
11312         genlmsg_cancel(msg, hdr);
11313         nlmsg_free(msg);
11314         return true;
11315 }
11316
11317 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11318                                 const u8 *addr, gfp_t gfp)
11319 {
11320         struct wireless_dev *wdev = dev->ieee80211_ptr;
11321         bool ret;
11322
11323         trace_cfg80211_rx_spurious_frame(dev, addr);
11324
11325         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11326                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11327                 trace_cfg80211_return_bool(false);
11328                 return false;
11329         }
11330         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11331                                          addr, gfp);
11332         trace_cfg80211_return_bool(ret);
11333         return ret;
11334 }
11335 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11336
11337 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11338                                         const u8 *addr, gfp_t gfp)
11339 {
11340         struct wireless_dev *wdev = dev->ieee80211_ptr;
11341         bool ret;
11342
11343         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11344
11345         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11346                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11347                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11348                 trace_cfg80211_return_bool(false);
11349                 return false;
11350         }
11351         ret = __nl80211_unexpected_frame(dev,
11352                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11353                                          addr, gfp);
11354         trace_cfg80211_return_bool(ret);
11355         return ret;
11356 }
11357 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11358
11359 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11360                       struct wireless_dev *wdev, u32 nlportid,
11361                       int freq, int sig_dbm,
11362                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11363 {
11364         struct net_device *netdev = wdev->netdev;
11365         struct sk_buff *msg;
11366         void *hdr;
11367
11368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11369         if (!msg)
11370                 return -ENOMEM;
11371
11372         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11373         if (!hdr) {
11374                 nlmsg_free(msg);
11375                 return -ENOMEM;
11376         }
11377
11378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11379             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11380                                         netdev->ifindex)) ||
11381             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11382             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11383             (sig_dbm &&
11384              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11385             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11386             (flags &&
11387              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11388                 goto nla_put_failure;
11389
11390         genlmsg_end(msg, hdr);
11391
11392         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11393
11394  nla_put_failure:
11395         genlmsg_cancel(msg, hdr);
11396         nlmsg_free(msg);
11397         return -ENOBUFS;
11398 }
11399
11400 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11401                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11402 {
11403         struct wiphy *wiphy = wdev->wiphy;
11404         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11405         struct net_device *netdev = wdev->netdev;
11406         struct sk_buff *msg;
11407         void *hdr;
11408
11409         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11410
11411         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11412         if (!msg)
11413                 return;
11414
11415         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11416         if (!hdr) {
11417                 nlmsg_free(msg);
11418                 return;
11419         }
11420
11421         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11422             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11423                                    netdev->ifindex)) ||
11424             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11425             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11426             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11427             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11428                 goto nla_put_failure;
11429
11430         genlmsg_end(msg, hdr);
11431
11432         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11433                                 NL80211_MCGRP_MLME, gfp);
11434         return;
11435
11436  nla_put_failure:
11437         genlmsg_cancel(msg, hdr);
11438         nlmsg_free(msg);
11439 }
11440 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11441
11442 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11443                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11444                               gfp_t gfp)
11445 {
11446         struct wireless_dev *wdev = dev->ieee80211_ptr;
11447         struct wiphy *wiphy = wdev->wiphy;
11448         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11449         struct sk_buff *msg;
11450         struct nlattr *pinfoattr;
11451         void *hdr;
11452
11453         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11454
11455         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11456         if (!msg)
11457                 return;
11458
11459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11460         if (!hdr) {
11461                 nlmsg_free(msg);
11462                 return;
11463         }
11464
11465         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11466             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11467                 goto nla_put_failure;
11468
11469         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11470         if (!pinfoattr)
11471                 goto nla_put_failure;
11472
11473         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11474                         rssi_event))
11475                 goto nla_put_failure;
11476
11477         nla_nest_end(msg, pinfoattr);
11478
11479         genlmsg_end(msg, hdr);
11480
11481         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11482                                 NL80211_MCGRP_MLME, gfp);
11483         return;
11484
11485  nla_put_failure:
11486         genlmsg_cancel(msg, hdr);
11487         nlmsg_free(msg);
11488 }
11489 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11490
11491 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11492                                      struct net_device *netdev, const u8 *bssid,
11493                                      const u8 *replay_ctr, gfp_t gfp)
11494 {
11495         struct sk_buff *msg;
11496         struct nlattr *rekey_attr;
11497         void *hdr;
11498
11499         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11500         if (!msg)
11501                 return;
11502
11503         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11504         if (!hdr) {
11505                 nlmsg_free(msg);
11506                 return;
11507         }
11508
11509         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11510             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11511             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11512                 goto nla_put_failure;
11513
11514         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11515         if (!rekey_attr)
11516                 goto nla_put_failure;
11517
11518         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11519                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11520                 goto nla_put_failure;
11521
11522         nla_nest_end(msg, rekey_attr);
11523
11524         genlmsg_end(msg, hdr);
11525
11526         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11527                                 NL80211_MCGRP_MLME, gfp);
11528         return;
11529
11530  nla_put_failure:
11531         genlmsg_cancel(msg, hdr);
11532         nlmsg_free(msg);
11533 }
11534
11535 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11536                                const u8 *replay_ctr, gfp_t gfp)
11537 {
11538         struct wireless_dev *wdev = dev->ieee80211_ptr;
11539         struct wiphy *wiphy = wdev->wiphy;
11540         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11541
11542         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11543         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11544 }
11545 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11546
11547 static void
11548 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11549                                struct net_device *netdev, int index,
11550                                const u8 *bssid, bool preauth, gfp_t gfp)
11551 {
11552         struct sk_buff *msg;
11553         struct nlattr *attr;
11554         void *hdr;
11555
11556         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11557         if (!msg)
11558                 return;
11559
11560         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11561         if (!hdr) {
11562                 nlmsg_free(msg);
11563                 return;
11564         }
11565
11566         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11567             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11568                 goto nla_put_failure;
11569
11570         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11571         if (!attr)
11572                 goto nla_put_failure;
11573
11574         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11575             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11576             (preauth &&
11577              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11578                 goto nla_put_failure;
11579
11580         nla_nest_end(msg, attr);
11581
11582         genlmsg_end(msg, hdr);
11583
11584         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11585                                 NL80211_MCGRP_MLME, gfp);
11586         return;
11587
11588  nla_put_failure:
11589         genlmsg_cancel(msg, hdr);
11590         nlmsg_free(msg);
11591 }
11592
11593 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11594                                      const u8 *bssid, bool preauth, gfp_t gfp)
11595 {
11596         struct wireless_dev *wdev = dev->ieee80211_ptr;
11597         struct wiphy *wiphy = wdev->wiphy;
11598         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11599
11600         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11601         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11602 }
11603 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11604
11605 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11606                                      struct net_device *netdev,
11607                                      struct cfg80211_chan_def *chandef,
11608                                      gfp_t gfp)
11609 {
11610         struct sk_buff *msg;
11611         void *hdr;
11612
11613         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11614         if (!msg)
11615                 return;
11616
11617         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11618         if (!hdr) {
11619                 nlmsg_free(msg);
11620                 return;
11621         }
11622
11623         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11624                 goto nla_put_failure;
11625
11626         if (nl80211_send_chandef(msg, chandef))
11627                 goto nla_put_failure;
11628
11629         genlmsg_end(msg, hdr);
11630
11631         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11632                                 NL80211_MCGRP_MLME, gfp);
11633         return;
11634
11635  nla_put_failure:
11636         genlmsg_cancel(msg, hdr);
11637         nlmsg_free(msg);
11638 }
11639
11640 void cfg80211_ch_switch_notify(struct net_device *dev,
11641                                struct cfg80211_chan_def *chandef)
11642 {
11643         struct wireless_dev *wdev = dev->ieee80211_ptr;
11644         struct wiphy *wiphy = wdev->wiphy;
11645         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11646
11647         ASSERT_WDEV_LOCK(wdev);
11648
11649         trace_cfg80211_ch_switch_notify(dev, chandef);
11650
11651         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11652                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11653                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11654                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11655                 return;
11656
11657         wdev->chandef = *chandef;
11658         wdev->preset_chandef = *chandef;
11659         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11660 }
11661 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11662
11663 void cfg80211_cqm_txe_notify(struct net_device *dev,
11664                              const u8 *peer, u32 num_packets,
11665                              u32 rate, u32 intvl, gfp_t gfp)
11666 {
11667         struct wireless_dev *wdev = dev->ieee80211_ptr;
11668         struct wiphy *wiphy = wdev->wiphy;
11669         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11670         struct sk_buff *msg;
11671         struct nlattr *pinfoattr;
11672         void *hdr;
11673
11674         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11675         if (!msg)
11676                 return;
11677
11678         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11679         if (!hdr) {
11680                 nlmsg_free(msg);
11681                 return;
11682         }
11683
11684         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11685             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11686             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11687                 goto nla_put_failure;
11688
11689         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11690         if (!pinfoattr)
11691                 goto nla_put_failure;
11692
11693         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11694                 goto nla_put_failure;
11695
11696         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11697                 goto nla_put_failure;
11698
11699         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11700                 goto nla_put_failure;
11701
11702         nla_nest_end(msg, pinfoattr);
11703
11704         genlmsg_end(msg, hdr);
11705
11706         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11707                                 NL80211_MCGRP_MLME, gfp);
11708         return;
11709
11710  nla_put_failure:
11711         genlmsg_cancel(msg, hdr);
11712         nlmsg_free(msg);
11713 }
11714 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11715
11716 void
11717 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11718                      const struct cfg80211_chan_def *chandef,
11719                      enum nl80211_radar_event event,
11720                      struct net_device *netdev, gfp_t gfp)
11721 {
11722         struct sk_buff *msg;
11723         void *hdr;
11724
11725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11726         if (!msg)
11727                 return;
11728
11729         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11730         if (!hdr) {
11731                 nlmsg_free(msg);
11732                 return;
11733         }
11734
11735         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11736                 goto nla_put_failure;
11737
11738         /* NOP and radar events don't need a netdev parameter */
11739         if (netdev) {
11740                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11741
11742                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11743                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11744                         goto nla_put_failure;
11745         }
11746
11747         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11748                 goto nla_put_failure;
11749
11750         if (nl80211_send_chandef(msg, chandef))
11751                 goto nla_put_failure;
11752
11753         genlmsg_end(msg, hdr);
11754
11755         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11756                                 NL80211_MCGRP_MLME, gfp);
11757         return;
11758
11759  nla_put_failure:
11760         genlmsg_cancel(msg, hdr);
11761         nlmsg_free(msg);
11762 }
11763
11764 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11765                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11766 {
11767         struct wireless_dev *wdev = dev->ieee80211_ptr;
11768         struct wiphy *wiphy = wdev->wiphy;
11769         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11770         struct sk_buff *msg;
11771         struct nlattr *pinfoattr;
11772         void *hdr;
11773
11774         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11775
11776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11777         if (!msg)
11778                 return;
11779
11780         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11781         if (!hdr) {
11782                 nlmsg_free(msg);
11783                 return;
11784         }
11785
11786         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11787             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11788             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11789                 goto nla_put_failure;
11790
11791         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11792         if (!pinfoattr)
11793                 goto nla_put_failure;
11794
11795         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11796                 goto nla_put_failure;
11797
11798         nla_nest_end(msg, pinfoattr);
11799
11800         genlmsg_end(msg, hdr);
11801
11802         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11803                                 NL80211_MCGRP_MLME, gfp);
11804         return;
11805
11806  nla_put_failure:
11807         genlmsg_cancel(msg, hdr);
11808         nlmsg_free(msg);
11809 }
11810 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11811
11812 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11813                            u64 cookie, bool acked, gfp_t gfp)
11814 {
11815         struct wireless_dev *wdev = dev->ieee80211_ptr;
11816         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11817         struct sk_buff *msg;
11818         void *hdr;
11819
11820         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11821
11822         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11823
11824         if (!msg)
11825                 return;
11826
11827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11828         if (!hdr) {
11829                 nlmsg_free(msg);
11830                 return;
11831         }
11832
11833         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11834             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11835             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11836             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11837             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11838                 goto nla_put_failure;
11839
11840         genlmsg_end(msg, hdr);
11841
11842         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11843                                 NL80211_MCGRP_MLME, gfp);
11844         return;
11845
11846  nla_put_failure:
11847         genlmsg_cancel(msg, hdr);
11848         nlmsg_free(msg);
11849 }
11850 EXPORT_SYMBOL(cfg80211_probe_status);
11851
11852 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11853                                  const u8 *frame, size_t len,
11854                                  int freq, int sig_dbm)
11855 {
11856         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11857         struct sk_buff *msg;
11858         void *hdr;
11859         struct cfg80211_beacon_registration *reg;
11860
11861         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11862
11863         spin_lock_bh(&rdev->beacon_registrations_lock);
11864         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11865                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11866                 if (!msg) {
11867                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11868                         return;
11869                 }
11870
11871                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11872                 if (!hdr)
11873                         goto nla_put_failure;
11874
11875                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11876                     (freq &&
11877                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11878                     (sig_dbm &&
11879                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11880                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11881                         goto nla_put_failure;
11882
11883                 genlmsg_end(msg, hdr);
11884
11885                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11886         }
11887         spin_unlock_bh(&rdev->beacon_registrations_lock);
11888         return;
11889
11890  nla_put_failure:
11891         spin_unlock_bh(&rdev->beacon_registrations_lock);
11892         if (hdr)
11893                 genlmsg_cancel(msg, hdr);
11894         nlmsg_free(msg);
11895 }
11896 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11897
11898 #ifdef CONFIG_PM
11899 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11900                                    struct cfg80211_wowlan_wakeup *wakeup,
11901                                    gfp_t gfp)
11902 {
11903         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11904         struct sk_buff *msg;
11905         void *hdr;
11906         int size = 200;
11907
11908         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11909
11910         if (wakeup)
11911                 size += wakeup->packet_present_len;
11912
11913         msg = nlmsg_new(size, gfp);
11914         if (!msg)
11915                 return;
11916
11917         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11918         if (!hdr)
11919                 goto free_msg;
11920
11921         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11922             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11923                 goto free_msg;
11924
11925         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11926                                         wdev->netdev->ifindex))
11927                 goto free_msg;
11928
11929         if (wakeup) {
11930                 struct nlattr *reasons;
11931
11932                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11933                 if (!reasons)
11934                         goto free_msg;
11935
11936                 if (wakeup->disconnect &&
11937                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11938                         goto free_msg;
11939                 if (wakeup->magic_pkt &&
11940                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11941                         goto free_msg;
11942                 if (wakeup->gtk_rekey_failure &&
11943                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11944                         goto free_msg;
11945                 if (wakeup->eap_identity_req &&
11946                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11947                         goto free_msg;
11948                 if (wakeup->four_way_handshake &&
11949                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11950                         goto free_msg;
11951                 if (wakeup->rfkill_release &&
11952                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11953                         goto free_msg;
11954
11955                 if (wakeup->pattern_idx >= 0 &&
11956                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11957                                 wakeup->pattern_idx))
11958                         goto free_msg;
11959
11960                 if (wakeup->tcp_match &&
11961                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11962                         goto free_msg;
11963
11964                 if (wakeup->tcp_connlost &&
11965                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11966                         goto free_msg;
11967
11968                 if (wakeup->tcp_nomoretokens &&
11969                     nla_put_flag(msg,
11970                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11971                         goto free_msg;
11972
11973                 if (wakeup->packet) {
11974                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11975                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11976
11977                         if (!wakeup->packet_80211) {
11978                                 pkt_attr =
11979                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11980                                 len_attr =
11981                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11982                         }
11983
11984                         if (wakeup->packet_len &&
11985                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11986                                 goto free_msg;
11987
11988                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11989                                     wakeup->packet))
11990                                 goto free_msg;
11991                 }
11992
11993                 nla_nest_end(msg, reasons);
11994         }
11995
11996         genlmsg_end(msg, hdr);
11997
11998         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11999                                 NL80211_MCGRP_MLME, gfp);
12000         return;
12001
12002  free_msg:
12003         nlmsg_free(msg);
12004 }
12005 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12006 #endif
12007
12008 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12009                                 enum nl80211_tdls_operation oper,
12010                                 u16 reason_code, gfp_t gfp)
12011 {
12012         struct wireless_dev *wdev = dev->ieee80211_ptr;
12013         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12014         struct sk_buff *msg;
12015         void *hdr;
12016
12017         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12018                                          reason_code);
12019
12020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12021         if (!msg)
12022                 return;
12023
12024         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12025         if (!hdr) {
12026                 nlmsg_free(msg);
12027                 return;
12028         }
12029
12030         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12031             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12032             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12033             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12034             (reason_code > 0 &&
12035              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12036                 goto nla_put_failure;
12037
12038         genlmsg_end(msg, hdr);
12039
12040         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12041                                 NL80211_MCGRP_MLME, gfp);
12042         return;
12043
12044  nla_put_failure:
12045         genlmsg_cancel(msg, hdr);
12046         nlmsg_free(msg);
12047 }
12048 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12049
12050 static int nl80211_netlink_notify(struct notifier_block * nb,
12051                                   unsigned long state,
12052                                   void *_notify)
12053 {
12054         struct netlink_notify *notify = _notify;
12055         struct cfg80211_registered_device *rdev;
12056         struct wireless_dev *wdev;
12057         struct cfg80211_beacon_registration *reg, *tmp;
12058
12059         if (state != NETLINK_URELEASE)
12060                 return NOTIFY_DONE;
12061
12062         rcu_read_lock();
12063
12064         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12065                 bool schedule_destroy_work = false;
12066
12067                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12068                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
12069
12070                         if (wdev->owner_nlportid == notify->portid)
12071                                 schedule_destroy_work = true;
12072                 }
12073
12074                 spin_lock_bh(&rdev->beacon_registrations_lock);
12075                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
12076                                          list) {
12077                         if (reg->nlportid == notify->portid) {
12078                                 list_del(&reg->list);
12079                                 kfree(reg);
12080                                 break;
12081                         }
12082                 }
12083                 spin_unlock_bh(&rdev->beacon_registrations_lock);
12084
12085                 if (schedule_destroy_work) {
12086                         struct cfg80211_iface_destroy *destroy;
12087
12088                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
12089                         if (destroy) {
12090                                 destroy->nlportid = notify->portid;
12091                                 spin_lock(&rdev->destroy_list_lock);
12092                                 list_add(&destroy->list, &rdev->destroy_list);
12093                                 spin_unlock(&rdev->destroy_list_lock);
12094                                 schedule_work(&rdev->destroy_work);
12095                         }
12096                 }
12097         }
12098
12099         rcu_read_unlock();
12100
12101         return NOTIFY_OK;
12102 }
12103
12104 static struct notifier_block nl80211_netlink_notifier = {
12105         .notifier_call = nl80211_netlink_notify,
12106 };
12107
12108 void cfg80211_ft_event(struct net_device *netdev,
12109                        struct cfg80211_ft_event_params *ft_event)
12110 {
12111         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12112         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12113         struct sk_buff *msg;
12114         void *hdr;
12115
12116         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
12117
12118         if (!ft_event->target_ap)
12119                 return;
12120
12121         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12122         if (!msg)
12123                 return;
12124
12125         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12126         if (!hdr)
12127                 goto out;
12128
12129         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12130             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12131             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
12132                 goto out;
12133
12134         if (ft_event->ies &&
12135             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
12136                 goto out;
12137         if (ft_event->ric_ies &&
12138             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
12139                     ft_event->ric_ies))
12140                 goto out;
12141
12142         genlmsg_end(msg, hdr);
12143
12144         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12145                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12146         return;
12147  out:
12148         nlmsg_free(msg);
12149 }
12150 EXPORT_SYMBOL(cfg80211_ft_event);
12151
12152 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
12153 {
12154         struct cfg80211_registered_device *rdev;
12155         struct sk_buff *msg;
12156         void *hdr;
12157         u32 nlportid;
12158
12159         rdev = wiphy_to_rdev(wdev->wiphy);
12160         if (!rdev->crit_proto_nlportid)
12161                 return;
12162
12163         nlportid = rdev->crit_proto_nlportid;
12164         rdev->crit_proto_nlportid = 0;
12165
12166         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12167         if (!msg)
12168                 return;
12169
12170         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
12171         if (!hdr)
12172                 goto nla_put_failure;
12173
12174         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12175             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12176                 goto nla_put_failure;
12177
12178         genlmsg_end(msg, hdr);
12179
12180         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12181         return;
12182
12183  nla_put_failure:
12184         if (hdr)
12185                 genlmsg_cancel(msg, hdr);
12186         nlmsg_free(msg);
12187
12188 }
12189 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
12190
12191 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
12192 {
12193         struct wiphy *wiphy = wdev->wiphy;
12194         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12195         struct sk_buff *msg;
12196         void *hdr;
12197
12198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12199         if (!msg)
12200                 return;
12201
12202         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
12203         if (!hdr)
12204                 goto out;
12205
12206         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12207             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
12208             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12209                 goto out;
12210
12211         genlmsg_end(msg, hdr);
12212
12213         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
12214                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12215         return;
12216  out:
12217         nlmsg_free(msg);
12218 }
12219
12220 /* initialisation/exit functions */
12221
12222 int nl80211_init(void)
12223 {
12224         int err;
12225
12226         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
12227                                                    nl80211_mcgrps);
12228         if (err)
12229                 return err;
12230
12231         err = netlink_register_notifier(&nl80211_netlink_notifier);
12232         if (err)
12233                 goto err_out;
12234
12235         return 0;
12236  err_out:
12237         genl_unregister_family(&nl80211_fam);
12238         return err;
12239 }
12240
12241 void nl80211_exit(void)
12242 {
12243         netlink_unregister_notifier(&nl80211_netlink_notifier);
12244         genl_unregister_family(&nl80211_fam);
12245 }