net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398 };
 399
 400 /* policy for the key attributes */
 401 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 402         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 403         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 404         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 405         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 406         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 407         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 408         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 409         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 410 };
 411
 412 /* policy for the key default flags */
 413 static const struct nla_policy
 414 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 415         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 416         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 417 };
 418
 419 /* policy for WoWLAN attributes */
 420 static const struct nla_policy
 421 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 422         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 423         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 424         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 425         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 426         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 427         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 428         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 431 };
 432
 433 static const struct nla_policy
 434 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 435         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 436         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 437         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 438         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 439         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 440         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 441         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 442                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 443         },
 444         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 445                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 446         },
 447         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 448         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 449         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 450 };
 451
 452 /* policy for coalesce rule attributes */
 453 static const struct nla_policy
 454 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 455         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 456         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 457         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 458 };
 459
 460 /* policy for GTK rekey offload attributes */
 461 static const struct nla_policy
 462 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 463         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 464         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 465         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 466 };
 467
 468 static const struct nla_policy
 469 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 470         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 471                                                  .len = IEEE80211_MAX_SSID_LEN },
 472         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 473 };
 474
 475 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 476                                      struct netlink_callback *cb,
 477                                      struct cfg80211_registered_device **rdev,
 478                                      struct wireless_dev **wdev)
 479 {
 480         int err;
 481
 482         rtnl_lock();
 483
 484         if (!cb->args[0]) {
 485                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 486                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 487                                   nl80211_policy);
 488                 if (err)
 489                         goto out_unlock;
 490
 491                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 492                                                    nl80211_fam.attrbuf);
 493                 if (IS_ERR(*wdev)) {
 494                         err = PTR_ERR(*wdev);
 495                         goto out_unlock;
 496                 }
 497                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 498                 /* 0 is the first index - add 1 to parse only once */
 499                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 500                 cb->args[1] = (*wdev)->identifier;
 501         } else {
 502                 /* subtract the 1 again here */
 503                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 504                 struct wireless_dev *tmp;
 505
 506                 if (!wiphy) {
 507                         err = -ENODEV;
 508                         goto out_unlock;
 509                 }
 510                 *rdev = wiphy_to_rdev(wiphy);
 511                 *wdev = NULL;
 512
 513                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 514                         if (tmp->identifier == cb->args[1]) {
 515                                 *wdev = tmp;
 516                                 break;
 517                         }
 518                 }
 519
 520                 if (!*wdev) {
 521                         err = -ENODEV;
 522                         goto out_unlock;
 523                 }
 524         }
 525
 526         return 0;
 527  out_unlock:
 528         rtnl_unlock();
 529         return err;
 530 }
 531
 532 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 533 {
 534         rtnl_unlock();
 535 }
 536
 537 /* IE validation */
 538 static bool is_valid_ie_attr(const struct nlattr *attr)
 539 {
 540         const u8 *pos;
 541         int len;
 542
 543         if (!attr)
 544                 return true;
 545
 546         pos = nla_data(attr);
 547         len = nla_len(attr);
 548
 549         while (len) {
 550                 u8 elemlen;
 551
 552                 if (len < 2)
 553                         return false;
 554                 len -= 2;
 555
 556                 elemlen = pos[1];
 557                 if (elemlen > len)
 558                         return false;
 559
 560                 len -= elemlen;
 561                 pos += 2 + elemlen;
 562         }
 563
 564         return true;
 565 }
 566
 567 /* message building helper */
 568 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 569                                    int flags, u8 cmd)
 570 {
 571         /* since there is no private header just add the generic one */
 572         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 573 }
 574
 575 static int nl80211_msg_put_channel(struct sk_buff *msg,
 576                                    struct ieee80211_channel *chan,
 577                                    bool large)
 578 {
 579         /* Some channels must be completely excluded from the
 580          * list to protect old user-space tools from breaking
 581          */
 582         if (!large && chan->flags &
 583             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 584                 return 0;
 585
 586         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 587                         chan->center_freq))
 588                 goto nla_put_failure;
 589
 590         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 591             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 592                 goto nla_put_failure;
 593         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 594                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 595                         goto nla_put_failure;
 596                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 597                         goto nla_put_failure;
 598         }
 599         if (chan->flags & IEEE80211_CHAN_RADAR) {
 600                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 601                         goto nla_put_failure;
 602                 if (large) {
 603                         u32 time;
 604
 605                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 606
 607                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 608                                         chan->dfs_state))
 609                                 goto nla_put_failure;
 610                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 611                                         time))
 612                                 goto nla_put_failure;
 613                         if (nla_put_u32(msg,
 614                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 615                                         chan->dfs_cac_ms))
 616                                 goto nla_put_failure;
 617                 }
 618         }
 619
 620         if (large) {
 621                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 622                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 623                         goto nla_put_failure;
 624                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 625                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 626                         goto nla_put_failure;
 627                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 628                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 629                         goto nla_put_failure;
 630                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 631                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 632                         goto nla_put_failure;
 633                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 634                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 635                         goto nla_put_failure;
 636                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 637                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 638                         goto nla_put_failure;
 639                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 640                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 641                         goto nla_put_failure;
 642                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 643                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 644                         goto nla_put_failure;
 645         }
 646
 647         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 648                         DBM_TO_MBM(chan->max_power)))
 649                 goto nla_put_failure;
 650
 651         return 0;
 652
 653  nla_put_failure:
 654         return -ENOBUFS;
 655 }
 656
 657 /* netlink command implementations */
 658
 659 struct key_parse {
 660         struct key_params p;
 661         int idx;
 662         int type;
 663         bool def, defmgmt;
 664         bool def_uni, def_multi;
 665 };
 666
 667 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 668 {
 669         struct nlattr *tb[NL80211_KEY_MAX + 1];
 670         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 671                                    nl80211_key_policy);
 672         if (err)
 673                 return err;
 674
 675         k->def = !!tb[NL80211_KEY_DEFAULT];
 676         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 677
 678         if (k->def) {
 679                 k->def_uni = true;
 680                 k->def_multi = true;
 681         }
 682         if (k->defmgmt)
 683                 k->def_multi = true;
 684
 685         if (tb[NL80211_KEY_IDX])
 686                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 687
 688         if (tb[NL80211_KEY_DATA]) {
 689                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 690                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 691         }
 692
 693         if (tb[NL80211_KEY_SEQ]) {
 694                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 695                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 696         }
 697
 698         if (tb[NL80211_KEY_CIPHER])
 699                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 700
 701         if (tb[NL80211_KEY_TYPE]) {
 702                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 703                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 704                         return -EINVAL;
 705         }
 706
 707         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 708                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 709                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 710                                        tb[NL80211_KEY_DEFAULT_TYPES],
 711                                        nl80211_key_default_policy);
 712                 if (err)
 713                         return err;
 714
 715                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 716                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 717         }
 718
 719         return 0;
 720 }
 721
 722 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 723 {
 724         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 725                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 726                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 727         }
 728
 729         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 730                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 731                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 732         }
 733
 734         if (info->attrs[NL80211_ATTR_KEY_IDX])
 735                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 736
 737         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 738                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 739
 740         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 741         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 742
 743         if (k->def) {
 744                 k->def_uni = true;
 745                 k->def_multi = true;
 746         }
 747         if (k->defmgmt)
 748                 k->def_multi = true;
 749
 750         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 751                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 752                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 753                         return -EINVAL;
 754         }
 755
 756         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 757                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 758                 int err = nla_parse_nested(
 759                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 760                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 761                                 nl80211_key_default_policy);
 762                 if (err)
 763                         return err;
 764
 765                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 766                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 767         }
 768
 769         return 0;
 770 }
 771
 772 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 773 {
 774         int err;
 775
 776         memset(k, 0, sizeof(*k));
 777         k->idx = -1;
 778         k->type = -1;
 779
 780         if (info->attrs[NL80211_ATTR_KEY])
 781                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 782         else
 783                 err = nl80211_parse_key_old(info, k);
 784
 785         if (err)
 786                 return err;
 787
 788         if (k->def && k->defmgmt)
 789                 return -EINVAL;
 790
 791         if (k->defmgmt) {
 792                 if (k->def_uni || !k->def_multi)
 793                         return -EINVAL;
 794         }
 795
 796         if (k->idx != -1) {
 797                 if (k->defmgmt) {
 798                         if (k->idx < 4 || k->idx > 5)
 799                                 return -EINVAL;
 800                 } else if (k->def) {
 801                         if (k->idx < 0 || k->idx > 3)
 802                                 return -EINVAL;
 803                 } else {
 804                         if (k->idx < 0 || k->idx > 5)
 805                                 return -EINVAL;
 806                 }
 807         }
 808
 809         return 0;
 810 }
 811
 812 static struct cfg80211_cached_keys *
 813 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 814                        struct nlattr *keys, bool *no_ht)
 815 {
 816         struct key_parse parse;
 817         struct nlattr *key;
 818         struct cfg80211_cached_keys *result;
 819         int rem, err, def = 0;
 820
 821         result = kzalloc(sizeof(*result), GFP_KERNEL);
 822         if (!result)
 823                 return ERR_PTR(-ENOMEM);
 824
 825         result->def = -1;
 826         result->defmgmt = -1;
 827
 828         nla_for_each_nested(key, keys, rem) {
 829                 memset(&parse, 0, sizeof(parse));
 830                 parse.idx = -1;
 831
 832                 err = nl80211_parse_key_new(key, &parse);
 833                 if (err)
 834                         goto error;
 835                 err = -EINVAL;
 836                 if (!parse.p.key)
 837                         goto error;
 838                 if (parse.idx < 0 || parse.idx > 4)
 839                         goto error;
 840                 if (parse.def) {
 841                         if (def)
 842                                 goto error;
 843                         def = 1;
 844                         result->def = parse.idx;
 845                         if (!parse.def_uni || !parse.def_multi)
 846                                 goto error;
 847                 } else if (parse.defmgmt)
 848                         goto error;
 849                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 850                                                      parse.idx, false, NULL);
 851                 if (err)
 852                         goto error;
 853                 result->params[parse.idx].cipher = parse.p.cipher;
 854                 result->params[parse.idx].key_len = parse.p.key_len;
 855                 result->params[parse.idx].key = result->data[parse.idx];
 856                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 857
 858                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 859                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 860                         if (no_ht)
 861                                 *no_ht = true;
 862                 }
 863         }
 864
 865         return result;
 866  error:
 867         kfree(result);
 868         return ERR_PTR(err);
 869 }
 870
 871 static int nl80211_key_allowed(struct wireless_dev *wdev)
 872 {
 873         ASSERT_WDEV_LOCK(wdev);
 874
 875         switch (wdev->iftype) {
 876         case NL80211_IFTYPE_AP:
 877         case NL80211_IFTYPE_AP_VLAN:
 878         case NL80211_IFTYPE_P2P_GO:
 879         case NL80211_IFTYPE_MESH_POINT:
 880                 break;
 881         case NL80211_IFTYPE_ADHOC:
 882         case NL80211_IFTYPE_STATION:
 883         case NL80211_IFTYPE_P2P_CLIENT:
 884                 if (!wdev->current_bss)
 885                         return -ENOLINK;
 886                 break;
 887         case NL80211_IFTYPE_UNSPECIFIED:
 888         case NL80211_IFTYPE_OCB:
 889         case NL80211_IFTYPE_MONITOR:
 890         case NL80211_IFTYPE_P2P_DEVICE:
 891         case NL80211_IFTYPE_WDS:
 892         case NUM_NL80211_IFTYPES:
 893                 return -EINVAL;
 894         }
 895
 896         return 0;
 897 }
 898
 899 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 900                                                         struct nlattr *tb)
 901 {
 902         struct ieee80211_channel *chan;
 903
 904         if (tb == NULL)
 905                 return NULL;
 906         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 907         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 908                 return NULL;
 909         return chan;
 910 }
 911
 912 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 913 {
 914         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 915         int i;
 916
 917         if (!nl_modes)
 918                 goto nla_put_failure;
 919
 920         i = 0;
 921         while (ifmodes) {
 922                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 923                         goto nla_put_failure;
 924                 ifmodes >>= 1;
 925                 i++;
 926         }
 927
 928         nla_nest_end(msg, nl_modes);
 929         return 0;
 930
 931 nla_put_failure:
 932         return -ENOBUFS;
 933 }
 934
 935 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 936                                           struct sk_buff *msg,
 937                                           bool large)
 938 {
 939         struct nlattr *nl_combis;
 940         int i, j;
 941
 942         nl_combis = nla_nest_start(msg,
 943                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 944         if (!nl_combis)
 945                 goto nla_put_failure;
 946
 947         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 948                 const struct ieee80211_iface_combination *c;
 949                 struct nlattr *nl_combi, *nl_limits;
 950
 951                 c = &wiphy->iface_combinations[i];
 952
 953                 nl_combi = nla_nest_start(msg, i + 1);
 954                 if (!nl_combi)
 955                         goto nla_put_failure;
 956
 957                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 958                 if (!nl_limits)
 959                         goto nla_put_failure;
 960
 961                 for (j = 0; j < c->n_limits; j++) {
 962                         struct nlattr *nl_limit;
 963
 964                         nl_limit = nla_nest_start(msg, j + 1);
 965                         if (!nl_limit)
 966                                 goto nla_put_failure;
 967                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 968                                         c->limits[j].max))
 969                                 goto nla_put_failure;
 970                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 971                                                 c->limits[j].types))
 972                                 goto nla_put_failure;
 973                         nla_nest_end(msg, nl_limit);
 974                 }
 975
 976                 nla_nest_end(msg, nl_limits);
 977
 978                 if (c->beacon_int_infra_match &&
 979                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 980                         goto nla_put_failure;
 981                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 982                                 c->num_different_channels) ||
 983                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 984                                 c->max_interfaces))
 985                         goto nla_put_failure;
 986                 if (large &&
 987                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 988                                 c->radar_detect_widths) ||
 989                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 990                                 c->radar_detect_regions)))
 991                         goto nla_put_failure;
 992
 993                 nla_nest_end(msg, nl_combi);
 994         }
 995
 996         nla_nest_end(msg, nl_combis);
 997
 998         return 0;
 999 nla_put_failure:
1000         return -ENOBUFS;
1001 }
1002
1003 #ifdef CONFIG_PM
1004 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1005                                         struct sk_buff *msg)
1006 {
1007         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1008         struct nlattr *nl_tcp;
1009
1010         if (!tcp)
1011                 return 0;
1012
1013         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1014         if (!nl_tcp)
1015                 return -ENOBUFS;
1016
1017         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1018                         tcp->data_payload_max))
1019                 return -ENOBUFS;
1020
1021         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1022                         tcp->data_payload_max))
1023                 return -ENOBUFS;
1024
1025         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1026                 return -ENOBUFS;
1027
1028         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1029                                 sizeof(*tcp->tok), tcp->tok))
1030                 return -ENOBUFS;
1031
1032         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1033                         tcp->data_interval_max))
1034                 return -ENOBUFS;
1035
1036         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1037                         tcp->wake_payload_max))
1038                 return -ENOBUFS;
1039
1040         nla_nest_end(msg, nl_tcp);
1041         return 0;
1042 }
1043
1044 static int nl80211_send_wowlan(struct sk_buff *msg,
1045                                struct cfg80211_registered_device *rdev,
1046                                bool large)
1047 {
1048         struct nlattr *nl_wowlan;
1049
1050         if (!rdev->wiphy.wowlan)
1051                 return 0;
1052
1053         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1054         if (!nl_wowlan)
1055                 return -ENOBUFS;
1056
1057         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1058              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1059             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1060              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1061             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1062              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1063             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1064              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1065             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1066              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1067             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1068              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1069             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1070              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1071             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1072              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1073                 return -ENOBUFS;
1074
1075         if (rdev->wiphy.wowlan->n_patterns) {
1076                 struct nl80211_pattern_support pat = {
1077                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1078                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1079                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1080                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1081                 };
1082
1083                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1084                             sizeof(pat), &pat))
1085                         return -ENOBUFS;
1086         }
1087
1088         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1089                 return -ENOBUFS;
1090
1091         nla_nest_end(msg, nl_wowlan);
1092
1093         return 0;
1094 }
1095 #endif
1096
1097 static int nl80211_send_coalesce(struct sk_buff *msg,
1098                                  struct cfg80211_registered_device *rdev)
1099 {
1100         struct nl80211_coalesce_rule_support rule;
1101
1102         if (!rdev->wiphy.coalesce)
1103                 return 0;
1104
1105         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1106         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1107         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1108         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1109         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1110         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1111
1112         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1113                 return -ENOBUFS;
1114
1115         return 0;
1116 }
1117
1118 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1119                                       struct ieee80211_supported_band *sband)
1120 {
1121         struct nlattr *nl_rates, *nl_rate;
1122         struct ieee80211_rate *rate;
1123         int i;
1124
1125         /* add HT info */
1126         if (sband->ht_cap.ht_supported &&
1127             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1128                      sizeof(sband->ht_cap.mcs),
1129                      &sband->ht_cap.mcs) ||
1130              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1131                          sband->ht_cap.cap) ||
1132              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1133                         sband->ht_cap.ampdu_factor) ||
1134              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1135                         sband->ht_cap.ampdu_density)))
1136                 return -ENOBUFS;
1137
1138         /* add VHT info */
1139         if (sband->vht_cap.vht_supported &&
1140             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1141                      sizeof(sband->vht_cap.vht_mcs),
1142                      &sband->vht_cap.vht_mcs) ||
1143              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1144                          sband->vht_cap.cap)))
1145                 return -ENOBUFS;
1146
1147         /* add bitrates */
1148         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1149         if (!nl_rates)
1150                 return -ENOBUFS;
1151
1152         for (i = 0; i < sband->n_bitrates; i++) {
1153                 nl_rate = nla_nest_start(msg, i);
1154                 if (!nl_rate)
1155                         return -ENOBUFS;
1156
1157                 rate = &sband->bitrates[i];
1158                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1159                                 rate->bitrate))
1160                         return -ENOBUFS;
1161                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1162                     nla_put_flag(msg,
1163                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1164                         return -ENOBUFS;
1165
1166                 nla_nest_end(msg, nl_rate);
1167         }
1168
1169         nla_nest_end(msg, nl_rates);
1170
1171         return 0;
1172 }
1173
1174 static int
1175 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1176                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1177 {
1178         u16 stypes;
1179         struct nlattr *nl_ftypes, *nl_ifs;
1180         enum nl80211_iftype ift;
1181         int i;
1182
1183         if (!mgmt_stypes)
1184                 return 0;
1185
1186         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1187         if (!nl_ifs)
1188                 return -ENOBUFS;
1189
1190         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1191                 nl_ftypes = nla_nest_start(msg, ift);
1192                 if (!nl_ftypes)
1193                         return -ENOBUFS;
1194                 i = 0;
1195                 stypes = mgmt_stypes[ift].tx;
1196                 while (stypes) {
1197                         if ((stypes & 1) &&
1198                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1199                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1200                                 return -ENOBUFS;
1201                         stypes >>= 1;
1202                         i++;
1203                 }
1204                 nla_nest_end(msg, nl_ftypes);
1205         }
1206
1207         nla_nest_end(msg, nl_ifs);
1208
1209         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1210         if (!nl_ifs)
1211                 return -ENOBUFS;
1212
1213         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1214                 nl_ftypes = nla_nest_start(msg, ift);
1215                 if (!nl_ftypes)
1216                         return -ENOBUFS;
1217                 i = 0;
1218                 stypes = mgmt_stypes[ift].rx;
1219                 while (stypes) {
1220                         if ((stypes & 1) &&
1221                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1222                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1223                                 return -ENOBUFS;
1224                         stypes >>= 1;
1225                         i++;
1226                 }
1227                 nla_nest_end(msg, nl_ftypes);
1228         }
1229         nla_nest_end(msg, nl_ifs);
1230
1231         return 0;
1232 }
1233
1234 struct nl80211_dump_wiphy_state {
1235         s64 filter_wiphy;
1236         long start;
1237         long split_start, band_start, chan_start;
1238         bool split;
1239 };
1240
1241 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1242                               enum nl80211_commands cmd,
1243                               struct sk_buff *msg, u32 portid, u32 seq,
1244                               int flags, struct nl80211_dump_wiphy_state *state)
1245 {
1246         void *hdr;
1247         struct nlattr *nl_bands, *nl_band;
1248         struct nlattr *nl_freqs, *nl_freq;
1249         struct nlattr *nl_cmds;
1250         enum ieee80211_band band;
1251         struct ieee80211_channel *chan;
1252         int i;
1253         const struct ieee80211_txrx_stypes *mgmt_stypes =
1254                                 rdev->wiphy.mgmt_stypes;
1255         u32 features;
1256
1257         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1258         if (!hdr)
1259                 return -ENOBUFS;
1260
1261         if (WARN_ON(!state))
1262                 return -EINVAL;
1263
1264         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1265             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1266                            wiphy_name(&rdev->wiphy)) ||
1267             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1268                         cfg80211_rdev_list_generation))
1269                 goto nla_put_failure;
1270
1271         if (cmd != NL80211_CMD_NEW_WIPHY)
1272                 goto finish;
1273
1274         switch (state->split_start) {
1275         case 0:
1276                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1277                                rdev->wiphy.retry_short) ||
1278                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1279                                rdev->wiphy.retry_long) ||
1280                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1281                                 rdev->wiphy.frag_threshold) ||
1282                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1283                                 rdev->wiphy.rts_threshold) ||
1284                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1285                                rdev->wiphy.coverage_class) ||
1286                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1287                                rdev->wiphy.max_scan_ssids) ||
1288                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1289                                rdev->wiphy.max_sched_scan_ssids) ||
1290                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1291                                 rdev->wiphy.max_scan_ie_len) ||
1292                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1293                                 rdev->wiphy.max_sched_scan_ie_len) ||
1294                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1295                                rdev->wiphy.max_match_sets))
1296                         goto nla_put_failure;
1297
1298                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1299                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1300                         goto nla_put_failure;
1301                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1302                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1303                         goto nla_put_failure;
1304                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1305                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1306                         goto nla_put_failure;
1307                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1308                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1309                         goto nla_put_failure;
1310                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1311                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1312                         goto nla_put_failure;
1313                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1314                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1315                         goto nla_put_failure;
1316                 state->split_start++;
1317                 if (state->split)
1318                         break;
1319         case 1:
1320                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1321                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1322                             rdev->wiphy.cipher_suites))
1323                         goto nla_put_failure;
1324
1325                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1326                                rdev->wiphy.max_num_pmkids))
1327                         goto nla_put_failure;
1328
1329                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1330                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1331                         goto nla_put_failure;
1332
1333                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1334                                 rdev->wiphy.available_antennas_tx) ||
1335                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1336                                 rdev->wiphy.available_antennas_rx))
1337                         goto nla_put_failure;
1338
1339                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1340                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1341                                 rdev->wiphy.probe_resp_offload))
1342                         goto nla_put_failure;
1343
1344                 if ((rdev->wiphy.available_antennas_tx ||
1345                      rdev->wiphy.available_antennas_rx) &&
1346                     rdev->ops->get_antenna) {
1347                         u32 tx_ant = 0, rx_ant = 0;
1348                         int res;
1349                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1350                         if (!res) {
1351                                 if (nla_put_u32(msg,
1352                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1353                                                 tx_ant) ||
1354                                     nla_put_u32(msg,
1355                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1356                                                 rx_ant))
1357                                         goto nla_put_failure;
1358                         }
1359                 }
1360
1361                 state->split_start++;
1362                 if (state->split)
1363                         break;
1364         case 2:
1365                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1366                                         rdev->wiphy.interface_modes))
1367                                 goto nla_put_failure;
1368                 state->split_start++;
1369                 if (state->split)
1370                         break;
1371         case 3:
1372                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1373                 if (!nl_bands)
1374                         goto nla_put_failure;
1375
1376                 for (band = state->band_start;
1377                      band < IEEE80211_NUM_BANDS; band++) {
1378                         struct ieee80211_supported_band *sband;
1379
1380                         sband = rdev->wiphy.bands[band];
1381
1382                         if (!sband)
1383                                 continue;
1384
1385                         nl_band = nla_nest_start(msg, band);
1386                         if (!nl_band)
1387                                 goto nla_put_failure;
1388
1389                         switch (state->chan_start) {
1390                         case 0:
1391                                 if (nl80211_send_band_rateinfo(msg, sband))
1392                                         goto nla_put_failure;
1393                                 state->chan_start++;
1394                                 if (state->split)
1395                                         break;
1396                         default:
1397                                 /* add frequencies */
1398                                 nl_freqs = nla_nest_start(
1399                                         msg, NL80211_BAND_ATTR_FREQS);
1400                                 if (!nl_freqs)
1401                                         goto nla_put_failure;
1402
1403                                 for (i = state->chan_start - 1;
1404                                      i < sband->n_channels;
1405                                      i++) {
1406                                         nl_freq = nla_nest_start(msg, i);
1407                                         if (!nl_freq)
1408                                                 goto nla_put_failure;
1409
1410                                         chan = &sband->channels[i];
1411
1412                                         if (nl80211_msg_put_channel(
1413                                                         msg, chan,
1414                                                         state->split))
1415                                                 goto nla_put_failure;
1416
1417                                         nla_nest_end(msg, nl_freq);
1418                                         if (state->split)
1419                                                 break;
1420                                 }
1421                                 if (i < sband->n_channels)
1422                                         state->chan_start = i + 2;
1423                                 else
1424                                         state->chan_start = 0;
1425                                 nla_nest_end(msg, nl_freqs);
1426                         }
1427
1428                         nla_nest_end(msg, nl_band);
1429
1430                         if (state->split) {
1431                                 /* start again here */
1432                                 if (state->chan_start)
1433                                         band--;
1434                                 break;
1435                         }
1436                 }
1437                 nla_nest_end(msg, nl_bands);
1438
1439                 if (band < IEEE80211_NUM_BANDS)
1440                         state->band_start = band + 1;
1441                 else
1442                         state->band_start = 0;
1443
1444                 /* if bands & channels are done, continue outside */
1445                 if (state->band_start == 0 && state->chan_start == 0)
1446                         state->split_start++;
1447                 if (state->split)
1448                         break;
1449         case 4:
1450                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1451                 if (!nl_cmds)
1452                         goto nla_put_failure;
1453
1454                 i = 0;
1455 #define CMD(op, n)                                                      \
1456                  do {                                                   \
1457                         if (rdev->ops->op) {                            \
1458                                 i++;                                    \
1459                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1460                                         goto nla_put_failure;           \
1461                         }                                               \
1462                 } while (0)
1463
1464                 CMD(add_virtual_intf, NEW_INTERFACE);
1465                 CMD(change_virtual_intf, SET_INTERFACE);
1466                 CMD(add_key, NEW_KEY);
1467                 CMD(start_ap, START_AP);
1468                 CMD(add_station, NEW_STATION);
1469                 CMD(add_mpath, NEW_MPATH);
1470                 CMD(update_mesh_config, SET_MESH_CONFIG);
1471                 CMD(change_bss, SET_BSS);
1472                 CMD(auth, AUTHENTICATE);
1473                 CMD(assoc, ASSOCIATE);
1474                 CMD(deauth, DEAUTHENTICATE);
1475                 CMD(disassoc, DISASSOCIATE);
1476                 CMD(join_ibss, JOIN_IBSS);
1477                 CMD(join_mesh, JOIN_MESH);
1478                 CMD(set_pmksa, SET_PMKSA);
1479                 CMD(del_pmksa, DEL_PMKSA);
1480                 CMD(flush_pmksa, FLUSH_PMKSA);
1481                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1482                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1483                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1484                 CMD(mgmt_tx, FRAME);
1485                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1486                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1487                         i++;
1488                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1489                                 goto nla_put_failure;
1490                 }
1491                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1492                     rdev->ops->join_mesh) {
1493                         i++;
1494                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1495                                 goto nla_put_failure;
1496                 }
1497                 CMD(set_wds_peer, SET_WDS_PEER);
1498                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1499                         CMD(tdls_mgmt, TDLS_MGMT);
1500                         CMD(tdls_oper, TDLS_OPER);
1501                 }
1502                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1503                         CMD(sched_scan_start, START_SCHED_SCAN);
1504                 CMD(probe_client, PROBE_CLIENT);
1505                 CMD(set_noack_map, SET_NOACK_MAP);
1506                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1507                         i++;
1508                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1509                                 goto nla_put_failure;
1510                 }
1511                 CMD(start_p2p_device, START_P2P_DEVICE);
1512                 CMD(set_mcast_rate, SET_MCAST_RATE);
1513 #ifdef CONFIG_NL80211_TESTMODE
1514                 CMD(testmode_cmd, TESTMODE);
1515 #endif
1516                 if (state->split) {
1517                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1518                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1519                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1520                                 CMD(channel_switch, CHANNEL_SWITCH);
1521                         CMD(set_qos_map, SET_QOS_MAP);
1522                         if (rdev->wiphy.features &
1523                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1524                                 CMD(add_tx_ts, ADD_TX_TS);
1525                 }
1526                 /* add into the if now */
1527 #undef CMD
1528
1529                 if (rdev->ops->connect || rdev->ops->auth) {
1530                         i++;
1531                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1532                                 goto nla_put_failure;
1533                 }
1534
1535                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1536                         i++;
1537                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1538                                 goto nla_put_failure;
1539                 }
1540
1541                 nla_nest_end(msg, nl_cmds);
1542                 state->split_start++;
1543                 if (state->split)
1544                         break;
1545         case 5:
1546                 if (rdev->ops->remain_on_channel &&
1547                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1548                     nla_put_u32(msg,
1549                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1550                                 rdev->wiphy.max_remain_on_channel_duration))
1551                         goto nla_put_failure;
1552
1553                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1554                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1555                         goto nla_put_failure;
1556
1557                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1558                         goto nla_put_failure;
1559                 state->split_start++;
1560                 if (state->split)
1561                         break;
1562         case 6:
1563 #ifdef CONFIG_PM
1564                 if (nl80211_send_wowlan(msg, rdev, state->split))
1565                         goto nla_put_failure;
1566                 state->split_start++;
1567                 if (state->split)
1568                         break;
1569 #else
1570                 state->split_start++;
1571 #endif
1572         case 7:
1573                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1574                                         rdev->wiphy.software_iftypes))
1575                         goto nla_put_failure;
1576
1577                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1578                                                    state->split))
1579                         goto nla_put_failure;
1580
1581                 state->split_start++;
1582                 if (state->split)
1583                         break;
1584         case 8:
1585                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1586                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1587                                 rdev->wiphy.ap_sme_capa))
1588                         goto nla_put_failure;
1589
1590                 features = rdev->wiphy.features;
1591                 /*
1592                  * We can only add the per-channel limit information if the
1593                  * dump is split, otherwise it makes it too big. Therefore
1594                  * only advertise it in that case.
1595                  */
1596                 if (state->split)
1597                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1598                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1599                         goto nla_put_failure;
1600
1601                 if (rdev->wiphy.ht_capa_mod_mask &&
1602                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1603                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1604                             rdev->wiphy.ht_capa_mod_mask))
1605                         goto nla_put_failure;
1606
1607                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1608                     rdev->wiphy.max_acl_mac_addrs &&
1609                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1610                                 rdev->wiphy.max_acl_mac_addrs))
1611                         goto nla_put_failure;
1612
1613                 /*
1614                  * Any information below this point is only available to
1615                  * applications that can deal with it being split. This
1616                  * helps ensure that newly added capabilities don't break
1617                  * older tools by overrunning their buffers.
1618                  *
1619                  * We still increment split_start so that in the split
1620                  * case we'll continue with more data in the next round,
1621                  * but break unconditionally so unsplit data stops here.
1622                  */
1623                 state->split_start++;
1624                 break;
1625         case 9:
1626                 if (rdev->wiphy.extended_capabilities &&
1627                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1628                              rdev->wiphy.extended_capabilities_len,
1629                              rdev->wiphy.extended_capabilities) ||
1630                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1631                              rdev->wiphy.extended_capabilities_len,
1632                              rdev->wiphy.extended_capabilities_mask)))
1633                         goto nla_put_failure;
1634
1635                 if (rdev->wiphy.vht_capa_mod_mask &&
1636                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1637                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1638                             rdev->wiphy.vht_capa_mod_mask))
1639                         goto nla_put_failure;
1640
1641                 state->split_start++;
1642                 break;
1643         case 10:
1644                 if (nl80211_send_coalesce(msg, rdev))
1645                         goto nla_put_failure;
1646
1647                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1648                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1649                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1650                         goto nla_put_failure;
1651
1652                 if (rdev->wiphy.max_ap_assoc_sta &&
1653                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1654                                 rdev->wiphy.max_ap_assoc_sta))
1655                         goto nla_put_failure;
1656
1657                 state->split_start++;
1658                 break;
1659         case 11:
1660                 if (rdev->wiphy.n_vendor_commands) {
1661                         const struct nl80211_vendor_cmd_info *info;
1662                         struct nlattr *nested;
1663
1664                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1665                         if (!nested)
1666                                 goto nla_put_failure;
1667
1668                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1669                                 info = &rdev->wiphy.vendor_commands[i].info;
1670                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1671                                         goto nla_put_failure;
1672                         }
1673                         nla_nest_end(msg, nested);
1674                 }
1675
1676                 if (rdev->wiphy.n_vendor_events) {
1677                         const struct nl80211_vendor_cmd_info *info;
1678                         struct nlattr *nested;
1679
1680                         nested = nla_nest_start(msg,
1681                                                 NL80211_ATTR_VENDOR_EVENTS);
1682                         if (!nested)
1683                                 goto nla_put_failure;
1684
1685                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1686                                 info = &rdev->wiphy.vendor_events[i];
1687                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1688                                         goto nla_put_failure;
1689                         }
1690                         nla_nest_end(msg, nested);
1691                 }
1692                 state->split_start++;
1693                 break;
1694         case 12:
1695                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1696                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1697                                rdev->wiphy.max_num_csa_counters))
1698                         goto nla_put_failure;
1699
1700                 /* done */
1701                 state->split_start = 0;
1702                 break;
1703         }
1704  finish:
1705         return genlmsg_end(msg, hdr);
1706
1707  nla_put_failure:
1708         genlmsg_cancel(msg, hdr);
1709         return -EMSGSIZE;
1710 }
1711
1712 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1713                                     struct netlink_callback *cb,
1714                                     struct nl80211_dump_wiphy_state *state)
1715 {
1716         struct nlattr **tb = nl80211_fam.attrbuf;
1717         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1718                               tb, nl80211_fam.maxattr, nl80211_policy);
1719         /* ignore parse errors for backward compatibility */
1720         if (ret)
1721                 return 0;
1722
1723         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1724         if (tb[NL80211_ATTR_WIPHY])
1725                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1726         if (tb[NL80211_ATTR_WDEV])
1727                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1728         if (tb[NL80211_ATTR_IFINDEX]) {
1729                 struct net_device *netdev;
1730                 struct cfg80211_registered_device *rdev;
1731                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1732
1733                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1734                 if (!netdev)
1735                         return -ENODEV;
1736                 if (netdev->ieee80211_ptr) {
1737                         rdev = wiphy_to_rdev(
1738                                 netdev->ieee80211_ptr->wiphy);
1739                         state->filter_wiphy = rdev->wiphy_idx;
1740                 }
1741         }
1742
1743         return 0;
1744 }
1745
1746 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1747 {
1748         int idx = 0, ret;
1749         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1750         struct cfg80211_registered_device *rdev;
1751
1752         rtnl_lock();
1753         if (!state) {
1754                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1755                 if (!state) {
1756                         rtnl_unlock();
1757                         return -ENOMEM;
1758                 }
1759                 state->filter_wiphy = -1;
1760                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1761                 if (ret) {
1762                         kfree(state);
1763                         rtnl_unlock();
1764                         return ret;
1765                 }
1766                 cb->args[0] = (long)state;
1767         }
1768
1769         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1770                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1771                         continue;
1772                 if (++idx <= state->start)
1773                         continue;
1774                 if (state->filter_wiphy != -1 &&
1775                     state->filter_wiphy != rdev->wiphy_idx)
1776                         continue;
1777                 /* attempt to fit multiple wiphy data chunks into the skb */
1778                 do {
1779                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1780                                                  skb,
1781                                                  NETLINK_CB(cb->skb).portid,
1782                                                  cb->nlh->nlmsg_seq,
1783                                                  NLM_F_MULTI, state);
1784                         if (ret < 0) {
1785                                 /*
1786                                  * If sending the wiphy data didn't fit (ENOBUFS
1787                                  * or EMSGSIZE returned), this SKB is still
1788                                  * empty (so it's not too big because another
1789                                  * wiphy dataset is already in the skb) and
1790                                  * we've not tried to adjust the dump allocation
1791                                  * yet ... then adjust the alloc size to be
1792                                  * bigger, and return 1 but with the empty skb.
1793                                  * This results in an empty message being RX'ed
1794                                  * in userspace, but that is ignored.
1795                                  *
1796                                  * We can then retry with the larger buffer.
1797                                  */
1798                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1799                                     !skb->len && !state->split &&
1800                                     cb->min_dump_alloc < 4096) {
1801                                         cb->min_dump_alloc = 4096;
1802                                         state->split_start = 0;
1803                                         rtnl_unlock();
1804                                         return 1;
1805                                 }
1806                                 idx--;
1807                                 break;
1808                         }
1809                 } while (state->split_start > 0);
1810                 break;
1811         }
1812         rtnl_unlock();
1813
1814         state->start = idx;
1815
1816         return skb->len;
1817 }
1818
1819 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1820 {
1821         kfree((void *)cb->args[0]);
1822         return 0;
1823 }
1824
1825 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1826 {
1827         struct sk_buff *msg;
1828         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1829         struct nl80211_dump_wiphy_state state = {};
1830
1831         msg = nlmsg_new(4096, GFP_KERNEL);
1832         if (!msg)
1833                 return -ENOMEM;
1834
1835         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1836                                info->snd_portid, info->snd_seq, 0,
1837                                &state) < 0) {
1838                 nlmsg_free(msg);
1839                 return -ENOBUFS;
1840         }
1841
1842         return genlmsg_reply(msg, info);
1843 }
1844
1845 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1846         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1847         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1848         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1849         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1850         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1851 };
1852
1853 static int parse_txq_params(struct nlattr *tb[],
1854                             struct ieee80211_txq_params *txq_params)
1855 {
1856         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1857             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1858             !tb[NL80211_TXQ_ATTR_AIFS])
1859                 return -EINVAL;
1860
1861         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1862         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1863         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1864         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1865         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1866
1867         if (txq_params->ac >= NL80211_NUM_ACS)
1868                 return -EINVAL;
1869
1870         return 0;
1871 }
1872
1873 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1874 {
1875         /*
1876          * You can only set the channel explicitly for WDS interfaces,
1877          * all others have their channel managed via their respective
1878          * "establish a connection" command (connect, join, ...)
1879          *
1880          * For AP/GO and mesh mode, the channel can be set with the
1881          * channel userspace API, but is only stored and passed to the
1882          * low-level driver when the AP starts or the mesh is joined.
1883          * This is for backward compatibility, userspace can also give
1884          * the channel in the start-ap or join-mesh commands instead.
1885          *
1886          * Monitors are special as they are normally slaved to
1887          * whatever else is going on, so they have their own special
1888          * operation to set the monitor channel if possible.
1889          */
1890         return !wdev ||
1891                 wdev->iftype == NL80211_IFTYPE_AP ||
1892                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1893                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1894                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1895 }
1896
1897 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1898                                  struct genl_info *info,
1899                                  struct cfg80211_chan_def *chandef)
1900 {
1901         u32 control_freq;
1902
1903         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1904                 return -EINVAL;
1905
1906         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1907
1908         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1909         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1910         chandef->center_freq1 = control_freq;
1911         chandef->center_freq2 = 0;
1912
1913         /* Primary channel not allowed */
1914         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1915                 return -EINVAL;
1916
1917         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1918                 enum nl80211_channel_type chantype;
1919
1920                 chantype = nla_get_u32(
1921                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1922
1923                 switch (chantype) {
1924                 case NL80211_CHAN_NO_HT:
1925                 case NL80211_CHAN_HT20:
1926                 case NL80211_CHAN_HT40PLUS:
1927                 case NL80211_CHAN_HT40MINUS:
1928                         cfg80211_chandef_create(chandef, chandef->chan,
1929                                                 chantype);
1930                         break;
1931                 default:
1932                         return -EINVAL;
1933                 }
1934         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1935                 chandef->width =
1936                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1937                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1938                         chandef->center_freq1 =
1939                                 nla_get_u32(
1940                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1941                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1942                         chandef->center_freq2 =
1943                                 nla_get_u32(
1944                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1945         }
1946
1947         if (!cfg80211_chandef_valid(chandef))
1948                 return -EINVAL;
1949
1950         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1951                                      IEEE80211_CHAN_DISABLED))
1952                 return -EINVAL;
1953
1954         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1955              chandef->width == NL80211_CHAN_WIDTH_10) &&
1956             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1957                 return -EINVAL;
1958
1959         return 0;
1960 }
1961
1962 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1963                                  struct net_device *dev,
1964                                  struct genl_info *info)
1965 {
1966         struct cfg80211_chan_def chandef;
1967         int result;
1968         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1969         struct wireless_dev *wdev = NULL;
1970
1971         if (dev)
1972                 wdev = dev->ieee80211_ptr;
1973         if (!nl80211_can_set_dev_channel(wdev))
1974                 return -EOPNOTSUPP;
1975         if (wdev)
1976                 iftype = wdev->iftype;
1977
1978         result = nl80211_parse_chandef(rdev, info, &chandef);
1979         if (result)
1980                 return result;
1981
1982         switch (iftype) {
1983         case NL80211_IFTYPE_AP:
1984         case NL80211_IFTYPE_P2P_GO:
1985                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1986                         result = -EINVAL;
1987                         break;
1988                 }
1989                 if (wdev->beacon_interval) {
1990                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1991                             !(rdev->wiphy.features &
1992                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1993                                 result = -EBUSY;
1994                                 break;
1995                         }
1996
1997                         /* Only allow dynamic channel width changes */
1998                         if (chandef.chan != wdev->preset_chandef.chan) {
1999                                 result = -EBUSY;
2000                                 break;
2001                         }
2002                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2003                         if (result)
2004                                 break;
2005                 }
2006                 wdev->preset_chandef = chandef;
2007                 result = 0;
2008                 break;
2009         case NL80211_IFTYPE_MESH_POINT:
2010                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2011                 break;
2012         case NL80211_IFTYPE_MONITOR:
2013                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2014                 break;
2015         default:
2016                 result = -EINVAL;
2017         }
2018
2019         return result;
2020 }
2021
2022 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2023 {
2024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2025         struct net_device *netdev = info->user_ptr[1];
2026
2027         return __nl80211_set_channel(rdev, netdev, info);
2028 }
2029
2030 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2031 {
2032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2033         struct net_device *dev = info->user_ptr[1];
2034         struct wireless_dev *wdev = dev->ieee80211_ptr;
2035         const u8 *bssid;
2036
2037         if (!info->attrs[NL80211_ATTR_MAC])
2038                 return -EINVAL;
2039
2040         if (netif_running(dev))
2041                 return -EBUSY;
2042
2043         if (!rdev->ops->set_wds_peer)
2044                 return -EOPNOTSUPP;
2045
2046         if (wdev->iftype != NL80211_IFTYPE_WDS)
2047                 return -EOPNOTSUPP;
2048
2049         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2050         return rdev_set_wds_peer(rdev, dev, bssid);
2051 }
2052
2053
2054 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2055 {
2056         struct cfg80211_registered_device *rdev;
2057         struct net_device *netdev = NULL;
2058         struct wireless_dev *wdev;
2059         int result = 0, rem_txq_params = 0;
2060         struct nlattr *nl_txq_params;
2061         u32 changed;
2062         u8 retry_short = 0, retry_long = 0;
2063         u32 frag_threshold = 0, rts_threshold = 0;
2064         u8 coverage_class = 0;
2065
2066         ASSERT_RTNL();
2067
2068         /*
2069          * Try to find the wiphy and netdev. Normally this
2070          * function shouldn't need the netdev, but this is
2071          * done for backward compatibility -- previously
2072          * setting the channel was done per wiphy, but now
2073          * it is per netdev. Previous userland like hostapd
2074          * also passed a netdev to set_wiphy, so that it is
2075          * possible to let that go to the right netdev!
2076          */
2077
2078         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2079                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2080
2081                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2082                 if (netdev && netdev->ieee80211_ptr)
2083                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2084                 else
2085                         netdev = NULL;
2086         }
2087
2088         if (!netdev) {
2089                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2090                                                   info->attrs);
2091                 if (IS_ERR(rdev))
2092                         return PTR_ERR(rdev);
2093                 wdev = NULL;
2094                 netdev = NULL;
2095                 result = 0;
2096         } else
2097                 wdev = netdev->ieee80211_ptr;
2098
2099         /*
2100          * end workaround code, by now the rdev is available
2101          * and locked, and wdev may or may not be NULL.
2102          */
2103
2104         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2105                 result = cfg80211_dev_rename(
2106                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2107
2108         if (result)
2109                 return result;
2110
2111         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2112                 struct ieee80211_txq_params txq_params;
2113                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2114
2115                 if (!rdev->ops->set_txq_params)
2116                         return -EOPNOTSUPP;
2117
2118                 if (!netdev)
2119                         return -EINVAL;
2120
2121                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2122                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2123                         return -EINVAL;
2124
2125                 if (!netif_running(netdev))
2126                         return -ENETDOWN;
2127
2128                 nla_for_each_nested(nl_txq_params,
2129                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2130                                     rem_txq_params) {
2131                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2132                                            nla_data(nl_txq_params),
2133                                            nla_len(nl_txq_params),
2134                                            txq_params_policy);
2135                         if (result)
2136                                 return result;
2137                         result = parse_txq_params(tb, &txq_params);
2138                         if (result)
2139                                 return result;
2140
2141                         result = rdev_set_txq_params(rdev, netdev,
2142                                                      &txq_params);
2143                         if (result)
2144                                 return result;
2145                 }
2146         }
2147
2148         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2149                 result = __nl80211_set_channel(
2150                         rdev,
2151                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2152                         info);
2153                 if (result)
2154                         return result;
2155         }
2156
2157         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2158                 struct wireless_dev *txp_wdev = wdev;
2159                 enum nl80211_tx_power_setting type;
2160                 int idx, mbm = 0;
2161
2162                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2163                         txp_wdev = NULL;
2164
2165                 if (!rdev->ops->set_tx_power)
2166                         return -EOPNOTSUPP;
2167
2168                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2169                 type = nla_get_u32(info->attrs[idx]);
2170
2171                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2172                     (type != NL80211_TX_POWER_AUTOMATIC))
2173                         return -EINVAL;
2174
2175                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2176                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2177                         mbm = nla_get_u32(info->attrs[idx]);
2178                 }
2179
2180                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2181                 if (result)
2182                         return result;
2183         }
2184
2185         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2186             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2187                 u32 tx_ant, rx_ant;
2188                 if ((!rdev->wiphy.available_antennas_tx &&
2189                      !rdev->wiphy.available_antennas_rx) ||
2190                     !rdev->ops->set_antenna)
2191                         return -EOPNOTSUPP;
2192
2193                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2194                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2195
2196                 /* reject antenna configurations which don't match the
2197                  * available antenna masks, except for the "all" mask */
2198                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2199                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2200                         return -EINVAL;
2201
2202                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2203                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2204
2205                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2206                 if (result)
2207                         return result;
2208         }
2209
2210         changed = 0;
2211
2212         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2213                 retry_short = nla_get_u8(
2214                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2215                 if (retry_short == 0)
2216                         return -EINVAL;
2217
2218                 changed |= WIPHY_PARAM_RETRY_SHORT;
2219         }
2220
2221         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2222                 retry_long = nla_get_u8(
2223                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2224                 if (retry_long == 0)
2225                         return -EINVAL;
2226
2227                 changed |= WIPHY_PARAM_RETRY_LONG;
2228         }
2229
2230         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2231                 frag_threshold = nla_get_u32(
2232                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2233                 if (frag_threshold < 256)
2234                         return -EINVAL;
2235
2236                 if (frag_threshold != (u32) -1) {
2237                         /*
2238                          * Fragments (apart from the last one) are required to
2239                          * have even length. Make the fragmentation code
2240                          * simpler by stripping LSB should someone try to use
2241                          * odd threshold value.
2242                          */
2243                         frag_threshold &= ~0x1;
2244                 }
2245                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2246         }
2247
2248         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2249                 rts_threshold = nla_get_u32(
2250                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2251                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2252         }
2253
2254         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2255                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2256                         return -EINVAL;
2257
2258                 coverage_class = nla_get_u8(
2259                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2260                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2261         }
2262
2263         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2264                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2265                         return -EOPNOTSUPP;
2266
2267                 changed |= WIPHY_PARAM_DYN_ACK;
2268         }
2269
2270         if (changed) {
2271                 u8 old_retry_short, old_retry_long;
2272                 u32 old_frag_threshold, old_rts_threshold;
2273                 u8 old_coverage_class;
2274
2275                 if (!rdev->ops->set_wiphy_params)
2276                         return -EOPNOTSUPP;
2277
2278                 old_retry_short = rdev->wiphy.retry_short;
2279                 old_retry_long = rdev->wiphy.retry_long;
2280                 old_frag_threshold = rdev->wiphy.frag_threshold;
2281                 old_rts_threshold = rdev->wiphy.rts_threshold;
2282                 old_coverage_class = rdev->wiphy.coverage_class;
2283
2284                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2285                         rdev->wiphy.retry_short = retry_short;
2286                 if (changed & WIPHY_PARAM_RETRY_LONG)
2287                         rdev->wiphy.retry_long = retry_long;
2288                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2289                         rdev->wiphy.frag_threshold = frag_threshold;
2290                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2291                         rdev->wiphy.rts_threshold = rts_threshold;
2292                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2293                         rdev->wiphy.coverage_class = coverage_class;
2294
2295                 result = rdev_set_wiphy_params(rdev, changed);
2296                 if (result) {
2297                         rdev->wiphy.retry_short = old_retry_short;
2298                         rdev->wiphy.retry_long = old_retry_long;
2299                         rdev->wiphy.frag_threshold = old_frag_threshold;
2300                         rdev->wiphy.rts_threshold = old_rts_threshold;
2301                         rdev->wiphy.coverage_class = old_coverage_class;
2302                 }
2303         }
2304         return 0;
2305 }
2306
2307 static inline u64 wdev_id(struct wireless_dev *wdev)
2308 {
2309         return (u64)wdev->identifier |
2310                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2311 }
2312
2313 static int nl80211_send_chandef(struct sk_buff *msg,
2314                                 const struct cfg80211_chan_def *chandef)
2315 {
2316         WARN_ON(!cfg80211_chandef_valid(chandef));
2317
2318         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2319                         chandef->chan->center_freq))
2320                 return -ENOBUFS;
2321         switch (chandef->width) {
2322         case NL80211_CHAN_WIDTH_20_NOHT:
2323         case NL80211_CHAN_WIDTH_20:
2324         case NL80211_CHAN_WIDTH_40:
2325                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2326                                 cfg80211_get_chandef_type(chandef)))
2327                         return -ENOBUFS;
2328                 break;
2329         default:
2330                 break;
2331         }
2332         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2333                 return -ENOBUFS;
2334         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2335                 return -ENOBUFS;
2336         if (chandef->center_freq2 &&
2337             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2338                 return -ENOBUFS;
2339         return 0;
2340 }
2341
2342 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2343                               struct cfg80211_registered_device *rdev,
2344                               struct wireless_dev *wdev)
2345 {
2346         struct net_device *dev = wdev->netdev;
2347         void *hdr;
2348
2349         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2350         if (!hdr)
2351                 return -1;
2352
2353         if (dev &&
2354             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2355              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2356                 goto nla_put_failure;
2357
2358         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2359             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2360             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2361             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2362             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2363                         rdev->devlist_generation ^
2364                         (cfg80211_rdev_list_generation << 2)))
2365                 goto nla_put_failure;
2366
2367         if (rdev->ops->get_channel) {
2368                 int ret;
2369                 struct cfg80211_chan_def chandef;
2370
2371                 ret = rdev_get_channel(rdev, wdev, &chandef);
2372                 if (ret == 0) {
2373                         if (nl80211_send_chandef(msg, &chandef))
2374                                 goto nla_put_failure;
2375                 }
2376         }
2377
2378         if (wdev->ssid_len) {
2379                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2380                         goto nla_put_failure;
2381         }
2382
2383         return genlmsg_end(msg, hdr);
2384
2385  nla_put_failure:
2386         genlmsg_cancel(msg, hdr);
2387         return -EMSGSIZE;
2388 }
2389
2390 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2391 {
2392         int wp_idx = 0;
2393         int if_idx = 0;
2394         int wp_start = cb->args[0];
2395         int if_start = cb->args[1];
2396         struct cfg80211_registered_device *rdev;
2397         struct wireless_dev *wdev;
2398
2399         rtnl_lock();
2400         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2401                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2402                         continue;
2403                 if (wp_idx < wp_start) {
2404                         wp_idx++;
2405                         continue;
2406                 }
2407                 if_idx = 0;
2408
2409                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2410                         if (if_idx < if_start) {
2411                                 if_idx++;
2412                                 continue;
2413                         }
2414                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2415                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2416                                                rdev, wdev) < 0) {
2417                                 goto out;
2418                         }
2419                         if_idx++;
2420                 }
2421
2422                 wp_idx++;
2423         }
2424  out:
2425         rtnl_unlock();
2426
2427         cb->args[0] = wp_idx;
2428         cb->args[1] = if_idx;
2429
2430         return skb->len;
2431 }
2432
2433 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2434 {
2435         struct sk_buff *msg;
2436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2437         struct wireless_dev *wdev = info->user_ptr[1];
2438
2439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2440         if (!msg)
2441                 return -ENOMEM;
2442
2443         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2444                                rdev, wdev) < 0) {
2445                 nlmsg_free(msg);
2446                 return -ENOBUFS;
2447         }
2448
2449         return genlmsg_reply(msg, info);
2450 }
2451
2452 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2453         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2454         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2455         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2456         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2457         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2458         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2459 };
2460
2461 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2462 {
2463         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2464         int flag;
2465
2466         *mntrflags = 0;
2467
2468         if (!nla)
2469                 return -EINVAL;
2470
2471         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2472                              nla, mntr_flags_policy))
2473                 return -EINVAL;
2474
2475         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2476                 if (flags[flag])
2477                         *mntrflags |= (1<<flag);
2478
2479         return 0;
2480 }
2481
2482 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2483                                struct net_device *netdev, u8 use_4addr,
2484                                enum nl80211_iftype iftype)
2485 {
2486         if (!use_4addr) {
2487                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2488                         return -EBUSY;
2489                 return 0;
2490         }
2491
2492         switch (iftype) {
2493         case NL80211_IFTYPE_AP_VLAN:
2494                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2495                         return 0;
2496                 break;
2497         case NL80211_IFTYPE_STATION:
2498                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2499                         return 0;
2500                 break;
2501         default:
2502                 break;
2503         }
2504
2505         return -EOPNOTSUPP;
2506 }
2507
2508 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2509 {
2510         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2511         struct vif_params params;
2512         int err;
2513         enum nl80211_iftype otype, ntype;
2514         struct net_device *dev = info->user_ptr[1];
2515         u32 _flags, *flags = NULL;
2516         bool change = false;
2517
2518         memset(&params, 0, sizeof(params));
2519
2520         otype = ntype = dev->ieee80211_ptr->iftype;
2521
2522         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2523                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2524                 if (otype != ntype)
2525                         change = true;
2526                 if (ntype > NL80211_IFTYPE_MAX)
2527                         return -EINVAL;
2528         }
2529
2530         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2531                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2532
2533                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2534                         return -EINVAL;
2535                 if (netif_running(dev))
2536                         return -EBUSY;
2537
2538                 wdev_lock(wdev);
2539                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2540                              IEEE80211_MAX_MESH_ID_LEN);
2541                 wdev->mesh_id_up_len =
2542                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2543                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2544                        wdev->mesh_id_up_len);
2545                 wdev_unlock(wdev);
2546         }
2547
2548         if (info->attrs[NL80211_ATTR_4ADDR]) {
2549                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2550                 change = true;
2551                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2552                 if (err)
2553                         return err;
2554         } else {
2555                 params.use_4addr = -1;
2556         }
2557
2558         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2559                 if (ntype != NL80211_IFTYPE_MONITOR)
2560                         return -EINVAL;
2561                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2562                                           &_flags);
2563                 if (err)
2564                         return err;
2565
2566                 flags = &_flags;
2567                 change = true;
2568         }
2569
2570         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2571             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2572                 return -EOPNOTSUPP;
2573
2574         if (change)
2575                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2576         else
2577                 err = 0;
2578
2579         if (!err && params.use_4addr != -1)
2580                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2581
2582         return err;
2583 }
2584
2585 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2586 {
2587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2588         struct vif_params params;
2589         struct wireless_dev *wdev;
2590         struct sk_buff *msg;
2591         int err;
2592         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2593         u32 flags;
2594
2595         /* to avoid failing a new interface creation due to pending removal */
2596         cfg80211_destroy_ifaces(rdev);
2597
2598         memset(&params, 0, sizeof(params));
2599
2600         if (!info->attrs[NL80211_ATTR_IFNAME])
2601                 return -EINVAL;
2602
2603         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2604                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2605                 if (type > NL80211_IFTYPE_MAX)
2606                         return -EINVAL;
2607         }
2608
2609         if (!rdev->ops->add_virtual_intf ||
2610             !(rdev->wiphy.interface_modes & (1 << type)))
2611                 return -EOPNOTSUPP;
2612
2613         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2614              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2615             info->attrs[NL80211_ATTR_MAC]) {
2616                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2617                            ETH_ALEN);
2618                 if (!is_valid_ether_addr(params.macaddr))
2619                         return -EADDRNOTAVAIL;
2620         }
2621
2622         if (info->attrs[NL80211_ATTR_4ADDR]) {
2623                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2624                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2625                 if (err)
2626                         return err;
2627         }
2628
2629         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2630         if (!msg)
2631                 return -ENOMEM;
2632
2633         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2634                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2635                                   &flags);
2636
2637         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2638             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2639                 return -EOPNOTSUPP;
2640
2641         wdev = rdev_add_virtual_intf(rdev,
2642                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2643                                 type, err ? NULL : &flags, &params);
2644         if (IS_ERR(wdev)) {
2645                 nlmsg_free(msg);
2646                 return PTR_ERR(wdev);
2647         }
2648
2649         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2650                 wdev->owner_nlportid = info->snd_portid;
2651
2652         switch (type) {
2653         case NL80211_IFTYPE_MESH_POINT:
2654                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2655                         break;
2656                 wdev_lock(wdev);
2657                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2658                              IEEE80211_MAX_MESH_ID_LEN);
2659                 wdev->mesh_id_up_len =
2660                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2661                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2662                        wdev->mesh_id_up_len);
2663                 wdev_unlock(wdev);
2664                 break;
2665         case NL80211_IFTYPE_P2P_DEVICE:
2666                 /*
2667                  * P2P Device doesn't have a netdev, so doesn't go
2668                  * through the netdev notifier and must be added here
2669                  */
2670                 mutex_init(&wdev->mtx);
2671                 INIT_LIST_HEAD(&wdev->event_list);
2672                 spin_lock_init(&wdev->event_lock);
2673                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2674                 spin_lock_init(&wdev->mgmt_registrations_lock);
2675
2676                 wdev->identifier = ++rdev->wdev_id;
2677                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2678                 rdev->devlist_generation++;
2679                 break;
2680         default:
2681                 break;
2682         }
2683
2684         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2685                                rdev, wdev) < 0) {
2686                 nlmsg_free(msg);
2687                 return -ENOBUFS;
2688         }
2689
2690         return genlmsg_reply(msg, info);
2691 }
2692
2693 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2694 {
2695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2696         struct wireless_dev *wdev = info->user_ptr[1];
2697
2698         if (!rdev->ops->del_virtual_intf)
2699                 return -EOPNOTSUPP;
2700
2701         /*
2702          * If we remove a wireless device without a netdev then clear
2703          * user_ptr[1] so that nl80211_post_doit won't dereference it
2704          * to check if it needs to do dev_put(). Otherwise it crashes
2705          * since the wdev has been freed, unlike with a netdev where
2706          * we need the dev_put() for the netdev to really be freed.
2707          */
2708         if (!wdev->netdev)
2709                 info->user_ptr[1] = NULL;
2710
2711         return rdev_del_virtual_intf(rdev, wdev);
2712 }
2713
2714 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2715 {
2716         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2717         struct net_device *dev = info->user_ptr[1];
2718         u16 noack_map;
2719
2720         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2721                 return -EINVAL;
2722
2723         if (!rdev->ops->set_noack_map)
2724                 return -EOPNOTSUPP;
2725
2726         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2727
2728         return rdev_set_noack_map(rdev, dev, noack_map);
2729 }
2730
2731 struct get_key_cookie {
2732         struct sk_buff *msg;
2733         int error;
2734         int idx;
2735 };
2736
2737 static void get_key_callback(void *c, struct key_params *params)
2738 {
2739         struct nlattr *key;
2740         struct get_key_cookie *cookie = c;
2741
2742         if ((params->key &&
2743              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2744                      params->key_len, params->key)) ||
2745             (params->seq &&
2746              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2747                      params->seq_len, params->seq)) ||
2748             (params->cipher &&
2749              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2750                          params->cipher)))
2751                 goto nla_put_failure;
2752
2753         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2754         if (!key)
2755                 goto nla_put_failure;
2756
2757         if ((params->key &&
2758              nla_put(cookie->msg, NL80211_KEY_DATA,
2759                      params->key_len, params->key)) ||
2760             (params->seq &&
2761              nla_put(cookie->msg, NL80211_KEY_SEQ,
2762                      params->seq_len, params->seq)) ||
2763             (params->cipher &&
2764              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2765                          params->cipher)))
2766                 goto nla_put_failure;
2767
2768         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2769                 goto nla_put_failure;
2770
2771         nla_nest_end(cookie->msg, key);
2772
2773         return;
2774  nla_put_failure:
2775         cookie->error = 1;
2776 }
2777
2778 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2779 {
2780         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2781         int err;
2782         struct net_device *dev = info->user_ptr[1];
2783         u8 key_idx = 0;
2784         const u8 *mac_addr = NULL;
2785         bool pairwise;
2786         struct get_key_cookie cookie = {
2787                 .error = 0,
2788         };
2789         void *hdr;
2790         struct sk_buff *msg;
2791
2792         if (info->attrs[NL80211_ATTR_KEY_IDX])
2793                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2794
2795         if (key_idx > 5)
2796                 return -EINVAL;
2797
2798         if (info->attrs[NL80211_ATTR_MAC])
2799                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2800
2801         pairwise = !!mac_addr;
2802         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2803                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2804                 if (kt >= NUM_NL80211_KEYTYPES)
2805                         return -EINVAL;
2806                 if (kt != NL80211_KEYTYPE_GROUP &&
2807                     kt != NL80211_KEYTYPE_PAIRWISE)
2808                         return -EINVAL;
2809                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2810         }
2811
2812         if (!rdev->ops->get_key)
2813                 return -EOPNOTSUPP;
2814
2815         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2816         if (!msg)
2817                 return -ENOMEM;
2818
2819         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2820                              NL80211_CMD_NEW_KEY);
2821         if (!hdr)
2822                 goto nla_put_failure;
2823
2824         cookie.msg = msg;
2825         cookie.idx = key_idx;
2826
2827         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2828             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2829                 goto nla_put_failure;
2830         if (mac_addr &&
2831             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2832                 goto nla_put_failure;
2833
2834         if (pairwise && mac_addr &&
2835             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2836                 return -ENOENT;
2837
2838         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2839                            get_key_callback);
2840
2841         if (err)
2842                 goto free_msg;
2843
2844         if (cookie.error)
2845                 goto nla_put_failure;
2846
2847         genlmsg_end(msg, hdr);
2848         return genlmsg_reply(msg, info);
2849
2850  nla_put_failure:
2851         err = -ENOBUFS;
2852  free_msg:
2853         nlmsg_free(msg);
2854         return err;
2855 }
2856
2857 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2858 {
2859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2860         struct key_parse key;
2861         int err;
2862         struct net_device *dev = info->user_ptr[1];
2863
2864         err = nl80211_parse_key(info, &key);
2865         if (err)
2866                 return err;
2867
2868         if (key.idx < 0)
2869                 return -EINVAL;
2870
2871         /* only support setting default key */
2872         if (!key.def && !key.defmgmt)
2873                 return -EINVAL;
2874
2875         wdev_lock(dev->ieee80211_ptr);
2876
2877         if (key.def) {
2878                 if (!rdev->ops->set_default_key) {
2879                         err = -EOPNOTSUPP;
2880                         goto out;
2881                 }
2882
2883                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2884                 if (err)
2885                         goto out;
2886
2887                 err = rdev_set_default_key(rdev, dev, key.idx,
2888                                                  key.def_uni, key.def_multi);
2889
2890                 if (err)
2891                         goto out;
2892
2893 #ifdef CONFIG_CFG80211_WEXT
2894                 dev->ieee80211_ptr->wext.default_key = key.idx;
2895 #endif
2896         } else {
2897                 if (key.def_uni || !key.def_multi) {
2898                         err = -EINVAL;
2899                         goto out;
2900                 }
2901
2902                 if (!rdev->ops->set_default_mgmt_key) {
2903                         err = -EOPNOTSUPP;
2904                         goto out;
2905                 }
2906
2907                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2908                 if (err)
2909                         goto out;
2910
2911                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2912                 if (err)
2913                         goto out;
2914
2915 #ifdef CONFIG_CFG80211_WEXT
2916                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2917 #endif
2918         }
2919
2920  out:
2921         wdev_unlock(dev->ieee80211_ptr);
2922
2923         return err;
2924 }
2925
2926 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2927 {
2928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2929         int err;
2930         struct net_device *dev = info->user_ptr[1];
2931         struct key_parse key;
2932         const u8 *mac_addr = NULL;
2933
2934         err = nl80211_parse_key(info, &key);
2935         if (err)
2936                 return err;
2937
2938         if (!key.p.key)
2939                 return -EINVAL;
2940
2941         if (info->attrs[NL80211_ATTR_MAC])
2942                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2943
2944         if (key.type == -1) {
2945                 if (mac_addr)
2946                         key.type = NL80211_KEYTYPE_PAIRWISE;
2947                 else
2948                         key.type = NL80211_KEYTYPE_GROUP;
2949         }
2950
2951         /* for now */
2952         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2953             key.type != NL80211_KEYTYPE_GROUP)
2954                 return -EINVAL;
2955
2956         if (!rdev->ops->add_key)
2957                 return -EOPNOTSUPP;
2958
2959         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2960                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2961                                            mac_addr))
2962                 return -EINVAL;
2963
2964         wdev_lock(dev->ieee80211_ptr);
2965         err = nl80211_key_allowed(dev->ieee80211_ptr);
2966         if (!err)
2967                 err = rdev_add_key(rdev, dev, key.idx,
2968                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2969                                     mac_addr, &key.p);
2970         wdev_unlock(dev->ieee80211_ptr);
2971
2972         return err;
2973 }
2974
2975 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2976 {
2977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2978         int err;
2979         struct net_device *dev = info->user_ptr[1];
2980         u8 *mac_addr = NULL;
2981         struct key_parse key;
2982
2983         err = nl80211_parse_key(info, &key);
2984         if (err)
2985                 return err;
2986
2987         if (info->attrs[NL80211_ATTR_MAC])
2988                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2989
2990         if (key.type == -1) {
2991                 if (mac_addr)
2992                         key.type = NL80211_KEYTYPE_PAIRWISE;
2993                 else
2994                         key.type = NL80211_KEYTYPE_GROUP;
2995         }
2996
2997         /* for now */
2998         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2999             key.type != NL80211_KEYTYPE_GROUP)
3000                 return -EINVAL;
3001
3002         if (!rdev->ops->del_key)
3003                 return -EOPNOTSUPP;
3004
3005         wdev_lock(dev->ieee80211_ptr);
3006         err = nl80211_key_allowed(dev->ieee80211_ptr);
3007
3008         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
3009             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3010                 err = -ENOENT;
3011
3012         if (!err)
3013                 err = rdev_del_key(rdev, dev, key.idx,
3014                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3015                                    mac_addr);
3016
3017 #ifdef CONFIG_CFG80211_WEXT
3018         if (!err) {
3019                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3020                         dev->ieee80211_ptr->wext.default_key = -1;
3021                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3022                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3023         }
3024 #endif
3025         wdev_unlock(dev->ieee80211_ptr);
3026
3027         return err;
3028 }
3029
3030 /* This function returns an error or the number of nested attributes */
3031 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3032 {
3033         struct nlattr *attr;
3034         int n_entries = 0, tmp;
3035
3036         nla_for_each_nested(attr, nl_attr, tmp) {
3037                 if (nla_len(attr) != ETH_ALEN)
3038                         return -EINVAL;
3039
3040                 n_entries++;
3041         }
3042
3043         return n_entries;
3044 }
3045
3046 /*
3047  * This function parses ACL information and allocates memory for ACL data.
3048  * On successful return, the calling function is responsible to free the
3049  * ACL buffer returned by this function.
3050  */
3051 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3052                                                 struct genl_info *info)
3053 {
3054         enum nl80211_acl_policy acl_policy;
3055         struct nlattr *attr;
3056         struct cfg80211_acl_data *acl;
3057         int i = 0, n_entries, tmp;
3058
3059         if (!wiphy->max_acl_mac_addrs)
3060                 return ERR_PTR(-EOPNOTSUPP);
3061
3062         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3063                 return ERR_PTR(-EINVAL);
3064
3065         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3066         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3067             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3068                 return ERR_PTR(-EINVAL);
3069
3070         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3071                 return ERR_PTR(-EINVAL);
3072
3073         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3074         if (n_entries < 0)
3075                 return ERR_PTR(n_entries);
3076
3077         if (n_entries > wiphy->max_acl_mac_addrs)
3078                 return ERR_PTR(-ENOTSUPP);
3079
3080         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3081                       GFP_KERNEL);
3082         if (!acl)
3083                 return ERR_PTR(-ENOMEM);
3084
3085         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3086                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3087                 i++;
3088         }
3089
3090         acl->n_acl_entries = n_entries;
3091         acl->acl_policy = acl_policy;
3092
3093         return acl;
3094 }
3095
3096 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3097 {
3098         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3099         struct net_device *dev = info->user_ptr[1];
3100         struct cfg80211_acl_data *acl;
3101         int err;
3102
3103         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3104             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3105                 return -EOPNOTSUPP;
3106
3107         if (!dev->ieee80211_ptr->beacon_interval)
3108                 return -EINVAL;
3109
3110         acl = parse_acl_data(&rdev->wiphy, info);
3111         if (IS_ERR(acl))
3112                 return PTR_ERR(acl);
3113
3114         err = rdev_set_mac_acl(rdev, dev, acl);
3115
3116         kfree(acl);
3117
3118         return err;
3119 }
3120
3121 static int nl80211_parse_beacon(struct nlattr *attrs[],
3122                                 struct cfg80211_beacon_data *bcn)
3123 {
3124         bool haveinfo = false;
3125
3126         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3127             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3128             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3129             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3130                 return -EINVAL;
3131
3132         memset(bcn, 0, sizeof(*bcn));
3133
3134         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3135                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3136                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3137                 if (!bcn->head_len)
3138                         return -EINVAL;
3139                 haveinfo = true;
3140         }
3141
3142         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3143                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3144                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3145                 haveinfo = true;
3146         }
3147
3148         if (!haveinfo)
3149                 return -EINVAL;
3150
3151         if (attrs[NL80211_ATTR_IE]) {
3152                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3153                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3154         }
3155
3156         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3157                 bcn->proberesp_ies =
3158                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3159                 bcn->proberesp_ies_len =
3160                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3161         }
3162
3163         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3164                 bcn->assocresp_ies =
3165                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3166                 bcn->assocresp_ies_len =
3167                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3168         }
3169
3170         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3171                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3172                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3173         }
3174
3175         return 0;
3176 }
3177
3178 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3179                                    struct cfg80211_ap_settings *params)
3180 {
3181         struct wireless_dev *wdev;
3182         bool ret = false;
3183
3184         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3185                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3186                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3187                         continue;
3188
3189                 if (!wdev->preset_chandef.chan)
3190                         continue;
3191
3192                 params->chandef = wdev->preset_chandef;
3193                 ret = true;
3194                 break;
3195         }
3196
3197         return ret;
3198 }
3199
3200 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3201                                     enum nl80211_auth_type auth_type,
3202                                     enum nl80211_commands cmd)
3203 {
3204         if (auth_type > NL80211_AUTHTYPE_MAX)
3205                 return false;
3206
3207         switch (cmd) {
3208         case NL80211_CMD_AUTHENTICATE:
3209                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3210                     auth_type == NL80211_AUTHTYPE_SAE)
3211                         return false;
3212                 return true;
3213         case NL80211_CMD_CONNECT:
3214         case NL80211_CMD_START_AP:
3215                 /* SAE not supported yet */
3216                 if (auth_type == NL80211_AUTHTYPE_SAE)
3217                         return false;
3218                 return true;
3219         default:
3220                 return false;
3221         }
3222 }
3223
3224 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3225 {
3226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3227         struct net_device *dev = info->user_ptr[1];
3228         struct wireless_dev *wdev = dev->ieee80211_ptr;
3229         struct cfg80211_ap_settings params;
3230         int err;
3231
3232         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3233             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3234                 return -EOPNOTSUPP;
3235
3236         if (!rdev->ops->start_ap)
3237                 return -EOPNOTSUPP;
3238
3239         if (wdev->beacon_interval)
3240                 return -EALREADY;
3241
3242         memset(&params, 0, sizeof(params));
3243
3244         /* these are required for START_AP */
3245         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3246             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3247             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3248                 return -EINVAL;
3249
3250         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3251         if (err)
3252                 return err;
3253
3254         params.beacon_interval =
3255                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3256         params.dtim_period =
3257                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3258
3259         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3260         if (err)
3261                 return err;
3262
3263         /*
3264          * In theory, some of these attributes should be required here
3265          * but since they were not used when the command was originally
3266          * added, keep them optional for old user space programs to let
3267          * them continue to work with drivers that do not need the
3268          * additional information -- drivers must check!
3269          */
3270         if (info->attrs[NL80211_ATTR_SSID]) {
3271                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3272                 params.ssid_len =
3273                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3274                 if (params.ssid_len == 0 ||
3275                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3276                         return -EINVAL;
3277         }
3278
3279         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3280                 params.hidden_ssid = nla_get_u32(
3281                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3282                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3283                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3284                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3285                         return -EINVAL;
3286         }
3287
3288         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3289
3290         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3291                 params.auth_type = nla_get_u32(
3292                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3293                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3294                                              NL80211_CMD_START_AP))
3295                         return -EINVAL;
3296         } else
3297                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3298
3299         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3300                                       NL80211_MAX_NR_CIPHER_SUITES);
3301         if (err)
3302                 return err;
3303
3304         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3305                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3306                         return -EOPNOTSUPP;
3307                 params.inactivity_timeout = nla_get_u16(
3308                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3309         }
3310
3311         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3312                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3313                         return -EINVAL;
3314                 params.p2p_ctwindow =
3315                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3316                 if (params.p2p_ctwindow > 127)
3317                         return -EINVAL;
3318                 if (params.p2p_ctwindow != 0 &&
3319                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3320                         return -EINVAL;
3321         }
3322
3323         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3324                 u8 tmp;
3325
3326                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3327                         return -EINVAL;
3328                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3329                 if (tmp > 1)
3330                         return -EINVAL;
3331                 params.p2p_opp_ps = tmp;
3332                 if (params.p2p_opp_ps != 0 &&
3333                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3334                         return -EINVAL;
3335         }
3336
3337         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3338                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3339                 if (err)
3340                         return err;
3341         } else if (wdev->preset_chandef.chan) {
3342                 params.chandef = wdev->preset_chandef;
3343         } else if (!nl80211_get_ap_channel(rdev, &params))
3344                 return -EINVAL;
3345
3346         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3347                                      wdev->iftype))
3348                 return -EINVAL;
3349
3350         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3351                 params.acl = parse_acl_data(&rdev->wiphy, info);
3352                 if (IS_ERR(params.acl))
3353                         return PTR_ERR(params.acl);
3354         }
3355
3356         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3357                 params.smps_mode =
3358                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3359                 switch (params.smps_mode) {
3360                 case NL80211_SMPS_OFF:
3361                         break;
3362                 case NL80211_SMPS_STATIC:
3363                         if (!(rdev->wiphy.features &
3364                               NL80211_FEATURE_STATIC_SMPS))
3365                                 return -EINVAL;
3366                         break;
3367                 case NL80211_SMPS_DYNAMIC:
3368                         if (!(rdev->wiphy.features &
3369                               NL80211_FEATURE_DYNAMIC_SMPS))
3370                                 return -EINVAL;
3371                         break;
3372                 default:
3373                         return -EINVAL;
3374                 }
3375         } else {
3376                 params.smps_mode = NL80211_SMPS_OFF;
3377         }
3378
3379         wdev_lock(wdev);
3380         err = rdev_start_ap(rdev, dev, &params);
3381         if (!err) {
3382                 wdev->preset_chandef = params.chandef;
3383                 wdev->beacon_interval = params.beacon_interval;
3384                 wdev->chandef = params.chandef;
3385                 wdev->ssid_len = params.ssid_len;
3386                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3387         }
3388         wdev_unlock(wdev);
3389
3390         kfree(params.acl);
3391
3392         return err;
3393 }
3394
3395 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3396 {
3397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3398         struct net_device *dev = info->user_ptr[1];
3399         struct wireless_dev *wdev = dev->ieee80211_ptr;
3400         struct cfg80211_beacon_data params;
3401         int err;
3402
3403         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3404             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3405                 return -EOPNOTSUPP;
3406
3407         if (!rdev->ops->change_beacon)
3408                 return -EOPNOTSUPP;
3409
3410         if (!wdev->beacon_interval)
3411                 return -EINVAL;
3412
3413         err = nl80211_parse_beacon(info->attrs, &params);
3414         if (err)
3415                 return err;
3416
3417         wdev_lock(wdev);
3418         err = rdev_change_beacon(rdev, dev, &params);
3419         wdev_unlock(wdev);
3420
3421         return err;
3422 }
3423
3424 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3425 {
3426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3427         struct net_device *dev = info->user_ptr[1];
3428
3429         return cfg80211_stop_ap(rdev, dev, false);
3430 }
3431
3432 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3433         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3434         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3435         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3436         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3437         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3438         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3439 };
3440
3441 static int parse_station_flags(struct genl_info *info,
3442                                enum nl80211_iftype iftype,
3443                                struct station_parameters *params)
3444 {
3445         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3446         struct nlattr *nla;
3447         int flag;
3448
3449         /*
3450          * Try parsing the new attribute first so userspace
3451          * can specify both for older kernels.
3452          */
3453         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3454         if (nla) {
3455                 struct nl80211_sta_flag_update *sta_flags;
3456
3457                 sta_flags = nla_data(nla);
3458                 params->sta_flags_mask = sta_flags->mask;
3459                 params->sta_flags_set = sta_flags->set;
3460                 params->sta_flags_set &= params->sta_flags_mask;
3461                 if ((params->sta_flags_mask |
3462                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3463                         return -EINVAL;
3464                 return 0;
3465         }
3466
3467         /* if present, parse the old attribute */
3468
3469         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3470         if (!nla)
3471                 return 0;
3472
3473         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3474                              nla, sta_flags_policy))
3475                 return -EINVAL;
3476
3477         /*
3478          * Only allow certain flags for interface types so that
3479          * other attributes are silently ignored. Remember that
3480          * this is backward compatibility code with old userspace
3481          * and shouldn't be hit in other cases anyway.
3482          */
3483         switch (iftype) {
3484         case NL80211_IFTYPE_AP:
3485         case NL80211_IFTYPE_AP_VLAN:
3486         case NL80211_IFTYPE_P2P_GO:
3487                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3488                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3489                                          BIT(NL80211_STA_FLAG_WME) |
3490                                          BIT(NL80211_STA_FLAG_MFP);
3491                 break;
3492         case NL80211_IFTYPE_P2P_CLIENT:
3493         case NL80211_IFTYPE_STATION:
3494                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3495                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3496                 break;
3497         case NL80211_IFTYPE_MESH_POINT:
3498                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3499                                          BIT(NL80211_STA_FLAG_MFP) |
3500                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3501         default:
3502                 return -EINVAL;
3503         }
3504
3505         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3506                 if (flags[flag]) {
3507                         params->sta_flags_set |= (1<<flag);
3508
3509                         /* no longer support new API additions in old API */
3510                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3511                                 return -EINVAL;
3512                 }
3513         }
3514
3515         return 0;
3516 }
3517
3518 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3519                                  int attr)
3520 {
3521         struct nlattr *rate;
3522         u32 bitrate;
3523         u16 bitrate_compat;
3524
3525         rate = nla_nest_start(msg, attr);
3526         if (!rate)
3527                 return false;
3528
3529         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3530         bitrate = cfg80211_calculate_bitrate(info);
3531         /* report 16-bit bitrate only if we can */
3532         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3533         if (bitrate > 0 &&
3534             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3535                 return false;
3536         if (bitrate_compat > 0 &&
3537             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3538                 return false;
3539
3540         if (info->flags & RATE_INFO_FLAGS_MCS) {
3541                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3542                         return false;
3543                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3544                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3545                         return false;
3546                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3547                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3548                         return false;
3549         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3550                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3551                         return false;
3552                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3553                         return false;
3554                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3555                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3556                         return false;
3557                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3558                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3559                         return false;
3560                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3561                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3562                         return false;
3563                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3564                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3565                         return false;
3566                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3567                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3568                         return false;
3569         }
3570
3571         nla_nest_end(msg, rate);
3572         return true;
3573 }
3574
3575 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3576                                int id)
3577 {
3578         void *attr;
3579         int i = 0;
3580
3581         if (!mask)
3582                 return true;
3583
3584         attr = nla_nest_start(msg, id);
3585         if (!attr)
3586                 return false;
3587
3588         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3589                 if (!(mask & BIT(i)))
3590                         continue;
3591
3592                 if (nla_put_u8(msg, i, signal[i]))
3593                         return false;
3594         }
3595
3596         nla_nest_end(msg, attr);
3597
3598         return true;
3599 }
3600
3601 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3602                                 int flags,
3603                                 struct cfg80211_registered_device *rdev,
3604                                 struct net_device *dev,
3605                                 const u8 *mac_addr, struct station_info *sinfo)
3606 {
3607         void *hdr;
3608         struct nlattr *sinfoattr, *bss_param;
3609
3610         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3611         if (!hdr)
3612                 return -1;
3613
3614         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3615             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3616             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3617                 goto nla_put_failure;
3618
3619         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3620         if (!sinfoattr)
3621                 goto nla_put_failure;
3622         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3623             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3624                         sinfo->connected_time))
3625                 goto nla_put_failure;
3626         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3627             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3628                         sinfo->inactive_time))
3629                 goto nla_put_failure;
3630         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3631                               STATION_INFO_RX_BYTES64)) &&
3632             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3633                         (u32)sinfo->rx_bytes))
3634                 goto nla_put_failure;
3635         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3636                               STATION_INFO_TX_BYTES64)) &&
3637             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3638                         (u32)sinfo->tx_bytes))
3639                 goto nla_put_failure;
3640         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3641             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3642                         sinfo->rx_bytes))
3643                 goto nla_put_failure;
3644         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3645             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3646                         sinfo->tx_bytes))
3647                 goto nla_put_failure;
3648         if ((sinfo->filled & STATION_INFO_LLID) &&
3649             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3650                 goto nla_put_failure;
3651         if ((sinfo->filled & STATION_INFO_PLID) &&
3652             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3653                 goto nla_put_failure;
3654         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3655             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3656                        sinfo->plink_state))
3657                 goto nla_put_failure;
3658         switch (rdev->wiphy.signal_type) {
3659         case CFG80211_SIGNAL_TYPE_MBM:
3660                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3661                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3662                                sinfo->signal))
3663                         goto nla_put_failure;
3664                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3665                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3666                                sinfo->signal_avg))
3667                         goto nla_put_failure;
3668                 break;
3669         default:
3670                 break;
3671         }
3672         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3673                 if (!nl80211_put_signal(msg, sinfo->chains,
3674                                         sinfo->chain_signal,
3675                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3676                         goto nla_put_failure;
3677         }
3678         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3679                 if (!nl80211_put_signal(msg, sinfo->chains,
3680                                         sinfo->chain_signal_avg,
3681                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3682                         goto nla_put_failure;
3683         }
3684         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3685                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3686                                           NL80211_STA_INFO_TX_BITRATE))
3687                         goto nla_put_failure;
3688         }
3689         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3690                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3691                                           NL80211_STA_INFO_RX_BITRATE))
3692                         goto nla_put_failure;
3693         }
3694         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3695             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3696                         sinfo->rx_packets))
3697                 goto nla_put_failure;
3698         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3699             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3700                         sinfo->tx_packets))
3701                 goto nla_put_failure;
3702         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3703             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3704                         sinfo->tx_retries))
3705                 goto nla_put_failure;
3706         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3707             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3708                         sinfo->tx_failed))
3709                 goto nla_put_failure;
3710         if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
3711             nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
3712                         sinfo->expected_throughput))
3713                 goto nla_put_failure;
3714         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3715             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3716                         sinfo->beacon_loss_count))
3717                 goto nla_put_failure;
3718         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3719             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3720                         sinfo->local_pm))
3721                 goto nla_put_failure;
3722         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3723             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3724                         sinfo->peer_pm))
3725                 goto nla_put_failure;
3726         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3727             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3728                         sinfo->nonpeer_pm))
3729                 goto nla_put_failure;
3730         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3731                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3732                 if (!bss_param)
3733                         goto nla_put_failure;
3734
3735                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3736                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3737                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3738                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3739                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3740                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3741                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3742                                sinfo->bss_param.dtim_period) ||
3743                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3744                                 sinfo->bss_param.beacon_interval))
3745                         goto nla_put_failure;
3746
3747                 nla_nest_end(msg, bss_param);
3748         }
3749         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3750             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3751                     sizeof(struct nl80211_sta_flag_update),
3752                     &sinfo->sta_flags))
3753                 goto nla_put_failure;
3754         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3755                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3756                             sinfo->t_offset))
3757                 goto nla_put_failure;
3758         nla_nest_end(msg, sinfoattr);
3759
3760         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3761             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3762                     sinfo->assoc_req_ies))
3763                 goto nla_put_failure;
3764
3765         return genlmsg_end(msg, hdr);
3766
3767  nla_put_failure:
3768         genlmsg_cancel(msg, hdr);
3769         return -EMSGSIZE;
3770 }
3771
3772 static int nl80211_dump_station(struct sk_buff *skb,
3773                                 struct netlink_callback *cb)
3774 {
3775         struct station_info sinfo;
3776         struct cfg80211_registered_device *rdev;
3777         struct wireless_dev *wdev;
3778         u8 mac_addr[ETH_ALEN];
3779         int sta_idx = cb->args[2];
3780         int err;
3781
3782         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3783         if (err)
3784                 return err;
3785
3786         if (!wdev->netdev) {
3787                 err = -EINVAL;
3788                 goto out_err;
3789         }
3790
3791         if (!rdev->ops->dump_station) {
3792                 err = -EOPNOTSUPP;
3793                 goto out_err;
3794         }
3795
3796         while (1) {
3797                 memset(&sinfo, 0, sizeof(sinfo));
3798                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3799                                         mac_addr, &sinfo);
3800                 if (err == -ENOENT)
3801                         break;
3802                 if (err)
3803                         goto out_err;
3804
3805                 if (nl80211_send_station(skb,
3806                                 NETLINK_CB(cb->skb).portid,
3807                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3808                                 rdev, wdev->netdev, mac_addr,
3809                                 &sinfo) < 0)
3810                         goto out;
3811
3812                 sta_idx++;
3813         }
3814
3815
3816  out:
3817         cb->args[2] = sta_idx;
3818         err = skb->len;
3819  out_err:
3820         nl80211_finish_wdev_dump(rdev);
3821
3822         return err;
3823 }
3824
3825 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3826 {
3827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3828         struct net_device *dev = info->user_ptr[1];
3829         struct station_info sinfo;
3830         struct sk_buff *msg;
3831         u8 *mac_addr = NULL;
3832         int err;
3833
3834         memset(&sinfo, 0, sizeof(sinfo));
3835
3836         if (!info->attrs[NL80211_ATTR_MAC])
3837                 return -EINVAL;
3838
3839         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3840
3841         if (!rdev->ops->get_station)
3842                 return -EOPNOTSUPP;
3843
3844         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3845         if (err)
3846                 return err;
3847
3848         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3849         if (!msg)
3850                 return -ENOMEM;
3851
3852         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3853                                  rdev, dev, mac_addr, &sinfo) < 0) {
3854                 nlmsg_free(msg);
3855                 return -ENOBUFS;
3856         }
3857
3858         return genlmsg_reply(msg, info);
3859 }
3860
3861 int cfg80211_check_station_change(struct wiphy *wiphy,
3862                                   struct station_parameters *params,
3863                                   enum cfg80211_station_type statype)
3864 {
3865         if (params->listen_interval != -1)
3866                 return -EINVAL;
3867         if (params->aid &&
3868             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3869                 return -EINVAL;
3870
3871         /* When you run into this, adjust the code below for the new flag */
3872         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3873
3874         switch (statype) {
3875         case CFG80211_STA_MESH_PEER_KERNEL:
3876         case CFG80211_STA_MESH_PEER_USER:
3877                 /*
3878                  * No ignoring the TDLS flag here -- the userspace mesh
3879                  * code doesn't have the bug of including TDLS in the
3880                  * mask everywhere.
3881                  */
3882                 if (params->sta_flags_mask &
3883                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3884                                   BIT(NL80211_STA_FLAG_MFP) |
3885                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3886                         return -EINVAL;
3887                 break;
3888         case CFG80211_STA_TDLS_PEER_SETUP:
3889         case CFG80211_STA_TDLS_PEER_ACTIVE:
3890                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3891                         return -EINVAL;
3892                 /* ignore since it can't change */
3893                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3894                 break;
3895         default:
3896                 /* disallow mesh-specific things */
3897                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3898                         return -EINVAL;
3899                 if (params->local_pm)
3900                         return -EINVAL;
3901                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3902                         return -EINVAL;
3903         }
3904
3905         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3906             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3907                 /* TDLS can't be set, ... */
3908                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3909                         return -EINVAL;
3910                 /*
3911                  * ... but don't bother the driver with it. This works around
3912                  * a hostapd/wpa_supplicant issue -- it always includes the
3913                  * TLDS_PEER flag in the mask even for AP mode.
3914                  */
3915                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3916         }
3917
3918         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3919                 /* reject other things that can't change */
3920                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3921                         return -EINVAL;
3922                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3923                         return -EINVAL;
3924                 if (params->supported_rates)
3925                         return -EINVAL;
3926                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3927                         return -EINVAL;
3928         }
3929
3930         if (statype != CFG80211_STA_AP_CLIENT) {
3931                 if (params->vlan)
3932                         return -EINVAL;
3933         }
3934
3935         switch (statype) {
3936         case CFG80211_STA_AP_MLME_CLIENT:
3937                 /* Use this only for authorizing/unauthorizing a station */
3938                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3939                         return -EOPNOTSUPP;
3940                 break;
3941         case CFG80211_STA_AP_CLIENT:
3942                 /* accept only the listed bits */
3943                 if (params->sta_flags_mask &
3944                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3945                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3946                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3947                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3948                                   BIT(NL80211_STA_FLAG_WME) |
3949                                   BIT(NL80211_STA_FLAG_MFP)))
3950                         return -EINVAL;
3951
3952                 /* but authenticated/associated only if driver handles it */
3953                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3954                     params->sta_flags_mask &
3955                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3956                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3957                         return -EINVAL;
3958                 break;
3959         case CFG80211_STA_IBSS:
3960         case CFG80211_STA_AP_STA:
3961                 /* reject any changes other than AUTHORIZED */
3962                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3963                         return -EINVAL;
3964                 break;
3965         case CFG80211_STA_TDLS_PEER_SETUP:
3966                 /* reject any changes other than AUTHORIZED or WME */
3967                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3968                                                BIT(NL80211_STA_FLAG_WME)))
3969                         return -EINVAL;
3970                 /* force (at least) rates when authorizing */
3971                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3972                     !params->supported_rates)
3973                         return -EINVAL;
3974                 break;
3975         case CFG80211_STA_TDLS_PEER_ACTIVE:
3976                 /* reject any changes */
3977                 return -EINVAL;
3978         case CFG80211_STA_MESH_PEER_KERNEL:
3979                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3980                         return -EINVAL;
3981                 break;
3982         case CFG80211_STA_MESH_PEER_USER:
3983                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3984                         return -EINVAL;
3985                 break;
3986         }
3987
3988         return 0;
3989 }
3990 EXPORT_SYMBOL(cfg80211_check_station_change);
3991
3992 /*
3993  * Get vlan interface making sure it is running and on the right wiphy.
3994  */
3995 static struct net_device *get_vlan(struct genl_info *info,
3996                                    struct cfg80211_registered_device *rdev)
3997 {
3998         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3999         struct net_device *v;
4000         int ret;
4001
4002         if (!vlanattr)
4003                 return NULL;
4004
4005         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4006         if (!v)
4007                 return ERR_PTR(-ENODEV);
4008
4009         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4010                 ret = -EINVAL;
4011                 goto error;
4012         }
4013
4014         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4015             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4016             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4017                 ret = -EINVAL;
4018                 goto error;
4019         }
4020
4021         if (!netif_running(v)) {
4022                 ret = -ENETDOWN;
4023                 goto error;
4024         }
4025
4026         return v;
4027  error:
4028         dev_put(v);
4029         return ERR_PTR(ret);
4030 }
4031
4032 static const struct nla_policy
4033 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4034         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4035         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4036 };
4037
4038 static int nl80211_parse_sta_wme(struct genl_info *info,
4039                                  struct station_parameters *params)
4040 {
4041         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4042         struct nlattr *nla;
4043         int err;
4044
4045         /* parse WME attributes if present */
4046         if (!info->attrs[NL80211_ATTR_STA_WME])
4047                 return 0;
4048
4049         nla = info->attrs[NL80211_ATTR_STA_WME];
4050         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4051                                nl80211_sta_wme_policy);
4052         if (err)
4053                 return err;
4054
4055         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4056                 params->uapsd_queues = nla_get_u8(
4057                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4058         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4059                 return -EINVAL;
4060
4061         if (tb[NL80211_STA_WME_MAX_SP])
4062                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4063
4064         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4065                 return -EINVAL;
4066
4067         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4068
4069         return 0;
4070 }
4071
4072 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4073                                       struct station_parameters *params)
4074 {
4075         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4076                 params->supported_channels =
4077                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4078                 params->supported_channels_len =
4079                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4080                 /*
4081                  * Need to include at least one (first channel, number of
4082                  * channels) tuple for each subband, and must have proper
4083                  * tuples for the rest of the data as well.
4084                  */
4085                 if (params->supported_channels_len < 2)
4086                         return -EINVAL;
4087                 if (params->supported_channels_len % 2)
4088                         return -EINVAL;
4089         }
4090
4091         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4092                 params->supported_oper_classes =
4093                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4094                 params->supported_oper_classes_len =
4095                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4096                 /*
4097                  * The value of the Length field of the Supported Operating
4098                  * Classes element is between 2 and 253.
4099                  */
4100                 if (params->supported_oper_classes_len < 2 ||
4101                     params->supported_oper_classes_len > 253)
4102                         return -EINVAL;
4103         }
4104         return 0;
4105 }
4106
4107 static int nl80211_set_station_tdls(struct genl_info *info,
4108                                     struct station_parameters *params)
4109 {
4110         int err;
4111         /* Dummy STA entry gets updated once the peer capabilities are known */
4112         if (info->attrs[NL80211_ATTR_PEER_AID])
4113                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4114         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4115                 params->ht_capa =
4116                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4117         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4118                 params->vht_capa =
4119                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4120
4121         err = nl80211_parse_sta_channel_info(info, params);
4122         if (err)
4123                 return err;
4124
4125         return nl80211_parse_sta_wme(info, params);
4126 }
4127
4128 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4129 {
4130         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4131         struct net_device *dev = info->user_ptr[1];
4132         struct station_parameters params;
4133         u8 *mac_addr;
4134         int err;
4135
4136         memset(&params, 0, sizeof(params));
4137
4138         params.listen_interval = -1;
4139
4140         if (!rdev->ops->change_station)
4141                 return -EOPNOTSUPP;
4142
4143         if (info->attrs[NL80211_ATTR_STA_AID])
4144                 return -EINVAL;
4145
4146         if (!info->attrs[NL80211_ATTR_MAC])
4147                 return -EINVAL;
4148
4149         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4150
4151         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4152                 params.supported_rates =
4153                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4154                 params.supported_rates_len =
4155                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4156         }
4157
4158         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4159                 params.capability =
4160                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4161                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4162         }
4163
4164         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4165                 params.ext_capab =
4166                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4167                 params.ext_capab_len =
4168                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4169         }
4170
4171         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4172                 return -EINVAL;
4173
4174         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4175                 return -EINVAL;
4176
4177         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4178                 params.plink_action =
4179                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4180                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4181                         return -EINVAL;
4182         }
4183
4184         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4185                 params.plink_state =
4186                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4187                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4188                         return -EINVAL;
4189                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4190         }
4191
4192         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4193                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4194                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4195
4196                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4197                     pm > NL80211_MESH_POWER_MAX)
4198                         return -EINVAL;
4199
4200                 params.local_pm = pm;
4201         }
4202
4203         /* Include parameters for TDLS peer (will check later) */
4204         err = nl80211_set_station_tdls(info, &params);
4205         if (err)
4206                 return err;
4207
4208         params.vlan = get_vlan(info, rdev);
4209         if (IS_ERR(params.vlan))
4210                 return PTR_ERR(params.vlan);
4211
4212         switch (dev->ieee80211_ptr->iftype) {
4213         case NL80211_IFTYPE_AP:
4214         case NL80211_IFTYPE_AP_VLAN:
4215         case NL80211_IFTYPE_P2P_GO:
4216         case NL80211_IFTYPE_P2P_CLIENT:
4217         case NL80211_IFTYPE_STATION:
4218         case NL80211_IFTYPE_ADHOC:
4219         case NL80211_IFTYPE_MESH_POINT:
4220                 break;
4221         default:
4222                 err = -EOPNOTSUPP;
4223                 goto out_put_vlan;
4224         }
4225
4226         /* driver will call cfg80211_check_station_change() */
4227         err = rdev_change_station(rdev, dev, mac_addr, &params);
4228
4229  out_put_vlan:
4230         if (params.vlan)
4231                 dev_put(params.vlan);
4232
4233         return err;
4234 }
4235
4236 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4237 {
4238         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4239         int err;
4240         struct net_device *dev = info->user_ptr[1];
4241         struct station_parameters params;
4242         u8 *mac_addr = NULL;
4243
4244         memset(&params, 0, sizeof(params));
4245
4246         if (!rdev->ops->add_station)
4247                 return -EOPNOTSUPP;
4248
4249         if (!info->attrs[NL80211_ATTR_MAC])
4250                 return -EINVAL;
4251
4252         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4253                 return -EINVAL;
4254
4255         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4256                 return -EINVAL;
4257
4258         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4259             !info->attrs[NL80211_ATTR_PEER_AID])
4260                 return -EINVAL;
4261
4262         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4263         params.supported_rates =
4264                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4265         params.supported_rates_len =
4266                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4267         params.listen_interval =
4268                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4269
4270         if (info->attrs[NL80211_ATTR_PEER_AID])
4271                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4272         else
4273                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4274         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4275                 return -EINVAL;
4276
4277         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4278                 params.capability =
4279                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4280                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4281         }
4282
4283         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4284                 params.ext_capab =
4285                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4286                 params.ext_capab_len =
4287                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4288         }
4289
4290         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4291                 params.ht_capa =
4292                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4293
4294         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4295                 params.vht_capa =
4296                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4297
4298         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4299                 params.opmode_notif_used = true;
4300                 params.opmode_notif =
4301                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4302         }
4303
4304         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4305                 params.plink_action =
4306                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4307                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4308                         return -EINVAL;
4309         }
4310
4311         err = nl80211_parse_sta_channel_info(info, &params);
4312         if (err)
4313                 return err;
4314
4315         err = nl80211_parse_sta_wme(info, &params);
4316         if (err)
4317                 return err;
4318
4319         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4320                 return -EINVAL;
4321
4322         /* When you run into this, adjust the code below for the new flag */
4323         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4324
4325         switch (dev->ieee80211_ptr->iftype) {
4326         case NL80211_IFTYPE_AP:
4327         case NL80211_IFTYPE_AP_VLAN:
4328         case NL80211_IFTYPE_P2P_GO:
4329                 /* ignore WME attributes if iface/sta is not capable */
4330                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4331                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4332                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4333
4334                 /* TDLS peers cannot be added */
4335                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4336                     info->attrs[NL80211_ATTR_PEER_AID])
4337                         return -EINVAL;
4338                 /* but don't bother the driver with it */
4339                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4340
4341                 /* allow authenticated/associated only if driver handles it */
4342                 if (!(rdev->wiphy.features &
4343                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4344                     params.sta_flags_mask &
4345                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4346                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4347                         return -EINVAL;
4348
4349                 /* must be last in here for error handling */
4350                 params.vlan = get_vlan(info, rdev);
4351                 if (IS_ERR(params.vlan))
4352                         return PTR_ERR(params.vlan);
4353                 break;
4354         case NL80211_IFTYPE_MESH_POINT:
4355                 /* ignore uAPSD data */
4356                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4357
4358                 /* associated is disallowed */
4359                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4360                         return -EINVAL;
4361                 /* TDLS peers cannot be added */
4362                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4363                     info->attrs[NL80211_ATTR_PEER_AID])
4364                         return -EINVAL;
4365                 break;
4366         case NL80211_IFTYPE_STATION:
4367         case NL80211_IFTYPE_P2P_CLIENT:
4368                 /* ignore uAPSD data */
4369                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4370
4371                 /* these are disallowed */
4372                 if (params.sta_flags_mask &
4373                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4374                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4375                         return -EINVAL;
4376                 /* Only TDLS peers can be added */
4377                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4378                         return -EINVAL;
4379                 /* Can only add if TDLS ... */
4380                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4381                         return -EOPNOTSUPP;
4382                 /* ... with external setup is supported */
4383                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4384                         return -EOPNOTSUPP;
4385                 /*
4386                  * Older wpa_supplicant versions always mark the TDLS peer
4387                  * as authorized, but it shouldn't yet be.
4388                  */
4389                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4390                 break;
4391         default:
4392                 return -EOPNOTSUPP;
4393         }
4394
4395         /* be aware of params.vlan when changing code here */
4396
4397         err = rdev_add_station(rdev, dev, mac_addr, &params);
4398
4399         if (params.vlan)
4400                 dev_put(params.vlan);
4401         return err;
4402 }
4403
4404 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4405 {
4406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4407         struct net_device *dev = info->user_ptr[1];
4408         struct station_del_parameters params;
4409
4410         memset(&params, 0, sizeof(params));
4411
4412         if (info->attrs[NL80211_ATTR_MAC])
4413                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4414
4415         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4416             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4417             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4418             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4419                 return -EINVAL;
4420
4421         if (!rdev->ops->del_station)
4422                 return -EOPNOTSUPP;
4423
4424         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4425                 params.subtype =
4426                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4427                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4428                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4429                         return -EINVAL;
4430         } else {
4431                 /* Default to Deauthentication frame */
4432                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4433         }
4434
4435         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4436                 params.reason_code =
4437                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4438                 if (params.reason_code == 0)
4439                         return -EINVAL; /* 0 is reserved */
4440         } else {
4441                 /* Default to reason code 2 */
4442                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4443         }
4444
4445         return rdev_del_station(rdev, dev, &params);
4446 }
4447
4448 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4449                                 int flags, struct net_device *dev,
4450                                 u8 *dst, u8 *next_hop,
4451                                 struct mpath_info *pinfo)
4452 {
4453         void *hdr;
4454         struct nlattr *pinfoattr;
4455
4456         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4457         if (!hdr)
4458                 return -1;
4459
4460         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4461             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4462             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4463             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4464                 goto nla_put_failure;
4465
4466         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4467         if (!pinfoattr)
4468                 goto nla_put_failure;
4469         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4470             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4471                         pinfo->frame_qlen))
4472                 goto nla_put_failure;
4473         if (((pinfo->filled & MPATH_INFO_SN) &&
4474              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4475             ((pinfo->filled & MPATH_INFO_METRIC) &&
4476              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4477                          pinfo->metric)) ||
4478             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4479              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4480                          pinfo->exptime)) ||
4481             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4482              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4483                         pinfo->flags)) ||
4484             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4485              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4486                          pinfo->discovery_timeout)) ||
4487             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4488              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4489                         pinfo->discovery_retries)))
4490                 goto nla_put_failure;
4491
4492         nla_nest_end(msg, pinfoattr);
4493
4494         return genlmsg_end(msg, hdr);
4495
4496  nla_put_failure:
4497         genlmsg_cancel(msg, hdr);
4498         return -EMSGSIZE;
4499 }
4500
4501 static int nl80211_dump_mpath(struct sk_buff *skb,
4502                               struct netlink_callback *cb)
4503 {
4504         struct mpath_info pinfo;
4505         struct cfg80211_registered_device *rdev;
4506         struct wireless_dev *wdev;
4507         u8 dst[ETH_ALEN];
4508         u8 next_hop[ETH_ALEN];
4509         int path_idx = cb->args[2];
4510         int err;
4511
4512         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4513         if (err)
4514                 return err;
4515
4516         if (!rdev->ops->dump_mpath) {
4517                 err = -EOPNOTSUPP;
4518                 goto out_err;
4519         }
4520
4521         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4522                 err = -EOPNOTSUPP;
4523                 goto out_err;
4524         }
4525
4526         while (1) {
4527                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4528                                       next_hop, &pinfo);
4529                 if (err == -ENOENT)
4530                         break;
4531                 if (err)
4532                         goto out_err;
4533
4534                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4535                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4536                                        wdev->netdev, dst, next_hop,
4537                                        &pinfo) < 0)
4538                         goto out;
4539
4540                 path_idx++;
4541         }
4542
4543
4544  out:
4545         cb->args[2] = path_idx;
4546         err = skb->len;
4547  out_err:
4548         nl80211_finish_wdev_dump(rdev);
4549         return err;
4550 }
4551
4552 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4553 {
4554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4555         int err;
4556         struct net_device *dev = info->user_ptr[1];
4557         struct mpath_info pinfo;
4558         struct sk_buff *msg;
4559         u8 *dst = NULL;
4560         u8 next_hop[ETH_ALEN];
4561
4562         memset(&pinfo, 0, sizeof(pinfo));
4563
4564         if (!info->attrs[NL80211_ATTR_MAC])
4565                 return -EINVAL;
4566
4567         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4568
4569         if (!rdev->ops->get_mpath)
4570                 return -EOPNOTSUPP;
4571
4572         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4573                 return -EOPNOTSUPP;
4574
4575         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4576         if (err)
4577                 return err;
4578
4579         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4580         if (!msg)
4581                 return -ENOMEM;
4582
4583         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4584                                  dev, dst, next_hop, &pinfo) < 0) {
4585                 nlmsg_free(msg);
4586                 return -ENOBUFS;
4587         }
4588
4589         return genlmsg_reply(msg, info);
4590 }
4591
4592 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4593 {
4594         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4595         struct net_device *dev = info->user_ptr[1];
4596         u8 *dst = NULL;
4597         u8 *next_hop = NULL;
4598
4599         if (!info->attrs[NL80211_ATTR_MAC])
4600                 return -EINVAL;
4601
4602         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4603                 return -EINVAL;
4604
4605         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4606         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4607
4608         if (!rdev->ops->change_mpath)
4609                 return -EOPNOTSUPP;
4610
4611         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4612                 return -EOPNOTSUPP;
4613
4614         return rdev_change_mpath(rdev, dev, dst, next_hop);
4615 }
4616
4617 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4618 {
4619         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4620         struct net_device *dev = info->user_ptr[1];
4621         u8 *dst = NULL;
4622         u8 *next_hop = NULL;
4623
4624         if (!info->attrs[NL80211_ATTR_MAC])
4625                 return -EINVAL;
4626
4627         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4628                 return -EINVAL;
4629
4630         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4631         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4632
4633         if (!rdev->ops->add_mpath)
4634                 return -EOPNOTSUPP;
4635
4636         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4637                 return -EOPNOTSUPP;
4638
4639         return rdev_add_mpath(rdev, dev, dst, next_hop);
4640 }
4641
4642 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4643 {
4644         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4645         struct net_device *dev = info->user_ptr[1];
4646         u8 *dst = NULL;
4647
4648         if (info->attrs[NL80211_ATTR_MAC])
4649                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4650
4651         if (!rdev->ops->del_mpath)
4652                 return -EOPNOTSUPP;
4653
4654         return rdev_del_mpath(rdev, dev, dst);
4655 }
4656
4657 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4658 {
4659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4660         int err;
4661         struct net_device *dev = info->user_ptr[1];
4662         struct mpath_info pinfo;
4663         struct sk_buff *msg;
4664         u8 *dst = NULL;
4665         u8 mpp[ETH_ALEN];
4666
4667         memset(&pinfo, 0, sizeof(pinfo));
4668
4669         if (!info->attrs[NL80211_ATTR_MAC])
4670                 return -EINVAL;
4671
4672         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4673
4674         if (!rdev->ops->get_mpp)
4675                 return -EOPNOTSUPP;
4676
4677         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4678                 return -EOPNOTSUPP;
4679
4680         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4681         if (err)
4682                 return err;
4683
4684         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4685         if (!msg)
4686                 return -ENOMEM;
4687
4688         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4689                                dev, dst, mpp, &pinfo) < 0) {
4690                 nlmsg_free(msg);
4691                 return -ENOBUFS;
4692         }
4693
4694         return genlmsg_reply(msg, info);
4695 }
4696
4697 static int nl80211_dump_mpp(struct sk_buff *skb,
4698                             struct netlink_callback *cb)
4699 {
4700         struct mpath_info pinfo;
4701         struct cfg80211_registered_device *rdev;
4702         struct wireless_dev *wdev;
4703         u8 dst[ETH_ALEN];
4704         u8 mpp[ETH_ALEN];
4705         int path_idx = cb->args[2];
4706         int err;
4707
4708         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4709         if (err)
4710                 return err;
4711
4712         if (!rdev->ops->dump_mpp) {
4713                 err = -EOPNOTSUPP;
4714                 goto out_err;
4715         }
4716
4717         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4718                 err = -EOPNOTSUPP;
4719                 goto out_err;
4720         }
4721
4722         while (1) {
4723                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4724                                     mpp, &pinfo);
4725                 if (err == -ENOENT)
4726                         break;
4727                 if (err)
4728                         goto out_err;
4729
4730                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4731                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4732                                        wdev->netdev, dst, mpp,
4733                                        &pinfo) < 0)
4734                         goto out;
4735
4736                 path_idx++;
4737         }
4738
4739  out:
4740         cb->args[2] = path_idx;
4741         err = skb->len;
4742  out_err:
4743         nl80211_finish_wdev_dump(rdev);
4744         return err;
4745 }
4746
4747 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4748 {
4749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4750         struct net_device *dev = info->user_ptr[1];
4751         struct wireless_dev *wdev = dev->ieee80211_ptr;
4752         struct bss_parameters params;
4753         int err;
4754
4755         memset(&params, 0, sizeof(params));
4756         /* default to not changing parameters */
4757         params.use_cts_prot = -1;
4758         params.use_short_preamble = -1;
4759         params.use_short_slot_time = -1;
4760         params.ap_isolate = -1;
4761         params.ht_opmode = -1;
4762         params.p2p_ctwindow = -1;
4763         params.p2p_opp_ps = -1;
4764
4765         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4766                 params.use_cts_prot =
4767                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4768         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4769                 params.use_short_preamble =
4770                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4771         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4772                 params.use_short_slot_time =
4773                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4774         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4775                 params.basic_rates =
4776                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4777                 params.basic_rates_len =
4778                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4779         }
4780         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4781                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4782         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4783                 params.ht_opmode =
4784                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4785
4786         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4787                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4788                         return -EINVAL;
4789                 params.p2p_ctwindow =
4790                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4791                 if (params.p2p_ctwindow < 0)
4792                         return -EINVAL;
4793                 if (params.p2p_ctwindow != 0 &&
4794                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4795                         return -EINVAL;
4796         }
4797
4798         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4799                 u8 tmp;
4800
4801                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4802                         return -EINVAL;
4803                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4804                 if (tmp > 1)
4805                         return -EINVAL;
4806                 params.p2p_opp_ps = tmp;
4807                 if (params.p2p_opp_ps &&
4808                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4809                         return -EINVAL;
4810         }
4811
4812         if (!rdev->ops->change_bss)
4813                 return -EOPNOTSUPP;
4814
4815         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4816             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4817                 return -EOPNOTSUPP;
4818
4819         wdev_lock(wdev);
4820         err = rdev_change_bss(rdev, dev, &params);
4821         wdev_unlock(wdev);
4822
4823         return err;
4824 }
4825
4826 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4827         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4828         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4829         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4830         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4831         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4832         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4833         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4834 };
4835
4836 static int parse_reg_rule(struct nlattr *tb[],
4837         struct ieee80211_reg_rule *reg_rule)
4838 {
4839         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4840         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4841
4842         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4843                 return -EINVAL;
4844         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4845                 return -EINVAL;
4846         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4847                 return -EINVAL;
4848         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4849                 return -EINVAL;
4850         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4851                 return -EINVAL;
4852
4853         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4854
4855         freq_range->start_freq_khz =
4856                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4857         freq_range->end_freq_khz =
4858                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4859         freq_range->max_bandwidth_khz =
4860                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4861
4862         power_rule->max_eirp =
4863                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4864
4865         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4866                 power_rule->max_antenna_gain =
4867                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4868
4869         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4870                 reg_rule->dfs_cac_ms =
4871                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4872
4873         return 0;
4874 }
4875
4876 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4877 {
4878         char *data = NULL;
4879         enum nl80211_user_reg_hint_type user_reg_hint_type;
4880
4881         /*
4882          * You should only get this when cfg80211 hasn't yet initialized
4883          * completely when built-in to the kernel right between the time
4884          * window between nl80211_init() and regulatory_init(), if that is
4885          * even possible.
4886          */
4887         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4888                 return -EINPROGRESS;
4889
4890         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4891                 user_reg_hint_type =
4892                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4893         else
4894                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4895
4896         switch (user_reg_hint_type) {
4897         case NL80211_USER_REG_HINT_USER:
4898         case NL80211_USER_REG_HINT_CELL_BASE:
4899                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4900                         return -EINVAL;
4901
4902                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4903                 return regulatory_hint_user(data, user_reg_hint_type);
4904         case NL80211_USER_REG_HINT_INDOOR:
4905                 return regulatory_hint_indoor_user();
4906         default:
4907                 return -EINVAL;
4908         }
4909 }
4910
4911 static int nl80211_get_mesh_config(struct sk_buff *skb,
4912                                    struct genl_info *info)
4913 {
4914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4915         struct net_device *dev = info->user_ptr[1];
4916         struct wireless_dev *wdev = dev->ieee80211_ptr;
4917         struct mesh_config cur_params;
4918         int err = 0;
4919         void *hdr;
4920         struct nlattr *pinfoattr;
4921         struct sk_buff *msg;
4922
4923         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4924                 return -EOPNOTSUPP;
4925
4926         if (!rdev->ops->get_mesh_config)
4927                 return -EOPNOTSUPP;
4928
4929         wdev_lock(wdev);
4930         /* If not connected, get default parameters */
4931         if (!wdev->mesh_id_len)
4932                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4933         else
4934                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4935         wdev_unlock(wdev);
4936
4937         if (err)
4938                 return err;
4939
4940         /* Draw up a netlink message to send back */
4941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4942         if (!msg)
4943                 return -ENOMEM;
4944         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4945                              NL80211_CMD_GET_MESH_CONFIG);
4946         if (!hdr)
4947                 goto out;
4948         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4949         if (!pinfoattr)
4950                 goto nla_put_failure;
4951         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4952             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4953                         cur_params.dot11MeshRetryTimeout) ||
4954             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4955                         cur_params.dot11MeshConfirmTimeout) ||
4956             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4957                         cur_params.dot11MeshHoldingTimeout) ||
4958             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4959                         cur_params.dot11MeshMaxPeerLinks) ||
4960             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4961                        cur_params.dot11MeshMaxRetries) ||
4962             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4963                        cur_params.dot11MeshTTL) ||
4964             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4965                        cur_params.element_ttl) ||
4966             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4967                        cur_params.auto_open_plinks) ||
4968             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4969                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4970             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4971                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4972             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4973                         cur_params.path_refresh_time) ||
4974             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4975                         cur_params.min_discovery_timeout) ||
4976             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4977                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4978             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4979                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4980             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4981                         cur_params.dot11MeshHWMPperrMinInterval) ||
4982             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4983                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4984             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4985                        cur_params.dot11MeshHWMPRootMode) ||
4986             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4987                         cur_params.dot11MeshHWMPRannInterval) ||
4988             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4989                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4990             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4991                        cur_params.dot11MeshForwarding) ||
4992             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4993                         cur_params.rssi_threshold) ||
4994             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4995                         cur_params.ht_opmode) ||
4996             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4997                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4998             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4999                         cur_params.dot11MeshHWMProotInterval) ||
5000             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5001                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5002             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5003                         cur_params.power_mode) ||
5004             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5005                         cur_params.dot11MeshAwakeWindowDuration) ||
5006             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5007                         cur_params.plink_timeout))
5008                 goto nla_put_failure;
5009         nla_nest_end(msg, pinfoattr);
5010         genlmsg_end(msg, hdr);
5011         return genlmsg_reply(msg, info);
5012
5013  nla_put_failure:
5014         genlmsg_cancel(msg, hdr);
5015  out:
5016         nlmsg_free(msg);
5017         return -ENOBUFS;
5018 }
5019
5020 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5021         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5022         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5023         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5024         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5025         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5026         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5027         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5028         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5029         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5030         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5031         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5032         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5033         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5034         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5035         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5036         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5037         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5038         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5039         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5040         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5041         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5042         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5043         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5044         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5045         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5046         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5047         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5048         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5049 };
5050
5051 static const struct nla_policy
5052         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5053         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5054         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5055         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5056         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5057         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5058         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5059         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5060                                     .len = IEEE80211_MAX_DATA_LEN },
5061         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5062 };
5063
5064 static int nl80211_parse_mesh_config(struct genl_info *info,
5065                                      struct mesh_config *cfg,
5066                                      u32 *mask_out)
5067 {
5068         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5069         u32 mask = 0;
5070
5071 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5072 do {                                                                        \
5073         if (tb[attr]) {                                                     \
5074                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5075                         return -EINVAL;                                     \
5076                 cfg->param = fn(tb[attr]);                                  \
5077                 mask |= (1 << (attr - 1));                                  \
5078         }                                                                   \
5079 } while (0)
5080
5081
5082         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5083                 return -EINVAL;
5084         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5085                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5086                              nl80211_meshconf_params_policy))
5087                 return -EINVAL;
5088
5089         /* This makes sure that there aren't more than 32 mesh config
5090          * parameters (otherwise our bitfield scheme would not work.) */
5091         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5092
5093         /* Fill in the params struct */
5094         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5095                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5096                                   nla_get_u16);
5097         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5098                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5099                                   nla_get_u16);
5100         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5101                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5102                                   nla_get_u16);
5103         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5104                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5105                                   nla_get_u16);
5106         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5107                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5108                                   nla_get_u8);
5109         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5110                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5111         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5112                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5113                                   nla_get_u8);
5114         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5115                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5116                                   nla_get_u8);
5117         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5118                                   1, 255, mask,
5119                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5120                                   nla_get_u32);
5121         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5122                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5123                                   nla_get_u8);
5124         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5125                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5126                                   nla_get_u32);
5127         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5128                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5129                                   nla_get_u16);
5130         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5131                                   1, 65535, mask,
5132                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5133                                   nla_get_u32);
5134         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5135                                   1, 65535, mask,
5136                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5137                                   nla_get_u16);
5138         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5139                                   1, 65535, mask,
5140                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5141                                   nla_get_u16);
5142         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5143                                   dot11MeshHWMPnetDiameterTraversalTime,
5144                                   1, 65535, mask,
5145                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5146                                   nla_get_u16);
5147         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5148                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5149                                   nla_get_u8);
5150         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5151                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5152                                   nla_get_u16);
5153         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5154                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5155                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5156                                   nla_get_u8);
5157         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5158                                   mask, NL80211_MESHCONF_FORWARDING,
5159                                   nla_get_u8);
5160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5161                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5162                                   nla_get_s32);
5163         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5164                                   mask, NL80211_MESHCONF_HT_OPMODE,
5165                                   nla_get_u16);
5166         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5167                                   1, 65535, mask,
5168                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5169                                   nla_get_u32);
5170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5171                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5172                                   nla_get_u16);
5173         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5174                                   dot11MeshHWMPconfirmationInterval,
5175                                   1, 65535, mask,
5176                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5177                                   nla_get_u16);
5178         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5179                                   NL80211_MESH_POWER_ACTIVE,
5180                                   NL80211_MESH_POWER_MAX,
5181                                   mask, NL80211_MESHCONF_POWER_MODE,
5182                                   nla_get_u32);
5183         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5184                                   0, 65535, mask,
5185                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5186         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5187                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5188                                   nla_get_u32);
5189         if (mask_out)
5190                 *mask_out = mask;
5191
5192         return 0;
5193
5194 #undef FILL_IN_MESH_PARAM_IF_SET
5195 }
5196
5197 static int nl80211_parse_mesh_setup(struct genl_info *info,
5198                                      struct mesh_setup *setup)
5199 {
5200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5201         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5202
5203         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5204                 return -EINVAL;
5205         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5206                              info->attrs[NL80211_ATTR_MESH_SETUP],
5207                              nl80211_mesh_setup_params_policy))
5208                 return -EINVAL;
5209
5210         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5211                 setup->sync_method =
5212                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5213                  IEEE80211_SYNC_METHOD_VENDOR :
5214                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5215
5216         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5217                 setup->path_sel_proto =
5218                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5219                  IEEE80211_PATH_PROTOCOL_VENDOR :
5220                  IEEE80211_PATH_PROTOCOL_HWMP;
5221
5222         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5223                 setup->path_metric =
5224                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5225                  IEEE80211_PATH_METRIC_VENDOR :
5226                  IEEE80211_PATH_METRIC_AIRTIME;
5227
5228
5229         if (tb[NL80211_MESH_SETUP_IE]) {
5230                 struct nlattr *ieattr =
5231                         tb[NL80211_MESH_SETUP_IE];
5232                 if (!is_valid_ie_attr(ieattr))
5233                         return -EINVAL;
5234                 setup->ie = nla_data(ieattr);
5235                 setup->ie_len = nla_len(ieattr);
5236         }
5237         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5238             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5239                 return -EINVAL;
5240         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5241         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5242         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5243         if (setup->is_secure)
5244                 setup->user_mpm = true;
5245
5246         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5247                 if (!setup->user_mpm)
5248                         return -EINVAL;
5249                 setup->auth_id =
5250                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5251         }
5252
5253         return 0;
5254 }
5255
5256 static int nl80211_update_mesh_config(struct sk_buff *skb,
5257                                       struct genl_info *info)
5258 {
5259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5260         struct net_device *dev = info->user_ptr[1];
5261         struct wireless_dev *wdev = dev->ieee80211_ptr;
5262         struct mesh_config cfg;
5263         u32 mask;
5264         int err;
5265
5266         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5267                 return -EOPNOTSUPP;
5268
5269         if (!rdev->ops->update_mesh_config)
5270                 return -EOPNOTSUPP;
5271
5272         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5273         if (err)
5274                 return err;
5275
5276         wdev_lock(wdev);
5277         if (!wdev->mesh_id_len)
5278                 err = -ENOLINK;
5279
5280         if (!err)
5281                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5282
5283         wdev_unlock(wdev);
5284
5285         return err;
5286 }
5287
5288 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5289 {
5290         const struct ieee80211_regdomain *regdom;
5291         struct sk_buff *msg;
5292         void *hdr = NULL;
5293         struct nlattr *nl_reg_rules;
5294         unsigned int i;
5295
5296         if (!cfg80211_regdomain)
5297                 return -EINVAL;
5298
5299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5300         if (!msg)
5301                 return -ENOBUFS;
5302
5303         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5304                              NL80211_CMD_GET_REG);
5305         if (!hdr)
5306                 goto put_failure;
5307
5308         if (reg_last_request_cell_base() &&
5309             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5310                         NL80211_USER_REG_HINT_CELL_BASE))
5311                 goto nla_put_failure;
5312
5313         rcu_read_lock();
5314         regdom = rcu_dereference(cfg80211_regdomain);
5315
5316         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5317             (regdom->dfs_region &&
5318              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5319                 goto nla_put_failure_rcu;
5320
5321         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5322         if (!nl_reg_rules)
5323                 goto nla_put_failure_rcu;
5324
5325         for (i = 0; i < regdom->n_reg_rules; i++) {
5326                 struct nlattr *nl_reg_rule;
5327                 const struct ieee80211_reg_rule *reg_rule;
5328                 const struct ieee80211_freq_range *freq_range;
5329                 const struct ieee80211_power_rule *power_rule;
5330                 unsigned int max_bandwidth_khz;
5331
5332                 reg_rule = &regdom->reg_rules[i];
5333                 freq_range = &reg_rule->freq_range;
5334                 power_rule = &reg_rule->power_rule;
5335
5336                 nl_reg_rule = nla_nest_start(msg, i);
5337                 if (!nl_reg_rule)
5338                         goto nla_put_failure_rcu;
5339
5340                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5341                 if (!max_bandwidth_khz)
5342                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5343                                                                   reg_rule);
5344
5345                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5346                                 reg_rule->flags) ||
5347                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5348                                 freq_range->start_freq_khz) ||
5349                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5350                                 freq_range->end_freq_khz) ||
5351                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5352                                 max_bandwidth_khz) ||
5353                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5354                                 power_rule->max_antenna_gain) ||
5355                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5356                                 power_rule->max_eirp) ||
5357                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5358                                 reg_rule->dfs_cac_ms))
5359                         goto nla_put_failure_rcu;
5360
5361                 nla_nest_end(msg, nl_reg_rule);
5362         }
5363         rcu_read_unlock();
5364
5365         nla_nest_end(msg, nl_reg_rules);
5366
5367         genlmsg_end(msg, hdr);
5368         return genlmsg_reply(msg, info);
5369
5370 nla_put_failure_rcu:
5371         rcu_read_unlock();
5372 nla_put_failure:
5373         genlmsg_cancel(msg, hdr);
5374 put_failure:
5375         nlmsg_free(msg);
5376         return -EMSGSIZE;
5377 }
5378
5379 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5380 {
5381         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5382         struct nlattr *nl_reg_rule;
5383         char *alpha2 = NULL;
5384         int rem_reg_rules = 0, r = 0;
5385         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5386         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5387         struct ieee80211_regdomain *rd = NULL;
5388
5389         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5390                 return -EINVAL;
5391
5392         if (!info->attrs[NL80211_ATTR_REG_RULES])
5393                 return -EINVAL;
5394
5395         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5396
5397         if (info->attrs[NL80211_ATTR_DFS_REGION])
5398                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5399
5400         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5401                             rem_reg_rules) {
5402                 num_rules++;
5403                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5404                         return -EINVAL;
5405         }
5406
5407         if (!reg_is_valid_request(alpha2))
5408                 return -EINVAL;
5409
5410         size_of_regd = sizeof(struct ieee80211_regdomain) +
5411                        num_rules * sizeof(struct ieee80211_reg_rule);
5412
5413         rd = kzalloc(size_of_regd, GFP_KERNEL);
5414         if (!rd)
5415                 return -ENOMEM;
5416
5417         rd->n_reg_rules = num_rules;
5418         rd->alpha2[0] = alpha2[0];
5419         rd->alpha2[1] = alpha2[1];
5420
5421         /*
5422          * Disable DFS master mode if the DFS region was
5423          * not supported or known on this kernel.
5424          */
5425         if (reg_supported_dfs_region(dfs_region))
5426                 rd->dfs_region = dfs_region;
5427
5428         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5429                             rem_reg_rules) {
5430                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5431                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5432                               reg_rule_policy);
5433                 if (r)
5434                         goto bad_reg;
5435                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5436                 if (r)
5437                         goto bad_reg;
5438
5439                 rule_idx++;
5440
5441                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5442                         r = -EINVAL;
5443                         goto bad_reg;
5444                 }
5445         }
5446
5447         r = set_regdom(rd);
5448         /* set_regdom took ownership */
5449         rd = NULL;
5450
5451  bad_reg:
5452         kfree(rd);
5453         return r;
5454 }
5455
5456 static int validate_scan_freqs(struct nlattr *freqs)
5457 {
5458         struct nlattr *attr1, *attr2;
5459         int n_channels = 0, tmp1, tmp2;
5460
5461         nla_for_each_nested(attr1, freqs, tmp1) {
5462                 n_channels++;
5463                 /*
5464                  * Some hardware has a limited channel list for
5465                  * scanning, and it is pretty much nonsensical
5466                  * to scan for a channel twice, so disallow that
5467                  * and don't require drivers to check that the
5468                  * channel list they get isn't longer than what
5469                  * they can scan, as long as they can scan all
5470                  * the channels they registered at once.
5471                  */
5472                 nla_for_each_nested(attr2, freqs, tmp2)
5473                         if (attr1 != attr2 &&
5474                             nla_get_u32(attr1) == nla_get_u32(attr2))
5475                                 return 0;
5476         }
5477
5478         return n_channels;
5479 }
5480
5481 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5482 {
5483         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5484         struct wireless_dev *wdev = info->user_ptr[1];
5485         struct cfg80211_scan_request *request;
5486         struct nlattr *attr;
5487         struct wiphy *wiphy;
5488         int err, tmp, n_ssids = 0, n_channels, i;
5489         size_t ie_len;
5490
5491         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5492                 return -EINVAL;
5493
5494         wiphy = &rdev->wiphy;
5495
5496         if (!rdev->ops->scan)
5497                 return -EOPNOTSUPP;
5498
5499         if (rdev->scan_req || rdev->scan_msg) {
5500                 err = -EBUSY;
5501                 goto unlock;
5502         }
5503
5504         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5505                 n_channels = validate_scan_freqs(
5506                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5507                 if (!n_channels) {
5508                         err = -EINVAL;
5509                         goto unlock;
5510                 }
5511         } else {
5512                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5513         }
5514
5515         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5516                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5517                         n_ssids++;
5518
5519         if (n_ssids > wiphy->max_scan_ssids) {
5520                 err = -EINVAL;
5521                 goto unlock;
5522         }
5523
5524         if (info->attrs[NL80211_ATTR_IE])
5525                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5526         else
5527                 ie_len = 0;
5528
5529         if (ie_len > wiphy->max_scan_ie_len) {
5530                 err = -EINVAL;
5531                 goto unlock;
5532         }
5533
5534         request = kzalloc(sizeof(*request)
5535                         + sizeof(*request->ssids) * n_ssids
5536                         + sizeof(*request->channels) * n_channels
5537                         + ie_len, GFP_KERNEL);
5538         if (!request) {
5539                 err = -ENOMEM;
5540                 goto unlock;
5541         }
5542
5543         if (n_ssids)
5544                 request->ssids = (void *)&request->channels[n_channels];
5545         request->n_ssids = n_ssids;
5546         if (ie_len) {
5547                 if (request->ssids)
5548                         request->ie = (void *)(request->ssids + n_ssids);
5549                 else
5550                         request->ie = (void *)(request->channels + n_channels);
5551         }
5552
5553         i = 0;
5554         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5555                 /* user specified, bail out if channel not found */
5556                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5557                         struct ieee80211_channel *chan;
5558
5559                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5560
5561                         if (!chan) {
5562                                 err = -EINVAL;
5563                                 goto out_free;
5564                         }
5565
5566                         /* ignore disabled channels */
5567                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5568                                 continue;
5569
5570                         request->channels[i] = chan;
5571                         i++;
5572                 }
5573         } else {
5574                 enum ieee80211_band band;
5575
5576                 /* all channels */
5577                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5578                         int j;
5579                         if (!wiphy->bands[band])
5580                                 continue;
5581                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5582                                 struct ieee80211_channel *chan;
5583
5584                                 chan = &wiphy->bands[band]->channels[j];
5585
5586                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5587                                         continue;
5588
5589                                 request->channels[i] = chan;
5590                                 i++;
5591                         }
5592                 }
5593         }
5594
5595         if (!i) {
5596                 err = -EINVAL;
5597                 goto out_free;
5598         }
5599
5600         request->n_channels = i;
5601
5602         i = 0;
5603         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5604                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5605                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5606                                 err = -EINVAL;
5607                                 goto out_free;
5608                         }
5609                         request->ssids[i].ssid_len = nla_len(attr);
5610                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5611                         i++;
5612                 }
5613         }
5614
5615         if (info->attrs[NL80211_ATTR_IE]) {
5616                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5617                 memcpy((void *)request->ie,
5618                        nla_data(info->attrs[NL80211_ATTR_IE]),
5619                        request->ie_len);
5620         }
5621
5622         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5623                 if (wiphy->bands[i])
5624                         request->rates[i] =
5625                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5626
5627         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5628                 nla_for_each_nested(attr,
5629                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5630                                     tmp) {
5631                         enum ieee80211_band band = nla_type(attr);
5632
5633                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5634                                 err = -EINVAL;
5635                                 goto out_free;
5636                         }
5637
5638                         if (!wiphy->bands[band])
5639                                 continue;
5640
5641                         err = ieee80211_get_ratemask(wiphy->bands[band],
5642                                                      nla_data(attr),
5643                                                      nla_len(attr),
5644                                                      &request->rates[band]);
5645                         if (err)
5646                                 goto out_free;
5647                 }
5648         }
5649
5650         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5651                 request->flags = nla_get_u32(
5652                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5653                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5654                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5655                         err = -EOPNOTSUPP;
5656                         goto out_free;
5657                 }
5658         }
5659
5660         request->no_cck =
5661                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5662
5663         request->wdev = wdev;
5664         request->wiphy = &rdev->wiphy;
5665         request->scan_start = jiffies;
5666
5667         rdev->scan_req = request;
5668         err = rdev_scan(rdev, request);
5669
5670         if (!err) {
5671                 nl80211_send_scan_start(rdev, wdev);
5672                 if (wdev->netdev)
5673                         dev_hold(wdev->netdev);
5674         } else {
5675  out_free:
5676                 rdev->scan_req = NULL;
5677                 kfree(request);
5678         }
5679
5680  unlock:
5681         return err;
5682 }
5683
5684 static int nl80211_start_sched_scan(struct sk_buff *skb,
5685                                     struct genl_info *info)
5686 {
5687         struct cfg80211_sched_scan_request *request;
5688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5689         struct net_device *dev = info->user_ptr[1];
5690         struct nlattr *attr;
5691         struct wiphy *wiphy;
5692         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5693         u32 interval;
5694         enum ieee80211_band band;
5695         size_t ie_len;
5696         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5697         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5698
5699         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5700             !rdev->ops->sched_scan_start)
5701                 return -EOPNOTSUPP;
5702
5703         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5704                 return -EINVAL;
5705
5706         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5707                 return -EINVAL;
5708
5709         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5710         if (interval == 0)
5711                 return -EINVAL;
5712
5713         wiphy = &rdev->wiphy;
5714
5715         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5716                 n_channels = validate_scan_freqs(
5717                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5718                 if (!n_channels)
5719                         return -EINVAL;
5720         } else {
5721                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5722         }
5723
5724         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5725                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5726                                     tmp)
5727                         n_ssids++;
5728
5729         if (n_ssids > wiphy->max_sched_scan_ssids)
5730                 return -EINVAL;
5731
5732         /*
5733          * First, count the number of 'real' matchsets. Due to an issue with
5734          * the old implementation, matchsets containing only the RSSI attribute
5735          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5736          * RSSI for all matchsets, rather than their own matchset for reporting
5737          * all APs with a strong RSSI. This is needed to be compatible with
5738          * older userspace that treated a matchset with only the RSSI as the
5739          * global RSSI for all other matchsets - if there are other matchsets.
5740          */
5741         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5742                 nla_for_each_nested(attr,
5743                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5744                                     tmp) {
5745                         struct nlattr *rssi;
5746
5747                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5748                                         nla_data(attr), nla_len(attr),
5749                                         nl80211_match_policy);
5750                         if (err)
5751                                 return err;
5752                         /* add other standalone attributes here */
5753                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5754                                 n_match_sets++;
5755                                 continue;
5756                         }
5757                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5758                         if (rssi)
5759                                 default_match_rssi = nla_get_s32(rssi);
5760                 }
5761         }
5762
5763         /* However, if there's no other matchset, add the RSSI one */
5764         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5765                 n_match_sets = 1;
5766
5767         if (n_match_sets > wiphy->max_match_sets)
5768                 return -EINVAL;
5769
5770         if (info->attrs[NL80211_ATTR_IE])
5771                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5772         else
5773                 ie_len = 0;
5774
5775         if (ie_len > wiphy->max_sched_scan_ie_len)
5776                 return -EINVAL;
5777
5778         if (rdev->sched_scan_req) {
5779                 err = -EINPROGRESS;
5780                 goto out;
5781         }
5782
5783         request = kzalloc(sizeof(*request)
5784                         + sizeof(*request->ssids) * n_ssids
5785                         + sizeof(*request->match_sets) * n_match_sets
5786                         + sizeof(*request->channels) * n_channels
5787                         + ie_len, GFP_KERNEL);
5788         if (!request) {
5789                 err = -ENOMEM;
5790                 goto out;
5791         }
5792
5793         if (n_ssids)
5794                 request->ssids = (void *)&request->channels[n_channels];
5795         request->n_ssids = n_ssids;
5796         if (ie_len) {
5797                 if (request->ssids)
5798                         request->ie = (void *)(request->ssids + n_ssids);
5799                 else
5800                         request->ie = (void *)(request->channels + n_channels);
5801         }
5802
5803         if (n_match_sets) {
5804                 if (request->ie)
5805                         request->match_sets = (void *)(request->ie + ie_len);
5806                 else if (request->ssids)
5807                         request->match_sets =
5808                                 (void *)(request->ssids + n_ssids);
5809                 else
5810                         request->match_sets =
5811                                 (void *)(request->channels + n_channels);
5812         }
5813         request->n_match_sets = n_match_sets;
5814
5815         i = 0;
5816         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5817                 /* user specified, bail out if channel not found */
5818                 nla_for_each_nested(attr,
5819                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5820                                     tmp) {
5821                         struct ieee80211_channel *chan;
5822
5823                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5824
5825                         if (!chan) {
5826                                 err = -EINVAL;
5827                                 goto out_free;
5828                         }
5829
5830                         /* ignore disabled channels */
5831                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5832                                 continue;
5833
5834                         request->channels[i] = chan;
5835                         i++;
5836                 }
5837         } else {
5838                 /* all channels */
5839                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5840                         int j;
5841                         if (!wiphy->bands[band])
5842                                 continue;
5843                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5844                                 struct ieee80211_channel *chan;
5845
5846                                 chan = &wiphy->bands[band]->channels[j];
5847
5848                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5849                                         continue;
5850
5851                                 request->channels[i] = chan;
5852                                 i++;
5853                         }
5854                 }
5855         }
5856
5857         if (!i) {
5858                 err = -EINVAL;
5859                 goto out_free;
5860         }
5861
5862         request->n_channels = i;
5863
5864         i = 0;
5865         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5866                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5867                                     tmp) {
5868                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5869                                 err = -EINVAL;
5870                                 goto out_free;
5871                         }
5872                         request->ssids[i].ssid_len = nla_len(attr);
5873                         memcpy(request->ssids[i].ssid, nla_data(attr),
5874                                nla_len(attr));
5875                         i++;
5876                 }
5877         }
5878
5879         i = 0;
5880         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5881                 nla_for_each_nested(attr,
5882                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5883                                     tmp) {
5884                         struct nlattr *ssid, *rssi;
5885
5886                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5887                                         nla_data(attr), nla_len(attr),
5888                                         nl80211_match_policy);
5889                         if (err)
5890                                 goto out_free;
5891                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5892                         if (ssid) {
5893                                 if (WARN_ON(i >= n_match_sets)) {
5894                                         /* this indicates a programming error,
5895                                          * the loop above should have verified
5896                                          * things properly
5897                                          */
5898                                         err = -EINVAL;
5899                                         goto out_free;
5900                                 }
5901
5902                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5903                                         err = -EINVAL;
5904                                         goto out_free;
5905                                 }
5906                                 memcpy(request->match_sets[i].ssid.ssid,
5907                                        nla_data(ssid), nla_len(ssid));
5908                                 request->match_sets[i].ssid.ssid_len =
5909                                         nla_len(ssid);
5910                                 /* special attribute - old implemenation w/a */
5911                                 request->match_sets[i].rssi_thold =
5912                                         default_match_rssi;
5913                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5914                                 if (rssi)
5915                                         request->match_sets[i].rssi_thold =
5916                                                 nla_get_s32(rssi);
5917                         }
5918                         i++;
5919                 }
5920
5921                 /* there was no other matchset, so the RSSI one is alone */
5922                 if (i == 0)
5923                         request->match_sets[0].rssi_thold = default_match_rssi;
5924
5925                 request->min_rssi_thold = INT_MAX;
5926                 for (i = 0; i < n_match_sets; i++)
5927                         request->min_rssi_thold =
5928                                 min(request->match_sets[i].rssi_thold,
5929                                     request->min_rssi_thold);
5930         } else {
5931                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5932         }
5933
5934         if (ie_len) {
5935                 request->ie_len = ie_len;
5936                 memcpy((void *)request->ie,
5937                        nla_data(info->attrs[NL80211_ATTR_IE]),
5938                        request->ie_len);
5939         }
5940
5941         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5942                 request->flags = nla_get_u32(
5943                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5944                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5945                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5946                         err = -EOPNOTSUPP;
5947                         goto out_free;
5948                 }
5949         }
5950
5951         request->dev = dev;
5952         request->wiphy = &rdev->wiphy;
5953         request->interval = interval;
5954         request->scan_start = jiffies;
5955
5956         err = rdev_sched_scan_start(rdev, dev, request);
5957         if (!err) {
5958                 rdev->sched_scan_req = request;
5959                 nl80211_send_sched_scan(rdev, dev,
5960                                         NL80211_CMD_START_SCHED_SCAN);
5961                 goto out;
5962         }
5963
5964 out_free:
5965         kfree(request);
5966 out:
5967         return err;
5968 }
5969
5970 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5971                                    struct genl_info *info)
5972 {
5973         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5974
5975         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5976             !rdev->ops->sched_scan_stop)
5977                 return -EOPNOTSUPP;
5978
5979         return __cfg80211_stop_sched_scan(rdev, false);
5980 }
5981
5982 static int nl80211_start_radar_detection(struct sk_buff *skb,
5983                                          struct genl_info *info)
5984 {
5985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5986         struct net_device *dev = info->user_ptr[1];
5987         struct wireless_dev *wdev = dev->ieee80211_ptr;
5988         struct cfg80211_chan_def chandef;
5989         enum nl80211_dfs_regions dfs_region;
5990         unsigned int cac_time_ms;
5991         int err;
5992
5993         dfs_region = reg_get_dfs_region(wdev->wiphy);
5994         if (dfs_region == NL80211_DFS_UNSET)
5995                 return -EINVAL;
5996
5997         err = nl80211_parse_chandef(rdev, info, &chandef);
5998         if (err)
5999                 return err;
6000
6001         if (netif_carrier_ok(dev))
6002                 return -EBUSY;
6003
6004         if (wdev->cac_started)
6005                 return -EBUSY;
6006
6007         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6008                                             wdev->iftype);
6009         if (err < 0)
6010                 return err;
6011
6012         if (err == 0)
6013                 return -EINVAL;
6014
6015         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6016                 return -EINVAL;
6017
6018         if (!rdev->ops->start_radar_detection)
6019                 return -EOPNOTSUPP;
6020
6021         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6022         if (WARN_ON(!cac_time_ms))
6023                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6024
6025         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6026                                                cac_time_ms);
6027         if (!err) {
6028                 wdev->chandef = chandef;
6029                 wdev->cac_started = true;
6030                 wdev->cac_start_time = jiffies;
6031                 wdev->cac_time_ms = cac_time_ms;
6032         }
6033         return err;
6034 }
6035
6036 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6037 {
6038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6039         struct net_device *dev = info->user_ptr[1];
6040         struct wireless_dev *wdev = dev->ieee80211_ptr;
6041         struct cfg80211_csa_settings params;
6042         /* csa_attrs is defined static to avoid waste of stack size - this
6043          * function is called under RTNL lock, so this should not be a problem.
6044          */
6045         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6046         int err;
6047         bool need_new_beacon = false;
6048         int len, i;
6049         u32 cs_count;
6050
6051         if (!rdev->ops->channel_switch ||
6052             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6053                 return -EOPNOTSUPP;
6054
6055         switch (dev->ieee80211_ptr->iftype) {
6056         case NL80211_IFTYPE_AP:
6057         case NL80211_IFTYPE_P2P_GO:
6058                 need_new_beacon = true;
6059
6060                 /* useless if AP is not running */
6061                 if (!wdev->beacon_interval)
6062                         return -ENOTCONN;
6063                 break;
6064         case NL80211_IFTYPE_ADHOC:
6065                 if (!wdev->ssid_len)
6066                         return -ENOTCONN;
6067                 break;
6068         case NL80211_IFTYPE_MESH_POINT:
6069                 if (!wdev->mesh_id_len)
6070                         return -ENOTCONN;
6071                 break;
6072         default:
6073                 return -EOPNOTSUPP;
6074         }
6075
6076         memset(&params, 0, sizeof(params));
6077
6078         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6079             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6080                 return -EINVAL;
6081
6082         /* only important for AP, IBSS and mesh create IEs internally */
6083         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6084                 return -EINVAL;
6085
6086         /* Even though the attribute is u32, the specification says
6087          * u8, so let's make sure we don't overflow.
6088          */
6089         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6090         if (cs_count > 255)
6091                 return -EINVAL;
6092
6093         params.count = cs_count;
6094
6095         if (!need_new_beacon)
6096                 goto skip_beacons;
6097
6098         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6099         if (err)
6100                 return err;
6101
6102         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6103                                info->attrs[NL80211_ATTR_CSA_IES],
6104                                nl80211_policy);
6105         if (err)
6106                 return err;
6107
6108         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6109         if (err)
6110                 return err;
6111
6112         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6113                 return -EINVAL;
6114
6115         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6116         if (!len || (len % sizeof(u16)))
6117                 return -EINVAL;
6118
6119         params.n_counter_offsets_beacon = len / sizeof(u16);
6120         if (rdev->wiphy.max_num_csa_counters &&
6121             (params.n_counter_offsets_beacon >
6122              rdev->wiphy.max_num_csa_counters))
6123                 return -EINVAL;
6124
6125         params.counter_offsets_beacon =
6126                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6127
6128         /* sanity checks - counters should fit and be the same */
6129         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6130                 u16 offset = params.counter_offsets_beacon[i];
6131
6132                 if (offset >= params.beacon_csa.tail_len)
6133                         return -EINVAL;
6134
6135                 if (params.beacon_csa.tail[offset] != params.count)
6136                         return -EINVAL;
6137         }
6138
6139         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6140                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6141                 if (!len || (len % sizeof(u16)))
6142                         return -EINVAL;
6143
6144                 params.n_counter_offsets_presp = len / sizeof(u16);
6145                 if (rdev->wiphy.max_num_csa_counters &&
6146                     (params.n_counter_offsets_beacon >
6147                      rdev->wiphy.max_num_csa_counters))
6148                         return -EINVAL;
6149
6150                 params.counter_offsets_presp =
6151                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6152
6153                 /* sanity checks - counters should fit and be the same */
6154                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6155                         u16 offset = params.counter_offsets_presp[i];
6156
6157                         if (offset >= params.beacon_csa.probe_resp_len)
6158                                 return -EINVAL;
6159
6160                         if (params.beacon_csa.probe_resp[offset] !=
6161                             params.count)
6162                                 return -EINVAL;
6163                 }
6164         }
6165
6166 skip_beacons:
6167         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6168         if (err)
6169                 return err;
6170
6171         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6172                                      wdev->iftype))
6173                 return -EINVAL;
6174
6175         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6176                                             &params.chandef,
6177                                             wdev->iftype);
6178         if (err < 0)
6179                 return err;
6180
6181         if (err > 0)
6182                 params.radar_required = true;
6183
6184         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6185                 params.block_tx = true;
6186
6187         wdev_lock(wdev);
6188         err = rdev_channel_switch(rdev, dev, &params);
6189         wdev_unlock(wdev);
6190
6191         return err;
6192 }
6193
6194 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6195                             u32 seq, int flags,
6196                             struct cfg80211_registered_device *rdev,
6197                             struct wireless_dev *wdev,
6198                             struct cfg80211_internal_bss *intbss)
6199 {
6200         struct cfg80211_bss *res = &intbss->pub;
6201         const struct cfg80211_bss_ies *ies;
6202         void *hdr;
6203         struct nlattr *bss;
6204
6205         ASSERT_WDEV_LOCK(wdev);
6206
6207         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6208                              NL80211_CMD_NEW_SCAN_RESULTS);
6209         if (!hdr)
6210                 return -1;
6211
6212         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6213
6214         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6215                 goto nla_put_failure;
6216         if (wdev->netdev &&
6217             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6218                 goto nla_put_failure;
6219         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6220                 goto nla_put_failure;
6221
6222         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6223         if (!bss)
6224                 goto nla_put_failure;
6225         if ((!is_zero_ether_addr(res->bssid) &&
6226              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6227                 goto nla_put_failure;
6228
6229         rcu_read_lock();
6230         /* indicate whether we have probe response data or not */
6231         if (rcu_access_pointer(res->proberesp_ies) &&
6232             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6233                 goto fail_unlock_rcu;
6234
6235         /* this pointer prefers to be pointed to probe response data
6236          * but is always valid
6237          */
6238         ies = rcu_dereference(res->ies);
6239         if (ies) {
6240                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6241                         goto fail_unlock_rcu;
6242                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6243                                         ies->len, ies->data))
6244                         goto fail_unlock_rcu;
6245         }
6246
6247         /* and this pointer is always (unless driver didn't know) beacon data */
6248         ies = rcu_dereference(res->beacon_ies);
6249         if (ies && ies->from_beacon) {
6250                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6251                         goto fail_unlock_rcu;
6252                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6253                                         ies->len, ies->data))
6254                         goto fail_unlock_rcu;
6255         }
6256         rcu_read_unlock();
6257
6258         if (res->beacon_interval &&
6259             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6260                 goto nla_put_failure;
6261         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6262             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6263             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6264             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6265                         jiffies_to_msecs(jiffies - intbss->ts)))
6266                 goto nla_put_failure;
6267
6268         switch (rdev->wiphy.signal_type) {
6269         case CFG80211_SIGNAL_TYPE_MBM:
6270                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6271                         goto nla_put_failure;
6272                 break;
6273         case CFG80211_SIGNAL_TYPE_UNSPEC:
6274                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6275                         goto nla_put_failure;
6276                 break;
6277         default:
6278                 break;
6279         }
6280
6281         switch (wdev->iftype) {
6282         case NL80211_IFTYPE_P2P_CLIENT:
6283         case NL80211_IFTYPE_STATION:
6284                 if (intbss == wdev->current_bss &&
6285                     nla_put_u32(msg, NL80211_BSS_STATUS,
6286                                 NL80211_BSS_STATUS_ASSOCIATED))
6287                         goto nla_put_failure;
6288                 break;
6289         case NL80211_IFTYPE_ADHOC:
6290                 if (intbss == wdev->current_bss &&
6291                     nla_put_u32(msg, NL80211_BSS_STATUS,
6292                                 NL80211_BSS_STATUS_IBSS_JOINED))
6293                         goto nla_put_failure;
6294                 break;
6295         default:
6296                 break;
6297         }
6298
6299         nla_nest_end(msg, bss);
6300
6301         return genlmsg_end(msg, hdr);
6302
6303  fail_unlock_rcu:
6304         rcu_read_unlock();
6305  nla_put_failure:
6306         genlmsg_cancel(msg, hdr);
6307         return -EMSGSIZE;
6308 }
6309
6310 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6311 {
6312         struct cfg80211_registered_device *rdev;
6313         struct cfg80211_internal_bss *scan;
6314         struct wireless_dev *wdev;
6315         int start = cb->args[2], idx = 0;
6316         int err;
6317
6318         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6319         if (err)
6320                 return err;
6321
6322         wdev_lock(wdev);
6323         spin_lock_bh(&rdev->bss_lock);
6324         cfg80211_bss_expire(rdev);
6325
6326         cb->seq = rdev->bss_generation;
6327
6328         list_for_each_entry(scan, &rdev->bss_list, list) {
6329                 if (++idx <= start)
6330                         continue;
6331                 if (nl80211_send_bss(skb, cb,
6332                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6333                                 rdev, wdev, scan) < 0) {
6334                         idx--;
6335                         break;
6336                 }
6337         }
6338
6339         spin_unlock_bh(&rdev->bss_lock);
6340         wdev_unlock(wdev);
6341
6342         cb->args[2] = idx;
6343         nl80211_finish_wdev_dump(rdev);
6344
6345         return skb->len;
6346 }
6347
6348 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6349                                 int flags, struct net_device *dev,
6350                                 struct survey_info *survey)
6351 {
6352         void *hdr;
6353         struct nlattr *infoattr;
6354
6355         hdr = nl80211hdr_put(msg, portid, seq, flags,
6356                              NL80211_CMD_NEW_SURVEY_RESULTS);
6357         if (!hdr)
6358                 return -ENOMEM;
6359
6360         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6361                 goto nla_put_failure;
6362
6363         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6364         if (!infoattr)
6365                 goto nla_put_failure;
6366
6367         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6368                         survey->channel->center_freq))
6369                 goto nla_put_failure;
6370
6371         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6372             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6373                 goto nla_put_failure;
6374         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6375             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6376                 goto nla_put_failure;
6377         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6378             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6379                         survey->channel_time))
6380                 goto nla_put_failure;
6381         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6382             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6383                         survey->channel_time_busy))
6384                 goto nla_put_failure;
6385         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6386             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6387                         survey->channel_time_ext_busy))
6388                 goto nla_put_failure;
6389         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6390             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6391                         survey->channel_time_rx))
6392                 goto nla_put_failure;
6393         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6394             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6395                         survey->channel_time_tx))
6396                 goto nla_put_failure;
6397
6398         nla_nest_end(msg, infoattr);
6399
6400         return genlmsg_end(msg, hdr);
6401
6402  nla_put_failure:
6403         genlmsg_cancel(msg, hdr);
6404         return -EMSGSIZE;
6405 }
6406
6407 static int nl80211_dump_survey(struct sk_buff *skb,
6408                         struct netlink_callback *cb)
6409 {
6410         struct survey_info survey;
6411         struct cfg80211_registered_device *rdev;
6412         struct wireless_dev *wdev;
6413         int survey_idx = cb->args[2];
6414         int res;
6415
6416         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6417         if (res)
6418                 return res;
6419
6420         if (!wdev->netdev) {
6421                 res = -EINVAL;
6422                 goto out_err;
6423         }
6424
6425         if (!rdev->ops->dump_survey) {
6426                 res = -EOPNOTSUPP;
6427                 goto out_err;
6428         }
6429
6430         while (1) {
6431                 struct ieee80211_channel *chan;
6432
6433                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6434                 if (res == -ENOENT)
6435                         break;
6436                 if (res)
6437                         goto out_err;
6438
6439                 /* Survey without a channel doesn't make sense */
6440                 if (!survey.channel) {
6441                         res = -EINVAL;
6442                         goto out;
6443                 }
6444
6445                 chan = ieee80211_get_channel(&rdev->wiphy,
6446                                              survey.channel->center_freq);
6447                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6448                         survey_idx++;
6449                         continue;
6450                 }
6451
6452                 if (nl80211_send_survey(skb,
6453                                 NETLINK_CB(cb->skb).portid,
6454                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6455                                 wdev->netdev, &survey) < 0)
6456                         goto out;
6457                 survey_idx++;
6458         }
6459
6460  out:
6461         cb->args[2] = survey_idx;
6462         res = skb->len;
6463  out_err:
6464         nl80211_finish_wdev_dump(rdev);
6465         return res;
6466 }
6467
6468 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6469 {
6470         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6471                                   NL80211_WPA_VERSION_2));
6472 }
6473
6474 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6475 {
6476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6477         struct net_device *dev = info->user_ptr[1];
6478         struct ieee80211_channel *chan;
6479         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6480         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6481         enum nl80211_auth_type auth_type;
6482         struct key_parse key;
6483         bool local_state_change;
6484
6485         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6486                 return -EINVAL;
6487
6488         if (!info->attrs[NL80211_ATTR_MAC])
6489                 return -EINVAL;
6490
6491         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6492                 return -EINVAL;
6493
6494         if (!info->attrs[NL80211_ATTR_SSID])
6495                 return -EINVAL;
6496
6497         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6498                 return -EINVAL;
6499
6500         err = nl80211_parse_key(info, &key);
6501         if (err)
6502                 return err;
6503
6504         if (key.idx >= 0) {
6505                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6506                         return -EINVAL;
6507                 if (!key.p.key || !key.p.key_len)
6508                         return -EINVAL;
6509                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6510                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6511                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6512                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6513                         return -EINVAL;
6514                 if (key.idx > 4)
6515                         return -EINVAL;
6516         } else {
6517                 key.p.key_len = 0;
6518                 key.p.key = NULL;
6519         }
6520
6521         if (key.idx >= 0) {
6522                 int i;
6523                 bool ok = false;
6524                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6525                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6526                                 ok = true;
6527                                 break;
6528                         }
6529                 }
6530                 if (!ok)
6531                         return -EINVAL;
6532         }
6533
6534         if (!rdev->ops->auth)
6535                 return -EOPNOTSUPP;
6536
6537         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6538             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6539                 return -EOPNOTSUPP;
6540
6541         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6542         chan = nl80211_get_valid_chan(&rdev->wiphy,
6543                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6544         if (!chan)
6545                 return -EINVAL;
6546
6547         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6548         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6549
6550         if (info->attrs[NL80211_ATTR_IE]) {
6551                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6552                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6553         }
6554
6555         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6556         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6557                 return -EINVAL;
6558
6559         if (auth_type == NL80211_AUTHTYPE_SAE &&
6560             !info->attrs[NL80211_ATTR_SAE_DATA])
6561                 return -EINVAL;
6562
6563         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6564                 if (auth_type != NL80211_AUTHTYPE_SAE)
6565                         return -EINVAL;
6566                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6567                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6568                 /* need to include at least Auth Transaction and Status Code */
6569                 if (sae_data_len < 4)
6570                         return -EINVAL;
6571         }
6572
6573         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6574
6575         /*
6576          * Since we no longer track auth state, ignore
6577          * requests to only change local state.
6578          */
6579         if (local_state_change)
6580                 return 0;
6581
6582         wdev_lock(dev->ieee80211_ptr);
6583         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6584                                  ssid, ssid_len, ie, ie_len,
6585                                  key.p.key, key.p.key_len, key.idx,
6586                                  sae_data, sae_data_len);
6587         wdev_unlock(dev->ieee80211_ptr);
6588         return err;
6589 }
6590
6591 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6592                                    struct genl_info *info,
6593                                    struct cfg80211_crypto_settings *settings,
6594                                    int cipher_limit)
6595 {
6596         memset(settings, 0, sizeof(*settings));
6597
6598         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6599
6600         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6601                 u16 proto;
6602                 proto = nla_get_u16(
6603                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6604                 settings->control_port_ethertype = cpu_to_be16(proto);
6605                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6606                     proto != ETH_P_PAE)
6607                         return -EINVAL;
6608                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6609                         settings->control_port_no_encrypt = true;
6610         } else
6611                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6612
6613         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6614                 void *data;
6615                 int len, i;
6616
6617                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6618                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6619                 settings->n_ciphers_pairwise = len / sizeof(u32);
6620
6621                 if (len % sizeof(u32))
6622                         return -EINVAL;
6623
6624                 if (settings->n_ciphers_pairwise > cipher_limit)
6625                         return -EINVAL;
6626
6627                 memcpy(settings->ciphers_pairwise, data, len);
6628
6629                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6630                         if (!cfg80211_supported_cipher_suite(
6631                                         &rdev->wiphy,
6632                                         settings->ciphers_pairwise[i]))
6633                                 return -EINVAL;
6634         }
6635
6636         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6637                 settings->cipher_group =
6638                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6639                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6640                                                      settings->cipher_group))
6641                         return -EINVAL;
6642         }
6643
6644         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6645                 settings->wpa_versions =
6646                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6647                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6648                         return -EINVAL;
6649         }
6650
6651         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6652                 void *data;
6653                 int len;
6654
6655                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6656                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6657                 settings->n_akm_suites = len / sizeof(u32);
6658
6659                 if (len % sizeof(u32))
6660                         return -EINVAL;
6661
6662                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6663                         return -EINVAL;
6664
6665                 memcpy(settings->akm_suites, data, len);
6666         }
6667
6668         return 0;
6669 }
6670
6671 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6672 {
6673         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6674         struct net_device *dev = info->user_ptr[1];
6675         struct ieee80211_channel *chan;
6676         struct cfg80211_assoc_request req = {};
6677         const u8 *bssid, *ssid;
6678         int err, ssid_len = 0;
6679
6680         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6681                 return -EINVAL;
6682
6683         if (!info->attrs[NL80211_ATTR_MAC] ||
6684             !info->attrs[NL80211_ATTR_SSID] ||
6685             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6686                 return -EINVAL;
6687
6688         if (!rdev->ops->assoc)
6689                 return -EOPNOTSUPP;
6690
6691         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6692             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6693                 return -EOPNOTSUPP;
6694
6695         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6696
6697         chan = nl80211_get_valid_chan(&rdev->wiphy,
6698                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6699         if (!chan)
6700                 return -EINVAL;
6701
6702         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6703         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6704
6705         if (info->attrs[NL80211_ATTR_IE]) {
6706                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6707                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6708         }
6709
6710         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6711                 enum nl80211_mfp mfp =
6712                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6713                 if (mfp == NL80211_MFP_REQUIRED)
6714                         req.use_mfp = true;
6715                 else if (mfp != NL80211_MFP_NO)
6716                         return -EINVAL;
6717         }
6718
6719         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6720                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6721
6722         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6723                 req.flags |= ASSOC_REQ_DISABLE_HT;
6724
6725         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6726                 memcpy(&req.ht_capa_mask,
6727                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6728                        sizeof(req.ht_capa_mask));
6729
6730         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6731                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6732                         return -EINVAL;
6733                 memcpy(&req.ht_capa,
6734                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6735                        sizeof(req.ht_capa));
6736         }
6737
6738         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6739                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6740
6741         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6742                 memcpy(&req.vht_capa_mask,
6743                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6744                        sizeof(req.vht_capa_mask));
6745
6746         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6747                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6748                         return -EINVAL;
6749                 memcpy(&req.vht_capa,
6750                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6751                        sizeof(req.vht_capa));
6752         }
6753
6754         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
6755                 if (!(rdev->wiphy.features &
6756                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
6757                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
6758                         return -EINVAL;
6759                 req.flags |= ASSOC_REQ_USE_RRM;
6760         }
6761
6762         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6763         if (!err) {
6764                 wdev_lock(dev->ieee80211_ptr);
6765                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6766                                           ssid, ssid_len, &req);
6767                 wdev_unlock(dev->ieee80211_ptr);
6768         }
6769
6770         return err;
6771 }
6772
6773 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6774 {
6775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6776         struct net_device *dev = info->user_ptr[1];
6777         const u8 *ie = NULL, *bssid;
6778         int ie_len = 0, err;
6779         u16 reason_code;
6780         bool local_state_change;
6781
6782         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6783                 return -EINVAL;
6784
6785         if (!info->attrs[NL80211_ATTR_MAC])
6786                 return -EINVAL;
6787
6788         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6789                 return -EINVAL;
6790
6791         if (!rdev->ops->deauth)
6792                 return -EOPNOTSUPP;
6793
6794         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6795             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6796                 return -EOPNOTSUPP;
6797
6798         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6799
6800         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6801         if (reason_code == 0) {
6802                 /* Reason Code 0 is reserved */
6803                 return -EINVAL;
6804         }
6805
6806         if (info->attrs[NL80211_ATTR_IE]) {
6807                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6808                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6809         }
6810
6811         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6812
6813         wdev_lock(dev->ieee80211_ptr);
6814         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6815                                    local_state_change);
6816         wdev_unlock(dev->ieee80211_ptr);
6817         return err;
6818 }
6819
6820 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6821 {
6822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6823         struct net_device *dev = info->user_ptr[1];
6824         const u8 *ie = NULL, *bssid;
6825         int ie_len = 0, err;
6826         u16 reason_code;
6827         bool local_state_change;
6828
6829         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6830                 return -EINVAL;
6831
6832         if (!info->attrs[NL80211_ATTR_MAC])
6833                 return -EINVAL;
6834
6835         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6836                 return -EINVAL;
6837
6838         if (!rdev->ops->disassoc)
6839                 return -EOPNOTSUPP;
6840
6841         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6842             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6843                 return -EOPNOTSUPP;
6844
6845         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6846
6847         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6848         if (reason_code == 0) {
6849                 /* Reason Code 0 is reserved */
6850                 return -EINVAL;
6851         }
6852
6853         if (info->attrs[NL80211_ATTR_IE]) {
6854                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6855                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6856         }
6857
6858         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6859
6860         wdev_lock(dev->ieee80211_ptr);
6861         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6862                                      local_state_change);
6863         wdev_unlock(dev->ieee80211_ptr);
6864         return err;
6865 }
6866
6867 static bool
6868 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6869                          int mcast_rate[IEEE80211_NUM_BANDS],
6870                          int rateval)
6871 {
6872         struct wiphy *wiphy = &rdev->wiphy;
6873         bool found = false;
6874         int band, i;
6875
6876         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6877                 struct ieee80211_supported_band *sband;
6878
6879                 sband = wiphy->bands[band];
6880                 if (!sband)
6881                         continue;
6882
6883                 for (i = 0; i < sband->n_bitrates; i++) {
6884                         if (sband->bitrates[i].bitrate == rateval) {
6885                                 mcast_rate[band] = i + 1;
6886                                 found = true;
6887                                 break;
6888                         }
6889                 }
6890         }
6891
6892         return found;
6893 }
6894
6895 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6896 {
6897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6898         struct net_device *dev = info->user_ptr[1];
6899         struct cfg80211_ibss_params ibss;
6900         struct wiphy *wiphy;
6901         struct cfg80211_cached_keys *connkeys = NULL;
6902         int err;
6903
6904         memset(&ibss, 0, sizeof(ibss));
6905
6906         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6907                 return -EINVAL;
6908
6909         if (!info->attrs[NL80211_ATTR_SSID] ||
6910             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6911                 return -EINVAL;
6912
6913         ibss.beacon_interval = 100;
6914
6915         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6916                 ibss.beacon_interval =
6917                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6918                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6919                         return -EINVAL;
6920         }
6921
6922         if (!rdev->ops->join_ibss)
6923                 return -EOPNOTSUPP;
6924
6925         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6926                 return -EOPNOTSUPP;
6927
6928         wiphy = &rdev->wiphy;
6929
6930         if (info->attrs[NL80211_ATTR_MAC]) {
6931                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6932
6933                 if (!is_valid_ether_addr(ibss.bssid))
6934                         return -EINVAL;
6935         }
6936         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6937         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6938
6939         if (info->attrs[NL80211_ATTR_IE]) {
6940                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6941                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6942         }
6943
6944         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6945         if (err)
6946                 return err;
6947
6948         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6949                                      NL80211_IFTYPE_ADHOC))
6950                 return -EINVAL;
6951
6952         switch (ibss.chandef.width) {
6953         case NL80211_CHAN_WIDTH_5:
6954         case NL80211_CHAN_WIDTH_10:
6955         case NL80211_CHAN_WIDTH_20_NOHT:
6956                 break;
6957         case NL80211_CHAN_WIDTH_20:
6958         case NL80211_CHAN_WIDTH_40:
6959                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6960                         break;
6961         default:
6962                 return -EINVAL;
6963         }
6964
6965         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6966         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6967
6968         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6969                 u8 *rates =
6970                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6971                 int n_rates =
6972                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6973                 struct ieee80211_supported_band *sband =
6974                         wiphy->bands[ibss.chandef.chan->band];
6975
6976                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6977                                              &ibss.basic_rates);
6978                 if (err)
6979                         return err;
6980         }
6981
6982         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6983                 memcpy(&ibss.ht_capa_mask,
6984                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6985                        sizeof(ibss.ht_capa_mask));
6986
6987         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6988                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6989                         return -EINVAL;
6990                 memcpy(&ibss.ht_capa,
6991                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6992                        sizeof(ibss.ht_capa));
6993         }
6994
6995         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6996             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6997                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6998                 return -EINVAL;
6999
7000         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7001                 bool no_ht = false;
7002
7003                 connkeys = nl80211_parse_connkeys(rdev,
7004                                           info->attrs[NL80211_ATTR_KEYS],
7005                                           &no_ht);
7006                 if (IS_ERR(connkeys))
7007                         return PTR_ERR(connkeys);
7008
7009                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7010                     no_ht) {
7011                         kfree(connkeys);
7012                         return -EINVAL;
7013                 }
7014         }
7015
7016         ibss.control_port =
7017                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7018
7019         ibss.userspace_handles_dfs =
7020                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7021
7022         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7023         if (err)
7024                 kzfree(connkeys);
7025         return err;
7026 }
7027
7028 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7029 {
7030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7031         struct net_device *dev = info->user_ptr[1];
7032
7033         if (!rdev->ops->leave_ibss)
7034                 return -EOPNOTSUPP;
7035
7036         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7037                 return -EOPNOTSUPP;
7038
7039         return cfg80211_leave_ibss(rdev, dev, false);
7040 }
7041
7042 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7043 {
7044         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7045         struct net_device *dev = info->user_ptr[1];
7046         int mcast_rate[IEEE80211_NUM_BANDS];
7047         u32 nla_rate;
7048         int err;
7049
7050         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7051             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7052                 return -EOPNOTSUPP;
7053
7054         if (!rdev->ops->set_mcast_rate)
7055                 return -EOPNOTSUPP;
7056
7057         memset(mcast_rate, 0, sizeof(mcast_rate));
7058
7059         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7060                 return -EINVAL;
7061
7062         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7063         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7064                 return -EINVAL;
7065
7066         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7067
7068         return err;
7069 }
7070
7071 static struct sk_buff *
7072 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7073                             int approxlen, u32 portid, u32 seq,
7074                             enum nl80211_commands cmd,
7075                             enum nl80211_attrs attr,
7076                             const struct nl80211_vendor_cmd_info *info,
7077                             gfp_t gfp)
7078 {
7079         struct sk_buff *skb;
7080         void *hdr;
7081         struct nlattr *data;
7082
7083         skb = nlmsg_new(approxlen + 100, gfp);
7084         if (!skb)
7085                 return NULL;
7086
7087         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7088         if (!hdr) {
7089                 kfree_skb(skb);
7090                 return NULL;
7091         }
7092
7093         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7094                 goto nla_put_failure;
7095
7096         if (info) {
7097                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7098                                 info->vendor_id))
7099                         goto nla_put_failure;
7100                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7101                                 info->subcmd))
7102                         goto nla_put_failure;
7103         }
7104
7105         data = nla_nest_start(skb, attr);
7106
7107         ((void **)skb->cb)[0] = rdev;
7108         ((void **)skb->cb)[1] = hdr;
7109         ((void **)skb->cb)[2] = data;
7110
7111         return skb;
7112
7113  nla_put_failure:
7114         kfree_skb(skb);
7115         return NULL;
7116 }
7117
7118 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7119                                            enum nl80211_commands cmd,
7120                                            enum nl80211_attrs attr,
7121                                            int vendor_event_idx,
7122                                            int approxlen, gfp_t gfp)
7123 {
7124         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7125         const struct nl80211_vendor_cmd_info *info;
7126
7127         switch (cmd) {
7128         case NL80211_CMD_TESTMODE:
7129                 if (WARN_ON(vendor_event_idx != -1))
7130                         return NULL;
7131                 info = NULL;
7132                 break;
7133         case NL80211_CMD_VENDOR:
7134                 if (WARN_ON(vendor_event_idx < 0 ||
7135                             vendor_event_idx >= wiphy->n_vendor_events))
7136                         return NULL;
7137                 info = &wiphy->vendor_events[vendor_event_idx];
7138                 break;
7139         default:
7140                 WARN_ON(1);
7141                 return NULL;
7142         }
7143
7144         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7145                                            cmd, attr, info, gfp);
7146 }
7147 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7148
7149 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7150 {
7151         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7152         void *hdr = ((void **)skb->cb)[1];
7153         struct nlattr *data = ((void **)skb->cb)[2];
7154         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7155
7156         /* clear CB data for netlink core to own from now on */
7157         memset(skb->cb, 0, sizeof(skb->cb));
7158
7159         nla_nest_end(skb, data);
7160         genlmsg_end(skb, hdr);
7161
7162         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7163                 mcgrp = NL80211_MCGRP_VENDOR;
7164
7165         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7166                                 mcgrp, gfp);
7167 }
7168 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7169
7170 #ifdef CONFIG_NL80211_TESTMODE
7171 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7172 {
7173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7174         struct wireless_dev *wdev =
7175                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7176         int err;
7177
7178         if (!rdev->ops->testmode_cmd)
7179                 return -EOPNOTSUPP;
7180
7181         if (IS_ERR(wdev)) {
7182                 err = PTR_ERR(wdev);
7183                 if (err != -EINVAL)
7184                         return err;
7185                 wdev = NULL;
7186         } else if (wdev->wiphy != &rdev->wiphy) {
7187                 return -EINVAL;
7188         }
7189
7190         if (!info->attrs[NL80211_ATTR_TESTDATA])
7191                 return -EINVAL;
7192
7193         rdev->cur_cmd_info = info;
7194         err = rdev_testmode_cmd(rdev, wdev,
7195                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7196                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7197         rdev->cur_cmd_info = NULL;
7198
7199         return err;
7200 }
7201
7202 static int nl80211_testmode_dump(struct sk_buff *skb,
7203                                  struct netlink_callback *cb)
7204 {
7205         struct cfg80211_registered_device *rdev;
7206         int err;
7207         long phy_idx;
7208         void *data = NULL;
7209         int data_len = 0;
7210
7211         rtnl_lock();
7212
7213         if (cb->args[0]) {
7214                 /*
7215                  * 0 is a valid index, but not valid for args[0],
7216                  * so we need to offset by 1.
7217                  */
7218                 phy_idx = cb->args[0] - 1;
7219         } else {
7220                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7221                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7222                                   nl80211_policy);
7223                 if (err)
7224                         goto out_err;
7225
7226                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7227                                                   nl80211_fam.attrbuf);
7228                 if (IS_ERR(rdev)) {
7229                         err = PTR_ERR(rdev);
7230                         goto out_err;
7231                 }
7232                 phy_idx = rdev->wiphy_idx;
7233                 rdev = NULL;
7234
7235                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7236                         cb->args[1] =
7237                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7238         }
7239
7240         if (cb->args[1]) {
7241                 data = nla_data((void *)cb->args[1]);
7242                 data_len = nla_len((void *)cb->args[1]);
7243         }
7244
7245         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7246         if (!rdev) {
7247                 err = -ENOENT;
7248                 goto out_err;
7249         }
7250
7251         if (!rdev->ops->testmode_dump) {
7252                 err = -EOPNOTSUPP;
7253                 goto out_err;
7254         }
7255
7256         while (1) {
7257                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7258                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7259                                            NL80211_CMD_TESTMODE);
7260                 struct nlattr *tmdata;
7261
7262                 if (!hdr)
7263                         break;
7264
7265                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7266                         genlmsg_cancel(skb, hdr);
7267                         break;
7268                 }
7269
7270                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7271                 if (!tmdata) {
7272                         genlmsg_cancel(skb, hdr);
7273                         break;
7274                 }
7275                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7276                 nla_nest_end(skb, tmdata);
7277
7278                 if (err == -ENOBUFS || err == -ENOENT) {
7279                         genlmsg_cancel(skb, hdr);
7280                         break;
7281                 } else if (err) {
7282                         genlmsg_cancel(skb, hdr);
7283                         goto out_err;
7284                 }
7285
7286                 genlmsg_end(skb, hdr);
7287         }
7288
7289         err = skb->len;
7290         /* see above */
7291         cb->args[0] = phy_idx + 1;
7292  out_err:
7293         rtnl_unlock();
7294         return err;
7295 }
7296 #endif
7297
7298 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7299 {
7300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7301         struct net_device *dev = info->user_ptr[1];
7302         struct cfg80211_connect_params connect;
7303         struct wiphy *wiphy;
7304         struct cfg80211_cached_keys *connkeys = NULL;
7305         int err;
7306
7307         memset(&connect, 0, sizeof(connect));
7308
7309         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7310                 return -EINVAL;
7311
7312         if (!info->attrs[NL80211_ATTR_SSID] ||
7313             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7314                 return -EINVAL;
7315
7316         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7317                 connect.auth_type =
7318                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7319                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7320                                              NL80211_CMD_CONNECT))
7321                         return -EINVAL;
7322         } else
7323                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7324
7325         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7326
7327         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7328                                       NL80211_MAX_NR_CIPHER_SUITES);
7329         if (err)
7330                 return err;
7331
7332         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7333             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7334                 return -EOPNOTSUPP;
7335
7336         wiphy = &rdev->wiphy;
7337
7338         connect.bg_scan_period = -1;
7339         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7340                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7341                 connect.bg_scan_period =
7342                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7343         }
7344
7345         if (info->attrs[NL80211_ATTR_MAC])
7346                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7347         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7348                 connect.bssid_hint =
7349                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7350         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7351         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7352
7353         if (info->attrs[NL80211_ATTR_IE]) {
7354                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7355                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7356         }
7357
7358         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7359                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7360                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7361                     connect.mfp != NL80211_MFP_NO)
7362                         return -EINVAL;
7363         } else {
7364                 connect.mfp = NL80211_MFP_NO;
7365         }
7366
7367         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7368                 connect.channel = nl80211_get_valid_chan(
7369                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7370                 if (!connect.channel)
7371                         return -EINVAL;
7372         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7373                 connect.channel_hint = nl80211_get_valid_chan(
7374                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7375                 if (!connect.channel_hint)
7376                         return -EINVAL;
7377         }
7378
7379         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7380                 connkeys = nl80211_parse_connkeys(rdev,
7381                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7382                 if (IS_ERR(connkeys))
7383                         return PTR_ERR(connkeys);
7384         }
7385
7386         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7387                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7388
7389         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7390                 memcpy(&connect.ht_capa_mask,
7391                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7392                        sizeof(connect.ht_capa_mask));
7393
7394         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7395                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7396                         kzfree(connkeys);
7397                         return -EINVAL;
7398                 }
7399                 memcpy(&connect.ht_capa,
7400                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7401                        sizeof(connect.ht_capa));
7402         }
7403
7404         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7405                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7406
7407         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7408                 memcpy(&connect.vht_capa_mask,
7409                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7410                        sizeof(connect.vht_capa_mask));
7411
7412         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7413                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7414                         kzfree(connkeys);
7415                         return -EINVAL;
7416                 }
7417                 memcpy(&connect.vht_capa,
7418                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7419                        sizeof(connect.vht_capa));
7420         }
7421
7422         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7423                 if (!(rdev->wiphy.features &
7424                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7425                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7426                         return -EINVAL;
7427                 connect.flags |= ASSOC_REQ_USE_RRM;
7428         }
7429
7430         wdev_lock(dev->ieee80211_ptr);
7431         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7432         wdev_unlock(dev->ieee80211_ptr);
7433         if (err)
7434                 kzfree(connkeys);
7435         return err;
7436 }
7437
7438 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7439 {
7440         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7441         struct net_device *dev = info->user_ptr[1];
7442         u16 reason;
7443         int ret;
7444
7445         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7446                 reason = WLAN_REASON_DEAUTH_LEAVING;
7447         else
7448                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7449
7450         if (reason == 0)
7451                 return -EINVAL;
7452
7453         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7454             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7455                 return -EOPNOTSUPP;
7456
7457         wdev_lock(dev->ieee80211_ptr);
7458         ret = cfg80211_disconnect(rdev, dev, reason, true);
7459         wdev_unlock(dev->ieee80211_ptr);
7460         return ret;
7461 }
7462
7463 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7464 {
7465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7466         struct net *net;
7467         int err;
7468         u32 pid;
7469
7470         if (!info->attrs[NL80211_ATTR_PID])
7471                 return -EINVAL;
7472
7473         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7474
7475         net = get_net_ns_by_pid(pid);
7476         if (IS_ERR(net))
7477                 return PTR_ERR(net);
7478
7479         err = 0;
7480
7481         /* check if anything to do */
7482         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7483                 err = cfg80211_switch_netns(rdev, net);
7484
7485         put_net(net);
7486         return err;
7487 }
7488
7489 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7490 {
7491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7492         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7493                         struct cfg80211_pmksa *pmksa) = NULL;
7494         struct net_device *dev = info->user_ptr[1];
7495         struct cfg80211_pmksa pmksa;
7496
7497         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7498
7499         if (!info->attrs[NL80211_ATTR_MAC])
7500                 return -EINVAL;
7501
7502         if (!info->attrs[NL80211_ATTR_PMKID])
7503                 return -EINVAL;
7504
7505         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7506         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7507
7508         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7509             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7510                 return -EOPNOTSUPP;
7511
7512         switch (info->genlhdr->cmd) {
7513         case NL80211_CMD_SET_PMKSA:
7514                 rdev_ops = rdev->ops->set_pmksa;
7515                 break;
7516         case NL80211_CMD_DEL_PMKSA:
7517                 rdev_ops = rdev->ops->del_pmksa;
7518                 break;
7519         default:
7520                 WARN_ON(1);
7521                 break;
7522         }
7523
7524         if (!rdev_ops)
7525                 return -EOPNOTSUPP;
7526
7527         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7528 }
7529
7530 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7531 {
7532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7533         struct net_device *dev = info->user_ptr[1];
7534
7535         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7536             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7537                 return -EOPNOTSUPP;
7538
7539         if (!rdev->ops->flush_pmksa)
7540                 return -EOPNOTSUPP;
7541
7542         return rdev_flush_pmksa(rdev, dev);
7543 }
7544
7545 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7546 {
7547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7548         struct net_device *dev = info->user_ptr[1];
7549         u8 action_code, dialog_token;
7550         u32 peer_capability = 0;
7551         u16 status_code;
7552         u8 *peer;
7553         bool initiator;
7554
7555         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7556             !rdev->ops->tdls_mgmt)
7557                 return -EOPNOTSUPP;
7558
7559         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7560             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7561             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7562             !info->attrs[NL80211_ATTR_IE] ||
7563             !info->attrs[NL80211_ATTR_MAC])
7564                 return -EINVAL;
7565
7566         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7567         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7568         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7569         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7570         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7571         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7572                 peer_capability =
7573                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7574
7575         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7576                               dialog_token, status_code, peer_capability,
7577                               initiator,
7578                               nla_data(info->attrs[NL80211_ATTR_IE]),
7579                               nla_len(info->attrs[NL80211_ATTR_IE]));
7580 }
7581
7582 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7583 {
7584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7585         struct net_device *dev = info->user_ptr[1];
7586         enum nl80211_tdls_operation operation;
7587         u8 *peer;
7588
7589         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7590             !rdev->ops->tdls_oper)
7591                 return -EOPNOTSUPP;
7592
7593         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7594             !info->attrs[NL80211_ATTR_MAC])
7595                 return -EINVAL;
7596
7597         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7598         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7599
7600         return rdev_tdls_oper(rdev, dev, peer, operation);
7601 }
7602
7603 static int nl80211_remain_on_channel(struct sk_buff *skb,
7604                                      struct genl_info *info)
7605 {
7606         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7607         struct wireless_dev *wdev = info->user_ptr[1];
7608         struct cfg80211_chan_def chandef;
7609         struct sk_buff *msg;
7610         void *hdr;
7611         u64 cookie;
7612         u32 duration;
7613         int err;
7614
7615         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7616             !info->attrs[NL80211_ATTR_DURATION])
7617                 return -EINVAL;
7618
7619         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7620
7621         if (!rdev->ops->remain_on_channel ||
7622             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7623                 return -EOPNOTSUPP;
7624
7625         /*
7626          * We should be on that channel for at least a minimum amount of
7627          * time (10ms) but no longer than the driver supports.
7628          */
7629         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7630             duration > rdev->wiphy.max_remain_on_channel_duration)
7631                 return -EINVAL;
7632
7633         err = nl80211_parse_chandef(rdev, info, &chandef);
7634         if (err)
7635                 return err;
7636
7637         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7638         if (!msg)
7639                 return -ENOMEM;
7640
7641         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7642                              NL80211_CMD_REMAIN_ON_CHANNEL);
7643         if (!hdr) {
7644                 err = -ENOBUFS;
7645                 goto free_msg;
7646         }
7647
7648         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7649                                      duration, &cookie);
7650
7651         if (err)
7652                 goto free_msg;
7653
7654         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7655                 goto nla_put_failure;
7656
7657         genlmsg_end(msg, hdr);
7658
7659         return genlmsg_reply(msg, info);
7660
7661  nla_put_failure:
7662         err = -ENOBUFS;
7663  free_msg:
7664         nlmsg_free(msg);
7665         return err;
7666 }
7667
7668 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7669                                             struct genl_info *info)
7670 {
7671         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7672         struct wireless_dev *wdev = info->user_ptr[1];
7673         u64 cookie;
7674
7675         if (!info->attrs[NL80211_ATTR_COOKIE])
7676                 return -EINVAL;
7677
7678         if (!rdev->ops->cancel_remain_on_channel)
7679                 return -EOPNOTSUPP;
7680
7681         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7682
7683         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7684 }
7685
7686 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7687                            u8 *rates, u8 rates_len)
7688 {
7689         u8 i;
7690         u32 mask = 0;
7691
7692         for (i = 0; i < rates_len; i++) {
7693                 int rate = (rates[i] & 0x7f) * 5;
7694                 int ridx;
7695                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7696                         struct ieee80211_rate *srate =
7697                                 &sband->bitrates[ridx];
7698                         if (rate == srate->bitrate) {
7699                                 mask |= 1 << ridx;
7700                                 break;
7701                         }
7702                 }
7703                 if (ridx == sband->n_bitrates)
7704                         return 0; /* rate not found */
7705         }
7706
7707         return mask;
7708 }
7709
7710 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7711                                u8 *rates, u8 rates_len,
7712                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7713 {
7714         u8 i;
7715
7716         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7717
7718         for (i = 0; i < rates_len; i++) {
7719                 int ridx, rbit;
7720
7721                 ridx = rates[i] / 8;
7722                 rbit = BIT(rates[i] % 8);
7723
7724                 /* check validity */
7725                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7726                         return false;
7727
7728                 /* check availability */
7729                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7730                         mcs[ridx] |= rbit;
7731                 else
7732                         return false;
7733         }
7734
7735         return true;
7736 }
7737
7738 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7739 {
7740         u16 mcs_mask = 0;
7741
7742         switch (vht_mcs_map) {
7743         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7744                 break;
7745         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7746                 mcs_mask = 0x00FF;
7747                 break;
7748         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7749                 mcs_mask = 0x01FF;
7750                 break;
7751         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7752                 mcs_mask = 0x03FF;
7753                 break;
7754         default:
7755                 break;
7756         }
7757
7758         return mcs_mask;
7759 }
7760
7761 static void vht_build_mcs_mask(u16 vht_mcs_map,
7762                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7763 {
7764         u8 nss;
7765
7766         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7767                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7768                 vht_mcs_map >>= 2;
7769         }
7770 }
7771
7772 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7773                              struct nl80211_txrate_vht *txrate,
7774                              u16 mcs[NL80211_VHT_NSS_MAX])
7775 {
7776         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7777         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7778         u8 i;
7779
7780         if (!sband->vht_cap.vht_supported)
7781                 return false;
7782
7783         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7784
7785         /* Build vht_mcs_mask from VHT capabilities */
7786         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7787
7788         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7789                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7790                         mcs[i] = txrate->mcs[i];
7791                 else
7792                         return false;
7793         }
7794
7795         return true;
7796 }
7797
7798 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7799         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7800                                     .len = NL80211_MAX_SUPP_RATES },
7801         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7802                                 .len = NL80211_MAX_SUPP_HT_RATES },
7803         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7804         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7805 };
7806
7807 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7808                                        struct genl_info *info)
7809 {
7810         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7811         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7812         struct cfg80211_bitrate_mask mask;
7813         int rem, i;
7814         struct net_device *dev = info->user_ptr[1];
7815         struct nlattr *tx_rates;
7816         struct ieee80211_supported_band *sband;
7817         u16 vht_tx_mcs_map;
7818
7819         if (!rdev->ops->set_bitrate_mask)
7820                 return -EOPNOTSUPP;
7821
7822         memset(&mask, 0, sizeof(mask));
7823         /* Default to all rates enabled */
7824         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7825                 sband = rdev->wiphy.bands[i];
7826
7827                 if (!sband)
7828                         continue;
7829
7830                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7831                 memcpy(mask.control[i].ht_mcs,
7832                        sband->ht_cap.mcs.rx_mask,
7833                        sizeof(mask.control[i].ht_mcs));
7834
7835                 if (!sband->vht_cap.vht_supported)
7836                         continue;
7837
7838                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7839                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7840         }
7841
7842         /* if no rates are given set it back to the defaults */
7843         if (!info->attrs[NL80211_ATTR_TX_RATES])
7844                 goto out;
7845
7846         /*
7847          * The nested attribute uses enum nl80211_band as the index. This maps
7848          * directly to the enum ieee80211_band values used in cfg80211.
7849          */
7850         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7851         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7852                 enum ieee80211_band band = nla_type(tx_rates);
7853                 int err;
7854
7855                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7856                         return -EINVAL;
7857                 sband = rdev->wiphy.bands[band];
7858                 if (sband == NULL)
7859                         return -EINVAL;
7860                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7861                                 nla_len(tx_rates), nl80211_txattr_policy);
7862                 if (err)
7863                         return err;
7864                 if (tb[NL80211_TXRATE_LEGACY]) {
7865                         mask.control[band].legacy = rateset_to_mask(
7866                                 sband,
7867                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7868                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7869                         if ((mask.control[band].legacy == 0) &&
7870                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7871                                 return -EINVAL;
7872                 }
7873                 if (tb[NL80211_TXRATE_HT]) {
7874                         if (!ht_rateset_to_mask(
7875                                         sband,
7876                                         nla_data(tb[NL80211_TXRATE_HT]),
7877                                         nla_len(tb[NL80211_TXRATE_HT]),
7878                                         mask.control[band].ht_mcs))
7879                                 return -EINVAL;
7880                 }
7881                 if (tb[NL80211_TXRATE_VHT]) {
7882                         if (!vht_set_mcs_mask(
7883                                         sband,
7884                                         nla_data(tb[NL80211_TXRATE_VHT]),
7885                                         mask.control[band].vht_mcs))
7886                                 return -EINVAL;
7887                 }
7888                 if (tb[NL80211_TXRATE_GI]) {
7889                         mask.control[band].gi =
7890                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7891                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7892                                 return -EINVAL;
7893                 }
7894
7895                 if (mask.control[band].legacy == 0) {
7896                         /* don't allow empty legacy rates if HT or VHT
7897                          * are not even supported.
7898                          */
7899                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7900                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7901                                 return -EINVAL;
7902
7903                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7904                                 if (mask.control[band].ht_mcs[i])
7905                                         goto out;
7906
7907                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7908                                 if (mask.control[band].vht_mcs[i])
7909                                         goto out;
7910
7911                         /* legacy and mcs rates may not be both empty */
7912                         return -EINVAL;
7913                 }
7914         }
7915
7916 out:
7917         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7918 }
7919
7920 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7921 {
7922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7923         struct wireless_dev *wdev = info->user_ptr[1];
7924         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7925
7926         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7927                 return -EINVAL;
7928
7929         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7930                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7931
7932         switch (wdev->iftype) {
7933         case NL80211_IFTYPE_STATION:
7934         case NL80211_IFTYPE_ADHOC:
7935         case NL80211_IFTYPE_P2P_CLIENT:
7936         case NL80211_IFTYPE_AP:
7937         case NL80211_IFTYPE_AP_VLAN:
7938         case NL80211_IFTYPE_MESH_POINT:
7939         case NL80211_IFTYPE_P2P_GO:
7940         case NL80211_IFTYPE_P2P_DEVICE:
7941                 break;
7942         default:
7943                 return -EOPNOTSUPP;
7944         }
7945
7946         /* not much point in registering if we can't reply */
7947         if (!rdev->ops->mgmt_tx)
7948                 return -EOPNOTSUPP;
7949
7950         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7951                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7952                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7953 }
7954
7955 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7956 {
7957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7958         struct wireless_dev *wdev = info->user_ptr[1];
7959         struct cfg80211_chan_def chandef;
7960         int err;
7961         void *hdr = NULL;
7962         u64 cookie;
7963         struct sk_buff *msg = NULL;
7964         struct cfg80211_mgmt_tx_params params = {
7965                 .dont_wait_for_ack =
7966                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7967         };
7968
7969         if (!info->attrs[NL80211_ATTR_FRAME])
7970                 return -EINVAL;
7971
7972         if (!rdev->ops->mgmt_tx)
7973                 return -EOPNOTSUPP;
7974
7975         switch (wdev->iftype) {
7976         case NL80211_IFTYPE_P2P_DEVICE:
7977                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7978                         return -EINVAL;
7979         case NL80211_IFTYPE_STATION:
7980         case NL80211_IFTYPE_ADHOC:
7981         case NL80211_IFTYPE_P2P_CLIENT:
7982         case NL80211_IFTYPE_AP:
7983         case NL80211_IFTYPE_AP_VLAN:
7984         case NL80211_IFTYPE_MESH_POINT:
7985         case NL80211_IFTYPE_P2P_GO:
7986                 break;
7987         default:
7988                 return -EOPNOTSUPP;
7989         }
7990
7991         if (info->attrs[NL80211_ATTR_DURATION]) {
7992                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7993                         return -EINVAL;
7994                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7995
7996                 /*
7997                  * We should wait on the channel for at least a minimum amount
7998                  * of time (10ms) but no longer than the driver supports.
7999                  */
8000                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8001                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8002                         return -EINVAL;
8003
8004         }
8005
8006         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8007
8008         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8009                 return -EINVAL;
8010
8011         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8012
8013         /* get the channel if any has been specified, otherwise pass NULL to
8014          * the driver. The latter will use the current one
8015          */
8016         chandef.chan = NULL;
8017         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8018                 err = nl80211_parse_chandef(rdev, info, &chandef);
8019                 if (err)
8020                         return err;
8021         }
8022
8023         if (!chandef.chan && params.offchan)
8024                 return -EINVAL;
8025
8026         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8027         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8028
8029         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8030                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8031                 int i;
8032
8033                 if (len % sizeof(u16))
8034                         return -EINVAL;
8035
8036                 params.n_csa_offsets = len / sizeof(u16);
8037                 params.csa_offsets =
8038                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8039
8040                 /* check that all the offsets fit the frame */
8041                 for (i = 0; i < params.n_csa_offsets; i++) {
8042                         if (params.csa_offsets[i] >= params.len)
8043                                 return -EINVAL;
8044                 }
8045         }
8046
8047         if (!params.dont_wait_for_ack) {
8048                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8049                 if (!msg)
8050                         return -ENOMEM;
8051
8052                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8053                                      NL80211_CMD_FRAME);
8054                 if (!hdr) {
8055                         err = -ENOBUFS;
8056                         goto free_msg;
8057                 }
8058         }
8059
8060         params.chan = chandef.chan;
8061         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8062         if (err)
8063                 goto free_msg;
8064
8065         if (msg) {
8066                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8067                         goto nla_put_failure;
8068
8069                 genlmsg_end(msg, hdr);
8070                 return genlmsg_reply(msg, info);
8071         }
8072
8073         return 0;
8074
8075  nla_put_failure:
8076         err = -ENOBUFS;
8077  free_msg:
8078         nlmsg_free(msg);
8079         return err;
8080 }
8081
8082 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8083 {
8084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8085         struct wireless_dev *wdev = info->user_ptr[1];
8086         u64 cookie;
8087
8088         if (!info->attrs[NL80211_ATTR_COOKIE])
8089                 return -EINVAL;
8090
8091         if (!rdev->ops->mgmt_tx_cancel_wait)
8092                 return -EOPNOTSUPP;
8093
8094         switch (wdev->iftype) {
8095         case NL80211_IFTYPE_STATION:
8096         case NL80211_IFTYPE_ADHOC:
8097         case NL80211_IFTYPE_P2P_CLIENT:
8098         case NL80211_IFTYPE_AP:
8099         case NL80211_IFTYPE_AP_VLAN:
8100         case NL80211_IFTYPE_P2P_GO:
8101         case NL80211_IFTYPE_P2P_DEVICE:
8102                 break;
8103         default:
8104                 return -EOPNOTSUPP;
8105         }
8106
8107         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8108
8109         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8110 }
8111
8112 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8113 {
8114         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8115         struct wireless_dev *wdev;
8116         struct net_device *dev = info->user_ptr[1];
8117         u8 ps_state;
8118         bool state;
8119         int err;
8120
8121         if (!info->attrs[NL80211_ATTR_PS_STATE])
8122                 return -EINVAL;
8123
8124         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8125
8126         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8127                 return -EINVAL;
8128
8129         wdev = dev->ieee80211_ptr;
8130
8131         if (!rdev->ops->set_power_mgmt)
8132                 return -EOPNOTSUPP;
8133
8134         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8135
8136         if (state == wdev->ps)
8137                 return 0;
8138
8139         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8140         if (!err)
8141                 wdev->ps = state;
8142         return err;
8143 }
8144
8145 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8146 {
8147         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8148         enum nl80211_ps_state ps_state;
8149         struct wireless_dev *wdev;
8150         struct net_device *dev = info->user_ptr[1];
8151         struct sk_buff *msg;
8152         void *hdr;
8153         int err;
8154
8155         wdev = dev->ieee80211_ptr;
8156
8157         if (!rdev->ops->set_power_mgmt)
8158                 return -EOPNOTSUPP;
8159
8160         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8161         if (!msg)
8162                 return -ENOMEM;
8163
8164         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8165                              NL80211_CMD_GET_POWER_SAVE);
8166         if (!hdr) {
8167                 err = -ENOBUFS;
8168                 goto free_msg;
8169         }
8170
8171         if (wdev->ps)
8172                 ps_state = NL80211_PS_ENABLED;
8173         else
8174                 ps_state = NL80211_PS_DISABLED;
8175
8176         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8177                 goto nla_put_failure;
8178
8179         genlmsg_end(msg, hdr);
8180         return genlmsg_reply(msg, info);
8181
8182  nla_put_failure:
8183         err = -ENOBUFS;
8184  free_msg:
8185         nlmsg_free(msg);
8186         return err;
8187 }
8188
8189 static const struct nla_policy
8190 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8191         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8192         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8193         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8194         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8195         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8196         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8197 };
8198
8199 static int nl80211_set_cqm_txe(struct genl_info *info,
8200                                u32 rate, u32 pkts, u32 intvl)
8201 {
8202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8203         struct net_device *dev = info->user_ptr[1];
8204         struct wireless_dev *wdev = dev->ieee80211_ptr;
8205
8206         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8207                 return -EINVAL;
8208
8209         if (!rdev->ops->set_cqm_txe_config)
8210                 return -EOPNOTSUPP;
8211
8212         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8213             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8214                 return -EOPNOTSUPP;
8215
8216         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8217 }
8218
8219 static int nl80211_set_cqm_rssi(struct genl_info *info,
8220                                 s32 threshold, u32 hysteresis)
8221 {
8222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8223         struct net_device *dev = info->user_ptr[1];
8224         struct wireless_dev *wdev = dev->ieee80211_ptr;
8225
8226         if (threshold > 0)
8227                 return -EINVAL;
8228
8229         /* disabling - hysteresis should also be zero then */
8230         if (threshold == 0)
8231                 hysteresis = 0;
8232
8233         if (!rdev->ops->set_cqm_rssi_config)
8234                 return -EOPNOTSUPP;
8235
8236         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8237             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8238                 return -EOPNOTSUPP;
8239
8240         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8241 }
8242
8243 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8244 {
8245         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8246         struct nlattr *cqm;
8247         int err;
8248
8249         cqm = info->attrs[NL80211_ATTR_CQM];
8250         if (!cqm)
8251                 return -EINVAL;
8252
8253         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8254                                nl80211_attr_cqm_policy);
8255         if (err)
8256                 return err;
8257
8258         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8259             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8260                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8261                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8262
8263                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8264         }
8265
8266         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8267             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8268             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8269                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8270                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8271                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8272
8273                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8274         }
8275
8276         return -EINVAL;
8277 }
8278
8279 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8280 {
8281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8282         struct net_device *dev = info->user_ptr[1];
8283         struct ocb_setup setup = {};
8284         int err;
8285
8286         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8287         if (err)
8288                 return err;
8289
8290         return cfg80211_join_ocb(rdev, dev, &setup);
8291 }
8292
8293 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8294 {
8295         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8296         struct net_device *dev = info->user_ptr[1];
8297
8298         return cfg80211_leave_ocb(rdev, dev);
8299 }
8300
8301 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8302 {
8303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8304         struct net_device *dev = info->user_ptr[1];
8305         struct mesh_config cfg;
8306         struct mesh_setup setup;
8307         int err;
8308
8309         /* start with default */
8310         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8311         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8312
8313         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8314                 /* and parse parameters if given */
8315                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8316                 if (err)
8317                         return err;
8318         }
8319
8320         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8321             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8322                 return -EINVAL;
8323
8324         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8325         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8326
8327         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8328             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8329                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8330                         return -EINVAL;
8331
8332         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8333                 setup.beacon_interval =
8334                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8335                 if (setup.beacon_interval < 10 ||
8336                     setup.beacon_interval > 10000)
8337                         return -EINVAL;
8338         }
8339
8340         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8341                 setup.dtim_period =
8342                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8343                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8344                         return -EINVAL;
8345         }
8346
8347         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8348                 /* parse additional setup parameters if given */
8349                 err = nl80211_parse_mesh_setup(info, &setup);
8350                 if (err)
8351                         return err;
8352         }
8353
8354         if (setup.user_mpm)
8355                 cfg.auto_open_plinks = false;
8356
8357         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8358                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8359                 if (err)
8360                         return err;
8361         } else {
8362                 /* cfg80211_join_mesh() will sort it out */
8363                 setup.chandef.chan = NULL;
8364         }
8365
8366         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8367                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8368                 int n_rates =
8369                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8370                 struct ieee80211_supported_band *sband;
8371
8372                 if (!setup.chandef.chan)
8373                         return -EINVAL;
8374
8375                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8376
8377                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8378                                              &setup.basic_rates);
8379                 if (err)
8380                         return err;
8381         }
8382
8383         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8384 }
8385
8386 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8387 {
8388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8389         struct net_device *dev = info->user_ptr[1];
8390
8391         return cfg80211_leave_mesh(rdev, dev);
8392 }
8393
8394 #ifdef CONFIG_PM
8395 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8396                                         struct cfg80211_registered_device *rdev)
8397 {
8398         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8399         struct nlattr *nl_pats, *nl_pat;
8400         int i, pat_len;
8401
8402         if (!wowlan->n_patterns)
8403                 return 0;
8404
8405         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8406         if (!nl_pats)
8407                 return -ENOBUFS;
8408
8409         for (i = 0; i < wowlan->n_patterns; i++) {
8410                 nl_pat = nla_nest_start(msg, i + 1);
8411                 if (!nl_pat)
8412                         return -ENOBUFS;
8413                 pat_len = wowlan->patterns[i].pattern_len;
8414                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8415                             wowlan->patterns[i].mask) ||
8416                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8417                             wowlan->patterns[i].pattern) ||
8418                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8419                                 wowlan->patterns[i].pkt_offset))
8420                         return -ENOBUFS;
8421                 nla_nest_end(msg, nl_pat);
8422         }
8423         nla_nest_end(msg, nl_pats);
8424
8425         return 0;
8426 }
8427
8428 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8429                                    struct cfg80211_wowlan_tcp *tcp)
8430 {
8431         struct nlattr *nl_tcp;
8432
8433         if (!tcp)
8434                 return 0;
8435
8436         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8437         if (!nl_tcp)
8438                 return -ENOBUFS;
8439
8440         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8441             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8442             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8443             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8444             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8445             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8446                     tcp->payload_len, tcp->payload) ||
8447             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8448                         tcp->data_interval) ||
8449             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8450                     tcp->wake_len, tcp->wake_data) ||
8451             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8452                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8453                 return -ENOBUFS;
8454
8455         if (tcp->payload_seq.len &&
8456             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8457                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8458                 return -ENOBUFS;
8459
8460         if (tcp->payload_tok.len &&
8461             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8462                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8463                     &tcp->payload_tok))
8464                 return -ENOBUFS;
8465
8466         nla_nest_end(msg, nl_tcp);
8467
8468         return 0;
8469 }
8470
8471 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8472 {
8473         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8474         struct sk_buff *msg;
8475         void *hdr;
8476         u32 size = NLMSG_DEFAULT_SIZE;
8477
8478         if (!rdev->wiphy.wowlan)
8479                 return -EOPNOTSUPP;
8480
8481         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8482                 /* adjust size to have room for all the data */
8483                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8484                         rdev->wiphy.wowlan_config->tcp->payload_len +
8485                         rdev->wiphy.wowlan_config->tcp->wake_len +
8486                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8487         }
8488
8489         msg = nlmsg_new(size, GFP_KERNEL);
8490         if (!msg)
8491                 return -ENOMEM;
8492
8493         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8494                              NL80211_CMD_GET_WOWLAN);
8495         if (!hdr)
8496                 goto nla_put_failure;
8497
8498         if (rdev->wiphy.wowlan_config) {
8499                 struct nlattr *nl_wowlan;
8500
8501                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8502                 if (!nl_wowlan)
8503                         goto nla_put_failure;
8504
8505                 if ((rdev->wiphy.wowlan_config->any &&
8506                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8507                     (rdev->wiphy.wowlan_config->disconnect &&
8508                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8509                     (rdev->wiphy.wowlan_config->magic_pkt &&
8510                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8511                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8512                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8513                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8514                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8515                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8516                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8517                     (rdev->wiphy.wowlan_config->rfkill_release &&
8518                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8519                         goto nla_put_failure;
8520
8521                 if (nl80211_send_wowlan_patterns(msg, rdev))
8522                         goto nla_put_failure;
8523
8524                 if (nl80211_send_wowlan_tcp(msg,
8525                                             rdev->wiphy.wowlan_config->tcp))
8526                         goto nla_put_failure;
8527
8528                 nla_nest_end(msg, nl_wowlan);
8529         }
8530
8531         genlmsg_end(msg, hdr);
8532         return genlmsg_reply(msg, info);
8533
8534 nla_put_failure:
8535         nlmsg_free(msg);
8536         return -ENOBUFS;
8537 }
8538
8539 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8540                                     struct nlattr *attr,
8541                                     struct cfg80211_wowlan *trig)
8542 {
8543         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8544         struct cfg80211_wowlan_tcp *cfg;
8545         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8546         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8547         u32 size;
8548         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8549         int err, port;
8550
8551         if (!rdev->wiphy.wowlan->tcp)
8552                 return -EINVAL;
8553
8554         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8555                         nla_data(attr), nla_len(attr),
8556                         nl80211_wowlan_tcp_policy);
8557         if (err)
8558                 return err;
8559
8560         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8561             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8562             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8563             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8564             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8565             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8566             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8567             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8568                 return -EINVAL;
8569
8570         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8571         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8572                 return -EINVAL;
8573
8574         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8575                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8576             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8577                 return -EINVAL;
8578
8579         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8580         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8581                 return -EINVAL;
8582
8583         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8584         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8585                 return -EINVAL;
8586
8587         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8588                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8589
8590                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8591                 tokens_size = tokln - sizeof(*tok);
8592
8593                 if (!tok->len || tokens_size % tok->len)
8594                         return -EINVAL;
8595                 if (!rdev->wiphy.wowlan->tcp->tok)
8596                         return -EINVAL;
8597                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8598                         return -EINVAL;
8599                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8600                         return -EINVAL;
8601                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8602                         return -EINVAL;
8603                 if (tok->offset + tok->len > data_size)
8604                         return -EINVAL;
8605         }
8606
8607         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8608                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8609                 if (!rdev->wiphy.wowlan->tcp->seq)
8610                         return -EINVAL;
8611                 if (seq->len == 0 || seq->len > 4)
8612                         return -EINVAL;
8613                 if (seq->len + seq->offset > data_size)
8614                         return -EINVAL;
8615         }
8616
8617         size = sizeof(*cfg);
8618         size += data_size;
8619         size += wake_size + wake_mask_size;
8620         size += tokens_size;
8621
8622         cfg = kzalloc(size, GFP_KERNEL);
8623         if (!cfg)
8624                 return -ENOMEM;
8625         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8626         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8627         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8628                ETH_ALEN);
8629         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8630                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8631         else
8632                 port = 0;
8633 #ifdef CONFIG_INET
8634         /* allocate a socket and port for it and use it */
8635         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8636                             IPPROTO_TCP, &cfg->sock, 1);
8637         if (err) {
8638                 kfree(cfg);
8639                 return err;
8640         }
8641         if (inet_csk_get_port(cfg->sock->sk, port)) {
8642                 sock_release(cfg->sock);
8643                 kfree(cfg);
8644                 return -EADDRINUSE;
8645         }
8646         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8647 #else
8648         if (!port) {
8649                 kfree(cfg);
8650                 return -EINVAL;
8651         }
8652         cfg->src_port = port;
8653 #endif
8654
8655         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8656         cfg->payload_len = data_size;
8657         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8658         memcpy((void *)cfg->payload,
8659                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8660                data_size);
8661         if (seq)
8662                 cfg->payload_seq = *seq;
8663         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8664         cfg->wake_len = wake_size;
8665         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8666         memcpy((void *)cfg->wake_data,
8667                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8668                wake_size);
8669         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8670                          data_size + wake_size;
8671         memcpy((void *)cfg->wake_mask,
8672                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8673                wake_mask_size);
8674         if (tok) {
8675                 cfg->tokens_size = tokens_size;
8676                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8677         }
8678
8679         trig->tcp = cfg;
8680
8681         return 0;
8682 }
8683
8684 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8685 {
8686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8687         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8688         struct cfg80211_wowlan new_triggers = {};
8689         struct cfg80211_wowlan *ntrig;
8690         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8691         int err, i;
8692         bool prev_enabled = rdev->wiphy.wowlan_config;
8693
8694         if (!wowlan)
8695                 return -EOPNOTSUPP;
8696
8697         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8698                 cfg80211_rdev_free_wowlan(rdev);
8699                 rdev->wiphy.wowlan_config = NULL;
8700                 goto set_wakeup;
8701         }
8702
8703         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8704                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8705                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8706                         nl80211_wowlan_policy);
8707         if (err)
8708                 return err;
8709
8710         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8711                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8712                         return -EINVAL;
8713                 new_triggers.any = true;
8714         }
8715
8716         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8717                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8718                         return -EINVAL;
8719                 new_triggers.disconnect = true;
8720         }
8721
8722         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8723                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8724                         return -EINVAL;
8725                 new_triggers.magic_pkt = true;
8726         }
8727
8728         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8729                 return -EINVAL;
8730
8731         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8732                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8733                         return -EINVAL;
8734                 new_triggers.gtk_rekey_failure = true;
8735         }
8736
8737         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8738                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8739                         return -EINVAL;
8740                 new_triggers.eap_identity_req = true;
8741         }
8742
8743         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8744                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8745                         return -EINVAL;
8746                 new_triggers.four_way_handshake = true;
8747         }
8748
8749         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8750                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8751                         return -EINVAL;
8752                 new_triggers.rfkill_release = true;
8753         }
8754
8755         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8756                 struct nlattr *pat;
8757                 int n_patterns = 0;
8758                 int rem, pat_len, mask_len, pkt_offset;
8759                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8760
8761                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8762                                     rem)
8763                         n_patterns++;
8764                 if (n_patterns > wowlan->n_patterns)
8765                         return -EINVAL;
8766
8767                 new_triggers.patterns = kcalloc(n_patterns,
8768                                                 sizeof(new_triggers.patterns[0]),
8769                                                 GFP_KERNEL);
8770                 if (!new_triggers.patterns)
8771                         return -ENOMEM;
8772
8773                 new_triggers.n_patterns = n_patterns;
8774                 i = 0;
8775
8776                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8777                                     rem) {
8778                         u8 *mask_pat;
8779
8780                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8781                                   nla_len(pat), NULL);
8782                         err = -EINVAL;
8783                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8784                             !pat_tb[NL80211_PKTPAT_PATTERN])
8785                                 goto error;
8786                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8787                         mask_len = DIV_ROUND_UP(pat_len, 8);
8788                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8789                                 goto error;
8790                         if (pat_len > wowlan->pattern_max_len ||
8791                             pat_len < wowlan->pattern_min_len)
8792                                 goto error;
8793
8794                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8795                                 pkt_offset = 0;
8796                         else
8797                                 pkt_offset = nla_get_u32(
8798                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8799                         if (pkt_offset > wowlan->max_pkt_offset)
8800                                 goto error;
8801                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8802
8803                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8804                         if (!mask_pat) {
8805                                 err = -ENOMEM;
8806                                 goto error;
8807                         }
8808                         new_triggers.patterns[i].mask = mask_pat;
8809                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8810                                mask_len);
8811                         mask_pat += mask_len;
8812                         new_triggers.patterns[i].pattern = mask_pat;
8813                         new_triggers.patterns[i].pattern_len = pat_len;
8814                         memcpy(mask_pat,
8815                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8816                                pat_len);
8817                         i++;
8818                 }
8819         }
8820
8821         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8822                 err = nl80211_parse_wowlan_tcp(
8823                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8824                         &new_triggers);
8825                 if (err)
8826                         goto error;
8827         }
8828
8829         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8830         if (!ntrig) {
8831                 err = -ENOMEM;
8832                 goto error;
8833         }
8834         cfg80211_rdev_free_wowlan(rdev);
8835         rdev->wiphy.wowlan_config = ntrig;
8836
8837  set_wakeup:
8838         if (rdev->ops->set_wakeup &&
8839             prev_enabled != !!rdev->wiphy.wowlan_config)
8840                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8841
8842         return 0;
8843  error:
8844         for (i = 0; i < new_triggers.n_patterns; i++)
8845                 kfree(new_triggers.patterns[i].mask);
8846         kfree(new_triggers.patterns);
8847         if (new_triggers.tcp && new_triggers.tcp->sock)
8848                 sock_release(new_triggers.tcp->sock);
8849         kfree(new_triggers.tcp);
8850         return err;
8851 }
8852 #endif
8853
8854 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8855                                        struct cfg80211_registered_device *rdev)
8856 {
8857         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8858         int i, j, pat_len;
8859         struct cfg80211_coalesce_rules *rule;
8860
8861         if (!rdev->coalesce->n_rules)
8862                 return 0;
8863
8864         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8865         if (!nl_rules)
8866                 return -ENOBUFS;
8867
8868         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8869                 nl_rule = nla_nest_start(msg, i + 1);
8870                 if (!nl_rule)
8871                         return -ENOBUFS;
8872
8873                 rule = &rdev->coalesce->rules[i];
8874                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8875                                 rule->delay))
8876                         return -ENOBUFS;
8877
8878                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8879                                 rule->condition))
8880                         return -ENOBUFS;
8881
8882                 nl_pats = nla_nest_start(msg,
8883                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8884                 if (!nl_pats)
8885                         return -ENOBUFS;
8886
8887                 for (j = 0; j < rule->n_patterns; j++) {
8888                         nl_pat = nla_nest_start(msg, j + 1);
8889                         if (!nl_pat)
8890                                 return -ENOBUFS;
8891                         pat_len = rule->patterns[j].pattern_len;
8892                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8893                                     DIV_ROUND_UP(pat_len, 8),
8894                                     rule->patterns[j].mask) ||
8895                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8896                                     rule->patterns[j].pattern) ||
8897                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8898                                         rule->patterns[j].pkt_offset))
8899                                 return -ENOBUFS;
8900                         nla_nest_end(msg, nl_pat);
8901                 }
8902                 nla_nest_end(msg, nl_pats);
8903                 nla_nest_end(msg, nl_rule);
8904         }
8905         nla_nest_end(msg, nl_rules);
8906
8907         return 0;
8908 }
8909
8910 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8911 {
8912         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8913         struct sk_buff *msg;
8914         void *hdr;
8915
8916         if (!rdev->wiphy.coalesce)
8917                 return -EOPNOTSUPP;
8918
8919         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8920         if (!msg)
8921                 return -ENOMEM;
8922
8923         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8924                              NL80211_CMD_GET_COALESCE);
8925         if (!hdr)
8926                 goto nla_put_failure;
8927
8928         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8929                 goto nla_put_failure;
8930
8931         genlmsg_end(msg, hdr);
8932         return genlmsg_reply(msg, info);
8933
8934 nla_put_failure:
8935         nlmsg_free(msg);
8936         return -ENOBUFS;
8937 }
8938
8939 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8940 {
8941         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8942         int i, j;
8943         struct cfg80211_coalesce_rules *rule;
8944
8945         if (!coalesce)
8946                 return;
8947
8948         for (i = 0; i < coalesce->n_rules; i++) {
8949                 rule = &coalesce->rules[i];
8950                 for (j = 0; j < rule->n_patterns; j++)
8951                         kfree(rule->patterns[j].mask);
8952                 kfree(rule->patterns);
8953         }
8954         kfree(coalesce->rules);
8955         kfree(coalesce);
8956         rdev->coalesce = NULL;
8957 }
8958
8959 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8960                                        struct nlattr *rule,
8961                                        struct cfg80211_coalesce_rules *new_rule)
8962 {
8963         int err, i;
8964         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8965         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8966         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8967         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8968
8969         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8970                         nla_len(rule), nl80211_coalesce_policy);
8971         if (err)
8972                 return err;
8973
8974         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8975                 new_rule->delay =
8976                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8977         if (new_rule->delay > coalesce->max_delay)
8978                 return -EINVAL;
8979
8980         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8981                 new_rule->condition =
8982                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8983         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8984             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8985                 return -EINVAL;
8986
8987         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8988                 return -EINVAL;
8989
8990         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8991                             rem)
8992                 n_patterns++;
8993         if (n_patterns > coalesce->n_patterns)
8994                 return -EINVAL;
8995
8996         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8997                                      GFP_KERNEL);
8998         if (!new_rule->patterns)
8999                 return -ENOMEM;
9000
9001         new_rule->n_patterns = n_patterns;
9002         i = 0;
9003
9004         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9005                             rem) {
9006                 u8 *mask_pat;
9007
9008                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9009                           nla_len(pat), NULL);
9010                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9011                     !pat_tb[NL80211_PKTPAT_PATTERN])
9012                         return -EINVAL;
9013                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9014                 mask_len = DIV_ROUND_UP(pat_len, 8);
9015                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9016                         return -EINVAL;
9017                 if (pat_len > coalesce->pattern_max_len ||
9018                     pat_len < coalesce->pattern_min_len)
9019                         return -EINVAL;
9020
9021                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9022                         pkt_offset = 0;
9023                 else
9024                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9025                 if (pkt_offset > coalesce->max_pkt_offset)
9026                         return -EINVAL;
9027                 new_rule->patterns[i].pkt_offset = pkt_offset;
9028
9029                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9030                 if (!mask_pat)
9031                         return -ENOMEM;
9032
9033                 new_rule->patterns[i].mask = mask_pat;
9034                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9035                        mask_len);
9036
9037                 mask_pat += mask_len;
9038                 new_rule->patterns[i].pattern = mask_pat;
9039                 new_rule->patterns[i].pattern_len = pat_len;
9040                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9041                        pat_len);
9042                 i++;
9043         }
9044
9045         return 0;
9046 }
9047
9048 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9049 {
9050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9051         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9052         struct cfg80211_coalesce new_coalesce = {};
9053         struct cfg80211_coalesce *n_coalesce;
9054         int err, rem_rule, n_rules = 0, i, j;
9055         struct nlattr *rule;
9056         struct cfg80211_coalesce_rules *tmp_rule;
9057
9058         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9059                 return -EOPNOTSUPP;
9060
9061         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9062                 cfg80211_rdev_free_coalesce(rdev);
9063                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9064                 return 0;
9065         }
9066
9067         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9068                             rem_rule)
9069                 n_rules++;
9070         if (n_rules > coalesce->n_rules)
9071                 return -EINVAL;
9072
9073         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9074                                      GFP_KERNEL);
9075         if (!new_coalesce.rules)
9076                 return -ENOMEM;
9077
9078         new_coalesce.n_rules = n_rules;
9079         i = 0;
9080
9081         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9082                             rem_rule) {
9083                 err = nl80211_parse_coalesce_rule(rdev, rule,
9084                                                   &new_coalesce.rules[i]);
9085                 if (err)
9086                         goto error;
9087
9088                 i++;
9089         }
9090
9091         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9092         if (err)
9093                 goto error;
9094
9095         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9096         if (!n_coalesce) {
9097                 err = -ENOMEM;
9098                 goto error;
9099         }
9100         cfg80211_rdev_free_coalesce(rdev);
9101         rdev->coalesce = n_coalesce;
9102
9103         return 0;
9104 error:
9105         for (i = 0; i < new_coalesce.n_rules; i++) {
9106                 tmp_rule = &new_coalesce.rules[i];
9107                 for (j = 0; j < tmp_rule->n_patterns; j++)
9108                         kfree(tmp_rule->patterns[j].mask);
9109                 kfree(tmp_rule->patterns);
9110         }
9111         kfree(new_coalesce.rules);
9112
9113         return err;
9114 }
9115
9116 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9117 {
9118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9119         struct net_device *dev = info->user_ptr[1];
9120         struct wireless_dev *wdev = dev->ieee80211_ptr;
9121         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9122         struct cfg80211_gtk_rekey_data rekey_data;
9123         int err;
9124
9125         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9126                 return -EINVAL;
9127
9128         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9129                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9130                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9131                         nl80211_rekey_policy);
9132         if (err)
9133                 return err;
9134
9135         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9136                 return -ERANGE;
9137         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9138                 return -ERANGE;
9139         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9140                 return -ERANGE;
9141
9142         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9143         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9144         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9145
9146         wdev_lock(wdev);
9147         if (!wdev->current_bss) {
9148                 err = -ENOTCONN;
9149                 goto out;
9150         }
9151
9152         if (!rdev->ops->set_rekey_data) {
9153                 err = -EOPNOTSUPP;
9154                 goto out;
9155         }
9156
9157         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9158  out:
9159         wdev_unlock(wdev);
9160         return err;
9161 }
9162
9163 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9164                                              struct genl_info *info)
9165 {
9166         struct net_device *dev = info->user_ptr[1];
9167         struct wireless_dev *wdev = dev->ieee80211_ptr;
9168
9169         if (wdev->iftype != NL80211_IFTYPE_AP &&
9170             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9171                 return -EINVAL;
9172
9173         if (wdev->ap_unexpected_nlportid)
9174                 return -EBUSY;
9175
9176         wdev->ap_unexpected_nlportid = info->snd_portid;
9177         return 0;
9178 }
9179
9180 static int nl80211_probe_client(struct sk_buff *skb,
9181                                 struct genl_info *info)
9182 {
9183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9184         struct net_device *dev = info->user_ptr[1];
9185         struct wireless_dev *wdev = dev->ieee80211_ptr;
9186         struct sk_buff *msg;
9187         void *hdr;
9188         const u8 *addr;
9189         u64 cookie;
9190         int err;
9191
9192         if (wdev->iftype != NL80211_IFTYPE_AP &&
9193             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9194                 return -EOPNOTSUPP;
9195
9196         if (!info->attrs[NL80211_ATTR_MAC])
9197                 return -EINVAL;
9198
9199         if (!rdev->ops->probe_client)
9200                 return -EOPNOTSUPP;
9201
9202         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9203         if (!msg)
9204                 return -ENOMEM;
9205
9206         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9207                              NL80211_CMD_PROBE_CLIENT);
9208         if (!hdr) {
9209                 err = -ENOBUFS;
9210                 goto free_msg;
9211         }
9212
9213         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9214
9215         err = rdev_probe_client(rdev, dev, addr, &cookie);
9216         if (err)
9217                 goto free_msg;
9218
9219         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9220                 goto nla_put_failure;
9221
9222         genlmsg_end(msg, hdr);
9223
9224         return genlmsg_reply(msg, info);
9225
9226  nla_put_failure:
9227         err = -ENOBUFS;
9228  free_msg:
9229         nlmsg_free(msg);
9230         return err;
9231 }
9232
9233 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9234 {
9235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9236         struct cfg80211_beacon_registration *reg, *nreg;
9237         int rv;
9238
9239         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9240                 return -EOPNOTSUPP;
9241
9242         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9243         if (!nreg)
9244                 return -ENOMEM;
9245
9246         /* First, check if already registered. */
9247         spin_lock_bh(&rdev->beacon_registrations_lock);
9248         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9249                 if (reg->nlportid == info->snd_portid) {
9250                         rv = -EALREADY;
9251                         goto out_err;
9252                 }
9253         }
9254         /* Add it to the list */
9255         nreg->nlportid = info->snd_portid;
9256         list_add(&nreg->list, &rdev->beacon_registrations);
9257
9258         spin_unlock_bh(&rdev->beacon_registrations_lock);
9259
9260         return 0;
9261 out_err:
9262         spin_unlock_bh(&rdev->beacon_registrations_lock);
9263         kfree(nreg);
9264         return rv;
9265 }
9266
9267 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9268 {
9269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9270         struct wireless_dev *wdev = info->user_ptr[1];
9271         int err;
9272
9273         if (!rdev->ops->start_p2p_device)
9274                 return -EOPNOTSUPP;
9275
9276         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9277                 return -EOPNOTSUPP;
9278
9279         if (wdev->p2p_started)
9280                 return 0;
9281
9282         if (rfkill_blocked(rdev->rfkill))
9283                 return -ERFKILL;
9284
9285         err = rdev_start_p2p_device(rdev, wdev);
9286         if (err)
9287                 return err;
9288
9289         wdev->p2p_started = true;
9290         rdev->opencount++;
9291
9292         return 0;
9293 }
9294
9295 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9296 {
9297         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9298         struct wireless_dev *wdev = info->user_ptr[1];
9299
9300         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9301                 return -EOPNOTSUPP;
9302
9303         if (!rdev->ops->stop_p2p_device)
9304                 return -EOPNOTSUPP;
9305
9306         cfg80211_stop_p2p_device(rdev, wdev);
9307
9308         return 0;
9309 }
9310
9311 static int nl80211_get_protocol_features(struct sk_buff *skb,
9312                                          struct genl_info *info)
9313 {
9314         void *hdr;
9315         struct sk_buff *msg;
9316
9317         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9318         if (!msg)
9319                 return -ENOMEM;
9320
9321         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9322                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9323         if (!hdr)
9324                 goto nla_put_failure;
9325
9326         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9327                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9328                 goto nla_put_failure;
9329
9330         genlmsg_end(msg, hdr);
9331         return genlmsg_reply(msg, info);
9332
9333  nla_put_failure:
9334         kfree_skb(msg);
9335         return -ENOBUFS;
9336 }
9337
9338 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9339 {
9340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9341         struct cfg80211_update_ft_ies_params ft_params;
9342         struct net_device *dev = info->user_ptr[1];
9343
9344         if (!rdev->ops->update_ft_ies)
9345                 return -EOPNOTSUPP;
9346
9347         if (!info->attrs[NL80211_ATTR_MDID] ||
9348             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9349                 return -EINVAL;
9350
9351         memset(&ft_params, 0, sizeof(ft_params));
9352         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9353         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9354         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9355
9356         return rdev_update_ft_ies(rdev, dev, &ft_params);
9357 }
9358
9359 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9360                                        struct genl_info *info)
9361 {
9362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9363         struct wireless_dev *wdev = info->user_ptr[1];
9364         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9365         u16 duration;
9366         int ret;
9367
9368         if (!rdev->ops->crit_proto_start)
9369                 return -EOPNOTSUPP;
9370
9371         if (WARN_ON(!rdev->ops->crit_proto_stop))
9372                 return -EINVAL;
9373
9374         if (rdev->crit_proto_nlportid)
9375                 return -EBUSY;
9376
9377         /* determine protocol if provided */
9378         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9379                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9380
9381         if (proto >= NUM_NL80211_CRIT_PROTO)
9382                 return -EINVAL;
9383
9384         /* timeout must be provided */
9385         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9386                 return -EINVAL;
9387
9388         duration =
9389                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9390
9391         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9392                 return -ERANGE;
9393
9394         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9395         if (!ret)
9396                 rdev->crit_proto_nlportid = info->snd_portid;
9397
9398         return ret;
9399 }
9400
9401 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9402                                       struct genl_info *info)
9403 {
9404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9405         struct wireless_dev *wdev = info->user_ptr[1];
9406
9407         if (!rdev->ops->crit_proto_stop)
9408                 return -EOPNOTSUPP;
9409
9410         if (rdev->crit_proto_nlportid) {
9411                 rdev->crit_proto_nlportid = 0;
9412                 rdev_crit_proto_stop(rdev, wdev);
9413         }
9414         return 0;
9415 }
9416
9417 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9418 {
9419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9420         struct wireless_dev *wdev =
9421                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9422         int i, err;
9423         u32 vid, subcmd;
9424
9425         if (!rdev->wiphy.vendor_commands)
9426                 return -EOPNOTSUPP;
9427
9428         if (IS_ERR(wdev)) {
9429                 err = PTR_ERR(wdev);
9430                 if (err != -EINVAL)
9431                         return err;
9432                 wdev = NULL;
9433         } else if (wdev->wiphy != &rdev->wiphy) {
9434                 return -EINVAL;
9435         }
9436
9437         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9438             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9439                 return -EINVAL;
9440
9441         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9442         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9443         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9444                 const struct wiphy_vendor_command *vcmd;
9445                 void *data = NULL;
9446                 int len = 0;
9447
9448                 vcmd = &rdev->wiphy.vendor_commands[i];
9449
9450                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9451                         continue;
9452
9453                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9454                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9455                         if (!wdev)
9456                                 return -EINVAL;
9457                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9458                             !wdev->netdev)
9459                                 return -EINVAL;
9460
9461                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9462                                 if (wdev->netdev &&
9463                                     !netif_running(wdev->netdev))
9464                                         return -ENETDOWN;
9465                                 if (!wdev->netdev && !wdev->p2p_started)
9466                                         return -ENETDOWN;
9467                         }
9468                 } else {
9469                         wdev = NULL;
9470                 }
9471
9472                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9473                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9474                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9475                 }
9476
9477                 rdev->cur_cmd_info = info;
9478                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9479                                                           data, len);
9480                 rdev->cur_cmd_info = NULL;
9481                 return err;
9482         }
9483
9484         return -EOPNOTSUPP;
9485 }
9486
9487 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9488                                            enum nl80211_commands cmd,
9489                                            enum nl80211_attrs attr,
9490                                            int approxlen)
9491 {
9492         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9493
9494         if (WARN_ON(!rdev->cur_cmd_info))
9495                 return NULL;
9496
9497         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9498                                            rdev->cur_cmd_info->snd_portid,
9499                                            rdev->cur_cmd_info->snd_seq,
9500                                            cmd, attr, NULL, GFP_KERNEL);
9501 }
9502 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9503
9504 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9505 {
9506         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9507         void *hdr = ((void **)skb->cb)[1];
9508         struct nlattr *data = ((void **)skb->cb)[2];
9509
9510         /* clear CB data for netlink core to own from now on */
9511         memset(skb->cb, 0, sizeof(skb->cb));
9512
9513         if (WARN_ON(!rdev->cur_cmd_info)) {
9514                 kfree_skb(skb);
9515                 return -EINVAL;
9516         }
9517
9518         nla_nest_end(skb, data);
9519         genlmsg_end(skb, hdr);
9520         return genlmsg_reply(skb, rdev->cur_cmd_info);
9521 }
9522 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9523
9524
9525 static int nl80211_set_qos_map(struct sk_buff *skb,
9526                                struct genl_info *info)
9527 {
9528         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9529         struct cfg80211_qos_map *qos_map = NULL;
9530         struct net_device *dev = info->user_ptr[1];
9531         u8 *pos, len, num_des, des_len, des;
9532         int ret;
9533
9534         if (!rdev->ops->set_qos_map)
9535                 return -EOPNOTSUPP;
9536
9537         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9538                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9539                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9540
9541                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9542                     len > IEEE80211_QOS_MAP_LEN_MAX)
9543                         return -EINVAL;
9544
9545                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9546                 if (!qos_map)
9547                         return -ENOMEM;
9548
9549                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9550                 if (num_des) {
9551                         des_len = num_des *
9552                                 sizeof(struct cfg80211_dscp_exception);
9553                         memcpy(qos_map->dscp_exception, pos, des_len);
9554                         qos_map->num_des = num_des;
9555                         for (des = 0; des < num_des; des++) {
9556                                 if (qos_map->dscp_exception[des].up > 7) {
9557                                         kfree(qos_map);
9558                                         return -EINVAL;
9559                                 }
9560                         }
9561                         pos += des_len;
9562                 }
9563                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9564         }
9565
9566         wdev_lock(dev->ieee80211_ptr);
9567         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9568         if (!ret)
9569                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9570         wdev_unlock(dev->ieee80211_ptr);
9571
9572         kfree(qos_map);
9573         return ret;
9574 }
9575
9576 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
9577 {
9578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9579         struct net_device *dev = info->user_ptr[1];
9580         struct wireless_dev *wdev = dev->ieee80211_ptr;
9581         const u8 *peer;
9582         u8 tsid, up;
9583         u16 admitted_time = 0;
9584         int err;
9585
9586         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
9587                 return -EOPNOTSUPP;
9588
9589         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
9590             !info->attrs[NL80211_ATTR_USER_PRIO])
9591                 return -EINVAL;
9592
9593         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9594         if (tsid >= IEEE80211_NUM_TIDS)
9595                 return -EINVAL;
9596
9597         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
9598         if (up >= IEEE80211_NUM_UPS)
9599                 return -EINVAL;
9600
9601         /* WMM uses TIDs 0-7 even for TSPEC */
9602         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
9603                 /* TODO: handle 802.11 TSPEC/admission control
9604                  * need more attributes for that (e.g. BA session requirement);
9605                  * change the WMM adminssion test above to allow both then
9606                  */
9607                 return -EINVAL;
9608         }
9609
9610         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9611
9612         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
9613                 admitted_time =
9614                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
9615                 if (!admitted_time)
9616                         return -EINVAL;
9617         }
9618
9619         wdev_lock(wdev);
9620         switch (wdev->iftype) {
9621         case NL80211_IFTYPE_STATION:
9622         case NL80211_IFTYPE_P2P_CLIENT:
9623                 if (wdev->current_bss)
9624                         break;
9625                 err = -ENOTCONN;
9626                 goto out;
9627         default:
9628                 err = -EOPNOTSUPP;
9629                 goto out;
9630         }
9631
9632         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
9633
9634  out:
9635         wdev_unlock(wdev);
9636         return err;
9637 }
9638
9639 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
9640 {
9641         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9642         struct net_device *dev = info->user_ptr[1];
9643         struct wireless_dev *wdev = dev->ieee80211_ptr;
9644         const u8 *peer;
9645         u8 tsid;
9646         int err;
9647
9648         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
9649                 return -EINVAL;
9650
9651         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9652         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9653
9654         wdev_lock(wdev);
9655         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
9656         wdev_unlock(wdev);
9657
9658         return err;
9659 }
9660
9661 #define NL80211_FLAG_NEED_WIPHY         0x01
9662 #define NL80211_FLAG_NEED_NETDEV        0x02
9663 #define NL80211_FLAG_NEED_RTNL          0x04
9664 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9665 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9666                                          NL80211_FLAG_CHECK_NETDEV_UP)
9667 #define NL80211_FLAG_NEED_WDEV          0x10
9668 /* If a netdev is associated, it must be UP, P2P must be started */
9669 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9670                                          NL80211_FLAG_CHECK_NETDEV_UP)
9671 #define NL80211_FLAG_CLEAR_SKB          0x20
9672
9673 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9674                             struct genl_info *info)
9675 {
9676         struct cfg80211_registered_device *rdev;
9677         struct wireless_dev *wdev;
9678         struct net_device *dev;
9679         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9680
9681         if (rtnl)
9682                 rtnl_lock();
9683
9684         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9685                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9686                 if (IS_ERR(rdev)) {
9687                         if (rtnl)
9688                                 rtnl_unlock();
9689                         return PTR_ERR(rdev);
9690                 }
9691                 info->user_ptr[0] = rdev;
9692         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9693                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9694                 ASSERT_RTNL();
9695
9696                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9697                                                   info->attrs);
9698                 if (IS_ERR(wdev)) {
9699                         if (rtnl)
9700                                 rtnl_unlock();
9701                         return PTR_ERR(wdev);
9702                 }
9703
9704                 dev = wdev->netdev;
9705                 rdev = wiphy_to_rdev(wdev->wiphy);
9706
9707                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9708                         if (!dev) {
9709                                 if (rtnl)
9710                                         rtnl_unlock();
9711                                 return -EINVAL;
9712                         }
9713
9714                         info->user_ptr[1] = dev;
9715                 } else {
9716                         info->user_ptr[1] = wdev;
9717                 }
9718
9719                 if (dev) {
9720                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9721                             !netif_running(dev)) {
9722                                 if (rtnl)
9723                                         rtnl_unlock();
9724                                 return -ENETDOWN;
9725                         }
9726
9727                         dev_hold(dev);
9728                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9729                         if (!wdev->p2p_started) {
9730                                 if (rtnl)
9731                                         rtnl_unlock();
9732                                 return -ENETDOWN;
9733                         }
9734                 }
9735
9736                 info->user_ptr[0] = rdev;
9737         }
9738
9739         return 0;
9740 }
9741
9742 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9743                               struct genl_info *info)
9744 {
9745         if (info->user_ptr[1]) {
9746                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9747                         struct wireless_dev *wdev = info->user_ptr[1];
9748
9749                         if (wdev->netdev)
9750                                 dev_put(wdev->netdev);
9751                 } else {
9752                         dev_put(info->user_ptr[1]);
9753                 }
9754         }
9755
9756         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9757                 rtnl_unlock();
9758
9759         /* If needed, clear the netlink message payload from the SKB
9760          * as it might contain key data that shouldn't stick around on
9761          * the heap after the SKB is freed. The netlink message header
9762          * is still needed for further processing, so leave it intact.
9763          */
9764         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
9765                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
9766
9767                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
9768         }
9769 }
9770
9771 static const struct genl_ops nl80211_ops[] = {
9772         {
9773                 .cmd = NL80211_CMD_GET_WIPHY,
9774                 .doit = nl80211_get_wiphy,
9775                 .dumpit = nl80211_dump_wiphy,
9776                 .done = nl80211_dump_wiphy_done,
9777                 .policy = nl80211_policy,
9778                 /* can be retrieved by unprivileged users */
9779                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9780                                   NL80211_FLAG_NEED_RTNL,
9781         },
9782         {
9783                 .cmd = NL80211_CMD_SET_WIPHY,
9784                 .doit = nl80211_set_wiphy,
9785                 .policy = nl80211_policy,
9786                 .flags = GENL_ADMIN_PERM,
9787                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9788         },
9789         {
9790                 .cmd = NL80211_CMD_GET_INTERFACE,
9791                 .doit = nl80211_get_interface,
9792                 .dumpit = nl80211_dump_interface,
9793                 .policy = nl80211_policy,
9794                 /* can be retrieved by unprivileged users */
9795                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9796                                   NL80211_FLAG_NEED_RTNL,
9797         },
9798         {
9799                 .cmd = NL80211_CMD_SET_INTERFACE,
9800                 .doit = nl80211_set_interface,
9801                 .policy = nl80211_policy,
9802                 .flags = GENL_ADMIN_PERM,
9803                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9804                                   NL80211_FLAG_NEED_RTNL,
9805         },
9806         {
9807                 .cmd = NL80211_CMD_NEW_INTERFACE,
9808                 .doit = nl80211_new_interface,
9809                 .policy = nl80211_policy,
9810                 .flags = GENL_ADMIN_PERM,
9811                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9812                                   NL80211_FLAG_NEED_RTNL,
9813         },
9814         {
9815                 .cmd = NL80211_CMD_DEL_INTERFACE,
9816                 .doit = nl80211_del_interface,
9817                 .policy = nl80211_policy,
9818                 .flags = GENL_ADMIN_PERM,
9819                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9820                                   NL80211_FLAG_NEED_RTNL,
9821         },
9822         {
9823                 .cmd = NL80211_CMD_GET_KEY,
9824                 .doit = nl80211_get_key,
9825                 .policy = nl80211_policy,
9826                 .flags = GENL_ADMIN_PERM,
9827                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9828                                   NL80211_FLAG_NEED_RTNL,
9829         },
9830         {
9831                 .cmd = NL80211_CMD_SET_KEY,
9832                 .doit = nl80211_set_key,
9833                 .policy = nl80211_policy,
9834                 .flags = GENL_ADMIN_PERM,
9835                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9836                                   NL80211_FLAG_NEED_RTNL |
9837                                   NL80211_FLAG_CLEAR_SKB,
9838         },
9839         {
9840                 .cmd = NL80211_CMD_NEW_KEY,
9841                 .doit = nl80211_new_key,
9842                 .policy = nl80211_policy,
9843                 .flags = GENL_ADMIN_PERM,
9844                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9845                                   NL80211_FLAG_NEED_RTNL |
9846                                   NL80211_FLAG_CLEAR_SKB,
9847         },
9848         {
9849                 .cmd = NL80211_CMD_DEL_KEY,
9850                 .doit = nl80211_del_key,
9851                 .policy = nl80211_policy,
9852                 .flags = GENL_ADMIN_PERM,
9853                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9854                                   NL80211_FLAG_NEED_RTNL,
9855         },
9856         {
9857                 .cmd = NL80211_CMD_SET_BEACON,
9858                 .policy = nl80211_policy,
9859                 .flags = GENL_ADMIN_PERM,
9860                 .doit = nl80211_set_beacon,
9861                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9862                                   NL80211_FLAG_NEED_RTNL,
9863         },
9864         {
9865                 .cmd = NL80211_CMD_START_AP,
9866                 .policy = nl80211_policy,
9867                 .flags = GENL_ADMIN_PERM,
9868                 .doit = nl80211_start_ap,
9869                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9870                                   NL80211_FLAG_NEED_RTNL,
9871         },
9872         {
9873                 .cmd = NL80211_CMD_STOP_AP,
9874                 .policy = nl80211_policy,
9875                 .flags = GENL_ADMIN_PERM,
9876                 .doit = nl80211_stop_ap,
9877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9878                                   NL80211_FLAG_NEED_RTNL,
9879         },
9880         {
9881                 .cmd = NL80211_CMD_GET_STATION,
9882                 .doit = nl80211_get_station,
9883                 .dumpit = nl80211_dump_station,
9884                 .policy = nl80211_policy,
9885                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9886                                   NL80211_FLAG_NEED_RTNL,
9887         },
9888         {
9889                 .cmd = NL80211_CMD_SET_STATION,
9890                 .doit = nl80211_set_station,
9891                 .policy = nl80211_policy,
9892                 .flags = GENL_ADMIN_PERM,
9893                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9894                                   NL80211_FLAG_NEED_RTNL,
9895         },
9896         {
9897                 .cmd = NL80211_CMD_NEW_STATION,
9898                 .doit = nl80211_new_station,
9899                 .policy = nl80211_policy,
9900                 .flags = GENL_ADMIN_PERM,
9901                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9902                                   NL80211_FLAG_NEED_RTNL,
9903         },
9904         {
9905                 .cmd = NL80211_CMD_DEL_STATION,
9906                 .doit = nl80211_del_station,
9907                 .policy = nl80211_policy,
9908                 .flags = GENL_ADMIN_PERM,
9909                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9910                                   NL80211_FLAG_NEED_RTNL,
9911         },
9912         {
9913                 .cmd = NL80211_CMD_GET_MPATH,
9914                 .doit = nl80211_get_mpath,
9915                 .dumpit = nl80211_dump_mpath,
9916                 .policy = nl80211_policy,
9917                 .flags = GENL_ADMIN_PERM,
9918                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9919                                   NL80211_FLAG_NEED_RTNL,
9920         },
9921         {
9922                 .cmd = NL80211_CMD_GET_MPP,
9923                 .doit = nl80211_get_mpp,
9924                 .dumpit = nl80211_dump_mpp,
9925                 .policy = nl80211_policy,
9926                 .flags = GENL_ADMIN_PERM,
9927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9928                                   NL80211_FLAG_NEED_RTNL,
9929         },
9930         {
9931                 .cmd = NL80211_CMD_SET_MPATH,
9932                 .doit = nl80211_set_mpath,
9933                 .policy = nl80211_policy,
9934                 .flags = GENL_ADMIN_PERM,
9935                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9936                                   NL80211_FLAG_NEED_RTNL,
9937         },
9938         {
9939                 .cmd = NL80211_CMD_NEW_MPATH,
9940                 .doit = nl80211_new_mpath,
9941                 .policy = nl80211_policy,
9942                 .flags = GENL_ADMIN_PERM,
9943                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9944                                   NL80211_FLAG_NEED_RTNL,
9945         },
9946         {
9947                 .cmd = NL80211_CMD_DEL_MPATH,
9948                 .doit = nl80211_del_mpath,
9949                 .policy = nl80211_policy,
9950                 .flags = GENL_ADMIN_PERM,
9951                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9952                                   NL80211_FLAG_NEED_RTNL,
9953         },
9954         {
9955                 .cmd = NL80211_CMD_SET_BSS,
9956                 .doit = nl80211_set_bss,
9957                 .policy = nl80211_policy,
9958                 .flags = GENL_ADMIN_PERM,
9959                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9960                                   NL80211_FLAG_NEED_RTNL,
9961         },
9962         {
9963                 .cmd = NL80211_CMD_GET_REG,
9964                 .doit = nl80211_get_reg,
9965                 .policy = nl80211_policy,
9966                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9967                 /* can be retrieved by unprivileged users */
9968         },
9969         {
9970                 .cmd = NL80211_CMD_SET_REG,
9971                 .doit = nl80211_set_reg,
9972                 .policy = nl80211_policy,
9973                 .flags = GENL_ADMIN_PERM,
9974                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9975         },
9976         {
9977                 .cmd = NL80211_CMD_REQ_SET_REG,
9978                 .doit = nl80211_req_set_reg,
9979                 .policy = nl80211_policy,
9980                 .flags = GENL_ADMIN_PERM,
9981         },
9982         {
9983                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9984                 .doit = nl80211_get_mesh_config,
9985                 .policy = nl80211_policy,
9986                 /* can be retrieved by unprivileged users */
9987                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9988                                   NL80211_FLAG_NEED_RTNL,
9989         },
9990         {
9991                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9992                 .doit = nl80211_update_mesh_config,
9993                 .policy = nl80211_policy,
9994                 .flags = GENL_ADMIN_PERM,
9995                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9996                                   NL80211_FLAG_NEED_RTNL,
9997         },
9998         {
9999                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10000                 .doit = nl80211_trigger_scan,
10001                 .policy = nl80211_policy,
10002                 .flags = GENL_ADMIN_PERM,
10003                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10004                                   NL80211_FLAG_NEED_RTNL,
10005         },
10006         {
10007                 .cmd = NL80211_CMD_GET_SCAN,
10008                 .policy = nl80211_policy,
10009                 .dumpit = nl80211_dump_scan,
10010         },
10011         {
10012                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10013                 .doit = nl80211_start_sched_scan,
10014                 .policy = nl80211_policy,
10015                 .flags = GENL_ADMIN_PERM,
10016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10017                                   NL80211_FLAG_NEED_RTNL,
10018         },
10019         {
10020                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10021                 .doit = nl80211_stop_sched_scan,
10022                 .policy = nl80211_policy,
10023                 .flags = GENL_ADMIN_PERM,
10024                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10025                                   NL80211_FLAG_NEED_RTNL,
10026         },
10027         {
10028                 .cmd = NL80211_CMD_AUTHENTICATE,
10029                 .doit = nl80211_authenticate,
10030                 .policy = nl80211_policy,
10031                 .flags = GENL_ADMIN_PERM,
10032                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10033                                   NL80211_FLAG_NEED_RTNL |
10034                                   NL80211_FLAG_CLEAR_SKB,
10035         },
10036         {
10037                 .cmd = NL80211_CMD_ASSOCIATE,
10038                 .doit = nl80211_associate,
10039                 .policy = nl80211_policy,
10040                 .flags = GENL_ADMIN_PERM,
10041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10042                                   NL80211_FLAG_NEED_RTNL,
10043         },
10044         {
10045                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10046                 .doit = nl80211_deauthenticate,
10047                 .policy = nl80211_policy,
10048                 .flags = GENL_ADMIN_PERM,
10049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10050                                   NL80211_FLAG_NEED_RTNL,
10051         },
10052         {
10053                 .cmd = NL80211_CMD_DISASSOCIATE,
10054                 .doit = nl80211_disassociate,
10055                 .policy = nl80211_policy,
10056                 .flags = GENL_ADMIN_PERM,
10057                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10058                                   NL80211_FLAG_NEED_RTNL,
10059         },
10060         {
10061                 .cmd = NL80211_CMD_JOIN_IBSS,
10062                 .doit = nl80211_join_ibss,
10063                 .policy = nl80211_policy,
10064                 .flags = GENL_ADMIN_PERM,
10065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10066                                   NL80211_FLAG_NEED_RTNL,
10067         },
10068         {
10069                 .cmd = NL80211_CMD_LEAVE_IBSS,
10070                 .doit = nl80211_leave_ibss,
10071                 .policy = nl80211_policy,
10072                 .flags = GENL_ADMIN_PERM,
10073                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10074                                   NL80211_FLAG_NEED_RTNL,
10075         },
10076 #ifdef CONFIG_NL80211_TESTMODE
10077         {
10078                 .cmd = NL80211_CMD_TESTMODE,
10079                 .doit = nl80211_testmode_do,
10080                 .dumpit = nl80211_testmode_dump,
10081                 .policy = nl80211_policy,
10082                 .flags = GENL_ADMIN_PERM,
10083                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10084                                   NL80211_FLAG_NEED_RTNL,
10085         },
10086 #endif
10087         {
10088                 .cmd = NL80211_CMD_CONNECT,
10089                 .doit = nl80211_connect,
10090                 .policy = nl80211_policy,
10091                 .flags = GENL_ADMIN_PERM,
10092                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10093                                   NL80211_FLAG_NEED_RTNL,
10094         },
10095         {
10096                 .cmd = NL80211_CMD_DISCONNECT,
10097                 .doit = nl80211_disconnect,
10098                 .policy = nl80211_policy,
10099                 .flags = GENL_ADMIN_PERM,
10100                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10101                                   NL80211_FLAG_NEED_RTNL,
10102         },
10103         {
10104                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10105                 .doit = nl80211_wiphy_netns,
10106                 .policy = nl80211_policy,
10107                 .flags = GENL_ADMIN_PERM,
10108                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10109                                   NL80211_FLAG_NEED_RTNL,
10110         },
10111         {
10112                 .cmd = NL80211_CMD_GET_SURVEY,
10113                 .policy = nl80211_policy,
10114                 .dumpit = nl80211_dump_survey,
10115         },
10116         {
10117                 .cmd = NL80211_CMD_SET_PMKSA,
10118                 .doit = nl80211_setdel_pmksa,
10119                 .policy = nl80211_policy,
10120                 .flags = GENL_ADMIN_PERM,
10121                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10122                                   NL80211_FLAG_NEED_RTNL,
10123         },
10124         {
10125                 .cmd = NL80211_CMD_DEL_PMKSA,
10126                 .doit = nl80211_setdel_pmksa,
10127                 .policy = nl80211_policy,
10128                 .flags = GENL_ADMIN_PERM,
10129                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10130                                   NL80211_FLAG_NEED_RTNL,
10131         },
10132         {
10133                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10134                 .doit = nl80211_flush_pmksa,
10135                 .policy = nl80211_policy,
10136                 .flags = GENL_ADMIN_PERM,
10137                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10138                                   NL80211_FLAG_NEED_RTNL,
10139         },
10140         {
10141                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10142                 .doit = nl80211_remain_on_channel,
10143                 .policy = nl80211_policy,
10144                 .flags = GENL_ADMIN_PERM,
10145                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10146                                   NL80211_FLAG_NEED_RTNL,
10147         },
10148         {
10149                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10150                 .doit = nl80211_cancel_remain_on_channel,
10151                 .policy = nl80211_policy,
10152                 .flags = GENL_ADMIN_PERM,
10153                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10154                                   NL80211_FLAG_NEED_RTNL,
10155         },
10156         {
10157                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10158                 .doit = nl80211_set_tx_bitrate_mask,
10159                 .policy = nl80211_policy,
10160                 .flags = GENL_ADMIN_PERM,
10161                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10162                                   NL80211_FLAG_NEED_RTNL,
10163         },
10164         {
10165                 .cmd = NL80211_CMD_REGISTER_FRAME,
10166                 .doit = nl80211_register_mgmt,
10167                 .policy = nl80211_policy,
10168                 .flags = GENL_ADMIN_PERM,
10169                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10170                                   NL80211_FLAG_NEED_RTNL,
10171         },
10172         {
10173                 .cmd = NL80211_CMD_FRAME,
10174                 .doit = nl80211_tx_mgmt,
10175                 .policy = nl80211_policy,
10176                 .flags = GENL_ADMIN_PERM,
10177                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10178                                   NL80211_FLAG_NEED_RTNL,
10179         },
10180         {
10181                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10182                 .doit = nl80211_tx_mgmt_cancel_wait,
10183                 .policy = nl80211_policy,
10184                 .flags = GENL_ADMIN_PERM,
10185                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10186                                   NL80211_FLAG_NEED_RTNL,
10187         },
10188         {
10189                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10190                 .doit = nl80211_set_power_save,
10191                 .policy = nl80211_policy,
10192                 .flags = GENL_ADMIN_PERM,
10193                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10194                                   NL80211_FLAG_NEED_RTNL,
10195         },
10196         {
10197                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10198                 .doit = nl80211_get_power_save,
10199                 .policy = nl80211_policy,
10200                 /* can be retrieved by unprivileged users */
10201                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10202                                   NL80211_FLAG_NEED_RTNL,
10203         },
10204         {
10205                 .cmd = NL80211_CMD_SET_CQM,
10206                 .doit = nl80211_set_cqm,
10207                 .policy = nl80211_policy,
10208                 .flags = GENL_ADMIN_PERM,
10209                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10210                                   NL80211_FLAG_NEED_RTNL,
10211         },
10212         {
10213                 .cmd = NL80211_CMD_SET_CHANNEL,
10214                 .doit = nl80211_set_channel,
10215                 .policy = nl80211_policy,
10216                 .flags = GENL_ADMIN_PERM,
10217                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10218                                   NL80211_FLAG_NEED_RTNL,
10219         },
10220         {
10221                 .cmd = NL80211_CMD_SET_WDS_PEER,
10222                 .doit = nl80211_set_wds_peer,
10223                 .policy = nl80211_policy,
10224                 .flags = GENL_ADMIN_PERM,
10225                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10226                                   NL80211_FLAG_NEED_RTNL,
10227         },
10228         {
10229                 .cmd = NL80211_CMD_JOIN_MESH,
10230                 .doit = nl80211_join_mesh,
10231                 .policy = nl80211_policy,
10232                 .flags = GENL_ADMIN_PERM,
10233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10234                                   NL80211_FLAG_NEED_RTNL,
10235         },
10236         {
10237                 .cmd = NL80211_CMD_LEAVE_MESH,
10238                 .doit = nl80211_leave_mesh,
10239                 .policy = nl80211_policy,
10240                 .flags = GENL_ADMIN_PERM,
10241                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10242                                   NL80211_FLAG_NEED_RTNL,
10243         },
10244         {
10245                 .cmd = NL80211_CMD_JOIN_OCB,
10246                 .doit = nl80211_join_ocb,
10247                 .policy = nl80211_policy,
10248                 .flags = GENL_ADMIN_PERM,
10249                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10250                                   NL80211_FLAG_NEED_RTNL,
10251         },
10252         {
10253                 .cmd = NL80211_CMD_LEAVE_OCB,
10254                 .doit = nl80211_leave_ocb,
10255                 .policy = nl80211_policy,
10256                 .flags = GENL_ADMIN_PERM,
10257                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10258                                   NL80211_FLAG_NEED_RTNL,
10259         },
10260 #ifdef CONFIG_PM
10261         {
10262                 .cmd = NL80211_CMD_GET_WOWLAN,
10263                 .doit = nl80211_get_wowlan,
10264                 .policy = nl80211_policy,
10265                 /* can be retrieved by unprivileged users */
10266                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10267                                   NL80211_FLAG_NEED_RTNL,
10268         },
10269         {
10270                 .cmd = NL80211_CMD_SET_WOWLAN,
10271                 .doit = nl80211_set_wowlan,
10272                 .policy = nl80211_policy,
10273                 .flags = GENL_ADMIN_PERM,
10274                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10275                                   NL80211_FLAG_NEED_RTNL,
10276         },
10277 #endif
10278         {
10279                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10280                 .doit = nl80211_set_rekey_data,
10281                 .policy = nl80211_policy,
10282                 .flags = GENL_ADMIN_PERM,
10283                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10284                                   NL80211_FLAG_NEED_RTNL |
10285                                   NL80211_FLAG_CLEAR_SKB,
10286         },
10287         {
10288                 .cmd = NL80211_CMD_TDLS_MGMT,
10289                 .doit = nl80211_tdls_mgmt,
10290                 .policy = nl80211_policy,
10291                 .flags = GENL_ADMIN_PERM,
10292                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10293                                   NL80211_FLAG_NEED_RTNL,
10294         },
10295         {
10296                 .cmd = NL80211_CMD_TDLS_OPER,
10297                 .doit = nl80211_tdls_oper,
10298                 .policy = nl80211_policy,
10299                 .flags = GENL_ADMIN_PERM,
10300                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10301                                   NL80211_FLAG_NEED_RTNL,
10302         },
10303         {
10304                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10305                 .doit = nl80211_register_unexpected_frame,
10306                 .policy = nl80211_policy,
10307                 .flags = GENL_ADMIN_PERM,
10308                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10309                                   NL80211_FLAG_NEED_RTNL,
10310         },
10311         {
10312                 .cmd = NL80211_CMD_PROBE_CLIENT,
10313                 .doit = nl80211_probe_client,
10314                 .policy = nl80211_policy,
10315                 .flags = GENL_ADMIN_PERM,
10316                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10317                                   NL80211_FLAG_NEED_RTNL,
10318         },
10319         {
10320                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10321                 .doit = nl80211_register_beacons,
10322                 .policy = nl80211_policy,
10323                 .flags = GENL_ADMIN_PERM,
10324                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10325                                   NL80211_FLAG_NEED_RTNL,
10326         },
10327         {
10328                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10329                 .doit = nl80211_set_noack_map,
10330                 .policy = nl80211_policy,
10331                 .flags = GENL_ADMIN_PERM,
10332                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10333                                   NL80211_FLAG_NEED_RTNL,
10334         },
10335         {
10336                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10337                 .doit = nl80211_start_p2p_device,
10338                 .policy = nl80211_policy,
10339                 .flags = GENL_ADMIN_PERM,
10340                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10341                                   NL80211_FLAG_NEED_RTNL,
10342         },
10343         {
10344                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10345                 .doit = nl80211_stop_p2p_device,
10346                 .policy = nl80211_policy,
10347                 .flags = GENL_ADMIN_PERM,
10348                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10349                                   NL80211_FLAG_NEED_RTNL,
10350         },
10351         {
10352                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10353                 .doit = nl80211_set_mcast_rate,
10354                 .policy = nl80211_policy,
10355                 .flags = GENL_ADMIN_PERM,
10356                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10357                                   NL80211_FLAG_NEED_RTNL,
10358         },
10359         {
10360                 .cmd = NL80211_CMD_SET_MAC_ACL,
10361                 .doit = nl80211_set_mac_acl,
10362                 .policy = nl80211_policy,
10363                 .flags = GENL_ADMIN_PERM,
10364                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10365                                   NL80211_FLAG_NEED_RTNL,
10366         },
10367         {
10368                 .cmd = NL80211_CMD_RADAR_DETECT,
10369                 .doit = nl80211_start_radar_detection,
10370                 .policy = nl80211_policy,
10371                 .flags = GENL_ADMIN_PERM,
10372                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10373                                   NL80211_FLAG_NEED_RTNL,
10374         },
10375         {
10376                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10377                 .doit = nl80211_get_protocol_features,
10378                 .policy = nl80211_policy,
10379         },
10380         {
10381                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10382                 .doit = nl80211_update_ft_ies,
10383                 .policy = nl80211_policy,
10384                 .flags = GENL_ADMIN_PERM,
10385                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10386                                   NL80211_FLAG_NEED_RTNL,
10387         },
10388         {
10389                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10390                 .doit = nl80211_crit_protocol_start,
10391                 .policy = nl80211_policy,
10392                 .flags = GENL_ADMIN_PERM,
10393                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10394                                   NL80211_FLAG_NEED_RTNL,
10395         },
10396         {
10397                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10398                 .doit = nl80211_crit_protocol_stop,
10399                 .policy = nl80211_policy,
10400                 .flags = GENL_ADMIN_PERM,
10401                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10402                                   NL80211_FLAG_NEED_RTNL,
10403         },
10404         {
10405                 .cmd = NL80211_CMD_GET_COALESCE,
10406                 .doit = nl80211_get_coalesce,
10407                 .policy = nl80211_policy,
10408                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10409                                   NL80211_FLAG_NEED_RTNL,
10410         },
10411         {
10412                 .cmd = NL80211_CMD_SET_COALESCE,
10413                 .doit = nl80211_set_coalesce,
10414                 .policy = nl80211_policy,
10415                 .flags = GENL_ADMIN_PERM,
10416                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10417                                   NL80211_FLAG_NEED_RTNL,
10418         },
10419         {
10420                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10421                 .doit = nl80211_channel_switch,
10422                 .policy = nl80211_policy,
10423                 .flags = GENL_ADMIN_PERM,
10424                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10425                                   NL80211_FLAG_NEED_RTNL,
10426         },
10427         {
10428                 .cmd = NL80211_CMD_VENDOR,
10429                 .doit = nl80211_vendor_cmd,
10430                 .policy = nl80211_policy,
10431                 .flags = GENL_ADMIN_PERM,
10432                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10433                                   NL80211_FLAG_NEED_RTNL,
10434         },
10435         {
10436                 .cmd = NL80211_CMD_SET_QOS_MAP,
10437                 .doit = nl80211_set_qos_map,
10438                 .policy = nl80211_policy,
10439                 .flags = GENL_ADMIN_PERM,
10440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10441                                   NL80211_FLAG_NEED_RTNL,
10442         },
10443         {
10444                 .cmd = NL80211_CMD_ADD_TX_TS,
10445                 .doit = nl80211_add_tx_ts,
10446                 .policy = nl80211_policy,
10447                 .flags = GENL_ADMIN_PERM,
10448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10449                                   NL80211_FLAG_NEED_RTNL,
10450         },
10451         {
10452                 .cmd = NL80211_CMD_DEL_TX_TS,
10453                 .doit = nl80211_del_tx_ts,
10454                 .policy = nl80211_policy,
10455                 .flags = GENL_ADMIN_PERM,
10456                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10457                                   NL80211_FLAG_NEED_RTNL,
10458         },
10459 };
10460
10461 /* notification functions */
10462
10463 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10464                           enum nl80211_commands cmd)
10465 {
10466         struct sk_buff *msg;
10467         struct nl80211_dump_wiphy_state state = {};
10468
10469         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10470                 cmd != NL80211_CMD_DEL_WIPHY);
10471
10472         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10473         if (!msg)
10474                 return;
10475
10476         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10477                 nlmsg_free(msg);
10478                 return;
10479         }
10480
10481         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10482                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10483 }
10484
10485 static int nl80211_add_scan_req(struct sk_buff *msg,
10486                                 struct cfg80211_registered_device *rdev)
10487 {
10488         struct cfg80211_scan_request *req = rdev->scan_req;
10489         struct nlattr *nest;
10490         int i;
10491
10492         if (WARN_ON(!req))
10493                 return 0;
10494
10495         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10496         if (!nest)
10497                 goto nla_put_failure;
10498         for (i = 0; i < req->n_ssids; i++) {
10499                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10500                         goto nla_put_failure;
10501         }
10502         nla_nest_end(msg, nest);
10503
10504         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10505         if (!nest)
10506                 goto nla_put_failure;
10507         for (i = 0; i < req->n_channels; i++) {
10508                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10509                         goto nla_put_failure;
10510         }
10511         nla_nest_end(msg, nest);
10512
10513         if (req->ie &&
10514             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10515                 goto nla_put_failure;
10516
10517         if (req->flags &&
10518             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10519                 goto nla_put_failure;
10520
10521         return 0;
10522  nla_put_failure:
10523         return -ENOBUFS;
10524 }
10525
10526 static int nl80211_send_scan_msg(struct sk_buff *msg,
10527                                  struct cfg80211_registered_device *rdev,
10528                                  struct wireless_dev *wdev,
10529                                  u32 portid, u32 seq, int flags,
10530                                  u32 cmd)
10531 {
10532         void *hdr;
10533
10534         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10535         if (!hdr)
10536                 return -1;
10537
10538         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10539             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10540                                          wdev->netdev->ifindex)) ||
10541             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10542                 goto nla_put_failure;
10543
10544         /* ignore errors and send incomplete event anyway */
10545         nl80211_add_scan_req(msg, rdev);
10546
10547         return genlmsg_end(msg, hdr);
10548
10549  nla_put_failure:
10550         genlmsg_cancel(msg, hdr);
10551         return -EMSGSIZE;
10552 }
10553
10554 static int
10555 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10556                             struct cfg80211_registered_device *rdev,
10557                             struct net_device *netdev,
10558                             u32 portid, u32 seq, int flags, u32 cmd)
10559 {
10560         void *hdr;
10561
10562         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10563         if (!hdr)
10564                 return -1;
10565
10566         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10567             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10568                 goto nla_put_failure;
10569
10570         return genlmsg_end(msg, hdr);
10571
10572  nla_put_failure:
10573         genlmsg_cancel(msg, hdr);
10574         return -EMSGSIZE;
10575 }
10576
10577 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10578                              struct wireless_dev *wdev)
10579 {
10580         struct sk_buff *msg;
10581
10582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10583         if (!msg)
10584                 return;
10585
10586         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10587                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10588                 nlmsg_free(msg);
10589                 return;
10590         }
10591
10592         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10593                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10594 }
10595
10596 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10597                                        struct wireless_dev *wdev, bool aborted)
10598 {
10599         struct sk_buff *msg;
10600
10601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10602         if (!msg)
10603                 return NULL;
10604
10605         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10606                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10607                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10608                 nlmsg_free(msg);
10609                 return NULL;
10610         }
10611
10612         return msg;
10613 }
10614
10615 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10616                               struct sk_buff *msg)
10617 {
10618         if (!msg)
10619                 return;
10620
10621         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10622                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10623 }
10624
10625 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10626                                      struct net_device *netdev)
10627 {
10628         struct sk_buff *msg;
10629
10630         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10631         if (!msg)
10632                 return;
10633
10634         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10635                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10636                 nlmsg_free(msg);
10637                 return;
10638         }
10639
10640         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10641                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10642 }
10643
10644 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10645                              struct net_device *netdev, u32 cmd)
10646 {
10647         struct sk_buff *msg;
10648
10649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10650         if (!msg)
10651                 return;
10652
10653         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10654                 nlmsg_free(msg);
10655                 return;
10656         }
10657
10658         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10659                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10660 }
10661
10662 /*
10663  * This can happen on global regulatory changes or device specific settings
10664  * based on custom world regulatory domains.
10665  */
10666 void nl80211_send_reg_change_event(struct regulatory_request *request)
10667 {
10668         struct sk_buff *msg;
10669         void *hdr;
10670
10671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10672         if (!msg)
10673                 return;
10674
10675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10676         if (!hdr) {
10677                 nlmsg_free(msg);
10678                 return;
10679         }
10680
10681         /* Userspace can always count this one always being set */
10682         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10683                 goto nla_put_failure;
10684
10685         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10686                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10687                                NL80211_REGDOM_TYPE_WORLD))
10688                         goto nla_put_failure;
10689         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10690                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10691                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10692                         goto nla_put_failure;
10693         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10694                    request->intersect) {
10695                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10696                                NL80211_REGDOM_TYPE_INTERSECTION))
10697                         goto nla_put_failure;
10698         } else {
10699                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10700                                NL80211_REGDOM_TYPE_COUNTRY) ||
10701                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10702                                    request->alpha2))
10703                         goto nla_put_failure;
10704         }
10705
10706         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10707             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10708                 goto nla_put_failure;
10709
10710         genlmsg_end(msg, hdr);
10711
10712         rcu_read_lock();
10713         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10714                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10715         rcu_read_unlock();
10716
10717         return;
10718
10719 nla_put_failure:
10720         genlmsg_cancel(msg, hdr);
10721         nlmsg_free(msg);
10722 }
10723
10724 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10725                                     struct net_device *netdev,
10726                                     const u8 *buf, size_t len,
10727                                     enum nl80211_commands cmd, gfp_t gfp,
10728                                     int uapsd_queues)
10729 {
10730         struct sk_buff *msg;
10731         void *hdr;
10732
10733         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10734         if (!msg)
10735                 return;
10736
10737         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10738         if (!hdr) {
10739                 nlmsg_free(msg);
10740                 return;
10741         }
10742
10743         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10744             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10745             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10746                 goto nla_put_failure;
10747
10748         if (uapsd_queues >= 0) {
10749                 struct nlattr *nla_wmm =
10750                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
10751                 if (!nla_wmm)
10752                         goto nla_put_failure;
10753
10754                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
10755                                uapsd_queues))
10756                         goto nla_put_failure;
10757
10758                 nla_nest_end(msg, nla_wmm);
10759         }
10760
10761         genlmsg_end(msg, hdr);
10762
10763         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10764                                 NL80211_MCGRP_MLME, gfp);
10765         return;
10766
10767  nla_put_failure:
10768         genlmsg_cancel(msg, hdr);
10769         nlmsg_free(msg);
10770 }
10771
10772 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10773                           struct net_device *netdev, const u8 *buf,
10774                           size_t len, gfp_t gfp)
10775 {
10776         nl80211_send_mlme_event(rdev, netdev, buf, len,
10777                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
10778 }
10779
10780 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10781                            struct net_device *netdev, const u8 *buf,
10782                            size_t len, gfp_t gfp, int uapsd_queues)
10783 {
10784         nl80211_send_mlme_event(rdev, netdev, buf, len,
10785                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
10786 }
10787
10788 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10789                          struct net_device *netdev, const u8 *buf,
10790                          size_t len, gfp_t gfp)
10791 {
10792         nl80211_send_mlme_event(rdev, netdev, buf, len,
10793                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
10794 }
10795
10796 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10797                            struct net_device *netdev, const u8 *buf,
10798                            size_t len, gfp_t gfp)
10799 {
10800         nl80211_send_mlme_event(rdev, netdev, buf, len,
10801                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
10802 }
10803
10804 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10805                                   size_t len)
10806 {
10807         struct wireless_dev *wdev = dev->ieee80211_ptr;
10808         struct wiphy *wiphy = wdev->wiphy;
10809         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10810         const struct ieee80211_mgmt *mgmt = (void *)buf;
10811         u32 cmd;
10812
10813         if (WARN_ON(len < 2))
10814                 return;
10815
10816         if (ieee80211_is_deauth(mgmt->frame_control))
10817                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10818         else
10819                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10820
10821         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10822         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
10823 }
10824 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10825
10826 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10827                                       struct net_device *netdev, int cmd,
10828                                       const u8 *addr, gfp_t gfp)
10829 {
10830         struct sk_buff *msg;
10831         void *hdr;
10832
10833         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10834         if (!msg)
10835                 return;
10836
10837         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10838         if (!hdr) {
10839                 nlmsg_free(msg);
10840                 return;
10841         }
10842
10843         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10844             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10845             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10846             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10847                 goto nla_put_failure;
10848
10849         genlmsg_end(msg, hdr);
10850
10851         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10852                                 NL80211_MCGRP_MLME, gfp);
10853         return;
10854
10855  nla_put_failure:
10856         genlmsg_cancel(msg, hdr);
10857         nlmsg_free(msg);
10858 }
10859
10860 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10861                                struct net_device *netdev, const u8 *addr,
10862                                gfp_t gfp)
10863 {
10864         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10865                                   addr, gfp);
10866 }
10867
10868 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10869                                 struct net_device *netdev, const u8 *addr,
10870                                 gfp_t gfp)
10871 {
10872         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10873                                   addr, gfp);
10874 }
10875
10876 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10877                                  struct net_device *netdev, const u8 *bssid,
10878                                  const u8 *req_ie, size_t req_ie_len,
10879                                  const u8 *resp_ie, size_t resp_ie_len,
10880                                  u16 status, gfp_t gfp)
10881 {
10882         struct sk_buff *msg;
10883         void *hdr;
10884
10885         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10886         if (!msg)
10887                 return;
10888
10889         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10890         if (!hdr) {
10891                 nlmsg_free(msg);
10892                 return;
10893         }
10894
10895         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10896             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10897             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10898             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10899             (req_ie &&
10900              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10901             (resp_ie &&
10902              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10903                 goto nla_put_failure;
10904
10905         genlmsg_end(msg, hdr);
10906
10907         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10908                                 NL80211_MCGRP_MLME, gfp);
10909         return;
10910
10911  nla_put_failure:
10912         genlmsg_cancel(msg, hdr);
10913         nlmsg_free(msg);
10914
10915 }
10916
10917 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10918                          struct net_device *netdev, const u8 *bssid,
10919                          const u8 *req_ie, size_t req_ie_len,
10920                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10921 {
10922         struct sk_buff *msg;
10923         void *hdr;
10924
10925         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10926         if (!msg)
10927                 return;
10928
10929         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10930         if (!hdr) {
10931                 nlmsg_free(msg);
10932                 return;
10933         }
10934
10935         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10936             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10937             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10938             (req_ie &&
10939              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10940             (resp_ie &&
10941              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10942                 goto nla_put_failure;
10943
10944         genlmsg_end(msg, hdr);
10945
10946         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10947                                 NL80211_MCGRP_MLME, gfp);
10948         return;
10949
10950  nla_put_failure:
10951         genlmsg_cancel(msg, hdr);
10952         nlmsg_free(msg);
10953
10954 }
10955
10956 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10957                                struct net_device *netdev, u16 reason,
10958                                const u8 *ie, size_t ie_len, bool from_ap)
10959 {
10960         struct sk_buff *msg;
10961         void *hdr;
10962
10963         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10964         if (!msg)
10965                 return;
10966
10967         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10968         if (!hdr) {
10969                 nlmsg_free(msg);
10970                 return;
10971         }
10972
10973         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10974             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10975             (from_ap && reason &&
10976              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10977             (from_ap &&
10978              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10979             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10980                 goto nla_put_failure;
10981
10982         genlmsg_end(msg, hdr);
10983
10984         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10985                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10986         return;
10987
10988  nla_put_failure:
10989         genlmsg_cancel(msg, hdr);
10990         nlmsg_free(msg);
10991
10992 }
10993
10994 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10995                              struct net_device *netdev, const u8 *bssid,
10996                              gfp_t gfp)
10997 {
10998         struct sk_buff *msg;
10999         void *hdr;
11000
11001         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11002         if (!msg)
11003                 return;
11004
11005         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11006         if (!hdr) {
11007                 nlmsg_free(msg);
11008                 return;
11009         }
11010
11011         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11012             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11013             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11014                 goto nla_put_failure;
11015
11016         genlmsg_end(msg, hdr);
11017
11018         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11019                                 NL80211_MCGRP_MLME, gfp);
11020         return;
11021
11022  nla_put_failure:
11023         genlmsg_cancel(msg, hdr);
11024         nlmsg_free(msg);
11025 }
11026
11027 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
11028                                         const u8* ie, u8 ie_len, gfp_t gfp)
11029 {
11030         struct wireless_dev *wdev = dev->ieee80211_ptr;
11031         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11032         struct sk_buff *msg;
11033         void *hdr;
11034
11035         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11036                 return;
11037
11038         trace_cfg80211_notify_new_peer_candidate(dev, addr);
11039
11040         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11041         if (!msg)
11042                 return;
11043
11044         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
11045         if (!hdr) {
11046                 nlmsg_free(msg);
11047                 return;
11048         }
11049
11050         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11051             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11052             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11053             (ie_len && ie &&
11054              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11055                 goto nla_put_failure;
11056
11057         genlmsg_end(msg, hdr);
11058
11059         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11060                                 NL80211_MCGRP_MLME, gfp);
11061         return;
11062
11063  nla_put_failure:
11064         genlmsg_cancel(msg, hdr);
11065         nlmsg_free(msg);
11066 }
11067 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11068
11069 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11070                                  struct net_device *netdev, const u8 *addr,
11071                                  enum nl80211_key_type key_type, int key_id,
11072                                  const u8 *tsc, gfp_t gfp)
11073 {
11074         struct sk_buff *msg;
11075         void *hdr;
11076
11077         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11078         if (!msg)
11079                 return;
11080
11081         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11082         if (!hdr) {
11083                 nlmsg_free(msg);
11084                 return;
11085         }
11086
11087         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11088             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11089             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11090             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11091             (key_id != -1 &&
11092              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11093             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11094                 goto nla_put_failure;
11095
11096         genlmsg_end(msg, hdr);
11097
11098         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11099                                 NL80211_MCGRP_MLME, gfp);
11100         return;
11101
11102  nla_put_failure:
11103         genlmsg_cancel(msg, hdr);
11104         nlmsg_free(msg);
11105 }
11106
11107 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11108                                     struct ieee80211_channel *channel_before,
11109                                     struct ieee80211_channel *channel_after)
11110 {
11111         struct sk_buff *msg;
11112         void *hdr;
11113         struct nlattr *nl_freq;
11114
11115         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11116         if (!msg)
11117                 return;
11118
11119         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11120         if (!hdr) {
11121                 nlmsg_free(msg);
11122                 return;
11123         }
11124
11125         /*
11126          * Since we are applying the beacon hint to a wiphy we know its
11127          * wiphy_idx is valid
11128          */
11129         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11130                 goto nla_put_failure;
11131
11132         /* Before */
11133         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11134         if (!nl_freq)
11135                 goto nla_put_failure;
11136         if (nl80211_msg_put_channel(msg, channel_before, false))
11137                 goto nla_put_failure;
11138         nla_nest_end(msg, nl_freq);
11139
11140         /* After */
11141         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11142         if (!nl_freq)
11143                 goto nla_put_failure;
11144         if (nl80211_msg_put_channel(msg, channel_after, false))
11145                 goto nla_put_failure;
11146         nla_nest_end(msg, nl_freq);
11147
11148         genlmsg_end(msg, hdr);
11149
11150         rcu_read_lock();
11151         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11152                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11153         rcu_read_unlock();
11154
11155         return;
11156
11157 nla_put_failure:
11158         genlmsg_cancel(msg, hdr);
11159         nlmsg_free(msg);
11160 }
11161
11162 static void nl80211_send_remain_on_chan_event(
11163         int cmd, struct cfg80211_registered_device *rdev,
11164         struct wireless_dev *wdev, u64 cookie,
11165         struct ieee80211_channel *chan,
11166         unsigned int duration, gfp_t gfp)
11167 {
11168         struct sk_buff *msg;
11169         void *hdr;
11170
11171         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11172         if (!msg)
11173                 return;
11174
11175         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11176         if (!hdr) {
11177                 nlmsg_free(msg);
11178                 return;
11179         }
11180
11181         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11182             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11183                                          wdev->netdev->ifindex)) ||
11184             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11185             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11186             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11187                         NL80211_CHAN_NO_HT) ||
11188             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
11189                 goto nla_put_failure;
11190
11191         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
11192             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
11193                 goto nla_put_failure;
11194
11195         genlmsg_end(msg, hdr);
11196
11197         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11198                                 NL80211_MCGRP_MLME, gfp);
11199         return;
11200
11201  nla_put_failure:
11202         genlmsg_cancel(msg, hdr);
11203         nlmsg_free(msg);
11204 }
11205
11206 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
11207                                struct ieee80211_channel *chan,
11208                                unsigned int duration, gfp_t gfp)
11209 {
11210         struct wiphy *wiphy = wdev->wiphy;
11211         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11212
11213         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11214         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11215                                           rdev, wdev, cookie, chan,
11216                                           duration, gfp);
11217 }
11218 EXPORT_SYMBOL(cfg80211_ready_on_channel);
11219
11220 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
11221                                         struct ieee80211_channel *chan,
11222                                         gfp_t gfp)
11223 {
11224         struct wiphy *wiphy = wdev->wiphy;
11225         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11226
11227         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11228         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11229                                           rdev, wdev, cookie, chan, 0, gfp);
11230 }
11231 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11232
11233 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
11234                       struct station_info *sinfo, gfp_t gfp)
11235 {
11236         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11237         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11238         struct sk_buff *msg;
11239
11240         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
11241
11242         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11243         if (!msg)
11244                 return;
11245
11246         if (nl80211_send_station(msg, 0, 0, 0,
11247                                  rdev, dev, mac_addr, sinfo) < 0) {
11248                 nlmsg_free(msg);
11249                 return;
11250         }
11251
11252         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11253                                 NL80211_MCGRP_MLME, gfp);
11254 }
11255 EXPORT_SYMBOL(cfg80211_new_sta);
11256
11257 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
11258 {
11259         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11260         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11261         struct sk_buff *msg;
11262         void *hdr;
11263
11264         trace_cfg80211_del_sta(dev, mac_addr);
11265
11266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11267         if (!msg)
11268                 return;
11269
11270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
11271         if (!hdr) {
11272                 nlmsg_free(msg);
11273                 return;
11274         }
11275
11276         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11277             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
11278                 goto nla_put_failure;
11279
11280         genlmsg_end(msg, hdr);
11281
11282         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11283                                 NL80211_MCGRP_MLME, gfp);
11284         return;
11285
11286  nla_put_failure:
11287         genlmsg_cancel(msg, hdr);
11288         nlmsg_free(msg);
11289 }
11290 EXPORT_SYMBOL(cfg80211_del_sta);
11291
11292 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11293                           enum nl80211_connect_failed_reason reason,
11294                           gfp_t gfp)
11295 {
11296         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11297         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11298         struct sk_buff *msg;
11299         void *hdr;
11300
11301         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11302         if (!msg)
11303                 return;
11304
11305         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11306         if (!hdr) {
11307                 nlmsg_free(msg);
11308                 return;
11309         }
11310
11311         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11312             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11313             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11314                 goto nla_put_failure;
11315
11316         genlmsg_end(msg, hdr);
11317
11318         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11319                                 NL80211_MCGRP_MLME, gfp);
11320         return;
11321
11322  nla_put_failure:
11323         genlmsg_cancel(msg, hdr);
11324         nlmsg_free(msg);
11325 }
11326 EXPORT_SYMBOL(cfg80211_conn_failed);
11327
11328 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11329                                        const u8 *addr, gfp_t gfp)
11330 {
11331         struct wireless_dev *wdev = dev->ieee80211_ptr;
11332         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11333         struct sk_buff *msg;
11334         void *hdr;
11335         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11336
11337         if (!nlportid)
11338                 return false;
11339
11340         msg = nlmsg_new(100, gfp);
11341         if (!msg)
11342                 return true;
11343
11344         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11345         if (!hdr) {
11346                 nlmsg_free(msg);
11347                 return true;
11348         }
11349
11350         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11351             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11352             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11353                 goto nla_put_failure;
11354
11355         genlmsg_end(msg, hdr);
11356         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11357         return true;
11358
11359  nla_put_failure:
11360         genlmsg_cancel(msg, hdr);
11361         nlmsg_free(msg);
11362         return true;
11363 }
11364
11365 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11366                                 const u8 *addr, gfp_t gfp)
11367 {
11368         struct wireless_dev *wdev = dev->ieee80211_ptr;
11369         bool ret;
11370
11371         trace_cfg80211_rx_spurious_frame(dev, addr);
11372
11373         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11374                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11375                 trace_cfg80211_return_bool(false);
11376                 return false;
11377         }
11378         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11379                                          addr, gfp);
11380         trace_cfg80211_return_bool(ret);
11381         return ret;
11382 }
11383 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11384
11385 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11386                                         const u8 *addr, gfp_t gfp)
11387 {
11388         struct wireless_dev *wdev = dev->ieee80211_ptr;
11389         bool ret;
11390
11391         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11392
11393         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11394                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11395                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11396                 trace_cfg80211_return_bool(false);
11397                 return false;
11398         }
11399         ret = __nl80211_unexpected_frame(dev,
11400                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11401                                          addr, gfp);
11402         trace_cfg80211_return_bool(ret);
11403         return ret;
11404 }
11405 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11406
11407 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11408                       struct wireless_dev *wdev, u32 nlportid,
11409                       int freq, int sig_dbm,
11410                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11411 {
11412         struct net_device *netdev = wdev->netdev;
11413         struct sk_buff *msg;
11414         void *hdr;
11415
11416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11417         if (!msg)
11418                 return -ENOMEM;
11419
11420         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11421         if (!hdr) {
11422                 nlmsg_free(msg);
11423                 return -ENOMEM;
11424         }
11425
11426         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11427             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11428                                         netdev->ifindex)) ||
11429             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11430             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11431             (sig_dbm &&
11432              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11433             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11434             (flags &&
11435              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11436                 goto nla_put_failure;
11437
11438         genlmsg_end(msg, hdr);
11439
11440         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11441
11442  nla_put_failure:
11443         genlmsg_cancel(msg, hdr);
11444         nlmsg_free(msg);
11445         return -ENOBUFS;
11446 }
11447
11448 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11449                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11450 {
11451         struct wiphy *wiphy = wdev->wiphy;
11452         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11453         struct net_device *netdev = wdev->netdev;
11454         struct sk_buff *msg;
11455         void *hdr;
11456
11457         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11458
11459         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11460         if (!msg)
11461                 return;
11462
11463         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11464         if (!hdr) {
11465                 nlmsg_free(msg);
11466                 return;
11467         }
11468
11469         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11470             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11471                                    netdev->ifindex)) ||
11472             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11473             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11474             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11475             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11476                 goto nla_put_failure;
11477
11478         genlmsg_end(msg, hdr);
11479
11480         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11481                                 NL80211_MCGRP_MLME, gfp);
11482         return;
11483
11484  nla_put_failure:
11485         genlmsg_cancel(msg, hdr);
11486         nlmsg_free(msg);
11487 }
11488 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11489
11490 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11491                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11492                               gfp_t gfp)
11493 {
11494         struct wireless_dev *wdev = dev->ieee80211_ptr;
11495         struct wiphy *wiphy = wdev->wiphy;
11496         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11497         struct sk_buff *msg;
11498         struct nlattr *pinfoattr;
11499         void *hdr;
11500
11501         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11502
11503         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11504         if (!msg)
11505                 return;
11506
11507         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11508         if (!hdr) {
11509                 nlmsg_free(msg);
11510                 return;
11511         }
11512
11513         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11514             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11515                 goto nla_put_failure;
11516
11517         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11518         if (!pinfoattr)
11519                 goto nla_put_failure;
11520
11521         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11522                         rssi_event))
11523                 goto nla_put_failure;
11524
11525         nla_nest_end(msg, pinfoattr);
11526
11527         genlmsg_end(msg, hdr);
11528
11529         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11530                                 NL80211_MCGRP_MLME, gfp);
11531         return;
11532
11533  nla_put_failure:
11534         genlmsg_cancel(msg, hdr);
11535         nlmsg_free(msg);
11536 }
11537 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11538
11539 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11540                                      struct net_device *netdev, const u8 *bssid,
11541                                      const u8 *replay_ctr, gfp_t gfp)
11542 {
11543         struct sk_buff *msg;
11544         struct nlattr *rekey_attr;
11545         void *hdr;
11546
11547         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11548         if (!msg)
11549                 return;
11550
11551         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11552         if (!hdr) {
11553                 nlmsg_free(msg);
11554                 return;
11555         }
11556
11557         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11558             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11559             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11560                 goto nla_put_failure;
11561
11562         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11563         if (!rekey_attr)
11564                 goto nla_put_failure;
11565
11566         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11567                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11568                 goto nla_put_failure;
11569
11570         nla_nest_end(msg, rekey_attr);
11571
11572         genlmsg_end(msg, hdr);
11573
11574         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11575                                 NL80211_MCGRP_MLME, gfp);
11576         return;
11577
11578  nla_put_failure:
11579         genlmsg_cancel(msg, hdr);
11580         nlmsg_free(msg);
11581 }
11582
11583 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11584                                const u8 *replay_ctr, gfp_t gfp)
11585 {
11586         struct wireless_dev *wdev = dev->ieee80211_ptr;
11587         struct wiphy *wiphy = wdev->wiphy;
11588         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11589
11590         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11591         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11592 }
11593 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11594
11595 static void
11596 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11597                                struct net_device *netdev, int index,
11598                                const u8 *bssid, bool preauth, gfp_t gfp)
11599 {
11600         struct sk_buff *msg;
11601         struct nlattr *attr;
11602         void *hdr;
11603
11604         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11605         if (!msg)
11606                 return;
11607
11608         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11609         if (!hdr) {
11610                 nlmsg_free(msg);
11611                 return;
11612         }
11613
11614         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11615             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11616                 goto nla_put_failure;
11617
11618         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11619         if (!attr)
11620                 goto nla_put_failure;
11621
11622         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11623             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11624             (preauth &&
11625              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11626                 goto nla_put_failure;
11627
11628         nla_nest_end(msg, attr);
11629
11630         genlmsg_end(msg, hdr);
11631
11632         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11633                                 NL80211_MCGRP_MLME, gfp);
11634         return;
11635
11636  nla_put_failure:
11637         genlmsg_cancel(msg, hdr);
11638         nlmsg_free(msg);
11639 }
11640
11641 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11642                                      const u8 *bssid, bool preauth, gfp_t gfp)
11643 {
11644         struct wireless_dev *wdev = dev->ieee80211_ptr;
11645         struct wiphy *wiphy = wdev->wiphy;
11646         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11647
11648         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11649         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11650 }
11651 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11652
11653 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11654                                      struct net_device *netdev,
11655                                      struct cfg80211_chan_def *chandef,
11656                                      gfp_t gfp,
11657                                      enum nl80211_commands notif,
11658                                      u8 count)
11659 {
11660         struct sk_buff *msg;
11661         void *hdr;
11662
11663         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11664         if (!msg)
11665                 return;
11666
11667         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
11668         if (!hdr) {
11669                 nlmsg_free(msg);
11670                 return;
11671         }
11672
11673         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11674                 goto nla_put_failure;
11675
11676         if (nl80211_send_chandef(msg, chandef))
11677                 goto nla_put_failure;
11678
11679         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
11680             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
11681                         goto nla_put_failure;
11682
11683         genlmsg_end(msg, hdr);
11684
11685         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11686                                 NL80211_MCGRP_MLME, gfp);
11687         return;
11688
11689  nla_put_failure:
11690         genlmsg_cancel(msg, hdr);
11691         nlmsg_free(msg);
11692 }
11693
11694 void cfg80211_ch_switch_notify(struct net_device *dev,
11695                                struct cfg80211_chan_def *chandef)
11696 {
11697         struct wireless_dev *wdev = dev->ieee80211_ptr;
11698         struct wiphy *wiphy = wdev->wiphy;
11699         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11700
11701         ASSERT_WDEV_LOCK(wdev);
11702
11703         trace_cfg80211_ch_switch_notify(dev, chandef);
11704
11705         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11706                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11707                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11708                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11709                 return;
11710
11711         wdev->chandef = *chandef;
11712         wdev->preset_chandef = *chandef;
11713         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
11714                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
11715 }
11716 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11717
11718 void cfg80211_ch_switch_started_notify(struct net_device *dev,
11719                                        struct cfg80211_chan_def *chandef,
11720                                        u8 count)
11721 {
11722         struct wireless_dev *wdev = dev->ieee80211_ptr;
11723         struct wiphy *wiphy = wdev->wiphy;
11724         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11725
11726         trace_cfg80211_ch_switch_started_notify(dev, chandef);
11727
11728         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
11729                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
11730 }
11731 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
11732
11733 void cfg80211_cqm_txe_notify(struct net_device *dev,
11734                              const u8 *peer, u32 num_packets,
11735                              u32 rate, u32 intvl, gfp_t gfp)
11736 {
11737         struct wireless_dev *wdev = dev->ieee80211_ptr;
11738         struct wiphy *wiphy = wdev->wiphy;
11739         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11740         struct sk_buff *msg;
11741         struct nlattr *pinfoattr;
11742         void *hdr;
11743
11744         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11745         if (!msg)
11746                 return;
11747
11748         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11749         if (!hdr) {
11750                 nlmsg_free(msg);
11751                 return;
11752         }
11753
11754         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11755             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11756             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11757                 goto nla_put_failure;
11758
11759         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11760         if (!pinfoattr)
11761                 goto nla_put_failure;
11762
11763         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11764                 goto nla_put_failure;
11765
11766         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11767                 goto nla_put_failure;
11768
11769         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11770                 goto nla_put_failure;
11771
11772         nla_nest_end(msg, pinfoattr);
11773
11774         genlmsg_end(msg, hdr);
11775
11776         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11777                                 NL80211_MCGRP_MLME, gfp);
11778         return;
11779
11780  nla_put_failure:
11781         genlmsg_cancel(msg, hdr);
11782         nlmsg_free(msg);
11783 }
11784 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11785
11786 void
11787 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11788                      const struct cfg80211_chan_def *chandef,
11789                      enum nl80211_radar_event event,
11790                      struct net_device *netdev, gfp_t gfp)
11791 {
11792         struct sk_buff *msg;
11793         void *hdr;
11794
11795         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11796         if (!msg)
11797                 return;
11798
11799         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11800         if (!hdr) {
11801                 nlmsg_free(msg);
11802                 return;
11803         }
11804
11805         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11806                 goto nla_put_failure;
11807
11808         /* NOP and radar events don't need a netdev parameter */
11809         if (netdev) {
11810                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11811
11812                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11813                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11814                         goto nla_put_failure;
11815         }
11816
11817         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11818                 goto nla_put_failure;
11819
11820         if (nl80211_send_chandef(msg, chandef))
11821                 goto nla_put_failure;
11822
11823         genlmsg_end(msg, hdr);
11824
11825         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11826                                 NL80211_MCGRP_MLME, gfp);
11827         return;
11828
11829  nla_put_failure:
11830         genlmsg_cancel(msg, hdr);
11831         nlmsg_free(msg);
11832 }
11833
11834 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11835                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11836 {
11837         struct wireless_dev *wdev = dev->ieee80211_ptr;
11838         struct wiphy *wiphy = wdev->wiphy;
11839         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11840         struct sk_buff *msg;
11841         struct nlattr *pinfoattr;
11842         void *hdr;
11843
11844         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11845
11846         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11847         if (!msg)
11848                 return;
11849
11850         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11851         if (!hdr) {
11852                 nlmsg_free(msg);
11853                 return;
11854         }
11855
11856         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11857             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11858             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11859                 goto nla_put_failure;
11860
11861         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11862         if (!pinfoattr)
11863                 goto nla_put_failure;
11864
11865         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11866                 goto nla_put_failure;
11867
11868         nla_nest_end(msg, pinfoattr);
11869
11870         genlmsg_end(msg, hdr);
11871
11872         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11873                                 NL80211_MCGRP_MLME, gfp);
11874         return;
11875
11876  nla_put_failure:
11877         genlmsg_cancel(msg, hdr);
11878         nlmsg_free(msg);
11879 }
11880 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11881
11882 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11883                            u64 cookie, bool acked, gfp_t gfp)
11884 {
11885         struct wireless_dev *wdev = dev->ieee80211_ptr;
11886         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11887         struct sk_buff *msg;
11888         void *hdr;
11889
11890         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11891
11892         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11893
11894         if (!msg)
11895                 return;
11896
11897         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11898         if (!hdr) {
11899                 nlmsg_free(msg);
11900                 return;
11901         }
11902
11903         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11904             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11905             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11906             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11907             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11908                 goto nla_put_failure;
11909
11910         genlmsg_end(msg, hdr);
11911
11912         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11913                                 NL80211_MCGRP_MLME, gfp);
11914         return;
11915
11916  nla_put_failure:
11917         genlmsg_cancel(msg, hdr);
11918         nlmsg_free(msg);
11919 }
11920 EXPORT_SYMBOL(cfg80211_probe_status);
11921
11922 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11923                                  const u8 *frame, size_t len,
11924                                  int freq, int sig_dbm)
11925 {
11926         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11927         struct sk_buff *msg;
11928         void *hdr;
11929         struct cfg80211_beacon_registration *reg;
11930
11931         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11932
11933         spin_lock_bh(&rdev->beacon_registrations_lock);
11934         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11935                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11936                 if (!msg) {
11937                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11938                         return;
11939                 }
11940
11941                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11942                 if (!hdr)
11943                         goto nla_put_failure;
11944
11945                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11946                     (freq &&
11947                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11948                     (sig_dbm &&
11949                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11950                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11951                         goto nla_put_failure;
11952
11953                 genlmsg_end(msg, hdr);
11954
11955                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11956         }
11957         spin_unlock_bh(&rdev->beacon_registrations_lock);
11958         return;
11959
11960  nla_put_failure:
11961         spin_unlock_bh(&rdev->beacon_registrations_lock);
11962         if (hdr)
11963                 genlmsg_cancel(msg, hdr);
11964         nlmsg_free(msg);
11965 }
11966 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11967
11968 #ifdef CONFIG_PM
11969 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11970                                    struct cfg80211_wowlan_wakeup *wakeup,
11971                                    gfp_t gfp)
11972 {
11973         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11974         struct sk_buff *msg;
11975         void *hdr;
11976         int size = 200;
11977
11978         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11979
11980         if (wakeup)
11981                 size += wakeup->packet_present_len;
11982
11983         msg = nlmsg_new(size, gfp);
11984         if (!msg)
11985                 return;
11986
11987         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11988         if (!hdr)
11989                 goto free_msg;
11990
11991         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11992             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11993                 goto free_msg;
11994
11995         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11996                                         wdev->netdev->ifindex))
11997                 goto free_msg;
11998
11999         if (wakeup) {
12000                 struct nlattr *reasons;
12001
12002                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12003                 if (!reasons)
12004                         goto free_msg;
12005
12006                 if (wakeup->disconnect &&
12007                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
12008                         goto free_msg;
12009                 if (wakeup->magic_pkt &&
12010                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
12011                         goto free_msg;
12012                 if (wakeup->gtk_rekey_failure &&
12013                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
12014                         goto free_msg;
12015                 if (wakeup->eap_identity_req &&
12016                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
12017                         goto free_msg;
12018                 if (wakeup->four_way_handshake &&
12019                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
12020                         goto free_msg;
12021                 if (wakeup->rfkill_release &&
12022                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
12023                         goto free_msg;
12024
12025                 if (wakeup->pattern_idx >= 0 &&
12026                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
12027                                 wakeup->pattern_idx))
12028                         goto free_msg;
12029
12030                 if (wakeup->tcp_match &&
12031                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
12032                         goto free_msg;
12033
12034                 if (wakeup->tcp_connlost &&
12035                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
12036                         goto free_msg;
12037
12038                 if (wakeup->tcp_nomoretokens &&
12039                     nla_put_flag(msg,
12040                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
12041                         goto free_msg;
12042
12043                 if (wakeup->packet) {
12044                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
12045                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
12046
12047                         if (!wakeup->packet_80211) {
12048                                 pkt_attr =
12049                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
12050                                 len_attr =
12051                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
12052                         }
12053
12054                         if (wakeup->packet_len &&
12055                             nla_put_u32(msg, len_attr, wakeup->packet_len))
12056                                 goto free_msg;
12057
12058                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
12059                                     wakeup->packet))
12060                                 goto free_msg;
12061                 }
12062
12063                 nla_nest_end(msg, reasons);
12064         }
12065
12066         genlmsg_end(msg, hdr);
12067
12068         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12069                                 NL80211_MCGRP_MLME, gfp);
12070         return;
12071
12072  free_msg:
12073         nlmsg_free(msg);
12074 }
12075 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12076 #endif
12077
12078 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12079                                 enum nl80211_tdls_operation oper,
12080                                 u16 reason_code, gfp_t gfp)
12081 {
12082         struct wireless_dev *wdev = dev->ieee80211_ptr;
12083         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12084         struct sk_buff *msg;
12085         void *hdr;
12086
12087         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12088                                          reason_code);
12089
12090         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12091         if (!msg)
12092                 return;
12093
12094         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12095         if (!hdr) {
12096                 nlmsg_free(msg);
12097                 return;
12098         }
12099
12100         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12101             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12102             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12103             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12104             (reason_code > 0 &&
12105              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12106                 goto nla_put_failure;
12107
12108         genlmsg_end(msg, hdr);
12109
12110         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12111                                 NL80211_MCGRP_MLME, gfp);
12112         return;
12113
12114  nla_put_failure:
12115         genlmsg_cancel(msg, hdr);
12116         nlmsg_free(msg);
12117 }
12118 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12119
12120 static int nl80211_netlink_notify(struct notifier_block * nb,
12121                                   unsigned long state,
12122                                   void *_notify)
12123 {
12124         struct netlink_notify *notify = _notify;
12125         struct cfg80211_registered_device *rdev;
12126         struct wireless_dev *wdev;
12127         struct cfg80211_beacon_registration *reg, *tmp;
12128
12129         if (state != NETLINK_URELEASE)
12130                 return NOTIFY_DONE;
12131
12132         rcu_read_lock();
12133
12134         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12135                 bool schedule_destroy_work = false;
12136
12137                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12138                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
12139
12140                         if (wdev->owner_nlportid == notify->portid)
12141                                 schedule_destroy_work = true;
12142                 }
12143
12144                 spin_lock_bh(&rdev->beacon_registrations_lock);
12145                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
12146                                          list) {
12147                         if (reg->nlportid == notify->portid) {
12148                                 list_del(&reg->list);
12149                                 kfree(reg);
12150                                 break;
12151                         }
12152                 }
12153                 spin_unlock_bh(&rdev->beacon_registrations_lock);
12154
12155                 if (schedule_destroy_work) {
12156                         struct cfg80211_iface_destroy *destroy;
12157
12158                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
12159                         if (destroy) {
12160                                 destroy->nlportid = notify->portid;
12161                                 spin_lock(&rdev->destroy_list_lock);
12162                                 list_add(&destroy->list, &rdev->destroy_list);
12163                                 spin_unlock(&rdev->destroy_list_lock);
12164                                 schedule_work(&rdev->destroy_work);
12165                         }
12166                 }
12167         }
12168
12169         rcu_read_unlock();
12170
12171         return NOTIFY_OK;
12172 }
12173
12174 static struct notifier_block nl80211_netlink_notifier = {
12175         .notifier_call = nl80211_netlink_notify,
12176 };
12177
12178 void cfg80211_ft_event(struct net_device *netdev,
12179                        struct cfg80211_ft_event_params *ft_event)
12180 {
12181         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12182         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12183         struct sk_buff *msg;
12184         void *hdr;
12185
12186         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
12187
12188         if (!ft_event->target_ap)
12189                 return;
12190
12191         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12192         if (!msg)
12193                 return;
12194
12195         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12196         if (!hdr)
12197                 goto out;
12198
12199         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12200             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12201             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
12202                 goto out;
12203
12204         if (ft_event->ies &&
12205             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
12206                 goto out;
12207         if (ft_event->ric_ies &&
12208             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
12209                     ft_event->ric_ies))
12210                 goto out;
12211
12212         genlmsg_end(msg, hdr);
12213
12214         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12215                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12216         return;
12217  out:
12218         nlmsg_free(msg);
12219 }
12220 EXPORT_SYMBOL(cfg80211_ft_event);
12221
12222 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
12223 {
12224         struct cfg80211_registered_device *rdev;
12225         struct sk_buff *msg;
12226         void *hdr;
12227         u32 nlportid;
12228
12229         rdev = wiphy_to_rdev(wdev->wiphy);
12230         if (!rdev->crit_proto_nlportid)
12231                 return;
12232
12233         nlportid = rdev->crit_proto_nlportid;
12234         rdev->crit_proto_nlportid = 0;
12235
12236         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12237         if (!msg)
12238                 return;
12239
12240         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
12241         if (!hdr)
12242                 goto nla_put_failure;
12243
12244         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12245             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12246                 goto nla_put_failure;
12247
12248         genlmsg_end(msg, hdr);
12249
12250         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12251         return;
12252
12253  nla_put_failure:
12254         if (hdr)
12255                 genlmsg_cancel(msg, hdr);
12256         nlmsg_free(msg);
12257
12258 }
12259 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
12260
12261 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
12262 {
12263         struct wiphy *wiphy = wdev->wiphy;
12264         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12265         struct sk_buff *msg;
12266         void *hdr;
12267
12268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12269         if (!msg)
12270                 return;
12271
12272         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
12273         if (!hdr)
12274                 goto out;
12275
12276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12277             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
12278             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12279                 goto out;
12280
12281         genlmsg_end(msg, hdr);
12282
12283         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
12284                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12285         return;
12286  out:
12287         nlmsg_free(msg);
12288 }
12289
12290 /* initialisation/exit functions */
12291
12292 int nl80211_init(void)
12293 {
12294         int err;
12295
12296         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
12297                                                    nl80211_mcgrps);
12298         if (err)
12299                 return err;
12300
12301         err = netlink_register_notifier(&nl80211_netlink_notifier);
12302         if (err)
12303                 goto err_out;
12304
12305         return 0;
12306  err_out:
12307         genl_unregister_family(&nl80211_fam);
12308         return err;
12309 }
12310
12311 void nl80211_exit(void)
12312 {
12313         netlink_unregister_notifier(&nl80211_netlink_notifier);
12314         genl_unregister_family(&nl80211_fam);
12315 }