net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 374         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 376                 .len = NL80211_VHT_CAPABILITY_LEN,
 377         },
 378         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 379         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 380                                   .len = IEEE80211_MAX_DATA_LEN },
 381 };
 382
 383 /* policy for the key attributes */
 384 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 385         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 386         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 387         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 388         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 389         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 390         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 391         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 392         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 393 };
 394
 395 /* policy for the key default flags */
 396 static const struct nla_policy
 397 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 398         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 399         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 400 };
 401
 402 /* policy for WoWLAN attributes */
 403 static const struct nla_policy
 404 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 405         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 406         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 407         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 408         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 409         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 410         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 411         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 413         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 414 };
 415
 416 static const struct nla_policy
 417 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 418         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 419         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 420         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 421         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 422         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 423         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 424         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 425                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 426         },
 427         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 428                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 429         },
 430         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 431         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 432         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 433 };
 434
 435 /* policy for GTK rekey offload attributes */
 436 static const struct nla_policy
 437 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 438         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 439         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 440         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 441 };
 442
 443 static const struct nla_policy
 444 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 445         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 446                                                  .len = IEEE80211_MAX_SSID_LEN },
 447         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 448 };
 449
 450 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 451                                      struct netlink_callback *cb,
 452                                      struct cfg80211_registered_device **rdev,
 453                                      struct wireless_dev **wdev)
 454 {
 455         int err;
 456
 457         rtnl_lock();
 458         mutex_lock(&cfg80211_mutex);
 459
 460         if (!cb->args[0]) {
 461                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 462                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 463                                   nl80211_policy);
 464                 if (err)
 465                         goto out_unlock;
 466
 467                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 468                                                    nl80211_fam.attrbuf);
 469                 if (IS_ERR(*wdev)) {
 470                         err = PTR_ERR(*wdev);
 471                         goto out_unlock;
 472                 }
 473                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 474                 /* 0 is the first index - add 1 to parse only once */
 475                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 476                 cb->args[1] = (*wdev)->identifier;
 477         } else {
 478                 /* subtract the 1 again here */
 479                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 480                 struct wireless_dev *tmp;
 481
 482                 if (!wiphy) {
 483                         err = -ENODEV;
 484                         goto out_unlock;
 485                 }
 486                 *rdev = wiphy_to_dev(wiphy);
 487                 *wdev = NULL;
 488
 489                 mutex_lock(&(*rdev)->devlist_mtx);
 490                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 491                         if (tmp->identifier == cb->args[1]) {
 492                                 *wdev = tmp;
 493                                 break;
 494                         }
 495                 }
 496                 mutex_unlock(&(*rdev)->devlist_mtx);
 497
 498                 if (!*wdev) {
 499                         err = -ENODEV;
 500                         goto out_unlock;
 501                 }
 502         }
 503
 504         cfg80211_lock_rdev(*rdev);
 505
 506         mutex_unlock(&cfg80211_mutex);
 507         return 0;
 508  out_unlock:
 509         mutex_unlock(&cfg80211_mutex);
 510         rtnl_unlock();
 511         return err;
 512 }
 513
 514 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 515 {
 516         cfg80211_unlock_rdev(rdev);
 517         rtnl_unlock();
 518 }
 519
 520 /* IE validation */
 521 static bool is_valid_ie_attr(const struct nlattr *attr)
 522 {
 523         const u8 *pos;
 524         int len;
 525
 526         if (!attr)
 527                 return true;
 528
 529         pos = nla_data(attr);
 530         len = nla_len(attr);
 531
 532         while (len) {
 533                 u8 elemlen;
 534
 535                 if (len < 2)
 536                         return false;
 537                 len -= 2;
 538
 539                 elemlen = pos[1];
 540                 if (elemlen > len)
 541                         return false;
 542
 543                 len -= elemlen;
 544                 pos += 2 + elemlen;
 545         }
 546
 547         return true;
 548 }
 549
 550 /* message building helper */
 551 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 552                                    int flags, u8 cmd)
 553 {
 554         /* since there is no private header just add the generic one */
 555         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 556 }
 557
 558 static int nl80211_msg_put_channel(struct sk_buff *msg,
 559                                    struct ieee80211_channel *chan,
 560                                    bool large)
 561 {
 562         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 563                         chan->center_freq))
 564                 goto nla_put_failure;
 565
 566         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 567             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 568                 goto nla_put_failure;
 569         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 570             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 571                 goto nla_put_failure;
 572         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 573             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 574                 goto nla_put_failure;
 575         if (chan->flags & IEEE80211_CHAN_RADAR) {
 576                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 577                         goto nla_put_failure;
 578                 if (large) {
 579                         u32 time;
 580
 581                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 582
 583                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 584                                         chan->dfs_state))
 585                                 goto nla_put_failure;
 586                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 587                                         time))
 588                                 goto nla_put_failure;
 589                 }
 590         }
 591
 592         if (large) {
 593                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 594                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 595                         goto nla_put_failure;
 596                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 597                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 598                         goto nla_put_failure;
 599                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 600                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 601                         goto nla_put_failure;
 602                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 603                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 604                         goto nla_put_failure;
 605         }
 606
 607         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 608                         DBM_TO_MBM(chan->max_power)))
 609                 goto nla_put_failure;
 610
 611         return 0;
 612
 613  nla_put_failure:
 614         return -ENOBUFS;
 615 }
 616
 617 /* netlink command implementations */
 618
 619 struct key_parse {
 620         struct key_params p;
 621         int idx;
 622         int type;
 623         bool def, defmgmt;
 624         bool def_uni, def_multi;
 625 };
 626
 627 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 628 {
 629         struct nlattr *tb[NL80211_KEY_MAX + 1];
 630         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 631                                    nl80211_key_policy);
 632         if (err)
 633                 return err;
 634
 635         k->def = !!tb[NL80211_KEY_DEFAULT];
 636         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 637
 638         if (k->def) {
 639                 k->def_uni = true;
 640                 k->def_multi = true;
 641         }
 642         if (k->defmgmt)
 643                 k->def_multi = true;
 644
 645         if (tb[NL80211_KEY_IDX])
 646                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 647
 648         if (tb[NL80211_KEY_DATA]) {
 649                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 650                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 651         }
 652
 653         if (tb[NL80211_KEY_SEQ]) {
 654                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 655                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 656         }
 657
 658         if (tb[NL80211_KEY_CIPHER])
 659                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 660
 661         if (tb[NL80211_KEY_TYPE]) {
 662                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 663                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 664                         return -EINVAL;
 665         }
 666
 667         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 668                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 669                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 670                                        tb[NL80211_KEY_DEFAULT_TYPES],
 671                                        nl80211_key_default_policy);
 672                 if (err)
 673                         return err;
 674
 675                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 676                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 677         }
 678
 679         return 0;
 680 }
 681
 682 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 683 {
 684         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 685                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 686                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 687         }
 688
 689         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 690                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 691                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 692         }
 693
 694         if (info->attrs[NL80211_ATTR_KEY_IDX])
 695                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 696
 697         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 698                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 699
 700         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 701         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 702
 703         if (k->def) {
 704                 k->def_uni = true;
 705                 k->def_multi = true;
 706         }
 707         if (k->defmgmt)
 708                 k->def_multi = true;
 709
 710         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 711                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 712                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 713                         return -EINVAL;
 714         }
 715
 716         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 717                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 718                 int err = nla_parse_nested(
 719                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 720                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 721                                 nl80211_key_default_policy);
 722                 if (err)
 723                         return err;
 724
 725                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 726                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 727         }
 728
 729         return 0;
 730 }
 731
 732 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 733 {
 734         int err;
 735
 736         memset(k, 0, sizeof(*k));
 737         k->idx = -1;
 738         k->type = -1;
 739
 740         if (info->attrs[NL80211_ATTR_KEY])
 741                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 742         else
 743                 err = nl80211_parse_key_old(info, k);
 744
 745         if (err)
 746                 return err;
 747
 748         if (k->def && k->defmgmt)
 749                 return -EINVAL;
 750
 751         if (k->defmgmt) {
 752                 if (k->def_uni || !k->def_multi)
 753                         return -EINVAL;
 754         }
 755
 756         if (k->idx != -1) {
 757                 if (k->defmgmt) {
 758                         if (k->idx < 4 || k->idx > 5)
 759                                 return -EINVAL;
 760                 } else if (k->def) {
 761                         if (k->idx < 0 || k->idx > 3)
 762                                 return -EINVAL;
 763                 } else {
 764                         if (k->idx < 0 || k->idx > 5)
 765                                 return -EINVAL;
 766                 }
 767         }
 768
 769         return 0;
 770 }
 771
 772 static struct cfg80211_cached_keys *
 773 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 774                        struct nlattr *keys, bool *no_ht)
 775 {
 776         struct key_parse parse;
 777         struct nlattr *key;
 778         struct cfg80211_cached_keys *result;
 779         int rem, err, def = 0;
 780
 781         result = kzalloc(sizeof(*result), GFP_KERNEL);
 782         if (!result)
 783                 return ERR_PTR(-ENOMEM);
 784
 785         result->def = -1;
 786         result->defmgmt = -1;
 787
 788         nla_for_each_nested(key, keys, rem) {
 789                 memset(&parse, 0, sizeof(parse));
 790                 parse.idx = -1;
 791
 792                 err = nl80211_parse_key_new(key, &parse);
 793                 if (err)
 794                         goto error;
 795                 err = -EINVAL;
 796                 if (!parse.p.key)
 797                         goto error;
 798                 if (parse.idx < 0 || parse.idx > 4)
 799                         goto error;
 800                 if (parse.def) {
 801                         if (def)
 802                                 goto error;
 803                         def = 1;
 804                         result->def = parse.idx;
 805                         if (!parse.def_uni || !parse.def_multi)
 806                                 goto error;
 807                 } else if (parse.defmgmt)
 808                         goto error;
 809                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 810                                                      parse.idx, false, NULL);
 811                 if (err)
 812                         goto error;
 813                 result->params[parse.idx].cipher = parse.p.cipher;
 814                 result->params[parse.idx].key_len = parse.p.key_len;
 815                 result->params[parse.idx].key = result->data[parse.idx];
 816                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 817
 818                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 819                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 820                         if (no_ht)
 821                                 *no_ht = true;
 822                 }
 823         }
 824
 825         return result;
 826  error:
 827         kfree(result);
 828         return ERR_PTR(err);
 829 }
 830
 831 static int nl80211_key_allowed(struct wireless_dev *wdev)
 832 {
 833         ASSERT_WDEV_LOCK(wdev);
 834
 835         switch (wdev->iftype) {
 836         case NL80211_IFTYPE_AP:
 837         case NL80211_IFTYPE_AP_VLAN:
 838         case NL80211_IFTYPE_P2P_GO:
 839         case NL80211_IFTYPE_MESH_POINT:
 840                 break;
 841         case NL80211_IFTYPE_ADHOC:
 842                 if (!wdev->current_bss)
 843                         return -ENOLINK;
 844                 break;
 845         case NL80211_IFTYPE_STATION:
 846         case NL80211_IFTYPE_P2P_CLIENT:
 847                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 848                         return -ENOLINK;
 849                 break;
 850         default:
 851                 return -EINVAL;
 852         }
 853
 854         return 0;
 855 }
 856
 857 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 858 {
 859         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 860         int i;
 861
 862         if (!nl_modes)
 863                 goto nla_put_failure;
 864
 865         i = 0;
 866         while (ifmodes) {
 867                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 868                         goto nla_put_failure;
 869                 ifmodes >>= 1;
 870                 i++;
 871         }
 872
 873         nla_nest_end(msg, nl_modes);
 874         return 0;
 875
 876 nla_put_failure:
 877         return -ENOBUFS;
 878 }
 879
 880 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 881                                           struct sk_buff *msg,
 882                                           bool large)
 883 {
 884         struct nlattr *nl_combis;
 885         int i, j;
 886
 887         nl_combis = nla_nest_start(msg,
 888                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 889         if (!nl_combis)
 890                 goto nla_put_failure;
 891
 892         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 893                 const struct ieee80211_iface_combination *c;
 894                 struct nlattr *nl_combi, *nl_limits;
 895
 896                 c = &wiphy->iface_combinations[i];
 897
 898                 nl_combi = nla_nest_start(msg, i + 1);
 899                 if (!nl_combi)
 900                         goto nla_put_failure;
 901
 902                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 903                 if (!nl_limits)
 904                         goto nla_put_failure;
 905
 906                 for (j = 0; j < c->n_limits; j++) {
 907                         struct nlattr *nl_limit;
 908
 909                         nl_limit = nla_nest_start(msg, j + 1);
 910                         if (!nl_limit)
 911                                 goto nla_put_failure;
 912                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 913                                         c->limits[j].max))
 914                                 goto nla_put_failure;
 915                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 916                                                 c->limits[j].types))
 917                                 goto nla_put_failure;
 918                         nla_nest_end(msg, nl_limit);
 919                 }
 920
 921                 nla_nest_end(msg, nl_limits);
 922
 923                 if (c->beacon_int_infra_match &&
 924                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 925                         goto nla_put_failure;
 926                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 927                                 c->num_different_channels) ||
 928                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 929                                 c->max_interfaces))
 930                         goto nla_put_failure;
 931                 if (large &&
 932                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 933                                 c->radar_detect_widths))
 934                         goto nla_put_failure;
 935
 936                 nla_nest_end(msg, nl_combi);
 937         }
 938
 939         nla_nest_end(msg, nl_combis);
 940
 941         return 0;
 942 nla_put_failure:
 943         return -ENOBUFS;
 944 }
 945
 946 #ifdef CONFIG_PM
 947 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 948                                         struct sk_buff *msg)
 949 {
 950         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 951         struct nlattr *nl_tcp;
 952
 953         if (!tcp)
 954                 return 0;
 955
 956         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 957         if (!nl_tcp)
 958                 return -ENOBUFS;
 959
 960         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 961                         tcp->data_payload_max))
 962                 return -ENOBUFS;
 963
 964         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 965                         tcp->data_payload_max))
 966                 return -ENOBUFS;
 967
 968         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 969                 return -ENOBUFS;
 970
 971         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 972                                 sizeof(*tcp->tok), tcp->tok))
 973                 return -ENOBUFS;
 974
 975         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 976                         tcp->data_interval_max))
 977                 return -ENOBUFS;
 978
 979         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 980                         tcp->wake_payload_max))
 981                 return -ENOBUFS;
 982
 983         nla_nest_end(msg, nl_tcp);
 984         return 0;
 985 }
 986
 987 static int nl80211_send_wowlan(struct sk_buff *msg,
 988                                struct cfg80211_registered_device *dev,
 989                                bool large)
 990 {
 991         struct nlattr *nl_wowlan;
 992
 993         if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
 994                 return 0;
 995
 996         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 997         if (!nl_wowlan)
 998                 return -ENOBUFS;
 999
1000         if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1001              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1002             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1003              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1004             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1005              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1006             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1007              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1008             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1009              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1010             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1011              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1012             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1013              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1014             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1015              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1016                 return -ENOBUFS;
1017
1018         if (dev->wiphy.wowlan.n_patterns) {
1019                 struct nl80211_wowlan_pattern_support pat = {
1020                         .max_patterns = dev->wiphy.wowlan.n_patterns,
1021                         .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
1022                         .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
1023                         .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
1024                 };
1025
1026                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1027                             sizeof(pat), &pat))
1028                         return -ENOBUFS;
1029         }
1030
1031         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1032                 return -ENOBUFS;
1033
1034         nla_nest_end(msg, nl_wowlan);
1035
1036         return 0;
1037 }
1038 #endif
1039
1040 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1041                                       struct ieee80211_supported_band *sband)
1042 {
1043         struct nlattr *nl_rates, *nl_rate;
1044         struct ieee80211_rate *rate;
1045         int i;
1046
1047         /* add HT info */
1048         if (sband->ht_cap.ht_supported &&
1049             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1050                      sizeof(sband->ht_cap.mcs),
1051                      &sband->ht_cap.mcs) ||
1052              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1053                          sband->ht_cap.cap) ||
1054              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1055                         sband->ht_cap.ampdu_factor) ||
1056              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1057                         sband->ht_cap.ampdu_density)))
1058                 return -ENOBUFS;
1059
1060         /* add VHT info */
1061         if (sband->vht_cap.vht_supported &&
1062             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1063                      sizeof(sband->vht_cap.vht_mcs),
1064                      &sband->vht_cap.vht_mcs) ||
1065              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1066                          sband->vht_cap.cap)))
1067                 return -ENOBUFS;
1068
1069         /* add bitrates */
1070         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1071         if (!nl_rates)
1072                 return -ENOBUFS;
1073
1074         for (i = 0; i < sband->n_bitrates; i++) {
1075                 nl_rate = nla_nest_start(msg, i);
1076                 if (!nl_rate)
1077                         return -ENOBUFS;
1078
1079                 rate = &sband->bitrates[i];
1080                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1081                                 rate->bitrate))
1082                         return -ENOBUFS;
1083                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1084                     nla_put_flag(msg,
1085                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1086                         return -ENOBUFS;
1087
1088                 nla_nest_end(msg, nl_rate);
1089         }
1090
1091         nla_nest_end(msg, nl_rates);
1092
1093         return 0;
1094 }
1095
1096 static int
1097 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1098                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1099 {
1100         u16 stypes;
1101         struct nlattr *nl_ftypes, *nl_ifs;
1102         enum nl80211_iftype ift;
1103         int i;
1104
1105         if (!mgmt_stypes)
1106                 return 0;
1107
1108         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1109         if (!nl_ifs)
1110                 return -ENOBUFS;
1111
1112         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1113                 nl_ftypes = nla_nest_start(msg, ift);
1114                 if (!nl_ftypes)
1115                         return -ENOBUFS;
1116                 i = 0;
1117                 stypes = mgmt_stypes[ift].tx;
1118                 while (stypes) {
1119                         if ((stypes & 1) &&
1120                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1121                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1122                                 return -ENOBUFS;
1123                         stypes >>= 1;
1124                         i++;
1125                 }
1126                 nla_nest_end(msg, nl_ftypes);
1127         }
1128
1129         nla_nest_end(msg, nl_ifs);
1130
1131         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1132         if (!nl_ifs)
1133                 return -ENOBUFS;
1134
1135         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1136                 nl_ftypes = nla_nest_start(msg, ift);
1137                 if (!nl_ftypes)
1138                         return -ENOBUFS;
1139                 i = 0;
1140                 stypes = mgmt_stypes[ift].rx;
1141                 while (stypes) {
1142                         if ((stypes & 1) &&
1143                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1144                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1145                                 return -ENOBUFS;
1146                         stypes >>= 1;
1147                         i++;
1148                 }
1149                 nla_nest_end(msg, nl_ftypes);
1150         }
1151         nla_nest_end(msg, nl_ifs);
1152
1153         return 0;
1154 }
1155
1156 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1157                               struct sk_buff *msg, u32 portid, u32 seq,
1158                               int flags, bool split, long *split_start,
1159                               long *band_start, long *chan_start)
1160 {
1161         void *hdr;
1162         struct nlattr *nl_bands, *nl_band;
1163         struct nlattr *nl_freqs, *nl_freq;
1164         struct nlattr *nl_cmds;
1165         enum ieee80211_band band;
1166         struct ieee80211_channel *chan;
1167         int i;
1168         const struct ieee80211_txrx_stypes *mgmt_stypes =
1169                                 dev->wiphy.mgmt_stypes;
1170         long start = 0, start_chan = 0, start_band = 0;
1171         u32 features;
1172
1173         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1174         if (!hdr)
1175                 return -ENOBUFS;
1176
1177         /* allow always using the variables */
1178         if (!split) {
1179                 split_start = &start;
1180                 band_start = &start_band;
1181                 chan_start = &start_chan;
1182         }
1183
1184         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1185             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1186                            wiphy_name(&dev->wiphy)) ||
1187             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1188                         cfg80211_rdev_list_generation))
1189                 goto nla_put_failure;
1190
1191         switch (*split_start) {
1192         case 0:
1193                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1194                                dev->wiphy.retry_short) ||
1195                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1196                                dev->wiphy.retry_long) ||
1197                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1198                                 dev->wiphy.frag_threshold) ||
1199                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1200                                 dev->wiphy.rts_threshold) ||
1201                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1202                                dev->wiphy.coverage_class) ||
1203                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1204                                dev->wiphy.max_scan_ssids) ||
1205                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1206                                dev->wiphy.max_sched_scan_ssids) ||
1207                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1208                                 dev->wiphy.max_scan_ie_len) ||
1209                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1210                                 dev->wiphy.max_sched_scan_ie_len) ||
1211                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1212                                dev->wiphy.max_match_sets))
1213                         goto nla_put_failure;
1214
1215                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1216                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1217                         goto nla_put_failure;
1218                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1219                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1220                         goto nla_put_failure;
1221                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1222                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1223                         goto nla_put_failure;
1224                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1225                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1226                         goto nla_put_failure;
1227                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1228                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1229                         goto nla_put_failure;
1230                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1231                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1232                         goto nla_put_failure;
1233
1234                 (*split_start)++;
1235                 if (split)
1236                         break;
1237         case 1:
1238                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1239                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1240                             dev->wiphy.cipher_suites))
1241                         goto nla_put_failure;
1242
1243                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1244                                dev->wiphy.max_num_pmkids))
1245                         goto nla_put_failure;
1246
1247                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1248                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1249                         goto nla_put_failure;
1250
1251                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1252                                 dev->wiphy.available_antennas_tx) ||
1253                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1254                                 dev->wiphy.available_antennas_rx))
1255                         goto nla_put_failure;
1256
1257                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1258                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1259                                 dev->wiphy.probe_resp_offload))
1260                         goto nla_put_failure;
1261
1262                 if ((dev->wiphy.available_antennas_tx ||
1263                      dev->wiphy.available_antennas_rx) &&
1264                     dev->ops->get_antenna) {
1265                         u32 tx_ant = 0, rx_ant = 0;
1266                         int res;
1267                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1268                         if (!res) {
1269                                 if (nla_put_u32(msg,
1270                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1271                                                 tx_ant) ||
1272                                     nla_put_u32(msg,
1273                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1274                                                 rx_ant))
1275                                         goto nla_put_failure;
1276                         }
1277                 }
1278
1279                 (*split_start)++;
1280                 if (split)
1281                         break;
1282         case 2:
1283                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1284                                         dev->wiphy.interface_modes))
1285                                 goto nla_put_failure;
1286                 (*split_start)++;
1287                 if (split)
1288                         break;
1289         case 3:
1290                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1291                 if (!nl_bands)
1292                         goto nla_put_failure;
1293
1294                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1295                         struct ieee80211_supported_band *sband;
1296
1297                         sband = dev->wiphy.bands[band];
1298
1299                         if (!sband)
1300                                 continue;
1301
1302                         nl_band = nla_nest_start(msg, band);
1303                         if (!nl_band)
1304                                 goto nla_put_failure;
1305
1306                         switch (*chan_start) {
1307                         case 0:
1308                                 if (nl80211_send_band_rateinfo(msg, sband))
1309                                         goto nla_put_failure;
1310                                 (*chan_start)++;
1311                                 if (split)
1312                                         break;
1313                         default:
1314                                 /* add frequencies */
1315                                 nl_freqs = nla_nest_start(
1316                                         msg, NL80211_BAND_ATTR_FREQS);
1317                                 if (!nl_freqs)
1318                                         goto nla_put_failure;
1319
1320                                 for (i = *chan_start - 1;
1321                                      i < sband->n_channels;
1322                                      i++) {
1323                                         nl_freq = nla_nest_start(msg, i);
1324                                         if (!nl_freq)
1325                                                 goto nla_put_failure;
1326
1327                                         chan = &sband->channels[i];
1328
1329                                         if (nl80211_msg_put_channel(msg, chan,
1330                                                                     split))
1331                                                 goto nla_put_failure;
1332
1333                                         nla_nest_end(msg, nl_freq);
1334                                         if (split)
1335                                                 break;
1336                                 }
1337                                 if (i < sband->n_channels)
1338                                         *chan_start = i + 2;
1339                                 else
1340                                         *chan_start = 0;
1341                                 nla_nest_end(msg, nl_freqs);
1342                         }
1343
1344                         nla_nest_end(msg, nl_band);
1345
1346                         if (split) {
1347                                 /* start again here */
1348                                 if (*chan_start)
1349                                         band--;
1350                                 break;
1351                         }
1352                 }
1353                 nla_nest_end(msg, nl_bands);
1354
1355                 if (band < IEEE80211_NUM_BANDS)
1356                         *band_start = band + 1;
1357                 else
1358                         *band_start = 0;
1359
1360                 /* if bands & channels are done, continue outside */
1361                 if (*band_start == 0 && *chan_start == 0)
1362                         (*split_start)++;
1363                 if (split)
1364                         break;
1365         case 4:
1366                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1367                 if (!nl_cmds)
1368                         goto nla_put_failure;
1369
1370                 i = 0;
1371 #define CMD(op, n)                                                      \
1372                  do {                                                   \
1373                         if (dev->ops->op) {                             \
1374                                 i++;                                    \
1375                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1376                                         goto nla_put_failure;           \
1377                         }                                               \
1378                 } while (0)
1379
1380                 CMD(add_virtual_intf, NEW_INTERFACE);
1381                 CMD(change_virtual_intf, SET_INTERFACE);
1382                 CMD(add_key, NEW_KEY);
1383                 CMD(start_ap, START_AP);
1384                 CMD(add_station, NEW_STATION);
1385                 CMD(add_mpath, NEW_MPATH);
1386                 CMD(update_mesh_config, SET_MESH_CONFIG);
1387                 CMD(change_bss, SET_BSS);
1388                 CMD(auth, AUTHENTICATE);
1389                 CMD(assoc, ASSOCIATE);
1390                 CMD(deauth, DEAUTHENTICATE);
1391                 CMD(disassoc, DISASSOCIATE);
1392                 CMD(join_ibss, JOIN_IBSS);
1393                 CMD(join_mesh, JOIN_MESH);
1394                 CMD(set_pmksa, SET_PMKSA);
1395                 CMD(del_pmksa, DEL_PMKSA);
1396                 CMD(flush_pmksa, FLUSH_PMKSA);
1397                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1398                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1399                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1400                 CMD(mgmt_tx, FRAME);
1401                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1402                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1403                         i++;
1404                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1405                                 goto nla_put_failure;
1406                 }
1407                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1408                     dev->ops->join_mesh) {
1409                         i++;
1410                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1411                                 goto nla_put_failure;
1412                 }
1413                 CMD(set_wds_peer, SET_WDS_PEER);
1414                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1415                         CMD(tdls_mgmt, TDLS_MGMT);
1416                         CMD(tdls_oper, TDLS_OPER);
1417                 }
1418                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1419                         CMD(sched_scan_start, START_SCHED_SCAN);
1420                 CMD(probe_client, PROBE_CLIENT);
1421                 CMD(set_noack_map, SET_NOACK_MAP);
1422                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1423                         i++;
1424                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1425                                 goto nla_put_failure;
1426                 }
1427                 CMD(start_p2p_device, START_P2P_DEVICE);
1428                 CMD(set_mcast_rate, SET_MCAST_RATE);
1429                 if (split) {
1430                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1431                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1432                 }
1433
1434 #ifdef CONFIG_NL80211_TESTMODE
1435                 CMD(testmode_cmd, TESTMODE);
1436 #endif
1437
1438 #undef CMD
1439
1440                 if (dev->ops->connect || dev->ops->auth) {
1441                         i++;
1442                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1443                                 goto nla_put_failure;
1444                 }
1445
1446                 if (dev->ops->disconnect || dev->ops->deauth) {
1447                         i++;
1448                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1449                                 goto nla_put_failure;
1450                 }
1451
1452                 nla_nest_end(msg, nl_cmds);
1453                 (*split_start)++;
1454                 if (split)
1455                         break;
1456         case 5:
1457                 if (dev->ops->remain_on_channel &&
1458                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1459                     nla_put_u32(msg,
1460                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1461                                 dev->wiphy.max_remain_on_channel_duration))
1462                         goto nla_put_failure;
1463
1464                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1465                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1466                         goto nla_put_failure;
1467
1468                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1469                         goto nla_put_failure;
1470                 (*split_start)++;
1471                 if (split)
1472                         break;
1473         case 6:
1474 #ifdef CONFIG_PM
1475                 if (nl80211_send_wowlan(msg, dev, split))
1476                         goto nla_put_failure;
1477                 (*split_start)++;
1478                 if (split)
1479                         break;
1480 #else
1481                 (*split_start)++;
1482 #endif
1483         case 7:
1484                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1485                                         dev->wiphy.software_iftypes))
1486                         goto nla_put_failure;
1487
1488                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1489                         goto nla_put_failure;
1490
1491                 (*split_start)++;
1492                 if (split)
1493                         break;
1494         case 8:
1495                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1496                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1497                                 dev->wiphy.ap_sme_capa))
1498                         goto nla_put_failure;
1499
1500                 features = dev->wiphy.features;
1501                 /*
1502                  * We can only add the per-channel limit information if the
1503                  * dump is split, otherwise it makes it too big. Therefore
1504                  * only advertise it in that case.
1505                  */
1506                 if (split)
1507                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1508                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1509                         goto nla_put_failure;
1510
1511                 if (dev->wiphy.ht_capa_mod_mask &&
1512                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1513                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1514                             dev->wiphy.ht_capa_mod_mask))
1515                         goto nla_put_failure;
1516
1517                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1518                     dev->wiphy.max_acl_mac_addrs &&
1519                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1520                                 dev->wiphy.max_acl_mac_addrs))
1521                         goto nla_put_failure;
1522
1523                 /*
1524                  * Any information below this point is only available to
1525                  * applications that can deal with it being split. This
1526                  * helps ensure that newly added capabilities don't break
1527                  * older tools by overrunning their buffers.
1528                  *
1529                  * We still increment split_start so that in the split
1530                  * case we'll continue with more data in the next round,
1531                  * but break unconditionally so unsplit data stops here.
1532                  */
1533                 (*split_start)++;
1534                 break;
1535         case 9:
1536                 if (dev->wiphy.extended_capabilities &&
1537                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1538                              dev->wiphy.extended_capabilities_len,
1539                              dev->wiphy.extended_capabilities) ||
1540                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1541                              dev->wiphy.extended_capabilities_len,
1542                              dev->wiphy.extended_capabilities_mask)))
1543                         goto nla_put_failure;
1544
1545                 if (dev->wiphy.vht_capa_mod_mask &&
1546                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1547                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1548                             dev->wiphy.vht_capa_mod_mask))
1549                         goto nla_put_failure;
1550
1551                 /* done */
1552                 *split_start = 0;
1553                 break;
1554         }
1555         return genlmsg_end(msg, hdr);
1556
1557  nla_put_failure:
1558         genlmsg_cancel(msg, hdr);
1559         return -EMSGSIZE;
1560 }
1561
1562 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1563 {
1564         int idx = 0, ret;
1565         int start = cb->args[0];
1566         struct cfg80211_registered_device *dev;
1567         s64 filter_wiphy = -1;
1568         bool split = false;
1569         struct nlattr **tb;
1570         int res;
1571
1572         /* will be zeroed in nlmsg_parse() */
1573         tb = kmalloc(sizeof(*tb) * (NL80211_ATTR_MAX + 1), GFP_KERNEL);
1574         if (!tb)
1575                 return -ENOMEM;
1576
1577         mutex_lock(&cfg80211_mutex);
1578         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1579                           tb, NL80211_ATTR_MAX, nl80211_policy);
1580         if (res == 0) {
1581                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1582                 if (tb[NL80211_ATTR_WIPHY])
1583                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1584                 if (tb[NL80211_ATTR_WDEV])
1585                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1586                 if (tb[NL80211_ATTR_IFINDEX]) {
1587                         struct net_device *netdev;
1588                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1589
1590                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1591                         if (!netdev) {
1592                                 mutex_unlock(&cfg80211_mutex);
1593                                 kfree(tb);
1594                                 return -ENODEV;
1595                         }
1596                         if (netdev->ieee80211_ptr) {
1597                                 dev = wiphy_to_dev(
1598                                         netdev->ieee80211_ptr->wiphy);
1599                                 filter_wiphy = dev->wiphy_idx;
1600                         }
1601                         dev_put(netdev);
1602                 }
1603         }
1604         kfree(tb);
1605
1606         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1607                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1608                         continue;
1609                 if (++idx <= start)
1610                         continue;
1611                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1612                         continue;
1613                 /* attempt to fit multiple wiphy data chunks into the skb */
1614                 do {
1615                         ret = nl80211_send_wiphy(dev, skb,
1616                                                  NETLINK_CB(cb->skb).portid,
1617                                                  cb->nlh->nlmsg_seq,
1618                                                  NLM_F_MULTI,
1619                                                  split, &cb->args[1],
1620                                                  &cb->args[2],
1621                                                  &cb->args[3]);
1622                         if (ret < 0) {
1623                                 /*
1624                                  * If sending the wiphy data didn't fit (ENOBUFS
1625                                  * or EMSGSIZE returned), this SKB is still
1626                                  * empty (so it's not too big because another
1627                                  * wiphy dataset is already in the skb) and
1628                                  * we've not tried to adjust the dump allocation
1629                                  * yet ... then adjust the alloc size to be
1630                                  * bigger, and return 1 but with the empty skb.
1631                                  * This results in an empty message being RX'ed
1632                                  * in userspace, but that is ignored.
1633                                  *
1634                                  * We can then retry with the larger buffer.
1635                                  */
1636                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1637                                     !skb->len &&
1638                                     cb->min_dump_alloc < 4096) {
1639                                         cb->min_dump_alloc = 4096;
1640                                         mutex_unlock(&cfg80211_mutex);
1641                                         return 1;
1642                                 }
1643                                 idx--;
1644                                 break;
1645                         }
1646                 } while (cb->args[1] > 0);
1647                 break;
1648         }
1649         mutex_unlock(&cfg80211_mutex);
1650
1651         cb->args[0] = idx;
1652
1653         return skb->len;
1654 }
1655
1656 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1657 {
1658         struct sk_buff *msg;
1659         struct cfg80211_registered_device *dev = info->user_ptr[0];
1660
1661         msg = nlmsg_new(4096, GFP_KERNEL);
1662         if (!msg)
1663                 return -ENOMEM;
1664
1665         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1666                                false, NULL, NULL, NULL) < 0) {
1667                 nlmsg_free(msg);
1668                 return -ENOBUFS;
1669         }
1670
1671         return genlmsg_reply(msg, info);
1672 }
1673
1674 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1675         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1676         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1677         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1678         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1679         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1680 };
1681
1682 static int parse_txq_params(struct nlattr *tb[],
1683                             struct ieee80211_txq_params *txq_params)
1684 {
1685         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1686             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1687             !tb[NL80211_TXQ_ATTR_AIFS])
1688                 return -EINVAL;
1689
1690         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1691         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1692         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1693         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1694         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1695
1696         if (txq_params->ac >= NL80211_NUM_ACS)
1697                 return -EINVAL;
1698
1699         return 0;
1700 }
1701
1702 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1703 {
1704         /*
1705          * You can only set the channel explicitly for WDS interfaces,
1706          * all others have their channel managed via their respective
1707          * "establish a connection" command (connect, join, ...)
1708          *
1709          * For AP/GO and mesh mode, the channel can be set with the
1710          * channel userspace API, but is only stored and passed to the
1711          * low-level driver when the AP starts or the mesh is joined.
1712          * This is for backward compatibility, userspace can also give
1713          * the channel in the start-ap or join-mesh commands instead.
1714          *
1715          * Monitors are special as they are normally slaved to
1716          * whatever else is going on, so they have their own special
1717          * operation to set the monitor channel if possible.
1718          */
1719         return !wdev ||
1720                 wdev->iftype == NL80211_IFTYPE_AP ||
1721                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1722                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1723                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1724 }
1725
1726 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1727                                  struct genl_info *info,
1728                                  struct cfg80211_chan_def *chandef)
1729 {
1730         u32 control_freq;
1731
1732         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1733                 return -EINVAL;
1734
1735         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1736
1737         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1738         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1739         chandef->center_freq1 = control_freq;
1740         chandef->center_freq2 = 0;
1741
1742         /* Primary channel not allowed */
1743         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1744                 return -EINVAL;
1745
1746         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1747                 enum nl80211_channel_type chantype;
1748
1749                 chantype = nla_get_u32(
1750                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1751
1752                 switch (chantype) {
1753                 case NL80211_CHAN_NO_HT:
1754                 case NL80211_CHAN_HT20:
1755                 case NL80211_CHAN_HT40PLUS:
1756                 case NL80211_CHAN_HT40MINUS:
1757                         cfg80211_chandef_create(chandef, chandef->chan,
1758                                                 chantype);
1759                         break;
1760                 default:
1761                         return -EINVAL;
1762                 }
1763         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1764                 chandef->width =
1765                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1766                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1767                         chandef->center_freq1 =
1768                                 nla_get_u32(
1769                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1770                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1771                         chandef->center_freq2 =
1772                                 nla_get_u32(
1773                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1774         }
1775
1776         if (!cfg80211_chandef_valid(chandef))
1777                 return -EINVAL;
1778
1779         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1780                                      IEEE80211_CHAN_DISABLED))
1781                 return -EINVAL;
1782
1783         return 0;
1784 }
1785
1786 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1787                                  struct wireless_dev *wdev,
1788                                  struct genl_info *info)
1789 {
1790         struct cfg80211_chan_def chandef;
1791         int result;
1792         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1793
1794         if (wdev)
1795                 iftype = wdev->iftype;
1796
1797         if (!nl80211_can_set_dev_channel(wdev))
1798                 return -EOPNOTSUPP;
1799
1800         result = nl80211_parse_chandef(rdev, info, &chandef);
1801         if (result)
1802                 return result;
1803
1804         mutex_lock(&rdev->devlist_mtx);
1805         switch (iftype) {
1806         case NL80211_IFTYPE_AP:
1807         case NL80211_IFTYPE_P2P_GO:
1808                 if (wdev->beacon_interval) {
1809                         result = -EBUSY;
1810                         break;
1811                 }
1812                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1813                         result = -EINVAL;
1814                         break;
1815                 }
1816                 wdev->preset_chandef = chandef;
1817                 result = 0;
1818                 break;
1819         case NL80211_IFTYPE_MESH_POINT:
1820                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1821                 break;
1822         case NL80211_IFTYPE_MONITOR:
1823                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1824                 break;
1825         default:
1826                 result = -EINVAL;
1827         }
1828         mutex_unlock(&rdev->devlist_mtx);
1829
1830         return result;
1831 }
1832
1833 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1834 {
1835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1836         struct net_device *netdev = info->user_ptr[1];
1837
1838         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1839 }
1840
1841 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1842 {
1843         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1844         struct net_device *dev = info->user_ptr[1];
1845         struct wireless_dev *wdev = dev->ieee80211_ptr;
1846         const u8 *bssid;
1847
1848         if (!info->attrs[NL80211_ATTR_MAC])
1849                 return -EINVAL;
1850
1851         if (netif_running(dev))
1852                 return -EBUSY;
1853
1854         if (!rdev->ops->set_wds_peer)
1855                 return -EOPNOTSUPP;
1856
1857         if (wdev->iftype != NL80211_IFTYPE_WDS)
1858                 return -EOPNOTSUPP;
1859
1860         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1861         return rdev_set_wds_peer(rdev, dev, bssid);
1862 }
1863
1864
1865 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1866 {
1867         struct cfg80211_registered_device *rdev;
1868         struct net_device *netdev = NULL;
1869         struct wireless_dev *wdev;
1870         int result = 0, rem_txq_params = 0;
1871         struct nlattr *nl_txq_params;
1872         u32 changed;
1873         u8 retry_short = 0, retry_long = 0;
1874         u32 frag_threshold = 0, rts_threshold = 0;
1875         u8 coverage_class = 0;
1876
1877         /*
1878          * Try to find the wiphy and netdev. Normally this
1879          * function shouldn't need the netdev, but this is
1880          * done for backward compatibility -- previously
1881          * setting the channel was done per wiphy, but now
1882          * it is per netdev. Previous userland like hostapd
1883          * also passed a netdev to set_wiphy, so that it is
1884          * possible to let that go to the right netdev!
1885          */
1886         mutex_lock(&cfg80211_mutex);
1887
1888         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1889                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1890
1891                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1892                 if (netdev && netdev->ieee80211_ptr) {
1893                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1894                         mutex_lock(&rdev->mtx);
1895                 } else
1896                         netdev = NULL;
1897         }
1898
1899         if (!netdev) {
1900                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1901                                                   info->attrs);
1902                 if (IS_ERR(rdev)) {
1903                         mutex_unlock(&cfg80211_mutex);
1904                         return PTR_ERR(rdev);
1905                 }
1906                 wdev = NULL;
1907                 netdev = NULL;
1908                 result = 0;
1909
1910                 mutex_lock(&rdev->mtx);
1911         } else
1912                 wdev = netdev->ieee80211_ptr;
1913
1914         /*
1915          * end workaround code, by now the rdev is available
1916          * and locked, and wdev may or may not be NULL.
1917          */
1918
1919         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1920                 result = cfg80211_dev_rename(
1921                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1922
1923         mutex_unlock(&cfg80211_mutex);
1924
1925         if (result)
1926                 goto bad_res;
1927
1928         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1929                 struct ieee80211_txq_params txq_params;
1930                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1931
1932                 if (!rdev->ops->set_txq_params) {
1933                         result = -EOPNOTSUPP;
1934                         goto bad_res;
1935                 }
1936
1937                 if (!netdev) {
1938                         result = -EINVAL;
1939                         goto bad_res;
1940                 }
1941
1942                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1943                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1944                         result = -EINVAL;
1945                         goto bad_res;
1946                 }
1947
1948                 if (!netif_running(netdev)) {
1949                         result = -ENETDOWN;
1950                         goto bad_res;
1951                 }
1952
1953                 nla_for_each_nested(nl_txq_params,
1954                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1955                                     rem_txq_params) {
1956                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1957                                   nla_data(nl_txq_params),
1958                                   nla_len(nl_txq_params),
1959                                   txq_params_policy);
1960                         result = parse_txq_params(tb, &txq_params);
1961                         if (result)
1962                                 goto bad_res;
1963
1964                         result = rdev_set_txq_params(rdev, netdev,
1965                                                      &txq_params);
1966                         if (result)
1967                                 goto bad_res;
1968                 }
1969         }
1970
1971         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1972                 result = __nl80211_set_channel(rdev,
1973                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1974                                 info);
1975                 if (result)
1976                         goto bad_res;
1977         }
1978
1979         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1980                 struct wireless_dev *txp_wdev = wdev;
1981                 enum nl80211_tx_power_setting type;
1982                 int idx, mbm = 0;
1983
1984                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1985                         txp_wdev = NULL;
1986
1987                 if (!rdev->ops->set_tx_power) {
1988                         result = -EOPNOTSUPP;
1989                         goto bad_res;
1990                 }
1991
1992                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1993                 type = nla_get_u32(info->attrs[idx]);
1994
1995                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1996                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1997                         result = -EINVAL;
1998                         goto bad_res;
1999                 }
2000
2001                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2002                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2003                         mbm = nla_get_u32(info->attrs[idx]);
2004                 }
2005
2006                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2007                 if (result)
2008                         goto bad_res;
2009         }
2010
2011         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2012             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2013                 u32 tx_ant, rx_ant;
2014                 if ((!rdev->wiphy.available_antennas_tx &&
2015                      !rdev->wiphy.available_antennas_rx) ||
2016                     !rdev->ops->set_antenna) {
2017                         result = -EOPNOTSUPP;
2018                         goto bad_res;
2019                 }
2020
2021                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2022                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2023
2024                 /* reject antenna configurations which don't match the
2025                  * available antenna masks, except for the "all" mask */
2026                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2027                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2028                         result = -EINVAL;
2029                         goto bad_res;
2030                 }
2031
2032                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2033                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2034
2035                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2036                 if (result)
2037                         goto bad_res;
2038         }
2039
2040         changed = 0;
2041
2042         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2043                 retry_short = nla_get_u8(
2044                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2045                 if (retry_short == 0) {
2046                         result = -EINVAL;
2047                         goto bad_res;
2048                 }
2049                 changed |= WIPHY_PARAM_RETRY_SHORT;
2050         }
2051
2052         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2053                 retry_long = nla_get_u8(
2054                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2055                 if (retry_long == 0) {
2056                         result = -EINVAL;
2057                         goto bad_res;
2058                 }
2059                 changed |= WIPHY_PARAM_RETRY_LONG;
2060         }
2061
2062         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2063                 frag_threshold = nla_get_u32(
2064                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2065                 if (frag_threshold < 256) {
2066                         result = -EINVAL;
2067                         goto bad_res;
2068                 }
2069                 if (frag_threshold != (u32) -1) {
2070                         /*
2071                          * Fragments (apart from the last one) are required to
2072                          * have even length. Make the fragmentation code
2073                          * simpler by stripping LSB should someone try to use
2074                          * odd threshold value.
2075                          */
2076                         frag_threshold &= ~0x1;
2077                 }
2078                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2079         }
2080
2081         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2082                 rts_threshold = nla_get_u32(
2083                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2084                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2085         }
2086
2087         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2088                 coverage_class = nla_get_u8(
2089                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2090                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2091         }
2092
2093         if (changed) {
2094                 u8 old_retry_short, old_retry_long;
2095                 u32 old_frag_threshold, old_rts_threshold;
2096                 u8 old_coverage_class;
2097
2098                 if (!rdev->ops->set_wiphy_params) {
2099                         result = -EOPNOTSUPP;
2100                         goto bad_res;
2101                 }
2102
2103                 old_retry_short = rdev->wiphy.retry_short;
2104                 old_retry_long = rdev->wiphy.retry_long;
2105                 old_frag_threshold = rdev->wiphy.frag_threshold;
2106                 old_rts_threshold = rdev->wiphy.rts_threshold;
2107                 old_coverage_class = rdev->wiphy.coverage_class;
2108
2109                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2110                         rdev->wiphy.retry_short = retry_short;
2111                 if (changed & WIPHY_PARAM_RETRY_LONG)
2112                         rdev->wiphy.retry_long = retry_long;
2113                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2114                         rdev->wiphy.frag_threshold = frag_threshold;
2115                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2116                         rdev->wiphy.rts_threshold = rts_threshold;
2117                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2118                         rdev->wiphy.coverage_class = coverage_class;
2119
2120                 result = rdev_set_wiphy_params(rdev, changed);
2121                 if (result) {
2122                         rdev->wiphy.retry_short = old_retry_short;
2123                         rdev->wiphy.retry_long = old_retry_long;
2124                         rdev->wiphy.frag_threshold = old_frag_threshold;
2125                         rdev->wiphy.rts_threshold = old_rts_threshold;
2126                         rdev->wiphy.coverage_class = old_coverage_class;
2127                 }
2128         }
2129
2130  bad_res:
2131         mutex_unlock(&rdev->mtx);
2132         if (netdev)
2133                 dev_put(netdev);
2134         return result;
2135 }
2136
2137 static inline u64 wdev_id(struct wireless_dev *wdev)
2138 {
2139         return (u64)wdev->identifier |
2140                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2141 }
2142
2143 static int nl80211_send_chandef(struct sk_buff *msg,
2144                                  struct cfg80211_chan_def *chandef)
2145 {
2146         WARN_ON(!cfg80211_chandef_valid(chandef));
2147
2148         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2149                         chandef->chan->center_freq))
2150                 return -ENOBUFS;
2151         switch (chandef->width) {
2152         case NL80211_CHAN_WIDTH_20_NOHT:
2153         case NL80211_CHAN_WIDTH_20:
2154         case NL80211_CHAN_WIDTH_40:
2155                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2156                                 cfg80211_get_chandef_type(chandef)))
2157                         return -ENOBUFS;
2158                 break;
2159         default:
2160                 break;
2161         }
2162         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2163                 return -ENOBUFS;
2164         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2165                 return -ENOBUFS;
2166         if (chandef->center_freq2 &&
2167             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2168                 return -ENOBUFS;
2169         return 0;
2170 }
2171
2172 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2173                               struct cfg80211_registered_device *rdev,
2174                               struct wireless_dev *wdev)
2175 {
2176         struct net_device *dev = wdev->netdev;
2177         void *hdr;
2178
2179         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2180         if (!hdr)
2181                 return -1;
2182
2183         if (dev &&
2184             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2185              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2186                 goto nla_put_failure;
2187
2188         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2189             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2190             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2191             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2192             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2193                         rdev->devlist_generation ^
2194                         (cfg80211_rdev_list_generation << 2)))
2195                 goto nla_put_failure;
2196
2197         if (rdev->ops->get_channel) {
2198                 int ret;
2199                 struct cfg80211_chan_def chandef;
2200
2201                 ret = rdev_get_channel(rdev, wdev, &chandef);
2202                 if (ret == 0) {
2203                         if (nl80211_send_chandef(msg, &chandef))
2204                                 goto nla_put_failure;
2205                 }
2206         }
2207
2208         if (wdev->ssid_len) {
2209                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2210                         goto nla_put_failure;
2211         }
2212
2213         return genlmsg_end(msg, hdr);
2214
2215  nla_put_failure:
2216         genlmsg_cancel(msg, hdr);
2217         return -EMSGSIZE;
2218 }
2219
2220 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2221 {
2222         int wp_idx = 0;
2223         int if_idx = 0;
2224         int wp_start = cb->args[0];
2225         int if_start = cb->args[1];
2226         struct cfg80211_registered_device *rdev;
2227         struct wireless_dev *wdev;
2228
2229         mutex_lock(&cfg80211_mutex);
2230         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2231                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2232                         continue;
2233                 if (wp_idx < wp_start) {
2234                         wp_idx++;
2235                         continue;
2236                 }
2237                 if_idx = 0;
2238
2239                 mutex_lock(&rdev->devlist_mtx);
2240                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2241                         if (if_idx < if_start) {
2242                                 if_idx++;
2243                                 continue;
2244                         }
2245                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2246                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2247                                                rdev, wdev) < 0) {
2248                                 mutex_unlock(&rdev->devlist_mtx);
2249                                 goto out;
2250                         }
2251                         if_idx++;
2252                 }
2253                 mutex_unlock(&rdev->devlist_mtx);
2254
2255                 wp_idx++;
2256         }
2257  out:
2258         mutex_unlock(&cfg80211_mutex);
2259
2260         cb->args[0] = wp_idx;
2261         cb->args[1] = if_idx;
2262
2263         return skb->len;
2264 }
2265
2266 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2267 {
2268         struct sk_buff *msg;
2269         struct cfg80211_registered_device *dev = info->user_ptr[0];
2270         struct wireless_dev *wdev = info->user_ptr[1];
2271
2272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2273         if (!msg)
2274                 return -ENOMEM;
2275
2276         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2277                                dev, wdev) < 0) {
2278                 nlmsg_free(msg);
2279                 return -ENOBUFS;
2280         }
2281
2282         return genlmsg_reply(msg, info);
2283 }
2284
2285 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2286         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2287         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2288         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2289         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2290         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2291 };
2292
2293 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2294 {
2295         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2296         int flag;
2297
2298         *mntrflags = 0;
2299
2300         if (!nla)
2301                 return -EINVAL;
2302
2303         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2304                              nla, mntr_flags_policy))
2305                 return -EINVAL;
2306
2307         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2308                 if (flags[flag])
2309                         *mntrflags |= (1<<flag);
2310
2311         return 0;
2312 }
2313
2314 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2315                                struct net_device *netdev, u8 use_4addr,
2316                                enum nl80211_iftype iftype)
2317 {
2318         if (!use_4addr) {
2319                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2320                         return -EBUSY;
2321                 return 0;
2322         }
2323
2324         switch (iftype) {
2325         case NL80211_IFTYPE_AP_VLAN:
2326                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2327                         return 0;
2328                 break;
2329         case NL80211_IFTYPE_STATION:
2330                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2331                         return 0;
2332                 break;
2333         default:
2334                 break;
2335         }
2336
2337         return -EOPNOTSUPP;
2338 }
2339
2340 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2341 {
2342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2343         struct vif_params params;
2344         int err;
2345         enum nl80211_iftype otype, ntype;
2346         struct net_device *dev = info->user_ptr[1];
2347         u32 _flags, *flags = NULL;
2348         bool change = false;
2349
2350         memset(&params, 0, sizeof(params));
2351
2352         otype = ntype = dev->ieee80211_ptr->iftype;
2353
2354         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2355                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2356                 if (otype != ntype)
2357                         change = true;
2358                 if (ntype > NL80211_IFTYPE_MAX)
2359                         return -EINVAL;
2360         }
2361
2362         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2363                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2364
2365                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2366                         return -EINVAL;
2367                 if (netif_running(dev))
2368                         return -EBUSY;
2369
2370                 wdev_lock(wdev);
2371                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2372                              IEEE80211_MAX_MESH_ID_LEN);
2373                 wdev->mesh_id_up_len =
2374                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2375                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2376                        wdev->mesh_id_up_len);
2377                 wdev_unlock(wdev);
2378         }
2379
2380         if (info->attrs[NL80211_ATTR_4ADDR]) {
2381                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2382                 change = true;
2383                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2384                 if (err)
2385                         return err;
2386         } else {
2387                 params.use_4addr = -1;
2388         }
2389
2390         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2391                 if (ntype != NL80211_IFTYPE_MONITOR)
2392                         return -EINVAL;
2393                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2394                                           &_flags);
2395                 if (err)
2396                         return err;
2397
2398                 flags = &_flags;
2399                 change = true;
2400         }
2401
2402         if (change)
2403                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2404         else
2405                 err = 0;
2406
2407         if (!err && params.use_4addr != -1)
2408                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2409
2410         return err;
2411 }
2412
2413 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2414 {
2415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2416         struct vif_params params;
2417         struct wireless_dev *wdev;
2418         struct sk_buff *msg;
2419         int err;
2420         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2421         u32 flags;
2422
2423         memset(&params, 0, sizeof(params));
2424
2425         if (!info->attrs[NL80211_ATTR_IFNAME])
2426                 return -EINVAL;
2427
2428         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2429                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2430                 if (type > NL80211_IFTYPE_MAX)
2431                         return -EINVAL;
2432         }
2433
2434         if (!rdev->ops->add_virtual_intf ||
2435             !(rdev->wiphy.interface_modes & (1 << type)))
2436                 return -EOPNOTSUPP;
2437
2438         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2439                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2440                            ETH_ALEN);
2441                 if (!is_valid_ether_addr(params.macaddr))
2442                         return -EADDRNOTAVAIL;
2443         }
2444
2445         if (info->attrs[NL80211_ATTR_4ADDR]) {
2446                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2447                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2448                 if (err)
2449                         return err;
2450         }
2451
2452         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2453         if (!msg)
2454                 return -ENOMEM;
2455
2456         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2457                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2458                                   &flags);
2459         wdev = rdev_add_virtual_intf(rdev,
2460                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2461                                 type, err ? NULL : &flags, &params);
2462         if (IS_ERR(wdev)) {
2463                 nlmsg_free(msg);
2464                 return PTR_ERR(wdev);
2465         }
2466
2467         switch (type) {
2468         case NL80211_IFTYPE_MESH_POINT:
2469                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2470                         break;
2471                 wdev_lock(wdev);
2472                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2473                              IEEE80211_MAX_MESH_ID_LEN);
2474                 wdev->mesh_id_up_len =
2475                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2476                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2477                        wdev->mesh_id_up_len);
2478                 wdev_unlock(wdev);
2479                 break;
2480         case NL80211_IFTYPE_P2P_DEVICE:
2481                 /*
2482                  * P2P Device doesn't have a netdev, so doesn't go
2483                  * through the netdev notifier and must be added here
2484                  */
2485                 mutex_init(&wdev->mtx);
2486                 INIT_LIST_HEAD(&wdev->event_list);
2487                 spin_lock_init(&wdev->event_lock);
2488                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2489                 spin_lock_init(&wdev->mgmt_registrations_lock);
2490
2491                 mutex_lock(&rdev->devlist_mtx);
2492                 wdev->identifier = ++rdev->wdev_id;
2493                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2494                 rdev->devlist_generation++;
2495                 mutex_unlock(&rdev->devlist_mtx);
2496                 break;
2497         default:
2498                 break;
2499         }
2500
2501         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2502                                rdev, wdev) < 0) {
2503                 nlmsg_free(msg);
2504                 return -ENOBUFS;
2505         }
2506
2507         return genlmsg_reply(msg, info);
2508 }
2509
2510 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2511 {
2512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2513         struct wireless_dev *wdev = info->user_ptr[1];
2514
2515         if (!rdev->ops->del_virtual_intf)
2516                 return -EOPNOTSUPP;
2517
2518         /*
2519          * If we remove a wireless device without a netdev then clear
2520          * user_ptr[1] so that nl80211_post_doit won't dereference it
2521          * to check if it needs to do dev_put(). Otherwise it crashes
2522          * since the wdev has been freed, unlike with a netdev where
2523          * we need the dev_put() for the netdev to really be freed.
2524          */
2525         if (!wdev->netdev)
2526                 info->user_ptr[1] = NULL;
2527
2528         return rdev_del_virtual_intf(rdev, wdev);
2529 }
2530
2531 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2532 {
2533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2534         struct net_device *dev = info->user_ptr[1];
2535         u16 noack_map;
2536
2537         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2538                 return -EINVAL;
2539
2540         if (!rdev->ops->set_noack_map)
2541                 return -EOPNOTSUPP;
2542
2543         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2544
2545         return rdev_set_noack_map(rdev, dev, noack_map);
2546 }
2547
2548 struct get_key_cookie {
2549         struct sk_buff *msg;
2550         int error;
2551         int idx;
2552 };
2553
2554 static void get_key_callback(void *c, struct key_params *params)
2555 {
2556         struct nlattr *key;
2557         struct get_key_cookie *cookie = c;
2558
2559         if ((params->key &&
2560              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2561                      params->key_len, params->key)) ||
2562             (params->seq &&
2563              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2564                      params->seq_len, params->seq)) ||
2565             (params->cipher &&
2566              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2567                          params->cipher)))
2568                 goto nla_put_failure;
2569
2570         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2571         if (!key)
2572                 goto nla_put_failure;
2573
2574         if ((params->key &&
2575              nla_put(cookie->msg, NL80211_KEY_DATA,
2576                      params->key_len, params->key)) ||
2577             (params->seq &&
2578              nla_put(cookie->msg, NL80211_KEY_SEQ,
2579                      params->seq_len, params->seq)) ||
2580             (params->cipher &&
2581              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2582                          params->cipher)))
2583                 goto nla_put_failure;
2584
2585         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2586                 goto nla_put_failure;
2587
2588         nla_nest_end(cookie->msg, key);
2589
2590         return;
2591  nla_put_failure:
2592         cookie->error = 1;
2593 }
2594
2595 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2596 {
2597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2598         int err;
2599         struct net_device *dev = info->user_ptr[1];
2600         u8 key_idx = 0;
2601         const u8 *mac_addr = NULL;
2602         bool pairwise;
2603         struct get_key_cookie cookie = {
2604                 .error = 0,
2605         };
2606         void *hdr;
2607         struct sk_buff *msg;
2608
2609         if (info->attrs[NL80211_ATTR_KEY_IDX])
2610                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2611
2612         if (key_idx > 5)
2613                 return -EINVAL;
2614
2615         if (info->attrs[NL80211_ATTR_MAC])
2616                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2617
2618         pairwise = !!mac_addr;
2619         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2620                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2621                 if (kt >= NUM_NL80211_KEYTYPES)
2622                         return -EINVAL;
2623                 if (kt != NL80211_KEYTYPE_GROUP &&
2624                     kt != NL80211_KEYTYPE_PAIRWISE)
2625                         return -EINVAL;
2626                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2627         }
2628
2629         if (!rdev->ops->get_key)
2630                 return -EOPNOTSUPP;
2631
2632         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2633         if (!msg)
2634                 return -ENOMEM;
2635
2636         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2637                              NL80211_CMD_NEW_KEY);
2638         if (IS_ERR(hdr))
2639                 return PTR_ERR(hdr);
2640
2641         cookie.msg = msg;
2642         cookie.idx = key_idx;
2643
2644         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2645             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2646                 goto nla_put_failure;
2647         if (mac_addr &&
2648             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2649                 goto nla_put_failure;
2650
2651         if (pairwise && mac_addr &&
2652             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2653                 return -ENOENT;
2654
2655         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2656                            get_key_callback);
2657
2658         if (err)
2659                 goto free_msg;
2660
2661         if (cookie.error)
2662                 goto nla_put_failure;
2663
2664         genlmsg_end(msg, hdr);
2665         return genlmsg_reply(msg, info);
2666
2667  nla_put_failure:
2668         err = -ENOBUFS;
2669  free_msg:
2670         nlmsg_free(msg);
2671         return err;
2672 }
2673
2674 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2675 {
2676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2677         struct key_parse key;
2678         int err;
2679         struct net_device *dev = info->user_ptr[1];
2680
2681         err = nl80211_parse_key(info, &key);
2682         if (err)
2683                 return err;
2684
2685         if (key.idx < 0)
2686                 return -EINVAL;
2687
2688         /* only support setting default key */
2689         if (!key.def && !key.defmgmt)
2690                 return -EINVAL;
2691
2692         wdev_lock(dev->ieee80211_ptr);
2693
2694         if (key.def) {
2695                 if (!rdev->ops->set_default_key) {
2696                         err = -EOPNOTSUPP;
2697                         goto out;
2698                 }
2699
2700                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2701                 if (err)
2702                         goto out;
2703
2704                 err = rdev_set_default_key(rdev, dev, key.idx,
2705                                                  key.def_uni, key.def_multi);
2706
2707                 if (err)
2708                         goto out;
2709
2710 #ifdef CONFIG_CFG80211_WEXT
2711                 dev->ieee80211_ptr->wext.default_key = key.idx;
2712 #endif
2713         } else {
2714                 if (key.def_uni || !key.def_multi) {
2715                         err = -EINVAL;
2716                         goto out;
2717                 }
2718
2719                 if (!rdev->ops->set_default_mgmt_key) {
2720                         err = -EOPNOTSUPP;
2721                         goto out;
2722                 }
2723
2724                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2725                 if (err)
2726                         goto out;
2727
2728                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2729                 if (err)
2730                         goto out;
2731
2732 #ifdef CONFIG_CFG80211_WEXT
2733                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2734 #endif
2735         }
2736
2737  out:
2738         wdev_unlock(dev->ieee80211_ptr);
2739
2740         return err;
2741 }
2742
2743 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2744 {
2745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2746         int err;
2747         struct net_device *dev = info->user_ptr[1];
2748         struct key_parse key;
2749         const u8 *mac_addr = NULL;
2750
2751         err = nl80211_parse_key(info, &key);
2752         if (err)
2753                 return err;
2754
2755         if (!key.p.key)
2756                 return -EINVAL;
2757
2758         if (info->attrs[NL80211_ATTR_MAC])
2759                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2760
2761         if (key.type == -1) {
2762                 if (mac_addr)
2763                         key.type = NL80211_KEYTYPE_PAIRWISE;
2764                 else
2765                         key.type = NL80211_KEYTYPE_GROUP;
2766         }
2767
2768         /* for now */
2769         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2770             key.type != NL80211_KEYTYPE_GROUP)
2771                 return -EINVAL;
2772
2773         if (!rdev->ops->add_key)
2774                 return -EOPNOTSUPP;
2775
2776         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2777                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2778                                            mac_addr))
2779                 return -EINVAL;
2780
2781         wdev_lock(dev->ieee80211_ptr);
2782         err = nl80211_key_allowed(dev->ieee80211_ptr);
2783         if (!err)
2784                 err = rdev_add_key(rdev, dev, key.idx,
2785                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2786                                     mac_addr, &key.p);
2787         wdev_unlock(dev->ieee80211_ptr);
2788
2789         return err;
2790 }
2791
2792 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2793 {
2794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2795         int err;
2796         struct net_device *dev = info->user_ptr[1];
2797         u8 *mac_addr = NULL;
2798         struct key_parse key;
2799
2800         err = nl80211_parse_key(info, &key);
2801         if (err)
2802                 return err;
2803
2804         if (info->attrs[NL80211_ATTR_MAC])
2805                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2806
2807         if (key.type == -1) {
2808                 if (mac_addr)
2809                         key.type = NL80211_KEYTYPE_PAIRWISE;
2810                 else
2811                         key.type = NL80211_KEYTYPE_GROUP;
2812         }
2813
2814         /* for now */
2815         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2816             key.type != NL80211_KEYTYPE_GROUP)
2817                 return -EINVAL;
2818
2819         if (!rdev->ops->del_key)
2820                 return -EOPNOTSUPP;
2821
2822         wdev_lock(dev->ieee80211_ptr);
2823         err = nl80211_key_allowed(dev->ieee80211_ptr);
2824
2825         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2826             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2827                 err = -ENOENT;
2828
2829         if (!err)
2830                 err = rdev_del_key(rdev, dev, key.idx,
2831                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2832                                    mac_addr);
2833
2834 #ifdef CONFIG_CFG80211_WEXT
2835         if (!err) {
2836                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2837                         dev->ieee80211_ptr->wext.default_key = -1;
2838                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2839                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2840         }
2841 #endif
2842         wdev_unlock(dev->ieee80211_ptr);
2843
2844         return err;
2845 }
2846
2847 /* This function returns an error or the number of nested attributes */
2848 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2849 {
2850         struct nlattr *attr;
2851         int n_entries = 0, tmp;
2852
2853         nla_for_each_nested(attr, nl_attr, tmp) {
2854                 if (nla_len(attr) != ETH_ALEN)
2855                         return -EINVAL;
2856
2857                 n_entries++;
2858         }
2859
2860         return n_entries;
2861 }
2862
2863 /*
2864  * This function parses ACL information and allocates memory for ACL data.
2865  * On successful return, the calling function is responsible to free the
2866  * ACL buffer returned by this function.
2867  */
2868 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2869                                                 struct genl_info *info)
2870 {
2871         enum nl80211_acl_policy acl_policy;
2872         struct nlattr *attr;
2873         struct cfg80211_acl_data *acl;
2874         int i = 0, n_entries, tmp;
2875
2876         if (!wiphy->max_acl_mac_addrs)
2877                 return ERR_PTR(-EOPNOTSUPP);
2878
2879         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2880                 return ERR_PTR(-EINVAL);
2881
2882         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2883         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2884             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2885                 return ERR_PTR(-EINVAL);
2886
2887         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2888                 return ERR_PTR(-EINVAL);
2889
2890         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2891         if (n_entries < 0)
2892                 return ERR_PTR(n_entries);
2893
2894         if (n_entries > wiphy->max_acl_mac_addrs)
2895                 return ERR_PTR(-ENOTSUPP);
2896
2897         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2898                       GFP_KERNEL);
2899         if (!acl)
2900                 return ERR_PTR(-ENOMEM);
2901
2902         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2903                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2904                 i++;
2905         }
2906
2907         acl->n_acl_entries = n_entries;
2908         acl->acl_policy = acl_policy;
2909
2910         return acl;
2911 }
2912
2913 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2914 {
2915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2916         struct net_device *dev = info->user_ptr[1];
2917         struct cfg80211_acl_data *acl;
2918         int err;
2919
2920         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2921             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2922                 return -EOPNOTSUPP;
2923
2924         if (!dev->ieee80211_ptr->beacon_interval)
2925                 return -EINVAL;
2926
2927         acl = parse_acl_data(&rdev->wiphy, info);
2928         if (IS_ERR(acl))
2929                 return PTR_ERR(acl);
2930
2931         err = rdev_set_mac_acl(rdev, dev, acl);
2932
2933         kfree(acl);
2934
2935         return err;
2936 }
2937
2938 static int nl80211_parse_beacon(struct genl_info *info,
2939                                 struct cfg80211_beacon_data *bcn)
2940 {
2941         bool haveinfo = false;
2942
2943         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2944             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2945             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2946             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2947                 return -EINVAL;
2948
2949         memset(bcn, 0, sizeof(*bcn));
2950
2951         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2952                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2953                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2954                 if (!bcn->head_len)
2955                         return -EINVAL;
2956                 haveinfo = true;
2957         }
2958
2959         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2960                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2961                 bcn->tail_len =
2962                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2963                 haveinfo = true;
2964         }
2965
2966         if (!haveinfo)
2967                 return -EINVAL;
2968
2969         if (info->attrs[NL80211_ATTR_IE]) {
2970                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2971                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2972         }
2973
2974         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2975                 bcn->proberesp_ies =
2976                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2977                 bcn->proberesp_ies_len =
2978                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2979         }
2980
2981         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2982                 bcn->assocresp_ies =
2983                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2984                 bcn->assocresp_ies_len =
2985                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2986         }
2987
2988         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2989                 bcn->probe_resp =
2990                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2991                 bcn->probe_resp_len =
2992                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2993         }
2994
2995         return 0;
2996 }
2997
2998 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2999                                    struct cfg80211_ap_settings *params)
3000 {
3001         struct wireless_dev *wdev;
3002         bool ret = false;
3003
3004         mutex_lock(&rdev->devlist_mtx);
3005
3006         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3007                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3008                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3009                         continue;
3010
3011                 if (!wdev->preset_chandef.chan)
3012                         continue;
3013
3014                 params->chandef = wdev->preset_chandef;
3015                 ret = true;
3016                 break;
3017         }
3018
3019         mutex_unlock(&rdev->devlist_mtx);
3020
3021         return ret;
3022 }
3023
3024 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3025                                     enum nl80211_auth_type auth_type,
3026                                     enum nl80211_commands cmd)
3027 {
3028         if (auth_type > NL80211_AUTHTYPE_MAX)
3029                 return false;
3030
3031         switch (cmd) {
3032         case NL80211_CMD_AUTHENTICATE:
3033                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3034                     auth_type == NL80211_AUTHTYPE_SAE)
3035                         return false;
3036                 return true;
3037         case NL80211_CMD_CONNECT:
3038         case NL80211_CMD_START_AP:
3039                 /* SAE not supported yet */
3040                 if (auth_type == NL80211_AUTHTYPE_SAE)
3041                         return false;
3042                 return true;
3043         default:
3044                 return false;
3045         }
3046 }
3047
3048 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3049 {
3050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3051         struct net_device *dev = info->user_ptr[1];
3052         struct wireless_dev *wdev = dev->ieee80211_ptr;
3053         struct cfg80211_ap_settings params;
3054         int err;
3055         u8 radar_detect_width = 0;
3056
3057         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3058             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3059                 return -EOPNOTSUPP;
3060
3061         if (!rdev->ops->start_ap)
3062                 return -EOPNOTSUPP;
3063
3064         if (wdev->beacon_interval)
3065                 return -EALREADY;
3066
3067         memset(&params, 0, sizeof(params));
3068
3069         /* these are required for START_AP */
3070         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3071             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3072             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3073                 return -EINVAL;
3074
3075         err = nl80211_parse_beacon(info, &params.beacon);
3076         if (err)
3077                 return err;
3078
3079         params.beacon_interval =
3080                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3081         params.dtim_period =
3082                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3083
3084         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3085         if (err)
3086                 return err;
3087
3088         /*
3089          * In theory, some of these attributes should be required here
3090          * but since they were not used when the command was originally
3091          * added, keep them optional for old user space programs to let
3092          * them continue to work with drivers that do not need the
3093          * additional information -- drivers must check!
3094          */
3095         if (info->attrs[NL80211_ATTR_SSID]) {
3096                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3097                 params.ssid_len =
3098                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3099                 if (params.ssid_len == 0 ||
3100                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3101                         return -EINVAL;
3102         }
3103
3104         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3105                 params.hidden_ssid = nla_get_u32(
3106                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3107                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3108                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3109                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3110                         return -EINVAL;
3111         }
3112
3113         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3114
3115         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3116                 params.auth_type = nla_get_u32(
3117                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3118                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3119                                              NL80211_CMD_START_AP))
3120                         return -EINVAL;
3121         } else
3122                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3123
3124         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3125                                       NL80211_MAX_NR_CIPHER_SUITES);
3126         if (err)
3127                 return err;
3128
3129         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3130                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3131                         return -EOPNOTSUPP;
3132                 params.inactivity_timeout = nla_get_u16(
3133                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3134         }
3135
3136         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3137                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3138                         return -EINVAL;
3139                 params.p2p_ctwindow =
3140                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3141                 if (params.p2p_ctwindow > 127)
3142                         return -EINVAL;
3143                 if (params.p2p_ctwindow != 0 &&
3144                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3145                         return -EINVAL;
3146         }
3147
3148         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3149                 u8 tmp;
3150
3151                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3152                         return -EINVAL;
3153                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3154                 if (tmp > 1)
3155                         return -EINVAL;
3156                 params.p2p_opp_ps = tmp;
3157                 if (params.p2p_opp_ps != 0 &&
3158                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3159                         return -EINVAL;
3160         }
3161
3162         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3163                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3164                 if (err)
3165                         return err;
3166         } else if (wdev->preset_chandef.chan) {
3167                 params.chandef = wdev->preset_chandef;
3168         } else if (!nl80211_get_ap_channel(rdev, &params))
3169                 return -EINVAL;
3170
3171         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3172                 return -EINVAL;
3173
3174         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3175         if (err < 0)
3176                 return err;
3177         if (err) {
3178                 radar_detect_width = BIT(params.chandef.width);
3179                 params.radar_required = true;
3180         }
3181
3182         mutex_lock(&rdev->devlist_mtx);
3183         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3184                                            params.chandef.chan,
3185                                            CHAN_MODE_SHARED,
3186                                            radar_detect_width);
3187         mutex_unlock(&rdev->devlist_mtx);
3188
3189         if (err)
3190                 return err;
3191
3192         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3193                 params.acl = parse_acl_data(&rdev->wiphy, info);
3194                 if (IS_ERR(params.acl))
3195                         return PTR_ERR(params.acl);
3196         }
3197
3198         err = rdev_start_ap(rdev, dev, &params);
3199         if (!err) {
3200                 wdev->preset_chandef = params.chandef;
3201                 wdev->beacon_interval = params.beacon_interval;
3202                 wdev->channel = params.chandef.chan;
3203                 wdev->ssid_len = params.ssid_len;
3204                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3205         }
3206
3207         kfree(params.acl);
3208
3209         return err;
3210 }
3211
3212 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3213 {
3214         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3215         struct net_device *dev = info->user_ptr[1];
3216         struct wireless_dev *wdev = dev->ieee80211_ptr;
3217         struct cfg80211_beacon_data params;
3218         int err;
3219
3220         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3221             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3222                 return -EOPNOTSUPP;
3223
3224         if (!rdev->ops->change_beacon)
3225                 return -EOPNOTSUPP;
3226
3227         if (!wdev->beacon_interval)
3228                 return -EINVAL;
3229
3230         err = nl80211_parse_beacon(info, &params);
3231         if (err)
3232                 return err;
3233
3234         return rdev_change_beacon(rdev, dev, &params);
3235 }
3236
3237 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3238 {
3239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3240         struct net_device *dev = info->user_ptr[1];
3241
3242         return cfg80211_stop_ap(rdev, dev);
3243 }
3244
3245 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3246         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3247         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3248         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3249         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3250         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3251         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3252 };
3253
3254 static int parse_station_flags(struct genl_info *info,
3255                                enum nl80211_iftype iftype,
3256                                struct station_parameters *params)
3257 {
3258         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3259         struct nlattr *nla;
3260         int flag;
3261
3262         /*
3263          * Try parsing the new attribute first so userspace
3264          * can specify both for older kernels.
3265          */
3266         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3267         if (nla) {
3268                 struct nl80211_sta_flag_update *sta_flags;
3269
3270                 sta_flags = nla_data(nla);
3271                 params->sta_flags_mask = sta_flags->mask;
3272                 params->sta_flags_set = sta_flags->set;
3273                 params->sta_flags_set &= params->sta_flags_mask;
3274                 if ((params->sta_flags_mask |
3275                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3276                         return -EINVAL;
3277                 return 0;
3278         }
3279
3280         /* if present, parse the old attribute */
3281
3282         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3283         if (!nla)
3284                 return 0;
3285
3286         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3287                              nla, sta_flags_policy))
3288                 return -EINVAL;
3289
3290         /*
3291          * Only allow certain flags for interface types so that
3292          * other attributes are silently ignored. Remember that
3293          * this is backward compatibility code with old userspace
3294          * and shouldn't be hit in other cases anyway.
3295          */
3296         switch (iftype) {
3297         case NL80211_IFTYPE_AP:
3298         case NL80211_IFTYPE_AP_VLAN:
3299         case NL80211_IFTYPE_P2P_GO:
3300                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3301                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3302                                          BIT(NL80211_STA_FLAG_WME) |
3303                                          BIT(NL80211_STA_FLAG_MFP);
3304                 break;
3305         case NL80211_IFTYPE_P2P_CLIENT:
3306         case NL80211_IFTYPE_STATION:
3307                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3308                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3309                 break;
3310         case NL80211_IFTYPE_MESH_POINT:
3311                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3312                                          BIT(NL80211_STA_FLAG_MFP) |
3313                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3314         default:
3315                 return -EINVAL;
3316         }
3317
3318         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3319                 if (flags[flag]) {
3320                         params->sta_flags_set |= (1<<flag);
3321
3322                         /* no longer support new API additions in old API */
3323                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3324                                 return -EINVAL;
3325                 }
3326         }
3327
3328         return 0;
3329 }
3330
3331 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3332                                  int attr)
3333 {
3334         struct nlattr *rate;
3335         u32 bitrate;
3336         u16 bitrate_compat;
3337
3338         rate = nla_nest_start(msg, attr);
3339         if (!rate)
3340                 return false;
3341
3342         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3343         bitrate = cfg80211_calculate_bitrate(info);
3344         /* report 16-bit bitrate only if we can */
3345         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3346         if (bitrate > 0 &&
3347             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3348                 return false;
3349         if (bitrate_compat > 0 &&
3350             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3351                 return false;
3352
3353         if (info->flags & RATE_INFO_FLAGS_MCS) {
3354                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3355                         return false;
3356                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3357                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3358                         return false;
3359                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3360                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3361                         return false;
3362         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3363                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3364                         return false;
3365                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3366                         return false;
3367                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3368                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3369                         return false;
3370                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3371                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3372                         return false;
3373                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3374                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3375                         return false;
3376                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3377                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3378                         return false;
3379                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3380                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3381                         return false;
3382         }
3383
3384         nla_nest_end(msg, rate);
3385         return true;
3386 }
3387
3388 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3389                                 int flags,
3390                                 struct cfg80211_registered_device *rdev,
3391                                 struct net_device *dev,
3392                                 const u8 *mac_addr, struct station_info *sinfo)
3393 {
3394         void *hdr;
3395         struct nlattr *sinfoattr, *bss_param;
3396
3397         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3398         if (!hdr)
3399                 return -1;
3400
3401         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3402             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3403             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3404                 goto nla_put_failure;
3405
3406         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3407         if (!sinfoattr)
3408                 goto nla_put_failure;
3409         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3410             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3411                         sinfo->connected_time))
3412                 goto nla_put_failure;
3413         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3414             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3415                         sinfo->inactive_time))
3416                 goto nla_put_failure;
3417         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3418                               STATION_INFO_RX_BYTES64)) &&
3419             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3420                         (u32)sinfo->rx_bytes))
3421                 goto nla_put_failure;
3422         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3423                               STATION_INFO_TX_BYTES64)) &&
3424             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3425                         (u32)sinfo->tx_bytes))
3426                 goto nla_put_failure;
3427         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3428             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3429                         sinfo->rx_bytes))
3430                 goto nla_put_failure;
3431         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3432             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3433                         sinfo->tx_bytes))
3434                 goto nla_put_failure;
3435         if ((sinfo->filled & STATION_INFO_LLID) &&
3436             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3437                 goto nla_put_failure;
3438         if ((sinfo->filled & STATION_INFO_PLID) &&
3439             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3440                 goto nla_put_failure;
3441         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3442             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3443                        sinfo->plink_state))
3444                 goto nla_put_failure;
3445         switch (rdev->wiphy.signal_type) {
3446         case CFG80211_SIGNAL_TYPE_MBM:
3447                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3448                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3449                                sinfo->signal))
3450                         goto nla_put_failure;
3451                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3452                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3453                                sinfo->signal_avg))
3454                         goto nla_put_failure;
3455                 break;
3456         default:
3457                 break;
3458         }
3459         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3460                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3461                                           NL80211_STA_INFO_TX_BITRATE))
3462                         goto nla_put_failure;
3463         }
3464         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3465                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3466                                           NL80211_STA_INFO_RX_BITRATE))
3467                         goto nla_put_failure;
3468         }
3469         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3470             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3471                         sinfo->rx_packets))
3472                 goto nla_put_failure;
3473         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3474             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3475                         sinfo->tx_packets))
3476                 goto nla_put_failure;
3477         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3478             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3479                         sinfo->tx_retries))
3480                 goto nla_put_failure;
3481         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3482             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3483                         sinfo->tx_failed))
3484                 goto nla_put_failure;
3485         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3486             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3487                         sinfo->beacon_loss_count))
3488                 goto nla_put_failure;
3489         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3490             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3491                         sinfo->local_pm))
3492                 goto nla_put_failure;
3493         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3494             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3495                         sinfo->peer_pm))
3496                 goto nla_put_failure;
3497         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3498             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3499                         sinfo->nonpeer_pm))
3500                 goto nla_put_failure;
3501         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3502                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3503                 if (!bss_param)
3504                         goto nla_put_failure;
3505
3506                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3507                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3508                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3509                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3510                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3511                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3512                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3513                                sinfo->bss_param.dtim_period) ||
3514                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3515                                 sinfo->bss_param.beacon_interval))
3516                         goto nla_put_failure;
3517
3518                 nla_nest_end(msg, bss_param);
3519         }
3520         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3521             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3522                     sizeof(struct nl80211_sta_flag_update),
3523                     &sinfo->sta_flags))
3524                 goto nla_put_failure;
3525         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3526                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3527                             sinfo->t_offset))
3528                 goto nla_put_failure;
3529         nla_nest_end(msg, sinfoattr);
3530
3531         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3532             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3533                     sinfo->assoc_req_ies))
3534                 goto nla_put_failure;
3535
3536         return genlmsg_end(msg, hdr);
3537
3538  nla_put_failure:
3539         genlmsg_cancel(msg, hdr);
3540         return -EMSGSIZE;
3541 }
3542
3543 static int nl80211_dump_station(struct sk_buff *skb,
3544                                 struct netlink_callback *cb)
3545 {
3546         struct station_info sinfo;
3547         struct cfg80211_registered_device *dev;
3548         struct wireless_dev *wdev;
3549         u8 mac_addr[ETH_ALEN];
3550         int sta_idx = cb->args[2];
3551         int err;
3552
3553         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3554         if (err)
3555                 return err;
3556
3557         if (!wdev->netdev) {
3558                 err = -EINVAL;
3559                 goto out_err;
3560         }
3561
3562         if (!dev->ops->dump_station) {
3563                 err = -EOPNOTSUPP;
3564                 goto out_err;
3565         }
3566
3567         while (1) {
3568                 memset(&sinfo, 0, sizeof(sinfo));
3569                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3570                                         mac_addr, &sinfo);
3571                 if (err == -ENOENT)
3572                         break;
3573                 if (err)
3574                         goto out_err;
3575
3576                 if (nl80211_send_station(skb,
3577                                 NETLINK_CB(cb->skb).portid,
3578                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3579                                 dev, wdev->netdev, mac_addr,
3580                                 &sinfo) < 0)
3581                         goto out;
3582
3583                 sta_idx++;
3584         }
3585
3586
3587  out:
3588         cb->args[2] = sta_idx;
3589         err = skb->len;
3590  out_err:
3591         nl80211_finish_wdev_dump(dev);
3592
3593         return err;
3594 }
3595
3596 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3597 {
3598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3599         struct net_device *dev = info->user_ptr[1];
3600         struct station_info sinfo;
3601         struct sk_buff *msg;
3602         u8 *mac_addr = NULL;
3603         int err;
3604
3605         memset(&sinfo, 0, sizeof(sinfo));
3606
3607         if (!info->attrs[NL80211_ATTR_MAC])
3608                 return -EINVAL;
3609
3610         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3611
3612         if (!rdev->ops->get_station)
3613                 return -EOPNOTSUPP;
3614
3615         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3616         if (err)
3617                 return err;
3618
3619         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3620         if (!msg)
3621                 return -ENOMEM;
3622
3623         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3624                                  rdev, dev, mac_addr, &sinfo) < 0) {
3625                 nlmsg_free(msg);
3626                 return -ENOBUFS;
3627         }
3628
3629         return genlmsg_reply(msg, info);
3630 }
3631
3632 int cfg80211_check_station_change(struct wiphy *wiphy,
3633                                   struct station_parameters *params,
3634                                   enum cfg80211_station_type statype)
3635 {
3636         if (params->listen_interval != -1)
3637                 return -EINVAL;
3638         if (params->aid)
3639                 return -EINVAL;
3640
3641         /* When you run into this, adjust the code below for the new flag */
3642         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3643
3644         switch (statype) {
3645         case CFG80211_STA_MESH_PEER_KERNEL:
3646         case CFG80211_STA_MESH_PEER_USER:
3647                 /*
3648                  * No ignoring the TDLS flag here -- the userspace mesh
3649                  * code doesn't have the bug of including TDLS in the
3650                  * mask everywhere.
3651                  */
3652                 if (params->sta_flags_mask &
3653                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3654                                   BIT(NL80211_STA_FLAG_MFP) |
3655                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3656                         return -EINVAL;
3657                 break;
3658         case CFG80211_STA_TDLS_PEER_SETUP:
3659         case CFG80211_STA_TDLS_PEER_ACTIVE:
3660                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3661                         return -EINVAL;
3662                 /* ignore since it can't change */
3663                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3664                 break;
3665         default:
3666                 /* disallow mesh-specific things */
3667                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3668                         return -EINVAL;
3669                 if (params->local_pm)
3670                         return -EINVAL;
3671                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3672                         return -EINVAL;
3673         }
3674
3675         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3676             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3677                 /* TDLS can't be set, ... */
3678                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3679                         return -EINVAL;
3680                 /*
3681                  * ... but don't bother the driver with it. This works around
3682                  * a hostapd/wpa_supplicant issue -- it always includes the
3683                  * TLDS_PEER flag in the mask even for AP mode.
3684                  */
3685                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3686         }
3687
3688         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3689                 /* reject other things that can't change */
3690                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3691                         return -EINVAL;
3692                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3693                         return -EINVAL;
3694                 if (params->supported_rates)
3695                         return -EINVAL;
3696                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3697                         return -EINVAL;
3698         }
3699
3700         if (statype != CFG80211_STA_AP_CLIENT) {
3701                 if (params->vlan)
3702                         return -EINVAL;
3703         }
3704
3705         switch (statype) {
3706         case CFG80211_STA_AP_MLME_CLIENT:
3707                 /* Use this only for authorizing/unauthorizing a station */
3708                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3709                         return -EOPNOTSUPP;
3710                 break;
3711         case CFG80211_STA_AP_CLIENT:
3712                 /* accept only the listed bits */
3713                 if (params->sta_flags_mask &
3714                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3715                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3716                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3717                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3718                                   BIT(NL80211_STA_FLAG_WME) |
3719                                   BIT(NL80211_STA_FLAG_MFP)))
3720                         return -EINVAL;
3721
3722                 /* but authenticated/associated only if driver handles it */
3723                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3724                     params->sta_flags_mask &
3725                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3726                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3727                         return -EINVAL;
3728                 break;
3729         case CFG80211_STA_IBSS:
3730         case CFG80211_STA_AP_STA:
3731                 /* reject any changes other than AUTHORIZED */
3732                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3733                         return -EINVAL;
3734                 break;
3735         case CFG80211_STA_TDLS_PEER_SETUP:
3736                 /* reject any changes other than AUTHORIZED or WME */
3737                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3738                                                BIT(NL80211_STA_FLAG_WME)))
3739                         return -EINVAL;
3740                 /* force (at least) rates when authorizing */
3741                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3742                     !params->supported_rates)
3743                         return -EINVAL;
3744                 break;
3745         case CFG80211_STA_TDLS_PEER_ACTIVE:
3746                 /* reject any changes */
3747                 return -EINVAL;
3748         case CFG80211_STA_MESH_PEER_KERNEL:
3749                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3750                         return -EINVAL;
3751                 break;
3752         case CFG80211_STA_MESH_PEER_USER:
3753                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3754                         return -EINVAL;
3755                 break;
3756         }
3757
3758         return 0;
3759 }
3760 EXPORT_SYMBOL(cfg80211_check_station_change);
3761
3762 /*
3763  * Get vlan interface making sure it is running and on the right wiphy.
3764  */
3765 static struct net_device *get_vlan(struct genl_info *info,
3766                                    struct cfg80211_registered_device *rdev)
3767 {
3768         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3769         struct net_device *v;
3770         int ret;
3771
3772         if (!vlanattr)
3773                 return NULL;
3774
3775         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3776         if (!v)
3777                 return ERR_PTR(-ENODEV);
3778
3779         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3780                 ret = -EINVAL;
3781                 goto error;
3782         }
3783
3784         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3785             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3786             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3787                 ret = -EINVAL;
3788                 goto error;
3789         }
3790
3791         if (!netif_running(v)) {
3792                 ret = -ENETDOWN;
3793                 goto error;
3794         }
3795
3796         return v;
3797  error:
3798         dev_put(v);
3799         return ERR_PTR(ret);
3800 }
3801
3802 static struct nla_policy
3803 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3804         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3805         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3806 };
3807
3808 static int nl80211_parse_sta_wme(struct genl_info *info,
3809                                  struct station_parameters *params)
3810 {
3811         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3812         struct nlattr *nla;
3813         int err;
3814
3815         /* parse WME attributes if present */
3816         if (!info->attrs[NL80211_ATTR_STA_WME])
3817                 return 0;
3818
3819         nla = info->attrs[NL80211_ATTR_STA_WME];
3820         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3821                                nl80211_sta_wme_policy);
3822         if (err)
3823                 return err;
3824
3825         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3826                 params->uapsd_queues = nla_get_u8(
3827                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3828         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3829                 return -EINVAL;
3830
3831         if (tb[NL80211_STA_WME_MAX_SP])
3832                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3833
3834         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3835                 return -EINVAL;
3836
3837         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3838
3839         return 0;
3840 }
3841
3842 static int nl80211_set_station_tdls(struct genl_info *info,
3843                                     struct station_parameters *params)
3844 {
3845         /* Dummy STA entry gets updated once the peer capabilities are known */
3846         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3847                 params->ht_capa =
3848                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3849         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3850                 params->vht_capa =
3851                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3852
3853         return nl80211_parse_sta_wme(info, params);
3854 }
3855
3856 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3857 {
3858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3859         struct net_device *dev = info->user_ptr[1];
3860         struct station_parameters params;
3861         u8 *mac_addr;
3862         int err;
3863
3864         memset(&params, 0, sizeof(params));
3865
3866         params.listen_interval = -1;
3867
3868         if (!rdev->ops->change_station)
3869                 return -EOPNOTSUPP;
3870
3871         if (info->attrs[NL80211_ATTR_STA_AID])
3872                 return -EINVAL;
3873
3874         if (!info->attrs[NL80211_ATTR_MAC])
3875                 return -EINVAL;
3876
3877         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3878
3879         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3880                 params.supported_rates =
3881                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3882                 params.supported_rates_len =
3883                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3884         }
3885
3886         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3887                 params.capability =
3888                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3889                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3890         }
3891
3892         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3893                 params.ext_capab =
3894                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3895                 params.ext_capab_len =
3896                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3897         }
3898
3899         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3900                 return -EINVAL;
3901
3902         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3903                 return -EINVAL;
3904
3905         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3906                 params.plink_action =
3907                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3908                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3909                         return -EINVAL;
3910         }
3911
3912         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3913                 params.plink_state =
3914                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3915                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3916                         return -EINVAL;
3917                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3918         }
3919
3920         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3921                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3922                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3923
3924                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3925                     pm > NL80211_MESH_POWER_MAX)
3926                         return -EINVAL;
3927
3928                 params.local_pm = pm;
3929         }
3930
3931         /* Include parameters for TDLS peer (will check later) */
3932         err = nl80211_set_station_tdls(info, &params);
3933         if (err)
3934                 return err;
3935
3936         params.vlan = get_vlan(info, rdev);
3937         if (IS_ERR(params.vlan))
3938                 return PTR_ERR(params.vlan);
3939
3940         switch (dev->ieee80211_ptr->iftype) {
3941         case NL80211_IFTYPE_AP:
3942         case NL80211_IFTYPE_AP_VLAN:
3943         case NL80211_IFTYPE_P2P_GO:
3944         case NL80211_IFTYPE_P2P_CLIENT:
3945         case NL80211_IFTYPE_STATION:
3946         case NL80211_IFTYPE_ADHOC:
3947         case NL80211_IFTYPE_MESH_POINT:
3948                 break;
3949         default:
3950                 err = -EOPNOTSUPP;
3951                 goto out_put_vlan;
3952         }
3953
3954         /* driver will call cfg80211_check_station_change() */
3955         err = rdev_change_station(rdev, dev, mac_addr, &params);
3956
3957  out_put_vlan:
3958         if (params.vlan)
3959                 dev_put(params.vlan);
3960
3961         return err;
3962 }
3963
3964 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3965 {
3966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3967         int err;
3968         struct net_device *dev = info->user_ptr[1];
3969         struct station_parameters params;
3970         u8 *mac_addr = NULL;
3971
3972         memset(&params, 0, sizeof(params));
3973
3974         if (!rdev->ops->add_station)
3975                 return -EOPNOTSUPP;
3976
3977         if (!info->attrs[NL80211_ATTR_MAC])
3978                 return -EINVAL;
3979
3980         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3981                 return -EINVAL;
3982
3983         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3984                 return -EINVAL;
3985
3986         if (!info->attrs[NL80211_ATTR_STA_AID])
3987                 return -EINVAL;
3988
3989         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3990         params.supported_rates =
3991                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3992         params.supported_rates_len =
3993                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3994         params.listen_interval =
3995                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3996
3997         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3998         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3999                 return -EINVAL;
4000
4001         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4002                 params.capability =
4003                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4004                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4005         }
4006
4007         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4008                 params.ext_capab =
4009                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4010                 params.ext_capab_len =
4011                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4012         }
4013
4014         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4015                 params.ht_capa =
4016                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4017
4018         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4019                 params.vht_capa =
4020                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4021
4022         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4023                 params.plink_action =
4024                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4025                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4026                         return -EINVAL;
4027         }
4028
4029         err = nl80211_parse_sta_wme(info, &params);
4030         if (err)
4031                 return err;
4032
4033         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4034                 return -EINVAL;
4035
4036         /* When you run into this, adjust the code below for the new flag */
4037         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4038
4039         switch (dev->ieee80211_ptr->iftype) {
4040         case NL80211_IFTYPE_AP:
4041         case NL80211_IFTYPE_AP_VLAN:
4042         case NL80211_IFTYPE_P2P_GO:
4043                 /* ignore WME attributes if iface/sta is not capable */
4044                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4045                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4046                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4047
4048                 /* TDLS peers cannot be added */
4049                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4050                         return -EINVAL;
4051                 /* but don't bother the driver with it */
4052                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4053
4054                 /* allow authenticated/associated only if driver handles it */
4055                 if (!(rdev->wiphy.features &
4056                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4057                     params.sta_flags_mask &
4058                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4059                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4060                         return -EINVAL;
4061
4062                 /* must be last in here for error handling */
4063                 params.vlan = get_vlan(info, rdev);
4064                 if (IS_ERR(params.vlan))
4065                         return PTR_ERR(params.vlan);
4066                 break;
4067         case NL80211_IFTYPE_MESH_POINT:
4068                 /* ignore uAPSD data */
4069                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4070
4071                 /* associated is disallowed */
4072                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4073                         return -EINVAL;
4074                 /* TDLS peers cannot be added */
4075                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4076                         return -EINVAL;
4077                 break;
4078         case NL80211_IFTYPE_STATION:
4079         case NL80211_IFTYPE_P2P_CLIENT:
4080                 /* ignore uAPSD data */
4081                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4082
4083                 /* these are disallowed */
4084                 if (params.sta_flags_mask &
4085                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4086                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4087                         return -EINVAL;
4088                 /* Only TDLS peers can be added */
4089                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4090                         return -EINVAL;
4091                 /* Can only add if TDLS ... */
4092                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4093                         return -EOPNOTSUPP;
4094                 /* ... with external setup is supported */
4095                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4096                         return -EOPNOTSUPP;
4097                 /*
4098                  * Older wpa_supplicant versions always mark the TDLS peer
4099                  * as authorized, but it shouldn't yet be.
4100                  */
4101                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4102                 break;
4103         default:
4104                 return -EOPNOTSUPP;
4105         }
4106
4107         /* be aware of params.vlan when changing code here */
4108
4109         err = rdev_add_station(rdev, dev, mac_addr, &params);
4110
4111         if (params.vlan)
4112                 dev_put(params.vlan);
4113         return err;
4114 }
4115
4116 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4117 {
4118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4119         struct net_device *dev = info->user_ptr[1];
4120         u8 *mac_addr = NULL;
4121
4122         if (info->attrs[NL80211_ATTR_MAC])
4123                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4124
4125         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4126             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4127             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4128             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4129                 return -EINVAL;
4130
4131         if (!rdev->ops->del_station)
4132                 return -EOPNOTSUPP;
4133
4134         return rdev_del_station(rdev, dev, mac_addr);
4135 }
4136
4137 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4138                                 int flags, struct net_device *dev,
4139                                 u8 *dst, u8 *next_hop,
4140                                 struct mpath_info *pinfo)
4141 {
4142         void *hdr;
4143         struct nlattr *pinfoattr;
4144
4145         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4146         if (!hdr)
4147                 return -1;
4148
4149         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4150             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4151             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4152             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4153                 goto nla_put_failure;
4154
4155         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4156         if (!pinfoattr)
4157                 goto nla_put_failure;
4158         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4159             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4160                         pinfo->frame_qlen))
4161                 goto nla_put_failure;
4162         if (((pinfo->filled & MPATH_INFO_SN) &&
4163              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4164             ((pinfo->filled & MPATH_INFO_METRIC) &&
4165              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4166                          pinfo->metric)) ||
4167             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4168              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4169                          pinfo->exptime)) ||
4170             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4171              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4172                         pinfo->flags)) ||
4173             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4174              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4175                          pinfo->discovery_timeout)) ||
4176             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4177              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4178                         pinfo->discovery_retries)))
4179                 goto nla_put_failure;
4180
4181         nla_nest_end(msg, pinfoattr);
4182
4183         return genlmsg_end(msg, hdr);
4184
4185  nla_put_failure:
4186         genlmsg_cancel(msg, hdr);
4187         return -EMSGSIZE;
4188 }
4189
4190 static int nl80211_dump_mpath(struct sk_buff *skb,
4191                               struct netlink_callback *cb)
4192 {
4193         struct mpath_info pinfo;
4194         struct cfg80211_registered_device *dev;
4195         struct wireless_dev *wdev;
4196         u8 dst[ETH_ALEN];
4197         u8 next_hop[ETH_ALEN];
4198         int path_idx = cb->args[2];
4199         int err;
4200
4201         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4202         if (err)
4203                 return err;
4204
4205         if (!dev->ops->dump_mpath) {
4206                 err = -EOPNOTSUPP;
4207                 goto out_err;
4208         }
4209
4210         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4211                 err = -EOPNOTSUPP;
4212                 goto out_err;
4213         }
4214
4215         while (1) {
4216                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4217                                       next_hop, &pinfo);
4218                 if (err == -ENOENT)
4219                         break;
4220                 if (err)
4221                         goto out_err;
4222
4223                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4224                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4225                                        wdev->netdev, dst, next_hop,
4226                                        &pinfo) < 0)
4227                         goto out;
4228
4229                 path_idx++;
4230         }
4231
4232
4233  out:
4234         cb->args[2] = path_idx;
4235         err = skb->len;
4236  out_err:
4237         nl80211_finish_wdev_dump(dev);
4238         return err;
4239 }
4240
4241 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4242 {
4243         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4244         int err;
4245         struct net_device *dev = info->user_ptr[1];
4246         struct mpath_info pinfo;
4247         struct sk_buff *msg;
4248         u8 *dst = NULL;
4249         u8 next_hop[ETH_ALEN];
4250
4251         memset(&pinfo, 0, sizeof(pinfo));
4252
4253         if (!info->attrs[NL80211_ATTR_MAC])
4254                 return -EINVAL;
4255
4256         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4257
4258         if (!rdev->ops->get_mpath)
4259                 return -EOPNOTSUPP;
4260
4261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4262                 return -EOPNOTSUPP;
4263
4264         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4265         if (err)
4266                 return err;
4267
4268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4269         if (!msg)
4270                 return -ENOMEM;
4271
4272         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4273                                  dev, dst, next_hop, &pinfo) < 0) {
4274                 nlmsg_free(msg);
4275                 return -ENOBUFS;
4276         }
4277
4278         return genlmsg_reply(msg, info);
4279 }
4280
4281 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4282 {
4283         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4284         struct net_device *dev = info->user_ptr[1];
4285         u8 *dst = NULL;
4286         u8 *next_hop = NULL;
4287
4288         if (!info->attrs[NL80211_ATTR_MAC])
4289                 return -EINVAL;
4290
4291         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4292                 return -EINVAL;
4293
4294         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4295         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4296
4297         if (!rdev->ops->change_mpath)
4298                 return -EOPNOTSUPP;
4299
4300         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4301                 return -EOPNOTSUPP;
4302
4303         return rdev_change_mpath(rdev, dev, dst, next_hop);
4304 }
4305
4306 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4307 {
4308         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4309         struct net_device *dev = info->user_ptr[1];
4310         u8 *dst = NULL;
4311         u8 *next_hop = NULL;
4312
4313         if (!info->attrs[NL80211_ATTR_MAC])
4314                 return -EINVAL;
4315
4316         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4317                 return -EINVAL;
4318
4319         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4320         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4321
4322         if (!rdev->ops->add_mpath)
4323                 return -EOPNOTSUPP;
4324
4325         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4326                 return -EOPNOTSUPP;
4327
4328         return rdev_add_mpath(rdev, dev, dst, next_hop);
4329 }
4330
4331 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4332 {
4333         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4334         struct net_device *dev = info->user_ptr[1];
4335         u8 *dst = NULL;
4336
4337         if (info->attrs[NL80211_ATTR_MAC])
4338                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4339
4340         if (!rdev->ops->del_mpath)
4341                 return -EOPNOTSUPP;
4342
4343         return rdev_del_mpath(rdev, dev, dst);
4344 }
4345
4346 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4347 {
4348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4349         struct net_device *dev = info->user_ptr[1];
4350         struct bss_parameters params;
4351
4352         memset(&params, 0, sizeof(params));
4353         /* default to not changing parameters */
4354         params.use_cts_prot = -1;
4355         params.use_short_preamble = -1;
4356         params.use_short_slot_time = -1;
4357         params.ap_isolate = -1;
4358         params.ht_opmode = -1;
4359         params.p2p_ctwindow = -1;
4360         params.p2p_opp_ps = -1;
4361
4362         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4363                 params.use_cts_prot =
4364                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4365         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4366                 params.use_short_preamble =
4367                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4368         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4369                 params.use_short_slot_time =
4370                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4371         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4372                 params.basic_rates =
4373                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4374                 params.basic_rates_len =
4375                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4376         }
4377         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4378                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4379         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4380                 params.ht_opmode =
4381                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4382
4383         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4384                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4385                         return -EINVAL;
4386                 params.p2p_ctwindow =
4387                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4388                 if (params.p2p_ctwindow < 0)
4389                         return -EINVAL;
4390                 if (params.p2p_ctwindow != 0 &&
4391                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4392                         return -EINVAL;
4393         }
4394
4395         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4396                 u8 tmp;
4397
4398                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4399                         return -EINVAL;
4400                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4401                 if (tmp > 1)
4402                         return -EINVAL;
4403                 params.p2p_opp_ps = tmp;
4404                 if (params.p2p_opp_ps &&
4405                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4406                         return -EINVAL;
4407         }
4408
4409         if (!rdev->ops->change_bss)
4410                 return -EOPNOTSUPP;
4411
4412         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4413             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4414                 return -EOPNOTSUPP;
4415
4416         return rdev_change_bss(rdev, dev, &params);
4417 }
4418
4419 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4420         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4421         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4422         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4423         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4424         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4425         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4426 };
4427
4428 static int parse_reg_rule(struct nlattr *tb[],
4429         struct ieee80211_reg_rule *reg_rule)
4430 {
4431         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4432         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4433
4434         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4435                 return -EINVAL;
4436         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4437                 return -EINVAL;
4438         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4439                 return -EINVAL;
4440         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4441                 return -EINVAL;
4442         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4443                 return -EINVAL;
4444
4445         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4446
4447         freq_range->start_freq_khz =
4448                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4449         freq_range->end_freq_khz =
4450                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4451         freq_range->max_bandwidth_khz =
4452                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4453
4454         power_rule->max_eirp =
4455                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4456
4457         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4458                 power_rule->max_antenna_gain =
4459                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4460
4461         return 0;
4462 }
4463
4464 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4465 {
4466         int r;
4467         char *data = NULL;
4468         enum nl80211_user_reg_hint_type user_reg_hint_type;
4469
4470         /*
4471          * You should only get this when cfg80211 hasn't yet initialized
4472          * completely when built-in to the kernel right between the time
4473          * window between nl80211_init() and regulatory_init(), if that is
4474          * even possible.
4475          */
4476         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4477                 return -EINPROGRESS;
4478
4479         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4480                 return -EINVAL;
4481
4482         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4483
4484         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4485                 user_reg_hint_type =
4486                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4487         else
4488                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4489
4490         switch (user_reg_hint_type) {
4491         case NL80211_USER_REG_HINT_USER:
4492         case NL80211_USER_REG_HINT_CELL_BASE:
4493                 break;
4494         default:
4495                 return -EINVAL;
4496         }
4497
4498         r = regulatory_hint_user(data, user_reg_hint_type);
4499
4500         return r;
4501 }
4502
4503 static int nl80211_get_mesh_config(struct sk_buff *skb,
4504                                    struct genl_info *info)
4505 {
4506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4507         struct net_device *dev = info->user_ptr[1];
4508         struct wireless_dev *wdev = dev->ieee80211_ptr;
4509         struct mesh_config cur_params;
4510         int err = 0;
4511         void *hdr;
4512         struct nlattr *pinfoattr;
4513         struct sk_buff *msg;
4514
4515         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4516                 return -EOPNOTSUPP;
4517
4518         if (!rdev->ops->get_mesh_config)
4519                 return -EOPNOTSUPP;
4520
4521         wdev_lock(wdev);
4522         /* If not connected, get default parameters */
4523         if (!wdev->mesh_id_len)
4524                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4525         else
4526                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4527         wdev_unlock(wdev);
4528
4529         if (err)
4530                 return err;
4531
4532         /* Draw up a netlink message to send back */
4533         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4534         if (!msg)
4535                 return -ENOMEM;
4536         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4537                              NL80211_CMD_GET_MESH_CONFIG);
4538         if (!hdr)
4539                 goto out;
4540         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4541         if (!pinfoattr)
4542                 goto nla_put_failure;
4543         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4544             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4545                         cur_params.dot11MeshRetryTimeout) ||
4546             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4547                         cur_params.dot11MeshConfirmTimeout) ||
4548             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4549                         cur_params.dot11MeshHoldingTimeout) ||
4550             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4551                         cur_params.dot11MeshMaxPeerLinks) ||
4552             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4553                        cur_params.dot11MeshMaxRetries) ||
4554             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4555                        cur_params.dot11MeshTTL) ||
4556             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4557                        cur_params.element_ttl) ||
4558             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4559                        cur_params.auto_open_plinks) ||
4560             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4561                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4562             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4563                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4564             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4565                         cur_params.path_refresh_time) ||
4566             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4567                         cur_params.min_discovery_timeout) ||
4568             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4569                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4570             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4571                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4572             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4573                         cur_params.dot11MeshHWMPperrMinInterval) ||
4574             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4575                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4576             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4577                        cur_params.dot11MeshHWMPRootMode) ||
4578             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4579                         cur_params.dot11MeshHWMPRannInterval) ||
4580             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4581                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4582             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4583                        cur_params.dot11MeshForwarding) ||
4584             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4585                         cur_params.rssi_threshold) ||
4586             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4587                         cur_params.ht_opmode) ||
4588             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4589                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4590             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4591                         cur_params.dot11MeshHWMProotInterval) ||
4592             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4593                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4594             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4595                         cur_params.power_mode) ||
4596             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4597                         cur_params.dot11MeshAwakeWindowDuration))
4598                 goto nla_put_failure;
4599         nla_nest_end(msg, pinfoattr);
4600         genlmsg_end(msg, hdr);
4601         return genlmsg_reply(msg, info);
4602
4603  nla_put_failure:
4604         genlmsg_cancel(msg, hdr);
4605  out:
4606         nlmsg_free(msg);
4607         return -ENOBUFS;
4608 }
4609
4610 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4611         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4612         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4613         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4614         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4615         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4616         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4617         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4618         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4619         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4620         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4621         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4622         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4623         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4624         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4625         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4626         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4627         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4628         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4629         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4630         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4631         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4632         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4633         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4634         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4635         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4636         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4637         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4638 };
4639
4640 static const struct nla_policy
4641         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4642         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4643         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4644         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4645         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4646         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4647         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4648                                     .len = IEEE80211_MAX_DATA_LEN },
4649         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4650 };
4651
4652 static int nl80211_parse_mesh_config(struct genl_info *info,
4653                                      struct mesh_config *cfg,
4654                                      u32 *mask_out)
4655 {
4656         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4657         u32 mask = 0;
4658
4659 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4660 do {                                                                        \
4661         if (tb[attr]) {                                                     \
4662                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4663                         return -EINVAL;                                     \
4664                 cfg->param = fn(tb[attr]);                                  \
4665                 mask |= (1 << (attr - 1));                                  \
4666         }                                                                   \
4667 } while (0)
4668
4669
4670         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4671                 return -EINVAL;
4672         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4673                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4674                              nl80211_meshconf_params_policy))
4675                 return -EINVAL;
4676
4677         /* This makes sure that there aren't more than 32 mesh config
4678          * parameters (otherwise our bitfield scheme would not work.) */
4679         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4680
4681         /* Fill in the params struct */
4682         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4683                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4684                                   nla_get_u16);
4685         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4686                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4687                                   nla_get_u16);
4688         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4689                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4690                                   nla_get_u16);
4691         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4692                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4693                                   nla_get_u16);
4694         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4695                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4696                                   nla_get_u8);
4697         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4698                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4699         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4700                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4701                                   nla_get_u8);
4702         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4703                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4704                                   nla_get_u8);
4705         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4706                                   1, 255, mask,
4707                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4708                                   nla_get_u32);
4709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4710                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4711                                   nla_get_u8);
4712         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4713                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4714                                   nla_get_u32);
4715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4716                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4717                                   nla_get_u16);
4718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4719                                   1, 65535, mask,
4720                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4721                                   nla_get_u32);
4722         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4723                                   1, 65535, mask,
4724                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4725                                   nla_get_u16);
4726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4727                                   1, 65535, mask,
4728                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4729                                   nla_get_u16);
4730         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4731                                   dot11MeshHWMPnetDiameterTraversalTime,
4732                                   1, 65535, mask,
4733                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4734                                   nla_get_u16);
4735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4736                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4737                                   nla_get_u8);
4738         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4739                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4740                                   nla_get_u16);
4741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4742                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4743                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4744                                   nla_get_u8);
4745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4746                                   mask, NL80211_MESHCONF_FORWARDING,
4747                                   nla_get_u8);
4748         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4749                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4750                                   nla_get_u32);
4751         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4752                                   mask, NL80211_MESHCONF_HT_OPMODE,
4753                                   nla_get_u16);
4754         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4755                                   1, 65535, mask,
4756                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4757                                   nla_get_u32);
4758         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4759                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4760                                   nla_get_u16);
4761         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4762                                   dot11MeshHWMPconfirmationInterval,
4763                                   1, 65535, mask,
4764                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4765                                   nla_get_u16);
4766         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4767                                   NL80211_MESH_POWER_ACTIVE,
4768                                   NL80211_MESH_POWER_MAX,
4769                                   mask, NL80211_MESHCONF_POWER_MODE,
4770                                   nla_get_u32);
4771         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4772                                   0, 65535, mask,
4773                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4774         if (mask_out)
4775                 *mask_out = mask;
4776
4777         return 0;
4778
4779 #undef FILL_IN_MESH_PARAM_IF_SET
4780 }
4781
4782 static int nl80211_parse_mesh_setup(struct genl_info *info,
4783                                      struct mesh_setup *setup)
4784 {
4785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4786         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4787
4788         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4789                 return -EINVAL;
4790         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4791                              info->attrs[NL80211_ATTR_MESH_SETUP],
4792                              nl80211_mesh_setup_params_policy))
4793                 return -EINVAL;
4794
4795         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4796                 setup->sync_method =
4797                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4798                  IEEE80211_SYNC_METHOD_VENDOR :
4799                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4800
4801         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4802                 setup->path_sel_proto =
4803                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4804                  IEEE80211_PATH_PROTOCOL_VENDOR :
4805                  IEEE80211_PATH_PROTOCOL_HWMP;
4806
4807         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4808                 setup->path_metric =
4809                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4810                  IEEE80211_PATH_METRIC_VENDOR :
4811                  IEEE80211_PATH_METRIC_AIRTIME;
4812
4813
4814         if (tb[NL80211_MESH_SETUP_IE]) {
4815                 struct nlattr *ieattr =
4816                         tb[NL80211_MESH_SETUP_IE];
4817                 if (!is_valid_ie_attr(ieattr))
4818                         return -EINVAL;
4819                 setup->ie = nla_data(ieattr);
4820                 setup->ie_len = nla_len(ieattr);
4821         }
4822         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4823             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4824                 return -EINVAL;
4825         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4826         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4827         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4828         if (setup->is_secure)
4829                 setup->user_mpm = true;
4830
4831         return 0;
4832 }
4833
4834 static int nl80211_update_mesh_config(struct sk_buff *skb,
4835                                       struct genl_info *info)
4836 {
4837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4838         struct net_device *dev = info->user_ptr[1];
4839         struct wireless_dev *wdev = dev->ieee80211_ptr;
4840         struct mesh_config cfg;
4841         u32 mask;
4842         int err;
4843
4844         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4845                 return -EOPNOTSUPP;
4846
4847         if (!rdev->ops->update_mesh_config)
4848                 return -EOPNOTSUPP;
4849
4850         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4851         if (err)
4852                 return err;
4853
4854         wdev_lock(wdev);
4855         if (!wdev->mesh_id_len)
4856                 err = -ENOLINK;
4857
4858         if (!err)
4859                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4860
4861         wdev_unlock(wdev);
4862
4863         return err;
4864 }
4865
4866 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4867 {
4868         const struct ieee80211_regdomain *regdom;
4869         struct sk_buff *msg;
4870         void *hdr = NULL;
4871         struct nlattr *nl_reg_rules;
4872         unsigned int i;
4873         int err = -EINVAL;
4874
4875         mutex_lock(&cfg80211_mutex);
4876
4877         if (!cfg80211_regdomain)
4878                 goto out;
4879
4880         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4881         if (!msg) {
4882                 err = -ENOBUFS;
4883                 goto out;
4884         }
4885
4886         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4887                              NL80211_CMD_GET_REG);
4888         if (!hdr)
4889                 goto put_failure;
4890
4891         if (reg_last_request_cell_base() &&
4892             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4893                         NL80211_USER_REG_HINT_CELL_BASE))
4894                 goto nla_put_failure;
4895
4896         rcu_read_lock();
4897         regdom = rcu_dereference(cfg80211_regdomain);
4898
4899         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4900             (regdom->dfs_region &&
4901              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4902                 goto nla_put_failure_rcu;
4903
4904         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4905         if (!nl_reg_rules)
4906                 goto nla_put_failure_rcu;
4907
4908         for (i = 0; i < regdom->n_reg_rules; i++) {
4909                 struct nlattr *nl_reg_rule;
4910                 const struct ieee80211_reg_rule *reg_rule;
4911                 const struct ieee80211_freq_range *freq_range;
4912                 const struct ieee80211_power_rule *power_rule;
4913
4914                 reg_rule = &regdom->reg_rules[i];
4915                 freq_range = &reg_rule->freq_range;
4916                 power_rule = &reg_rule->power_rule;
4917
4918                 nl_reg_rule = nla_nest_start(msg, i);
4919                 if (!nl_reg_rule)
4920                         goto nla_put_failure_rcu;
4921
4922                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4923                                 reg_rule->flags) ||
4924                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4925                                 freq_range->start_freq_khz) ||
4926                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4927                                 freq_range->end_freq_khz) ||
4928                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4929                                 freq_range->max_bandwidth_khz) ||
4930                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4931                                 power_rule->max_antenna_gain) ||
4932                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4933                                 power_rule->max_eirp))
4934                         goto nla_put_failure_rcu;
4935
4936                 nla_nest_end(msg, nl_reg_rule);
4937         }
4938         rcu_read_unlock();
4939
4940         nla_nest_end(msg, nl_reg_rules);
4941
4942         genlmsg_end(msg, hdr);
4943         err = genlmsg_reply(msg, info);
4944         goto out;
4945
4946 nla_put_failure_rcu:
4947         rcu_read_unlock();
4948 nla_put_failure:
4949         genlmsg_cancel(msg, hdr);
4950 put_failure:
4951         nlmsg_free(msg);
4952         err = -EMSGSIZE;
4953 out:
4954         mutex_unlock(&cfg80211_mutex);
4955         return err;
4956 }
4957
4958 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4959 {
4960         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4961         struct nlattr *nl_reg_rule;
4962         char *alpha2 = NULL;
4963         int rem_reg_rules = 0, r = 0;
4964         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4965         u8 dfs_region = 0;
4966         struct ieee80211_regdomain *rd = NULL;
4967
4968         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4969                 return -EINVAL;
4970
4971         if (!info->attrs[NL80211_ATTR_REG_RULES])
4972                 return -EINVAL;
4973
4974         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4975
4976         if (info->attrs[NL80211_ATTR_DFS_REGION])
4977                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4978
4979         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4980                             rem_reg_rules) {
4981                 num_rules++;
4982                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4983                         return -EINVAL;
4984         }
4985
4986         size_of_regd = sizeof(struct ieee80211_regdomain) +
4987                        num_rules * sizeof(struct ieee80211_reg_rule);
4988
4989         rd = kzalloc(size_of_regd, GFP_KERNEL);
4990         if (!rd)
4991                 return -ENOMEM;
4992
4993         rd->n_reg_rules = num_rules;
4994         rd->alpha2[0] = alpha2[0];
4995         rd->alpha2[1] = alpha2[1];
4996
4997         /*
4998          * Disable DFS master mode if the DFS region was
4999          * not supported or known on this kernel.
5000          */
5001         if (reg_supported_dfs_region(dfs_region))
5002                 rd->dfs_region = dfs_region;
5003
5004         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5005                             rem_reg_rules) {
5006                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5007                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5008                           reg_rule_policy);
5009                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5010                 if (r)
5011                         goto bad_reg;
5012
5013                 rule_idx++;
5014
5015                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5016                         r = -EINVAL;
5017                         goto bad_reg;
5018                 }
5019         }
5020
5021         mutex_lock(&cfg80211_mutex);
5022
5023         r = set_regdom(rd);
5024         /* set_regdom took ownership */
5025         rd = NULL;
5026         mutex_unlock(&cfg80211_mutex);
5027
5028  bad_reg:
5029         kfree(rd);
5030         return r;
5031 }
5032
5033 static int validate_scan_freqs(struct nlattr *freqs)
5034 {
5035         struct nlattr *attr1, *attr2;
5036         int n_channels = 0, tmp1, tmp2;
5037
5038         nla_for_each_nested(attr1, freqs, tmp1) {
5039                 n_channels++;
5040                 /*
5041                  * Some hardware has a limited channel list for
5042                  * scanning, and it is pretty much nonsensical
5043                  * to scan for a channel twice, so disallow that
5044                  * and don't require drivers to check that the
5045                  * channel list they get isn't longer than what
5046                  * they can scan, as long as they can scan all
5047                  * the channels they registered at once.
5048                  */
5049                 nla_for_each_nested(attr2, freqs, tmp2)
5050                         if (attr1 != attr2 &&
5051                             nla_get_u32(attr1) == nla_get_u32(attr2))
5052                                 return 0;
5053         }
5054
5055         return n_channels;
5056 }
5057
5058 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5059 {
5060         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5061         struct wireless_dev *wdev = info->user_ptr[1];
5062         struct cfg80211_scan_request *request;
5063         struct nlattr *attr;
5064         struct wiphy *wiphy;
5065         int err, tmp, n_ssids = 0, n_channels, i;
5066         size_t ie_len;
5067
5068         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5069                 return -EINVAL;
5070
5071         wiphy = &rdev->wiphy;
5072
5073         if (!rdev->ops->scan)
5074                 return -EOPNOTSUPP;
5075
5076         mutex_lock(&rdev->sched_scan_mtx);
5077         if (rdev->scan_req) {
5078                 err = -EBUSY;
5079                 goto unlock;
5080         }
5081
5082         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5083                 n_channels = validate_scan_freqs(
5084                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5085                 if (!n_channels) {
5086                         err = -EINVAL;
5087                         goto unlock;
5088                 }
5089         } else {
5090                 enum ieee80211_band band;
5091                 n_channels = 0;
5092
5093                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5094                         if (wiphy->bands[band])
5095                                 n_channels += wiphy->bands[band]->n_channels;
5096         }
5097
5098         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5099                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5100                         n_ssids++;
5101
5102         if (n_ssids > wiphy->max_scan_ssids) {
5103                 err = -EINVAL;
5104                 goto unlock;
5105         }
5106
5107         if (info->attrs[NL80211_ATTR_IE])
5108                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5109         else
5110                 ie_len = 0;
5111
5112         if (ie_len > wiphy->max_scan_ie_len) {
5113                 err = -EINVAL;
5114                 goto unlock;
5115         }
5116
5117         request = kzalloc(sizeof(*request)
5118                         + sizeof(*request->ssids) * n_ssids
5119                         + sizeof(*request->channels) * n_channels
5120                         + ie_len, GFP_KERNEL);
5121         if (!request) {
5122                 err = -ENOMEM;
5123                 goto unlock;
5124         }
5125
5126         if (n_ssids)
5127                 request->ssids = (void *)&request->channels[n_channels];
5128         request->n_ssids = n_ssids;
5129         if (ie_len) {
5130                 if (request->ssids)
5131                         request->ie = (void *)(request->ssids + n_ssids);
5132                 else
5133                         request->ie = (void *)(request->channels + n_channels);
5134         }
5135
5136         i = 0;
5137         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5138                 /* user specified, bail out if channel not found */
5139                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5140                         struct ieee80211_channel *chan;
5141
5142                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5143
5144                         if (!chan) {
5145                                 err = -EINVAL;
5146                                 goto out_free;
5147                         }
5148
5149                         /* ignore disabled channels */
5150                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5151                                 continue;
5152
5153                         request->channels[i] = chan;
5154                         i++;
5155                 }
5156         } else {
5157                 enum ieee80211_band band;
5158
5159                 /* all channels */
5160                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5161                         int j;
5162                         if (!wiphy->bands[band])
5163                                 continue;
5164                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5165                                 struct ieee80211_channel *chan;
5166
5167                                 chan = &wiphy->bands[band]->channels[j];
5168
5169                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5170                                         continue;
5171
5172                                 request->channels[i] = chan;
5173                                 i++;
5174                         }
5175                 }
5176         }
5177
5178         if (!i) {
5179                 err = -EINVAL;
5180                 goto out_free;
5181         }
5182
5183         request->n_channels = i;
5184
5185         i = 0;
5186         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5187                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5188                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5189                                 err = -EINVAL;
5190                                 goto out_free;
5191                         }
5192                         request->ssids[i].ssid_len = nla_len(attr);
5193                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5194                         i++;
5195                 }
5196         }
5197
5198         if (info->attrs[NL80211_ATTR_IE]) {
5199                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5200                 memcpy((void *)request->ie,
5201                        nla_data(info->attrs[NL80211_ATTR_IE]),
5202                        request->ie_len);
5203         }
5204
5205         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5206                 if (wiphy->bands[i])
5207                         request->rates[i] =
5208                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5209
5210         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5211                 nla_for_each_nested(attr,
5212                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5213                                     tmp) {
5214                         enum ieee80211_band band = nla_type(attr);
5215
5216                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5217                                 err = -EINVAL;
5218                                 goto out_free;
5219                         }
5220                         err = ieee80211_get_ratemask(wiphy->bands[band],
5221                                                      nla_data(attr),
5222                                                      nla_len(attr),
5223                                                      &request->rates[band]);
5224                         if (err)
5225                                 goto out_free;
5226                 }
5227         }
5228
5229         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5230                 request->flags = nla_get_u32(
5231                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5232                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5233                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5234                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5235                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5236                         err = -EOPNOTSUPP;
5237                         goto out_free;
5238                 }
5239         }
5240
5241         request->no_cck =
5242                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5243
5244         request->wdev = wdev;
5245         request->wiphy = &rdev->wiphy;
5246         request->scan_start = jiffies;
5247
5248         rdev->scan_req = request;
5249         err = rdev_scan(rdev, request);
5250
5251         if (!err) {
5252                 nl80211_send_scan_start(rdev, wdev);
5253                 if (wdev->netdev)
5254                         dev_hold(wdev->netdev);
5255         } else {
5256  out_free:
5257                 rdev->scan_req = NULL;
5258                 kfree(request);
5259         }
5260
5261  unlock:
5262         mutex_unlock(&rdev->sched_scan_mtx);
5263         return err;
5264 }
5265
5266 static int nl80211_start_sched_scan(struct sk_buff *skb,
5267                                     struct genl_info *info)
5268 {
5269         struct cfg80211_sched_scan_request *request;
5270         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5271         struct net_device *dev = info->user_ptr[1];
5272         struct nlattr *attr;
5273         struct wiphy *wiphy;
5274         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5275         u32 interval;
5276         enum ieee80211_band band;
5277         size_t ie_len;
5278         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5279
5280         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5281             !rdev->ops->sched_scan_start)
5282                 return -EOPNOTSUPP;
5283
5284         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5285                 return -EINVAL;
5286
5287         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5288                 return -EINVAL;
5289
5290         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5291         if (interval == 0)
5292                 return -EINVAL;
5293
5294         wiphy = &rdev->wiphy;
5295
5296         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5297                 n_channels = validate_scan_freqs(
5298                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5299                 if (!n_channels)
5300                         return -EINVAL;
5301         } else {
5302                 n_channels = 0;
5303
5304                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5305                         if (wiphy->bands[band])
5306                                 n_channels += wiphy->bands[band]->n_channels;
5307         }
5308
5309         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5310                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5311                                     tmp)
5312                         n_ssids++;
5313
5314         if (n_ssids > wiphy->max_sched_scan_ssids)
5315                 return -EINVAL;
5316
5317         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5318                 nla_for_each_nested(attr,
5319                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5320                                     tmp)
5321                         n_match_sets++;
5322
5323         if (n_match_sets > wiphy->max_match_sets)
5324                 return -EINVAL;
5325
5326         if (info->attrs[NL80211_ATTR_IE])
5327                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5328         else
5329                 ie_len = 0;
5330
5331         if (ie_len > wiphy->max_sched_scan_ie_len)
5332                 return -EINVAL;
5333
5334         mutex_lock(&rdev->sched_scan_mtx);
5335
5336         if (rdev->sched_scan_req) {
5337                 err = -EINPROGRESS;
5338                 goto out;
5339         }
5340
5341         request = kzalloc(sizeof(*request)
5342                         + sizeof(*request->ssids) * n_ssids
5343                         + sizeof(*request->match_sets) * n_match_sets
5344                         + sizeof(*request->channels) * n_channels
5345                         + ie_len, GFP_KERNEL);
5346         if (!request) {
5347                 err = -ENOMEM;
5348                 goto out;
5349         }
5350
5351         if (n_ssids)
5352                 request->ssids = (void *)&request->channels[n_channels];
5353         request->n_ssids = n_ssids;
5354         if (ie_len) {
5355                 if (request->ssids)
5356                         request->ie = (void *)(request->ssids + n_ssids);
5357                 else
5358                         request->ie = (void *)(request->channels + n_channels);
5359         }
5360
5361         if (n_match_sets) {
5362                 if (request->ie)
5363                         request->match_sets = (void *)(request->ie + ie_len);
5364                 else if (request->ssids)
5365                         request->match_sets =
5366                                 (void *)(request->ssids + n_ssids);
5367                 else
5368                         request->match_sets =
5369                                 (void *)(request->channels + n_channels);
5370         }
5371         request->n_match_sets = n_match_sets;
5372
5373         i = 0;
5374         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5375                 /* user specified, bail out if channel not found */
5376                 nla_for_each_nested(attr,
5377                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5378                                     tmp) {
5379                         struct ieee80211_channel *chan;
5380
5381                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5382
5383                         if (!chan) {
5384                                 err = -EINVAL;
5385                                 goto out_free;
5386                         }
5387
5388                         /* ignore disabled channels */
5389                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5390                                 continue;
5391
5392                         request->channels[i] = chan;
5393                         i++;
5394                 }
5395         } else {
5396                 /* all channels */
5397                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5398                         int j;
5399                         if (!wiphy->bands[band])
5400                                 continue;
5401                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5402                                 struct ieee80211_channel *chan;
5403
5404                                 chan = &wiphy->bands[band]->channels[j];
5405
5406                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5407                                         continue;
5408
5409                                 request->channels[i] = chan;
5410                                 i++;
5411                         }
5412                 }
5413         }
5414
5415         if (!i) {
5416                 err = -EINVAL;
5417                 goto out_free;
5418         }
5419
5420         request->n_channels = i;
5421
5422         i = 0;
5423         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5424                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5425                                     tmp) {
5426                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5427                                 err = -EINVAL;
5428                                 goto out_free;
5429                         }
5430                         request->ssids[i].ssid_len = nla_len(attr);
5431                         memcpy(request->ssids[i].ssid, nla_data(attr),
5432                                nla_len(attr));
5433                         i++;
5434                 }
5435         }
5436
5437         i = 0;
5438         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5439                 nla_for_each_nested(attr,
5440                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5441                                     tmp) {
5442                         struct nlattr *ssid, *rssi;
5443
5444                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5445                                   nla_data(attr), nla_len(attr),
5446                                   nl80211_match_policy);
5447                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5448                         if (ssid) {
5449                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5450                                         err = -EINVAL;
5451                                         goto out_free;
5452                                 }
5453                                 memcpy(request->match_sets[i].ssid.ssid,
5454                                        nla_data(ssid), nla_len(ssid));
5455                                 request->match_sets[i].ssid.ssid_len =
5456                                         nla_len(ssid);
5457                         }
5458                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5459                         if (rssi)
5460                                 request->rssi_thold = nla_get_u32(rssi);
5461                         else
5462                                 request->rssi_thold =
5463                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5464                         i++;
5465                 }
5466         }
5467
5468         if (info->attrs[NL80211_ATTR_IE]) {
5469                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5470                 memcpy((void *)request->ie,
5471                        nla_data(info->attrs[NL80211_ATTR_IE]),
5472                        request->ie_len);
5473         }
5474
5475         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5476                 request->flags = nla_get_u32(
5477                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5478                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5479                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5480                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5481                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5482                         err = -EOPNOTSUPP;
5483                         goto out_free;
5484                 }
5485         }
5486
5487         request->dev = dev;
5488         request->wiphy = &rdev->wiphy;
5489         request->interval = interval;
5490         request->scan_start = jiffies;
5491
5492         err = rdev_sched_scan_start(rdev, dev, request);
5493         if (!err) {
5494                 rdev->sched_scan_req = request;
5495                 nl80211_send_sched_scan(rdev, dev,
5496                                         NL80211_CMD_START_SCHED_SCAN);
5497                 goto out;
5498         }
5499
5500 out_free:
5501         kfree(request);
5502 out:
5503         mutex_unlock(&rdev->sched_scan_mtx);
5504         return err;
5505 }
5506
5507 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5508                                    struct genl_info *info)
5509 {
5510         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5511         int err;
5512
5513         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5514             !rdev->ops->sched_scan_stop)
5515                 return -EOPNOTSUPP;
5516
5517         mutex_lock(&rdev->sched_scan_mtx);
5518         err = __cfg80211_stop_sched_scan(rdev, false);
5519         mutex_unlock(&rdev->sched_scan_mtx);
5520
5521         return err;
5522 }
5523
5524 static int nl80211_start_radar_detection(struct sk_buff *skb,
5525                                          struct genl_info *info)
5526 {
5527         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5528         struct net_device *dev = info->user_ptr[1];
5529         struct wireless_dev *wdev = dev->ieee80211_ptr;
5530         struct cfg80211_chan_def chandef;
5531         int err;
5532
5533         err = nl80211_parse_chandef(rdev, info, &chandef);
5534         if (err)
5535                 return err;
5536
5537         if (wdev->cac_started)
5538                 return -EBUSY;
5539
5540         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5541         if (err < 0)
5542                 return err;
5543
5544         if (err == 0)
5545                 return -EINVAL;
5546
5547         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5548                 return -EINVAL;
5549
5550         if (!rdev->ops->start_radar_detection)
5551                 return -EOPNOTSUPP;
5552
5553         mutex_lock(&rdev->devlist_mtx);
5554         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5555                                            chandef.chan, CHAN_MODE_SHARED,
5556                                            BIT(chandef.width));
5557         if (err)
5558                 goto err_locked;
5559
5560         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5561         if (!err) {
5562                 wdev->channel = chandef.chan;
5563                 wdev->cac_started = true;
5564                 wdev->cac_start_time = jiffies;
5565         }
5566 err_locked:
5567         mutex_unlock(&rdev->devlist_mtx);
5568
5569         return err;
5570 }
5571
5572 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5573                             u32 seq, int flags,
5574                             struct cfg80211_registered_device *rdev,
5575                             struct wireless_dev *wdev,
5576                             struct cfg80211_internal_bss *intbss)
5577 {
5578         struct cfg80211_bss *res = &intbss->pub;
5579         const struct cfg80211_bss_ies *ies;
5580         void *hdr;
5581         struct nlattr *bss;
5582         bool tsf = false;
5583
5584         ASSERT_WDEV_LOCK(wdev);
5585
5586         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5587                              NL80211_CMD_NEW_SCAN_RESULTS);
5588         if (!hdr)
5589                 return -1;
5590
5591         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5592
5593         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5594                 goto nla_put_failure;
5595         if (wdev->netdev &&
5596             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5597                 goto nla_put_failure;
5598         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5599                 goto nla_put_failure;
5600
5601         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5602         if (!bss)
5603                 goto nla_put_failure;
5604         if ((!is_zero_ether_addr(res->bssid) &&
5605              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5606                 goto nla_put_failure;
5607
5608         rcu_read_lock();
5609         ies = rcu_dereference(res->ies);
5610         if (ies) {
5611                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5612                         goto fail_unlock_rcu;
5613                 tsf = true;
5614                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5615                                         ies->len, ies->data))
5616                         goto fail_unlock_rcu;
5617         }
5618         ies = rcu_dereference(res->beacon_ies);
5619         if (ies) {
5620                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5621                         goto fail_unlock_rcu;
5622                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5623                                         ies->len, ies->data))
5624                         goto fail_unlock_rcu;
5625         }
5626         rcu_read_unlock();
5627
5628         if (res->beacon_interval &&
5629             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5630                 goto nla_put_failure;
5631         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5632             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5633             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5634                         jiffies_to_msecs(jiffies - intbss->ts)))
5635                 goto nla_put_failure;
5636
5637         switch (rdev->wiphy.signal_type) {
5638         case CFG80211_SIGNAL_TYPE_MBM:
5639                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5640                         goto nla_put_failure;
5641                 break;
5642         case CFG80211_SIGNAL_TYPE_UNSPEC:
5643                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5644                         goto nla_put_failure;
5645                 break;
5646         default:
5647                 break;
5648         }
5649
5650         switch (wdev->iftype) {
5651         case NL80211_IFTYPE_P2P_CLIENT:
5652         case NL80211_IFTYPE_STATION:
5653                 if (intbss == wdev->current_bss &&
5654                     nla_put_u32(msg, NL80211_BSS_STATUS,
5655                                 NL80211_BSS_STATUS_ASSOCIATED))
5656                         goto nla_put_failure;
5657                 break;
5658         case NL80211_IFTYPE_ADHOC:
5659                 if (intbss == wdev->current_bss &&
5660                     nla_put_u32(msg, NL80211_BSS_STATUS,
5661                                 NL80211_BSS_STATUS_IBSS_JOINED))
5662                         goto nla_put_failure;
5663                 break;
5664         default:
5665                 break;
5666         }
5667
5668         nla_nest_end(msg, bss);
5669
5670         return genlmsg_end(msg, hdr);
5671
5672  fail_unlock_rcu:
5673         rcu_read_unlock();
5674  nla_put_failure:
5675         genlmsg_cancel(msg, hdr);
5676         return -EMSGSIZE;
5677 }
5678
5679 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5680 {
5681         struct cfg80211_registered_device *rdev;
5682         struct cfg80211_internal_bss *scan;
5683         struct wireless_dev *wdev;
5684         int start = cb->args[2], idx = 0;
5685         int err;
5686
5687         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5688         if (err)
5689                 return err;
5690
5691         wdev_lock(wdev);
5692         spin_lock_bh(&rdev->bss_lock);
5693         cfg80211_bss_expire(rdev);
5694
5695         cb->seq = rdev->bss_generation;
5696
5697         list_for_each_entry(scan, &rdev->bss_list, list) {
5698                 if (++idx <= start)
5699                         continue;
5700                 if (nl80211_send_bss(skb, cb,
5701                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5702                                 rdev, wdev, scan) < 0) {
5703                         idx--;
5704                         break;
5705                 }
5706         }
5707
5708         spin_unlock_bh(&rdev->bss_lock);
5709         wdev_unlock(wdev);
5710
5711         cb->args[2] = idx;
5712         nl80211_finish_wdev_dump(rdev);
5713
5714         return skb->len;
5715 }
5716
5717 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5718                                 int flags, struct net_device *dev,
5719                                 struct survey_info *survey)
5720 {
5721         void *hdr;
5722         struct nlattr *infoattr;
5723
5724         hdr = nl80211hdr_put(msg, portid, seq, flags,
5725                              NL80211_CMD_NEW_SURVEY_RESULTS);
5726         if (!hdr)
5727                 return -ENOMEM;
5728
5729         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5730                 goto nla_put_failure;
5731
5732         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5733         if (!infoattr)
5734                 goto nla_put_failure;
5735
5736         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5737                         survey->channel->center_freq))
5738                 goto nla_put_failure;
5739
5740         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5741             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5742                 goto nla_put_failure;
5743         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5744             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5745                 goto nla_put_failure;
5746         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5747             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5748                         survey->channel_time))
5749                 goto nla_put_failure;
5750         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5751             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5752                         survey->channel_time_busy))
5753                 goto nla_put_failure;
5754         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5755             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5756                         survey->channel_time_ext_busy))
5757                 goto nla_put_failure;
5758         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5759             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5760                         survey->channel_time_rx))
5761                 goto nla_put_failure;
5762         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5763             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5764                         survey->channel_time_tx))
5765                 goto nla_put_failure;
5766
5767         nla_nest_end(msg, infoattr);
5768
5769         return genlmsg_end(msg, hdr);
5770
5771  nla_put_failure:
5772         genlmsg_cancel(msg, hdr);
5773         return -EMSGSIZE;
5774 }
5775
5776 static int nl80211_dump_survey(struct sk_buff *skb,
5777                         struct netlink_callback *cb)
5778 {
5779         struct survey_info survey;
5780         struct cfg80211_registered_device *dev;
5781         struct wireless_dev *wdev;
5782         int survey_idx = cb->args[2];
5783         int res;
5784
5785         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5786         if (res)
5787                 return res;
5788
5789         if (!wdev->netdev) {
5790                 res = -EINVAL;
5791                 goto out_err;
5792         }
5793
5794         if (!dev->ops->dump_survey) {
5795                 res = -EOPNOTSUPP;
5796                 goto out_err;
5797         }
5798
5799         while (1) {
5800                 struct ieee80211_channel *chan;
5801
5802                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5803                 if (res == -ENOENT)
5804                         break;
5805                 if (res)
5806                         goto out_err;
5807
5808                 /* Survey without a channel doesn't make sense */
5809                 if (!survey.channel) {
5810                         res = -EINVAL;
5811                         goto out;
5812                 }
5813
5814                 chan = ieee80211_get_channel(&dev->wiphy,
5815                                              survey.channel->center_freq);
5816                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5817                         survey_idx++;
5818                         continue;
5819                 }
5820
5821                 if (nl80211_send_survey(skb,
5822                                 NETLINK_CB(cb->skb).portid,
5823                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5824                                 wdev->netdev, &survey) < 0)
5825                         goto out;
5826                 survey_idx++;
5827         }
5828
5829  out:
5830         cb->args[2] = survey_idx;
5831         res = skb->len;
5832  out_err:
5833         nl80211_finish_wdev_dump(dev);
5834         return res;
5835 }
5836
5837 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5838 {
5839         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5840                                   NL80211_WPA_VERSION_2));
5841 }
5842
5843 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5844 {
5845         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5846         struct net_device *dev = info->user_ptr[1];
5847         struct ieee80211_channel *chan;
5848         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5849         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5850         enum nl80211_auth_type auth_type;
5851         struct key_parse key;
5852         bool local_state_change;
5853
5854         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5855                 return -EINVAL;
5856
5857         if (!info->attrs[NL80211_ATTR_MAC])
5858                 return -EINVAL;
5859
5860         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5861                 return -EINVAL;
5862
5863         if (!info->attrs[NL80211_ATTR_SSID])
5864                 return -EINVAL;
5865
5866         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5867                 return -EINVAL;
5868
5869         err = nl80211_parse_key(info, &key);
5870         if (err)
5871                 return err;
5872
5873         if (key.idx >= 0) {
5874                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5875                         return -EINVAL;
5876                 if (!key.p.key || !key.p.key_len)
5877                         return -EINVAL;
5878                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5879                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5880                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5881                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5882                         return -EINVAL;
5883                 if (key.idx > 4)
5884                         return -EINVAL;
5885         } else {
5886                 key.p.key_len = 0;
5887                 key.p.key = NULL;
5888         }
5889
5890         if (key.idx >= 0) {
5891                 int i;
5892                 bool ok = false;
5893                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5894                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5895                                 ok = true;
5896                                 break;
5897                         }
5898                 }
5899                 if (!ok)
5900                         return -EINVAL;
5901         }
5902
5903         if (!rdev->ops->auth)
5904                 return -EOPNOTSUPP;
5905
5906         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5907             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5908                 return -EOPNOTSUPP;
5909
5910         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5911         chan = ieee80211_get_channel(&rdev->wiphy,
5912                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5913         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5914                 return -EINVAL;
5915
5916         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5917         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5918
5919         if (info->attrs[NL80211_ATTR_IE]) {
5920                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5921                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5922         }
5923
5924         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5925         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5926                 return -EINVAL;
5927
5928         if (auth_type == NL80211_AUTHTYPE_SAE &&
5929             !info->attrs[NL80211_ATTR_SAE_DATA])
5930                 return -EINVAL;
5931
5932         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5933                 if (auth_type != NL80211_AUTHTYPE_SAE)
5934                         return -EINVAL;
5935                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5936                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5937                 /* need to include at least Auth Transaction and Status Code */
5938                 if (sae_data_len < 4)
5939                         return -EINVAL;
5940         }
5941
5942         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5943
5944         /*
5945          * Since we no longer track auth state, ignore
5946          * requests to only change local state.
5947          */
5948         if (local_state_change)
5949                 return 0;
5950
5951         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5952                                   ssid, ssid_len, ie, ie_len,
5953                                   key.p.key, key.p.key_len, key.idx,
5954                                   sae_data, sae_data_len);
5955 }
5956
5957 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5958                                    struct genl_info *info,
5959                                    struct cfg80211_crypto_settings *settings,
5960                                    int cipher_limit)
5961 {
5962         memset(settings, 0, sizeof(*settings));
5963
5964         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5965
5966         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5967                 u16 proto;
5968                 proto = nla_get_u16(
5969                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5970                 settings->control_port_ethertype = cpu_to_be16(proto);
5971                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5972                     proto != ETH_P_PAE)
5973                         return -EINVAL;
5974                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5975                         settings->control_port_no_encrypt = true;
5976         } else
5977                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5978
5979         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5980                 void *data;
5981                 int len, i;
5982
5983                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5984                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5985                 settings->n_ciphers_pairwise = len / sizeof(u32);
5986
5987                 if (len % sizeof(u32))
5988                         return -EINVAL;
5989
5990                 if (settings->n_ciphers_pairwise > cipher_limit)
5991                         return -EINVAL;
5992
5993                 memcpy(settings->ciphers_pairwise, data, len);
5994
5995                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5996                         if (!cfg80211_supported_cipher_suite(
5997                                         &rdev->wiphy,
5998                                         settings->ciphers_pairwise[i]))
5999                                 return -EINVAL;
6000         }
6001
6002         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6003                 settings->cipher_group =
6004                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6005                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6006                                                      settings->cipher_group))
6007                         return -EINVAL;
6008         }
6009
6010         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6011                 settings->wpa_versions =
6012                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6013                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6014                         return -EINVAL;
6015         }
6016
6017         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6018                 void *data;
6019                 int len;
6020
6021                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6022                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6023                 settings->n_akm_suites = len / sizeof(u32);
6024
6025                 if (len % sizeof(u32))
6026                         return -EINVAL;
6027
6028                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6029                         return -EINVAL;
6030
6031                 memcpy(settings->akm_suites, data, len);
6032         }
6033
6034         return 0;
6035 }
6036
6037 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6038 {
6039         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6040         struct net_device *dev = info->user_ptr[1];
6041         struct ieee80211_channel *chan;
6042         struct cfg80211_assoc_request req = {};
6043         const u8 *bssid, *ssid;
6044         int err, ssid_len = 0;
6045
6046         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6047                 return -EINVAL;
6048
6049         if (!info->attrs[NL80211_ATTR_MAC] ||
6050             !info->attrs[NL80211_ATTR_SSID] ||
6051             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6052                 return -EINVAL;
6053
6054         if (!rdev->ops->assoc)
6055                 return -EOPNOTSUPP;
6056
6057         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6058             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6059                 return -EOPNOTSUPP;
6060
6061         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6062
6063         chan = ieee80211_get_channel(&rdev->wiphy,
6064                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6065         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6066                 return -EINVAL;
6067
6068         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6069         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6070
6071         if (info->attrs[NL80211_ATTR_IE]) {
6072                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6073                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6074         }
6075
6076         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6077                 enum nl80211_mfp mfp =
6078                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6079                 if (mfp == NL80211_MFP_REQUIRED)
6080                         req.use_mfp = true;
6081                 else if (mfp != NL80211_MFP_NO)
6082                         return -EINVAL;
6083         }
6084
6085         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6086                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6087
6088         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6089                 req.flags |= ASSOC_REQ_DISABLE_HT;
6090
6091         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6092                 memcpy(&req.ht_capa_mask,
6093                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6094                        sizeof(req.ht_capa_mask));
6095
6096         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6097                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6098                         return -EINVAL;
6099                 memcpy(&req.ht_capa,
6100                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6101                        sizeof(req.ht_capa));
6102         }
6103
6104         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6105                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6106
6107         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6108                 memcpy(&req.vht_capa_mask,
6109                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6110                        sizeof(req.vht_capa_mask));
6111
6112         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6113                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6114                         return -EINVAL;
6115                 memcpy(&req.vht_capa,
6116                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6117                        sizeof(req.vht_capa));
6118         }
6119
6120         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6121         if (!err)
6122                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6123                                           ssid, ssid_len, &req);
6124
6125         return err;
6126 }
6127
6128 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6129 {
6130         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6131         struct net_device *dev = info->user_ptr[1];
6132         const u8 *ie = NULL, *bssid;
6133         int ie_len = 0;
6134         u16 reason_code;
6135         bool local_state_change;
6136
6137         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6138                 return -EINVAL;
6139
6140         if (!info->attrs[NL80211_ATTR_MAC])
6141                 return -EINVAL;
6142
6143         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6144                 return -EINVAL;
6145
6146         if (!rdev->ops->deauth)
6147                 return -EOPNOTSUPP;
6148
6149         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6150             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6151                 return -EOPNOTSUPP;
6152
6153         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6154
6155         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6156         if (reason_code == 0) {
6157                 /* Reason Code 0 is reserved */
6158                 return -EINVAL;
6159         }
6160
6161         if (info->attrs[NL80211_ATTR_IE]) {
6162                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6163                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6164         }
6165
6166         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6167
6168         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6169                                     local_state_change);
6170 }
6171
6172 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6173 {
6174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6175         struct net_device *dev = info->user_ptr[1];
6176         const u8 *ie = NULL, *bssid;
6177         int ie_len = 0;
6178         u16 reason_code;
6179         bool local_state_change;
6180
6181         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6182                 return -EINVAL;
6183
6184         if (!info->attrs[NL80211_ATTR_MAC])
6185                 return -EINVAL;
6186
6187         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6188                 return -EINVAL;
6189
6190         if (!rdev->ops->disassoc)
6191                 return -EOPNOTSUPP;
6192
6193         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6194             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6195                 return -EOPNOTSUPP;
6196
6197         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6198
6199         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6200         if (reason_code == 0) {
6201                 /* Reason Code 0 is reserved */
6202                 return -EINVAL;
6203         }
6204
6205         if (info->attrs[NL80211_ATTR_IE]) {
6206                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6207                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6208         }
6209
6210         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6211
6212         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6213                                       local_state_change);
6214 }
6215
6216 static bool
6217 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6218                          int mcast_rate[IEEE80211_NUM_BANDS],
6219                          int rateval)
6220 {
6221         struct wiphy *wiphy = &rdev->wiphy;
6222         bool found = false;
6223         int band, i;
6224
6225         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6226                 struct ieee80211_supported_band *sband;
6227
6228                 sband = wiphy->bands[band];
6229                 if (!sband)
6230                         continue;
6231
6232                 for (i = 0; i < sband->n_bitrates; i++) {
6233                         if (sband->bitrates[i].bitrate == rateval) {
6234                                 mcast_rate[band] = i + 1;
6235                                 found = true;
6236                                 break;
6237                         }
6238                 }
6239         }
6240
6241         return found;
6242 }
6243
6244 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6245 {
6246         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6247         struct net_device *dev = info->user_ptr[1];
6248         struct cfg80211_ibss_params ibss;
6249         struct wiphy *wiphy;
6250         struct cfg80211_cached_keys *connkeys = NULL;
6251         int err;
6252
6253         memset(&ibss, 0, sizeof(ibss));
6254
6255         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6256                 return -EINVAL;
6257
6258         if (!info->attrs[NL80211_ATTR_SSID] ||
6259             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6260                 return -EINVAL;
6261
6262         ibss.beacon_interval = 100;
6263
6264         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6265                 ibss.beacon_interval =
6266                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6267                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6268                         return -EINVAL;
6269         }
6270
6271         if (!rdev->ops->join_ibss)
6272                 return -EOPNOTSUPP;
6273
6274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6275                 return -EOPNOTSUPP;
6276
6277         wiphy = &rdev->wiphy;
6278
6279         if (info->attrs[NL80211_ATTR_MAC]) {
6280                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6281
6282                 if (!is_valid_ether_addr(ibss.bssid))
6283                         return -EINVAL;
6284         }
6285         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6286         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6287
6288         if (info->attrs[NL80211_ATTR_IE]) {
6289                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6290                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6291         }
6292
6293         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6294         if (err)
6295                 return err;
6296
6297         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6298                 return -EINVAL;
6299
6300         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6301                 return -EINVAL;
6302         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6303             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6304                 return -EINVAL;
6305
6306         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6307         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6308
6309         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6310                 u8 *rates =
6311                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6312                 int n_rates =
6313                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6314                 struct ieee80211_supported_band *sband =
6315                         wiphy->bands[ibss.chandef.chan->band];
6316
6317                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6318                                              &ibss.basic_rates);
6319                 if (err)
6320                         return err;
6321         }
6322
6323         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6324             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6325                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6326                 return -EINVAL;
6327
6328         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6329                 bool no_ht = false;
6330
6331                 connkeys = nl80211_parse_connkeys(rdev,
6332                                           info->attrs[NL80211_ATTR_KEYS],
6333                                           &no_ht);
6334                 if (IS_ERR(connkeys))
6335                         return PTR_ERR(connkeys);
6336
6337                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6338                     no_ht) {
6339                         kfree(connkeys);
6340                         return -EINVAL;
6341                 }
6342         }
6343
6344         ibss.control_port =
6345                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6346
6347         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6348         if (err)
6349                 kfree(connkeys);
6350         return err;
6351 }
6352
6353 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6354 {
6355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6356         struct net_device *dev = info->user_ptr[1];
6357
6358         if (!rdev->ops->leave_ibss)
6359                 return -EOPNOTSUPP;
6360
6361         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6362                 return -EOPNOTSUPP;
6363
6364         return cfg80211_leave_ibss(rdev, dev, false);
6365 }
6366
6367 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6368 {
6369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6370         struct net_device *dev = info->user_ptr[1];
6371         int mcast_rate[IEEE80211_NUM_BANDS];
6372         u32 nla_rate;
6373         int err;
6374
6375         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6376             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6377                 return -EOPNOTSUPP;
6378
6379         if (!rdev->ops->set_mcast_rate)
6380                 return -EOPNOTSUPP;
6381
6382         memset(mcast_rate, 0, sizeof(mcast_rate));
6383
6384         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6385                 return -EINVAL;
6386
6387         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6388         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6389                 return -EINVAL;
6390
6391         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6392
6393         return err;
6394 }
6395
6396
6397 #ifdef CONFIG_NL80211_TESTMODE
6398 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6399         .name = "testmode",
6400 };
6401
6402 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6403 {
6404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6405         int err;
6406
6407         if (!info->attrs[NL80211_ATTR_TESTDATA])
6408                 return -EINVAL;
6409
6410         err = -EOPNOTSUPP;
6411         if (rdev->ops->testmode_cmd) {
6412                 rdev->testmode_info = info;
6413                 err = rdev_testmode_cmd(rdev,
6414                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6415                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6416                 rdev->testmode_info = NULL;
6417         }
6418
6419         return err;
6420 }
6421
6422 static int nl80211_testmode_dump(struct sk_buff *skb,
6423                                  struct netlink_callback *cb)
6424 {
6425         struct cfg80211_registered_device *rdev;
6426         int err;
6427         long phy_idx;
6428         void *data = NULL;
6429         int data_len = 0;
6430
6431         if (cb->args[0]) {
6432                 /*
6433                  * 0 is a valid index, but not valid for args[0],
6434                  * so we need to offset by 1.
6435                  */
6436                 phy_idx = cb->args[0] - 1;
6437         } else {
6438                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6439                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6440                                   nl80211_policy);
6441                 if (err)
6442                         return err;
6443
6444                 mutex_lock(&cfg80211_mutex);
6445                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6446                                                   nl80211_fam.attrbuf);
6447                 if (IS_ERR(rdev)) {
6448                         mutex_unlock(&cfg80211_mutex);
6449                         return PTR_ERR(rdev);
6450                 }
6451                 phy_idx = rdev->wiphy_idx;
6452                 rdev = NULL;
6453                 mutex_unlock(&cfg80211_mutex);
6454
6455                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6456                         cb->args[1] =
6457                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6458         }
6459
6460         if (cb->args[1]) {
6461                 data = nla_data((void *)cb->args[1]);
6462                 data_len = nla_len((void *)cb->args[1]);
6463         }
6464
6465         mutex_lock(&cfg80211_mutex);
6466         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6467         if (!rdev) {
6468                 mutex_unlock(&cfg80211_mutex);
6469                 return -ENOENT;
6470         }
6471         cfg80211_lock_rdev(rdev);
6472         mutex_unlock(&cfg80211_mutex);
6473
6474         if (!rdev->ops->testmode_dump) {
6475                 err = -EOPNOTSUPP;
6476                 goto out_err;
6477         }
6478
6479         while (1) {
6480                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6481                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6482                                            NL80211_CMD_TESTMODE);
6483                 struct nlattr *tmdata;
6484
6485                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6486                         genlmsg_cancel(skb, hdr);
6487                         break;
6488                 }
6489
6490                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6491                 if (!tmdata) {
6492                         genlmsg_cancel(skb, hdr);
6493                         break;
6494                 }
6495                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6496                 nla_nest_end(skb, tmdata);
6497
6498                 if (err == -ENOBUFS || err == -ENOENT) {
6499                         genlmsg_cancel(skb, hdr);
6500                         break;
6501                 } else if (err) {
6502                         genlmsg_cancel(skb, hdr);
6503                         goto out_err;
6504                 }
6505
6506                 genlmsg_end(skb, hdr);
6507         }
6508
6509         err = skb->len;
6510         /* see above */
6511         cb->args[0] = phy_idx + 1;
6512  out_err:
6513         cfg80211_unlock_rdev(rdev);
6514         return err;
6515 }
6516
6517 static struct sk_buff *
6518 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6519                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6520 {
6521         struct sk_buff *skb;
6522         void *hdr;
6523         struct nlattr *data;
6524
6525         skb = nlmsg_new(approxlen + 100, gfp);
6526         if (!skb)
6527                 return NULL;
6528
6529         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6530         if (!hdr) {
6531                 kfree_skb(skb);
6532                 return NULL;
6533         }
6534
6535         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6536                 goto nla_put_failure;
6537         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6538
6539         ((void **)skb->cb)[0] = rdev;
6540         ((void **)skb->cb)[1] = hdr;
6541         ((void **)skb->cb)[2] = data;
6542
6543         return skb;
6544
6545  nla_put_failure:
6546         kfree_skb(skb);
6547         return NULL;
6548 }
6549
6550 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6551                                                   int approxlen)
6552 {
6553         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6554
6555         if (WARN_ON(!rdev->testmode_info))
6556                 return NULL;
6557
6558         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6559                                 rdev->testmode_info->snd_portid,
6560                                 rdev->testmode_info->snd_seq,
6561                                 GFP_KERNEL);
6562 }
6563 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6564
6565 int cfg80211_testmode_reply(struct sk_buff *skb)
6566 {
6567         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6568         void *hdr = ((void **)skb->cb)[1];
6569         struct nlattr *data = ((void **)skb->cb)[2];
6570
6571         /* clear CB data for netlink core to own from now on */
6572         memset(skb->cb, 0, sizeof(skb->cb));
6573
6574         if (WARN_ON(!rdev->testmode_info)) {
6575                 kfree_skb(skb);
6576                 return -EINVAL;
6577         }
6578
6579         nla_nest_end(skb, data);
6580         genlmsg_end(skb, hdr);
6581         return genlmsg_reply(skb, rdev->testmode_info);
6582 }
6583 EXPORT_SYMBOL(cfg80211_testmode_reply);
6584
6585 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6586                                                   int approxlen, gfp_t gfp)
6587 {
6588         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6589
6590         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6591 }
6592 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6593
6594 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6595 {
6596         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6597         void *hdr = ((void **)skb->cb)[1];
6598         struct nlattr *data = ((void **)skb->cb)[2];
6599
6600         /* clear CB data for netlink core to own from now on */
6601         memset(skb->cb, 0, sizeof(skb->cb));
6602
6603         nla_nest_end(skb, data);
6604         genlmsg_end(skb, hdr);
6605         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
6606                                 nl80211_testmode_mcgrp.id, gfp);
6607 }
6608 EXPORT_SYMBOL(cfg80211_testmode_event);
6609 #endif
6610
6611 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6612 {
6613         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6614         struct net_device *dev = info->user_ptr[1];
6615         struct cfg80211_connect_params connect;
6616         struct wiphy *wiphy;
6617         struct cfg80211_cached_keys *connkeys = NULL;
6618         int err;
6619
6620         memset(&connect, 0, sizeof(connect));
6621
6622         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6623                 return -EINVAL;
6624
6625         if (!info->attrs[NL80211_ATTR_SSID] ||
6626             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6627                 return -EINVAL;
6628
6629         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6630                 connect.auth_type =
6631                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6632                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6633                                              NL80211_CMD_CONNECT))
6634                         return -EINVAL;
6635         } else
6636                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6637
6638         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6639
6640         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6641                                       NL80211_MAX_NR_CIPHER_SUITES);
6642         if (err)
6643                 return err;
6644
6645         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6646             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6647                 return -EOPNOTSUPP;
6648
6649         wiphy = &rdev->wiphy;
6650
6651         connect.bg_scan_period = -1;
6652         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6653                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6654                 connect.bg_scan_period =
6655                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6656         }
6657
6658         if (info->attrs[NL80211_ATTR_MAC])
6659                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6660         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6661         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6662
6663         if (info->attrs[NL80211_ATTR_IE]) {
6664                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6665                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6666         }
6667
6668         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6669                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6670                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6671                     connect.mfp != NL80211_MFP_NO)
6672                         return -EINVAL;
6673         } else {
6674                 connect.mfp = NL80211_MFP_NO;
6675         }
6676
6677         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6678                 connect.channel =
6679                         ieee80211_get_channel(wiphy,
6680                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6681                 if (!connect.channel ||
6682                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6683                         return -EINVAL;
6684         }
6685
6686         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6687                 connkeys = nl80211_parse_connkeys(rdev,
6688                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6689                 if (IS_ERR(connkeys))
6690                         return PTR_ERR(connkeys);
6691         }
6692
6693         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6694                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6695
6696         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6697                 memcpy(&connect.ht_capa_mask,
6698                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6699                        sizeof(connect.ht_capa_mask));
6700
6701         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6702                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6703                         kfree(connkeys);
6704                         return -EINVAL;
6705                 }
6706                 memcpy(&connect.ht_capa,
6707                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6708                        sizeof(connect.ht_capa));
6709         }
6710
6711         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6712                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6713
6714         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6715                 memcpy(&connect.vht_capa_mask,
6716                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6717                        sizeof(connect.vht_capa_mask));
6718
6719         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6720                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6721                         kfree(connkeys);
6722                         return -EINVAL;
6723                 }
6724                 memcpy(&connect.vht_capa,
6725                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6726                        sizeof(connect.vht_capa));
6727         }
6728
6729         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6730         if (err)
6731                 kfree(connkeys);
6732         return err;
6733 }
6734
6735 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6736 {
6737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6738         struct net_device *dev = info->user_ptr[1];
6739         u16 reason;
6740
6741         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6742                 reason = WLAN_REASON_DEAUTH_LEAVING;
6743         else
6744                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6745
6746         if (reason == 0)
6747                 return -EINVAL;
6748
6749         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6750             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6751                 return -EOPNOTSUPP;
6752
6753         return cfg80211_disconnect(rdev, dev, reason, true);
6754 }
6755
6756 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6757 {
6758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6759         struct net *net;
6760         int err;
6761         u32 pid;
6762
6763         if (!info->attrs[NL80211_ATTR_PID])
6764                 return -EINVAL;
6765
6766         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6767
6768         net = get_net_ns_by_pid(pid);
6769         if (IS_ERR(net))
6770                 return PTR_ERR(net);
6771
6772         err = 0;
6773
6774         /* check if anything to do */
6775         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6776                 err = cfg80211_switch_netns(rdev, net);
6777
6778         put_net(net);
6779         return err;
6780 }
6781
6782 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6783 {
6784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6785         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6786                         struct cfg80211_pmksa *pmksa) = NULL;
6787         struct net_device *dev = info->user_ptr[1];
6788         struct cfg80211_pmksa pmksa;
6789
6790         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6791
6792         if (!info->attrs[NL80211_ATTR_MAC])
6793                 return -EINVAL;
6794
6795         if (!info->attrs[NL80211_ATTR_PMKID])
6796                 return -EINVAL;
6797
6798         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6799         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6800
6801         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6802             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6803                 return -EOPNOTSUPP;
6804
6805         switch (info->genlhdr->cmd) {
6806         case NL80211_CMD_SET_PMKSA:
6807                 rdev_ops = rdev->ops->set_pmksa;
6808                 break;
6809         case NL80211_CMD_DEL_PMKSA:
6810                 rdev_ops = rdev->ops->del_pmksa;
6811                 break;
6812         default:
6813                 WARN_ON(1);
6814                 break;
6815         }
6816
6817         if (!rdev_ops)
6818                 return -EOPNOTSUPP;
6819
6820         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6821 }
6822
6823 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6824 {
6825         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6826         struct net_device *dev = info->user_ptr[1];
6827
6828         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6829             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6830                 return -EOPNOTSUPP;
6831
6832         if (!rdev->ops->flush_pmksa)
6833                 return -EOPNOTSUPP;
6834
6835         return rdev_flush_pmksa(rdev, dev);
6836 }
6837
6838 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6839 {
6840         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6841         struct net_device *dev = info->user_ptr[1];
6842         u8 action_code, dialog_token;
6843         u16 status_code;
6844         u8 *peer;
6845
6846         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6847             !rdev->ops->tdls_mgmt)
6848                 return -EOPNOTSUPP;
6849
6850         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6851             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6852             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6853             !info->attrs[NL80211_ATTR_IE] ||
6854             !info->attrs[NL80211_ATTR_MAC])
6855                 return -EINVAL;
6856
6857         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6858         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6859         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6860         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6861
6862         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6863                               dialog_token, status_code,
6864                               nla_data(info->attrs[NL80211_ATTR_IE]),
6865                               nla_len(info->attrs[NL80211_ATTR_IE]));
6866 }
6867
6868 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6869 {
6870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6871         struct net_device *dev = info->user_ptr[1];
6872         enum nl80211_tdls_operation operation;
6873         u8 *peer;
6874
6875         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6876             !rdev->ops->tdls_oper)
6877                 return -EOPNOTSUPP;
6878
6879         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6880             !info->attrs[NL80211_ATTR_MAC])
6881                 return -EINVAL;
6882
6883         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6884         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6885
6886         return rdev_tdls_oper(rdev, dev, peer, operation);
6887 }
6888
6889 static int nl80211_remain_on_channel(struct sk_buff *skb,
6890                                      struct genl_info *info)
6891 {
6892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6893         struct wireless_dev *wdev = info->user_ptr[1];
6894         struct cfg80211_chan_def chandef;
6895         struct sk_buff *msg;
6896         void *hdr;
6897         u64 cookie;
6898         u32 duration;
6899         int err;
6900
6901         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6902             !info->attrs[NL80211_ATTR_DURATION])
6903                 return -EINVAL;
6904
6905         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6906
6907         if (!rdev->ops->remain_on_channel ||
6908             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6909                 return -EOPNOTSUPP;
6910
6911         /*
6912          * We should be on that channel for at least a minimum amount of
6913          * time (10ms) but no longer than the driver supports.
6914          */
6915         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6916             duration > rdev->wiphy.max_remain_on_channel_duration)
6917                 return -EINVAL;
6918
6919         err = nl80211_parse_chandef(rdev, info, &chandef);
6920         if (err)
6921                 return err;
6922
6923         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6924         if (!msg)
6925                 return -ENOMEM;
6926
6927         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6928                              NL80211_CMD_REMAIN_ON_CHANNEL);
6929
6930         if (IS_ERR(hdr)) {
6931                 err = PTR_ERR(hdr);
6932                 goto free_msg;
6933         }
6934
6935         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6936                                      duration, &cookie);
6937
6938         if (err)
6939                 goto free_msg;
6940
6941         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6942                 goto nla_put_failure;
6943
6944         genlmsg_end(msg, hdr);
6945
6946         return genlmsg_reply(msg, info);
6947
6948  nla_put_failure:
6949         err = -ENOBUFS;
6950  free_msg:
6951         nlmsg_free(msg);
6952         return err;
6953 }
6954
6955 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6956                                             struct genl_info *info)
6957 {
6958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6959         struct wireless_dev *wdev = info->user_ptr[1];
6960         u64 cookie;
6961
6962         if (!info->attrs[NL80211_ATTR_COOKIE])
6963                 return -EINVAL;
6964
6965         if (!rdev->ops->cancel_remain_on_channel)
6966                 return -EOPNOTSUPP;
6967
6968         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6969
6970         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6971 }
6972
6973 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6974                            u8 *rates, u8 rates_len)
6975 {
6976         u8 i;
6977         u32 mask = 0;
6978
6979         for (i = 0; i < rates_len; i++) {
6980                 int rate = (rates[i] & 0x7f) * 5;
6981                 int ridx;
6982                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6983                         struct ieee80211_rate *srate =
6984                                 &sband->bitrates[ridx];
6985                         if (rate == srate->bitrate) {
6986                                 mask |= 1 << ridx;
6987                                 break;
6988                         }
6989                 }
6990                 if (ridx == sband->n_bitrates)
6991                         return 0; /* rate not found */
6992         }
6993
6994         return mask;
6995 }
6996
6997 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6998                                u8 *rates, u8 rates_len,
6999                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7000 {
7001         u8 i;
7002
7003         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7004
7005         for (i = 0; i < rates_len; i++) {
7006                 int ridx, rbit;
7007
7008                 ridx = rates[i] / 8;
7009                 rbit = BIT(rates[i] % 8);
7010
7011                 /* check validity */
7012                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7013                         return false;
7014
7015                 /* check availability */
7016                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7017                         mcs[ridx] |= rbit;
7018                 else
7019                         return false;
7020         }
7021
7022         return true;
7023 }
7024
7025 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7026         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7027                                     .len = NL80211_MAX_SUPP_RATES },
7028         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7029                                  .len = NL80211_MAX_SUPP_HT_RATES },
7030 };
7031
7032 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7033                                        struct genl_info *info)
7034 {
7035         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7037         struct cfg80211_bitrate_mask mask;
7038         int rem, i;
7039         struct net_device *dev = info->user_ptr[1];
7040         struct nlattr *tx_rates;
7041         struct ieee80211_supported_band *sband;
7042
7043         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7044                 return -EINVAL;
7045
7046         if (!rdev->ops->set_bitrate_mask)
7047                 return -EOPNOTSUPP;
7048
7049         memset(&mask, 0, sizeof(mask));
7050         /* Default to all rates enabled */
7051         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7052                 sband = rdev->wiphy.bands[i];
7053                 mask.control[i].legacy =
7054                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7055                 if (sband)
7056                         memcpy(mask.control[i].mcs,
7057                                sband->ht_cap.mcs.rx_mask,
7058                                sizeof(mask.control[i].mcs));
7059                 else
7060                         memset(mask.control[i].mcs, 0,
7061                                sizeof(mask.control[i].mcs));
7062         }
7063
7064         /*
7065          * The nested attribute uses enum nl80211_band as the index. This maps
7066          * directly to the enum ieee80211_band values used in cfg80211.
7067          */
7068         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7069         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7070         {
7071                 enum ieee80211_band band = nla_type(tx_rates);
7072                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7073                         return -EINVAL;
7074                 sband = rdev->wiphy.bands[band];
7075                 if (sband == NULL)
7076                         return -EINVAL;
7077                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7078                           nla_len(tx_rates), nl80211_txattr_policy);
7079                 if (tb[NL80211_TXRATE_LEGACY]) {
7080                         mask.control[band].legacy = rateset_to_mask(
7081                                 sband,
7082                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7083                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7084                         if ((mask.control[band].legacy == 0) &&
7085                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7086                                 return -EINVAL;
7087                 }
7088                 if (tb[NL80211_TXRATE_MCS]) {
7089                         if (!ht_rateset_to_mask(
7090                                         sband,
7091                                         nla_data(tb[NL80211_TXRATE_MCS]),
7092                                         nla_len(tb[NL80211_TXRATE_MCS]),
7093                                         mask.control[band].mcs))
7094                                 return -EINVAL;
7095                 }
7096
7097                 if (mask.control[band].legacy == 0) {
7098                         /* don't allow empty legacy rates if HT
7099                          * is not even supported. */
7100                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7101                                 return -EINVAL;
7102
7103                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7104                                 if (mask.control[band].mcs[i])
7105                                         break;
7106
7107                         /* legacy and mcs rates may not be both empty */
7108                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7109                                 return -EINVAL;
7110                 }
7111         }
7112
7113         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7114 }
7115
7116 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7117 {
7118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7119         struct wireless_dev *wdev = info->user_ptr[1];
7120         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7121
7122         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7123                 return -EINVAL;
7124
7125         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7126                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7127
7128         switch (wdev->iftype) {
7129         case NL80211_IFTYPE_STATION:
7130         case NL80211_IFTYPE_ADHOC:
7131         case NL80211_IFTYPE_P2P_CLIENT:
7132         case NL80211_IFTYPE_AP:
7133         case NL80211_IFTYPE_AP_VLAN:
7134         case NL80211_IFTYPE_MESH_POINT:
7135         case NL80211_IFTYPE_P2P_GO:
7136         case NL80211_IFTYPE_P2P_DEVICE:
7137                 break;
7138         default:
7139                 return -EOPNOTSUPP;
7140         }
7141
7142         /* not much point in registering if we can't reply */
7143         if (!rdev->ops->mgmt_tx)
7144                 return -EOPNOTSUPP;
7145
7146         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7147                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7148                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7149 }
7150
7151 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7152 {
7153         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7154         struct wireless_dev *wdev = info->user_ptr[1];
7155         struct cfg80211_chan_def chandef;
7156         int err;
7157         void *hdr = NULL;
7158         u64 cookie;
7159         struct sk_buff *msg = NULL;
7160         unsigned int wait = 0;
7161         bool offchan, no_cck, dont_wait_for_ack;
7162
7163         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7164
7165         if (!info->attrs[NL80211_ATTR_FRAME])
7166                 return -EINVAL;
7167
7168         if (!rdev->ops->mgmt_tx)
7169                 return -EOPNOTSUPP;
7170
7171         switch (wdev->iftype) {
7172         case NL80211_IFTYPE_STATION:
7173         case NL80211_IFTYPE_ADHOC:
7174         case NL80211_IFTYPE_P2P_CLIENT:
7175         case NL80211_IFTYPE_AP:
7176         case NL80211_IFTYPE_AP_VLAN:
7177         case NL80211_IFTYPE_MESH_POINT:
7178         case NL80211_IFTYPE_P2P_GO:
7179         case NL80211_IFTYPE_P2P_DEVICE:
7180                 break;
7181         default:
7182                 return -EOPNOTSUPP;
7183         }
7184
7185         if (info->attrs[NL80211_ATTR_DURATION]) {
7186                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7187                         return -EINVAL;
7188                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7189
7190                 /*
7191                  * We should wait on the channel for at least a minimum amount
7192                  * of time (10ms) but no longer than the driver supports.
7193                  */
7194                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7195                     wait > rdev->wiphy.max_remain_on_channel_duration)
7196                         return -EINVAL;
7197
7198         }
7199
7200         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7201
7202         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7203                 return -EINVAL;
7204
7205         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7206
7207         err = nl80211_parse_chandef(rdev, info, &chandef);
7208         if (err)
7209                 return err;
7210
7211         if (!dont_wait_for_ack) {
7212                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7213                 if (!msg)
7214                         return -ENOMEM;
7215
7216                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7217                                      NL80211_CMD_FRAME);
7218
7219                 if (IS_ERR(hdr)) {
7220                         err = PTR_ERR(hdr);
7221                         goto free_msg;
7222                 }
7223         }
7224
7225         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7226                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7227                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7228                                     no_cck, dont_wait_for_ack, &cookie);
7229         if (err)
7230                 goto free_msg;
7231
7232         if (msg) {
7233                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7234                         goto nla_put_failure;
7235
7236                 genlmsg_end(msg, hdr);
7237                 return genlmsg_reply(msg, info);
7238         }
7239
7240         return 0;
7241
7242  nla_put_failure:
7243         err = -ENOBUFS;
7244  free_msg:
7245         nlmsg_free(msg);
7246         return err;
7247 }
7248
7249 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7250 {
7251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7252         struct wireless_dev *wdev = info->user_ptr[1];
7253         u64 cookie;
7254
7255         if (!info->attrs[NL80211_ATTR_COOKIE])
7256                 return -EINVAL;
7257
7258         if (!rdev->ops->mgmt_tx_cancel_wait)
7259                 return -EOPNOTSUPP;
7260
7261         switch (wdev->iftype) {
7262         case NL80211_IFTYPE_STATION:
7263         case NL80211_IFTYPE_ADHOC:
7264         case NL80211_IFTYPE_P2P_CLIENT:
7265         case NL80211_IFTYPE_AP:
7266         case NL80211_IFTYPE_AP_VLAN:
7267         case NL80211_IFTYPE_P2P_GO:
7268         case NL80211_IFTYPE_P2P_DEVICE:
7269                 break;
7270         default:
7271                 return -EOPNOTSUPP;
7272         }
7273
7274         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7275
7276         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7277 }
7278
7279 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7280 {
7281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7282         struct wireless_dev *wdev;
7283         struct net_device *dev = info->user_ptr[1];
7284         u8 ps_state;
7285         bool state;
7286         int err;
7287
7288         if (!info->attrs[NL80211_ATTR_PS_STATE])
7289                 return -EINVAL;
7290
7291         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7292
7293         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7294                 return -EINVAL;
7295
7296         wdev = dev->ieee80211_ptr;
7297
7298         if (!rdev->ops->set_power_mgmt)
7299                 return -EOPNOTSUPP;
7300
7301         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7302
7303         if (state == wdev->ps)
7304                 return 0;
7305
7306         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7307         if (!err)
7308                 wdev->ps = state;
7309         return err;
7310 }
7311
7312 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7313 {
7314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7315         enum nl80211_ps_state ps_state;
7316         struct wireless_dev *wdev;
7317         struct net_device *dev = info->user_ptr[1];
7318         struct sk_buff *msg;
7319         void *hdr;
7320         int err;
7321
7322         wdev = dev->ieee80211_ptr;
7323
7324         if (!rdev->ops->set_power_mgmt)
7325                 return -EOPNOTSUPP;
7326
7327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7328         if (!msg)
7329                 return -ENOMEM;
7330
7331         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7332                              NL80211_CMD_GET_POWER_SAVE);
7333         if (!hdr) {
7334                 err = -ENOBUFS;
7335                 goto free_msg;
7336         }
7337
7338         if (wdev->ps)
7339                 ps_state = NL80211_PS_ENABLED;
7340         else
7341                 ps_state = NL80211_PS_DISABLED;
7342
7343         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7344                 goto nla_put_failure;
7345
7346         genlmsg_end(msg, hdr);
7347         return genlmsg_reply(msg, info);
7348
7349  nla_put_failure:
7350         err = -ENOBUFS;
7351  free_msg:
7352         nlmsg_free(msg);
7353         return err;
7354 }
7355
7356 static struct nla_policy
7357 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7358         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7359         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7360         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7361         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7362         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7363         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7364 };
7365
7366 static int nl80211_set_cqm_txe(struct genl_info *info,
7367                                u32 rate, u32 pkts, u32 intvl)
7368 {
7369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7370         struct wireless_dev *wdev;
7371         struct net_device *dev = info->user_ptr[1];
7372
7373         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7374                 return -EINVAL;
7375
7376         wdev = dev->ieee80211_ptr;
7377
7378         if (!rdev->ops->set_cqm_txe_config)
7379                 return -EOPNOTSUPP;
7380
7381         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7382             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7383                 return -EOPNOTSUPP;
7384
7385         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7386 }
7387
7388 static int nl80211_set_cqm_rssi(struct genl_info *info,
7389                                 s32 threshold, u32 hysteresis)
7390 {
7391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7392         struct wireless_dev *wdev;
7393         struct net_device *dev = info->user_ptr[1];
7394
7395         if (threshold > 0)
7396                 return -EINVAL;
7397
7398         wdev = dev->ieee80211_ptr;
7399
7400         if (!rdev->ops->set_cqm_rssi_config)
7401                 return -EOPNOTSUPP;
7402
7403         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7404             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7405                 return -EOPNOTSUPP;
7406
7407         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7408 }
7409
7410 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7411 {
7412         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7413         struct nlattr *cqm;
7414         int err;
7415
7416         cqm = info->attrs[NL80211_ATTR_CQM];
7417         if (!cqm) {
7418                 err = -EINVAL;
7419                 goto out;
7420         }
7421
7422         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7423                                nl80211_attr_cqm_policy);
7424         if (err)
7425                 goto out;
7426
7427         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7428             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7429                 s32 threshold;
7430                 u32 hysteresis;
7431                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7432                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7433                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7434         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7435                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7436                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7437                 u32 rate, pkts, intvl;
7438                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7439                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7440                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7441                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7442         } else
7443                 err = -EINVAL;
7444
7445 out:
7446         return err;
7447 }
7448
7449 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7450 {
7451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7452         struct net_device *dev = info->user_ptr[1];
7453         struct mesh_config cfg;
7454         struct mesh_setup setup;
7455         int err;
7456
7457         /* start with default */
7458         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7459         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7460
7461         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7462                 /* and parse parameters if given */
7463                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7464                 if (err)
7465                         return err;
7466         }
7467
7468         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7469             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7470                 return -EINVAL;
7471
7472         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7473         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7474
7475         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7476             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7477                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7478                         return -EINVAL;
7479
7480         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7481                 setup.beacon_interval =
7482                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7483                 if (setup.beacon_interval < 10 ||
7484                     setup.beacon_interval > 10000)
7485                         return -EINVAL;
7486         }
7487
7488         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7489                 setup.dtim_period =
7490                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7491                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7492                         return -EINVAL;
7493         }
7494
7495         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7496                 /* parse additional setup parameters if given */
7497                 err = nl80211_parse_mesh_setup(info, &setup);
7498                 if (err)
7499                         return err;
7500         }
7501
7502         if (setup.user_mpm)
7503                 cfg.auto_open_plinks = false;
7504
7505         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7506                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7507                 if (err)
7508                         return err;
7509         } else {
7510                 /* cfg80211_join_mesh() will sort it out */
7511                 setup.chandef.chan = NULL;
7512         }
7513
7514         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7515 }
7516
7517 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7518 {
7519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7520         struct net_device *dev = info->user_ptr[1];
7521
7522         return cfg80211_leave_mesh(rdev, dev);
7523 }
7524
7525 #ifdef CONFIG_PM
7526 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7527                                         struct cfg80211_registered_device *rdev)
7528 {
7529         struct nlattr *nl_pats, *nl_pat;
7530         int i, pat_len;
7531
7532         if (!rdev->wowlan->n_patterns)
7533                 return 0;
7534
7535         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7536         if (!nl_pats)
7537                 return -ENOBUFS;
7538
7539         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7540                 nl_pat = nla_nest_start(msg, i + 1);
7541                 if (!nl_pat)
7542                         return -ENOBUFS;
7543                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7544                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7545                             DIV_ROUND_UP(pat_len, 8),
7546                             rdev->wowlan->patterns[i].mask) ||
7547                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7548                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7549                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7550                                 rdev->wowlan->patterns[i].pkt_offset))
7551                         return -ENOBUFS;
7552                 nla_nest_end(msg, nl_pat);
7553         }
7554         nla_nest_end(msg, nl_pats);
7555
7556         return 0;
7557 }
7558
7559 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7560                                    struct cfg80211_wowlan_tcp *tcp)
7561 {
7562         struct nlattr *nl_tcp;
7563
7564         if (!tcp)
7565                 return 0;
7566
7567         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7568         if (!nl_tcp)
7569                 return -ENOBUFS;
7570
7571         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7572             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7573             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7574             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7575             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7576             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7577                     tcp->payload_len, tcp->payload) ||
7578             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7579                         tcp->data_interval) ||
7580             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7581                     tcp->wake_len, tcp->wake_data) ||
7582             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7583                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7584                 return -ENOBUFS;
7585
7586         if (tcp->payload_seq.len &&
7587             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7588                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7589                 return -ENOBUFS;
7590
7591         if (tcp->payload_tok.len &&
7592             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7593                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7594                     &tcp->payload_tok))
7595                 return -ENOBUFS;
7596
7597         nla_nest_end(msg, nl_tcp);
7598
7599         return 0;
7600 }
7601
7602 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7603 {
7604         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7605         struct sk_buff *msg;
7606         void *hdr;
7607         u32 size = NLMSG_DEFAULT_SIZE;
7608
7609         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7610             !rdev->wiphy.wowlan.tcp)
7611                 return -EOPNOTSUPP;
7612
7613         if (rdev->wowlan && rdev->wowlan->tcp) {
7614                 /* adjust size to have room for all the data */
7615                 size += rdev->wowlan->tcp->tokens_size +
7616                         rdev->wowlan->tcp->payload_len +
7617                         rdev->wowlan->tcp->wake_len +
7618                         rdev->wowlan->tcp->wake_len / 8;
7619         }
7620
7621         msg = nlmsg_new(size, GFP_KERNEL);
7622         if (!msg)
7623                 return -ENOMEM;
7624
7625         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7626                              NL80211_CMD_GET_WOWLAN);
7627         if (!hdr)
7628                 goto nla_put_failure;
7629
7630         if (rdev->wowlan) {
7631                 struct nlattr *nl_wowlan;
7632
7633                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7634                 if (!nl_wowlan)
7635                         goto nla_put_failure;
7636
7637                 if ((rdev->wowlan->any &&
7638                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7639                     (rdev->wowlan->disconnect &&
7640                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7641                     (rdev->wowlan->magic_pkt &&
7642                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7643                     (rdev->wowlan->gtk_rekey_failure &&
7644                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7645                     (rdev->wowlan->eap_identity_req &&
7646                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7647                     (rdev->wowlan->four_way_handshake &&
7648                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7649                     (rdev->wowlan->rfkill_release &&
7650                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7651                         goto nla_put_failure;
7652
7653                 if (nl80211_send_wowlan_patterns(msg, rdev))
7654                         goto nla_put_failure;
7655
7656                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7657                         goto nla_put_failure;
7658
7659                 nla_nest_end(msg, nl_wowlan);
7660         }
7661
7662         genlmsg_end(msg, hdr);
7663         return genlmsg_reply(msg, info);
7664
7665 nla_put_failure:
7666         nlmsg_free(msg);
7667         return -ENOBUFS;
7668 }
7669
7670 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7671                                     struct nlattr *attr,
7672                                     struct cfg80211_wowlan *trig)
7673 {
7674         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7675         struct cfg80211_wowlan_tcp *cfg;
7676         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7677         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7678         u32 size;
7679         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7680         int err, port;
7681
7682         if (!rdev->wiphy.wowlan.tcp)
7683                 return -EINVAL;
7684
7685         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7686                         nla_data(attr), nla_len(attr),
7687                         nl80211_wowlan_tcp_policy);
7688         if (err)
7689                 return err;
7690
7691         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7692             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7693             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7694             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7695             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7696             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7697             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7698             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7699                 return -EINVAL;
7700
7701         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7702         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7703                 return -EINVAL;
7704
7705         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7706                         rdev->wiphy.wowlan.tcp->data_interval_max ||
7707             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7708                 return -EINVAL;
7709
7710         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7711         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7712                 return -EINVAL;
7713
7714         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7715         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7716                 return -EINVAL;
7717
7718         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7719                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7720
7721                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7722                 tokens_size = tokln - sizeof(*tok);
7723
7724                 if (!tok->len || tokens_size % tok->len)
7725                         return -EINVAL;
7726                 if (!rdev->wiphy.wowlan.tcp->tok)
7727                         return -EINVAL;
7728                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7729                         return -EINVAL;
7730                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7731                         return -EINVAL;
7732                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7733                         return -EINVAL;
7734                 if (tok->offset + tok->len > data_size)
7735                         return -EINVAL;
7736         }
7737
7738         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7739                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7740                 if (!rdev->wiphy.wowlan.tcp->seq)
7741                         return -EINVAL;
7742                 if (seq->len == 0 || seq->len > 4)
7743                         return -EINVAL;
7744                 if (seq->len + seq->offset > data_size)
7745                         return -EINVAL;
7746         }
7747
7748         size = sizeof(*cfg);
7749         size += data_size;
7750         size += wake_size + wake_mask_size;
7751         size += tokens_size;
7752
7753         cfg = kzalloc(size, GFP_KERNEL);
7754         if (!cfg)
7755                 return -ENOMEM;
7756         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7757         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7758         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7759                ETH_ALEN);
7760         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7761                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7762         else
7763                 port = 0;
7764 #ifdef CONFIG_INET
7765         /* allocate a socket and port for it and use it */
7766         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7767                             IPPROTO_TCP, &cfg->sock, 1);
7768         if (err) {
7769                 kfree(cfg);
7770                 return err;
7771         }
7772         if (inet_csk_get_port(cfg->sock->sk, port)) {
7773                 sock_release(cfg->sock);
7774                 kfree(cfg);
7775                 return -EADDRINUSE;
7776         }
7777         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7778 #else
7779         if (!port) {
7780                 kfree(cfg);
7781                 return -EINVAL;
7782         }
7783         cfg->src_port = port;
7784 #endif
7785
7786         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7787         cfg->payload_len = data_size;
7788         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7789         memcpy((void *)cfg->payload,
7790                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7791                data_size);
7792         if (seq)
7793                 cfg->payload_seq = *seq;
7794         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7795         cfg->wake_len = wake_size;
7796         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7797         memcpy((void *)cfg->wake_data,
7798                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7799                wake_size);
7800         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7801                          data_size + wake_size;
7802         memcpy((void *)cfg->wake_mask,
7803                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7804                wake_mask_size);
7805         if (tok) {
7806                 cfg->tokens_size = tokens_size;
7807                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7808         }
7809
7810         trig->tcp = cfg;
7811
7812         return 0;
7813 }
7814
7815 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7816 {
7817         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7818         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7819         struct cfg80211_wowlan new_triggers = {};
7820         struct cfg80211_wowlan *ntrig;
7821         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7822         int err, i;
7823         bool prev_enabled = rdev->wowlan;
7824
7825         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7826             !rdev->wiphy.wowlan.tcp)
7827                 return -EOPNOTSUPP;
7828
7829         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7830                 cfg80211_rdev_free_wowlan(rdev);
7831                 rdev->wowlan = NULL;
7832                 goto set_wakeup;
7833         }
7834
7835         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7836                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7837                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7838                         nl80211_wowlan_policy);
7839         if (err)
7840                 return err;
7841
7842         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7843                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7844                         return -EINVAL;
7845                 new_triggers.any = true;
7846         }
7847
7848         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7849                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7850                         return -EINVAL;
7851                 new_triggers.disconnect = true;
7852         }
7853
7854         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7855                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7856                         return -EINVAL;
7857                 new_triggers.magic_pkt = true;
7858         }
7859
7860         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7861                 return -EINVAL;
7862
7863         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7864                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7865                         return -EINVAL;
7866                 new_triggers.gtk_rekey_failure = true;
7867         }
7868
7869         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7870                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7871                         return -EINVAL;
7872                 new_triggers.eap_identity_req = true;
7873         }
7874
7875         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7876                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7877                         return -EINVAL;
7878                 new_triggers.four_way_handshake = true;
7879         }
7880
7881         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7882                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7883                         return -EINVAL;
7884                 new_triggers.rfkill_release = true;
7885         }
7886
7887         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7888                 struct nlattr *pat;
7889                 int n_patterns = 0;
7890                 int rem, pat_len, mask_len, pkt_offset;
7891                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7892
7893                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7894                                     rem)
7895                         n_patterns++;
7896                 if (n_patterns > wowlan->n_patterns)
7897                         return -EINVAL;
7898
7899                 new_triggers.patterns = kcalloc(n_patterns,
7900                                                 sizeof(new_triggers.patterns[0]),
7901                                                 GFP_KERNEL);
7902                 if (!new_triggers.patterns)
7903                         return -ENOMEM;
7904
7905                 new_triggers.n_patterns = n_patterns;
7906                 i = 0;
7907
7908                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7909                                     rem) {
7910                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7911                                   nla_data(pat), nla_len(pat), NULL);
7912                         err = -EINVAL;
7913                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7914                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7915                                 goto error;
7916                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7917                         mask_len = DIV_ROUND_UP(pat_len, 8);
7918                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7919                             mask_len)
7920                                 goto error;
7921                         if (pat_len > wowlan->pattern_max_len ||
7922                             pat_len < wowlan->pattern_min_len)
7923                                 goto error;
7924
7925                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7926                                 pkt_offset = 0;
7927                         else
7928                                 pkt_offset = nla_get_u32(
7929                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7930                         if (pkt_offset > wowlan->max_pkt_offset)
7931                                 goto error;
7932                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7933
7934                         new_triggers.patterns[i].mask =
7935                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7936                         if (!new_triggers.patterns[i].mask) {
7937                                 err = -ENOMEM;
7938                                 goto error;
7939                         }
7940                         new_triggers.patterns[i].pattern =
7941                                 new_triggers.patterns[i].mask + mask_len;
7942                         memcpy(new_triggers.patterns[i].mask,
7943                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7944                                mask_len);
7945                         new_triggers.patterns[i].pattern_len = pat_len;
7946                         memcpy(new_triggers.patterns[i].pattern,
7947                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7948                                pat_len);
7949                         i++;
7950                 }
7951         }
7952
7953         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7954                 err = nl80211_parse_wowlan_tcp(
7955                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7956                         &new_triggers);
7957                 if (err)
7958                         goto error;
7959         }
7960
7961         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7962         if (!ntrig) {
7963                 err = -ENOMEM;
7964                 goto error;
7965         }
7966         cfg80211_rdev_free_wowlan(rdev);
7967         rdev->wowlan = ntrig;
7968
7969  set_wakeup:
7970         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7971                 rdev_set_wakeup(rdev, rdev->wowlan);
7972
7973         return 0;
7974  error:
7975         for (i = 0; i < new_triggers.n_patterns; i++)
7976                 kfree(new_triggers.patterns[i].mask);
7977         kfree(new_triggers.patterns);
7978         if (new_triggers.tcp && new_triggers.tcp->sock)
7979                 sock_release(new_triggers.tcp->sock);
7980         kfree(new_triggers.tcp);
7981         return err;
7982 }
7983 #endif
7984
7985 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7986 {
7987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7988         struct net_device *dev = info->user_ptr[1];
7989         struct wireless_dev *wdev = dev->ieee80211_ptr;
7990         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7991         struct cfg80211_gtk_rekey_data rekey_data;
7992         int err;
7993
7994         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7995                 return -EINVAL;
7996
7997         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7998                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7999                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8000                         nl80211_rekey_policy);
8001         if (err)
8002                 return err;
8003
8004         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8005                 return -ERANGE;
8006         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8007                 return -ERANGE;
8008         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8009                 return -ERANGE;
8010
8011         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8012                NL80211_KEK_LEN);
8013         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8014                NL80211_KCK_LEN);
8015         memcpy(rekey_data.replay_ctr,
8016                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8017                NL80211_REPLAY_CTR_LEN);
8018
8019         wdev_lock(wdev);
8020         if (!wdev->current_bss) {
8021                 err = -ENOTCONN;
8022                 goto out;
8023         }
8024
8025         if (!rdev->ops->set_rekey_data) {
8026                 err = -EOPNOTSUPP;
8027                 goto out;
8028         }
8029
8030         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8031  out:
8032         wdev_unlock(wdev);
8033         return err;
8034 }
8035
8036 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8037                                              struct genl_info *info)
8038 {
8039         struct net_device *dev = info->user_ptr[1];
8040         struct wireless_dev *wdev = dev->ieee80211_ptr;
8041
8042         if (wdev->iftype != NL80211_IFTYPE_AP &&
8043             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8044                 return -EINVAL;
8045
8046         if (wdev->ap_unexpected_nlportid)
8047                 return -EBUSY;
8048
8049         wdev->ap_unexpected_nlportid = info->snd_portid;
8050         return 0;
8051 }
8052
8053 static int nl80211_probe_client(struct sk_buff *skb,
8054                                 struct genl_info *info)
8055 {
8056         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8057         struct net_device *dev = info->user_ptr[1];
8058         struct wireless_dev *wdev = dev->ieee80211_ptr;
8059         struct sk_buff *msg;
8060         void *hdr;
8061         const u8 *addr;
8062         u64 cookie;
8063         int err;
8064
8065         if (wdev->iftype != NL80211_IFTYPE_AP &&
8066             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8067                 return -EOPNOTSUPP;
8068
8069         if (!info->attrs[NL80211_ATTR_MAC])
8070                 return -EINVAL;
8071
8072         if (!rdev->ops->probe_client)
8073                 return -EOPNOTSUPP;
8074
8075         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8076         if (!msg)
8077                 return -ENOMEM;
8078
8079         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8080                              NL80211_CMD_PROBE_CLIENT);
8081
8082         if (IS_ERR(hdr)) {
8083                 err = PTR_ERR(hdr);
8084                 goto free_msg;
8085         }
8086
8087         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8088
8089         err = rdev_probe_client(rdev, dev, addr, &cookie);
8090         if (err)
8091                 goto free_msg;
8092
8093         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8094                 goto nla_put_failure;
8095
8096         genlmsg_end(msg, hdr);
8097
8098         return genlmsg_reply(msg, info);
8099
8100  nla_put_failure:
8101         err = -ENOBUFS;
8102  free_msg:
8103         nlmsg_free(msg);
8104         return err;
8105 }
8106
8107 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8108 {
8109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8110         struct cfg80211_beacon_registration *reg, *nreg;
8111         int rv;
8112
8113         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8114                 return -EOPNOTSUPP;
8115
8116         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8117         if (!nreg)
8118                 return -ENOMEM;
8119
8120         /* First, check if already registered. */
8121         spin_lock_bh(&rdev->beacon_registrations_lock);
8122         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8123                 if (reg->nlportid == info->snd_portid) {
8124                         rv = -EALREADY;
8125                         goto out_err;
8126                 }
8127         }
8128         /* Add it to the list */
8129         nreg->nlportid = info->snd_portid;
8130         list_add(&nreg->list, &rdev->beacon_registrations);
8131
8132         spin_unlock_bh(&rdev->beacon_registrations_lock);
8133
8134         return 0;
8135 out_err:
8136         spin_unlock_bh(&rdev->beacon_registrations_lock);
8137         kfree(nreg);
8138         return rv;
8139 }
8140
8141 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8142 {
8143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8144         struct wireless_dev *wdev = info->user_ptr[1];
8145         int err;
8146
8147         if (!rdev->ops->start_p2p_device)
8148                 return -EOPNOTSUPP;
8149
8150         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8151                 return -EOPNOTSUPP;
8152
8153         if (wdev->p2p_started)
8154                 return 0;
8155
8156         mutex_lock(&rdev->devlist_mtx);
8157         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8158         mutex_unlock(&rdev->devlist_mtx);
8159         if (err)
8160                 return err;
8161
8162         err = rdev_start_p2p_device(rdev, wdev);
8163         if (err)
8164                 return err;
8165
8166         wdev->p2p_started = true;
8167         mutex_lock(&rdev->devlist_mtx);
8168         rdev->opencount++;
8169         mutex_unlock(&rdev->devlist_mtx);
8170
8171         return 0;
8172 }
8173
8174 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8175 {
8176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8177         struct wireless_dev *wdev = info->user_ptr[1];
8178
8179         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8180                 return -EOPNOTSUPP;
8181
8182         if (!rdev->ops->stop_p2p_device)
8183                 return -EOPNOTSUPP;
8184
8185         mutex_lock(&rdev->devlist_mtx);
8186         mutex_lock(&rdev->sched_scan_mtx);
8187         cfg80211_stop_p2p_device(rdev, wdev);
8188         mutex_unlock(&rdev->sched_scan_mtx);
8189         mutex_unlock(&rdev->devlist_mtx);
8190
8191         return 0;
8192 }
8193
8194 static int nl80211_get_protocol_features(struct sk_buff *skb,
8195                                          struct genl_info *info)
8196 {
8197         void *hdr;
8198         struct sk_buff *msg;
8199
8200         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8201         if (!msg)
8202                 return -ENOMEM;
8203
8204         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8205                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8206         if (!hdr)
8207                 goto nla_put_failure;
8208
8209         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8210                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8211                 goto nla_put_failure;
8212
8213         genlmsg_end(msg, hdr);
8214         return genlmsg_reply(msg, info);
8215
8216  nla_put_failure:
8217         kfree_skb(msg);
8218         return -ENOBUFS;
8219 }
8220
8221 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8222 {
8223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8224         struct cfg80211_update_ft_ies_params ft_params;
8225         struct net_device *dev = info->user_ptr[1];
8226
8227         if (!rdev->ops->update_ft_ies)
8228                 return -EOPNOTSUPP;
8229
8230         if (!info->attrs[NL80211_ATTR_MDID] ||
8231             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8232                 return -EINVAL;
8233
8234         memset(&ft_params, 0, sizeof(ft_params));
8235         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8236         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8237         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8238
8239         return rdev_update_ft_ies(rdev, dev, &ft_params);
8240 }
8241
8242 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8243                                        struct genl_info *info)
8244 {
8245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8246         struct wireless_dev *wdev = info->user_ptr[1];
8247         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8248         u16 duration;
8249         int ret;
8250
8251         if (!rdev->ops->crit_proto_start)
8252                 return -EOPNOTSUPP;
8253
8254         if (WARN_ON(!rdev->ops->crit_proto_stop))
8255                 return -EINVAL;
8256
8257         if (rdev->crit_proto_nlportid)
8258                 return -EBUSY;
8259
8260         /* determine protocol if provided */
8261         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8262                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8263
8264         if (proto >= NUM_NL80211_CRIT_PROTO)
8265                 return -EINVAL;
8266
8267         /* timeout must be provided */
8268         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8269                 return -EINVAL;
8270
8271         duration =
8272                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8273
8274         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8275                 return -ERANGE;
8276
8277         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8278         if (!ret)
8279                 rdev->crit_proto_nlportid = info->snd_portid;
8280
8281         return ret;
8282 }
8283
8284 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8285                                       struct genl_info *info)
8286 {
8287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8288         struct wireless_dev *wdev = info->user_ptr[1];
8289
8290         if (!rdev->ops->crit_proto_stop)
8291                 return -EOPNOTSUPP;
8292
8293         if (rdev->crit_proto_nlportid) {
8294                 rdev->crit_proto_nlportid = 0;
8295                 rdev_crit_proto_stop(rdev, wdev);
8296         }
8297         return 0;
8298 }
8299
8300 #define NL80211_FLAG_NEED_WIPHY         0x01
8301 #define NL80211_FLAG_NEED_NETDEV        0x02
8302 #define NL80211_FLAG_NEED_RTNL          0x04
8303 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8304 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8305                                          NL80211_FLAG_CHECK_NETDEV_UP)
8306 #define NL80211_FLAG_NEED_WDEV          0x10
8307 /* If a netdev is associated, it must be UP, P2P must be started */
8308 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8309                                          NL80211_FLAG_CHECK_NETDEV_UP)
8310
8311 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8312                             struct genl_info *info)
8313 {
8314         struct cfg80211_registered_device *rdev;
8315         struct wireless_dev *wdev;
8316         struct net_device *dev;
8317         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8318
8319         if (rtnl)
8320                 rtnl_lock();
8321
8322         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8323                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8324                 if (IS_ERR(rdev)) {
8325                         if (rtnl)
8326                                 rtnl_unlock();
8327                         return PTR_ERR(rdev);
8328                 }
8329                 info->user_ptr[0] = rdev;
8330         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8331                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8332                 mutex_lock(&cfg80211_mutex);
8333                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8334                                                   info->attrs);
8335                 if (IS_ERR(wdev)) {
8336                         mutex_unlock(&cfg80211_mutex);
8337                         if (rtnl)
8338                                 rtnl_unlock();
8339                         return PTR_ERR(wdev);
8340                 }
8341
8342                 dev = wdev->netdev;
8343                 rdev = wiphy_to_dev(wdev->wiphy);
8344
8345                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8346                         if (!dev) {
8347                                 mutex_unlock(&cfg80211_mutex);
8348                                 if (rtnl)
8349                                         rtnl_unlock();
8350                                 return -EINVAL;
8351                         }
8352
8353                         info->user_ptr[1] = dev;
8354                 } else {
8355                         info->user_ptr[1] = wdev;
8356                 }
8357
8358                 if (dev) {
8359                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8360                             !netif_running(dev)) {
8361                                 mutex_unlock(&cfg80211_mutex);
8362                                 if (rtnl)
8363                                         rtnl_unlock();
8364                                 return -ENETDOWN;
8365                         }
8366
8367                         dev_hold(dev);
8368                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8369                         if (!wdev->p2p_started) {
8370                                 mutex_unlock(&cfg80211_mutex);
8371                                 if (rtnl)
8372                                         rtnl_unlock();
8373                                 return -ENETDOWN;
8374                         }
8375                 }
8376
8377                 cfg80211_lock_rdev(rdev);
8378
8379                 mutex_unlock(&cfg80211_mutex);
8380
8381                 info->user_ptr[0] = rdev;
8382         }
8383
8384         return 0;
8385 }
8386
8387 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8388                               struct genl_info *info)
8389 {
8390         if (info->user_ptr[0])
8391                 cfg80211_unlock_rdev(info->user_ptr[0]);
8392         if (info->user_ptr[1]) {
8393                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8394                         struct wireless_dev *wdev = info->user_ptr[1];
8395
8396                         if (wdev->netdev)
8397                                 dev_put(wdev->netdev);
8398                 } else {
8399                         dev_put(info->user_ptr[1]);
8400                 }
8401         }
8402         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8403                 rtnl_unlock();
8404 }
8405
8406 static struct genl_ops nl80211_ops[] = {
8407         {
8408                 .cmd = NL80211_CMD_GET_WIPHY,
8409                 .doit = nl80211_get_wiphy,
8410                 .dumpit = nl80211_dump_wiphy,
8411                 .policy = nl80211_policy,
8412                 /* can be retrieved by unprivileged users */
8413                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
8414         },
8415         {
8416                 .cmd = NL80211_CMD_SET_WIPHY,
8417                 .doit = nl80211_set_wiphy,
8418                 .policy = nl80211_policy,
8419                 .flags = GENL_ADMIN_PERM,
8420                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8421         },
8422         {
8423                 .cmd = NL80211_CMD_GET_INTERFACE,
8424                 .doit = nl80211_get_interface,
8425                 .dumpit = nl80211_dump_interface,
8426                 .policy = nl80211_policy,
8427                 /* can be retrieved by unprivileged users */
8428                 .internal_flags = NL80211_FLAG_NEED_WDEV,
8429         },
8430         {
8431                 .cmd = NL80211_CMD_SET_INTERFACE,
8432                 .doit = nl80211_set_interface,
8433                 .policy = nl80211_policy,
8434                 .flags = GENL_ADMIN_PERM,
8435                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8436                                   NL80211_FLAG_NEED_RTNL,
8437         },
8438         {
8439                 .cmd = NL80211_CMD_NEW_INTERFACE,
8440                 .doit = nl80211_new_interface,
8441                 .policy = nl80211_policy,
8442                 .flags = GENL_ADMIN_PERM,
8443                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8444                                   NL80211_FLAG_NEED_RTNL,
8445         },
8446         {
8447                 .cmd = NL80211_CMD_DEL_INTERFACE,
8448                 .doit = nl80211_del_interface,
8449                 .policy = nl80211_policy,
8450                 .flags = GENL_ADMIN_PERM,
8451                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8452                                   NL80211_FLAG_NEED_RTNL,
8453         },
8454         {
8455                 .cmd = NL80211_CMD_GET_KEY,
8456                 .doit = nl80211_get_key,
8457                 .policy = nl80211_policy,
8458                 .flags = GENL_ADMIN_PERM,
8459                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8460                                   NL80211_FLAG_NEED_RTNL,
8461         },
8462         {
8463                 .cmd = NL80211_CMD_SET_KEY,
8464                 .doit = nl80211_set_key,
8465                 .policy = nl80211_policy,
8466                 .flags = GENL_ADMIN_PERM,
8467                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8468                                   NL80211_FLAG_NEED_RTNL,
8469         },
8470         {
8471                 .cmd = NL80211_CMD_NEW_KEY,
8472                 .doit = nl80211_new_key,
8473                 .policy = nl80211_policy,
8474                 .flags = GENL_ADMIN_PERM,
8475                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8476                                   NL80211_FLAG_NEED_RTNL,
8477         },
8478         {
8479                 .cmd = NL80211_CMD_DEL_KEY,
8480                 .doit = nl80211_del_key,
8481                 .policy = nl80211_policy,
8482                 .flags = GENL_ADMIN_PERM,
8483                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8484                                   NL80211_FLAG_NEED_RTNL,
8485         },
8486         {
8487                 .cmd = NL80211_CMD_SET_BEACON,
8488                 .policy = nl80211_policy,
8489                 .flags = GENL_ADMIN_PERM,
8490                 .doit = nl80211_set_beacon,
8491                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8492                                   NL80211_FLAG_NEED_RTNL,
8493         },
8494         {
8495                 .cmd = NL80211_CMD_START_AP,
8496                 .policy = nl80211_policy,
8497                 .flags = GENL_ADMIN_PERM,
8498                 .doit = nl80211_start_ap,
8499                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8500                                   NL80211_FLAG_NEED_RTNL,
8501         },
8502         {
8503                 .cmd = NL80211_CMD_STOP_AP,
8504                 .policy = nl80211_policy,
8505                 .flags = GENL_ADMIN_PERM,
8506                 .doit = nl80211_stop_ap,
8507                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8508                                   NL80211_FLAG_NEED_RTNL,
8509         },
8510         {
8511                 .cmd = NL80211_CMD_GET_STATION,
8512                 .doit = nl80211_get_station,
8513                 .dumpit = nl80211_dump_station,
8514                 .policy = nl80211_policy,
8515                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8516                                   NL80211_FLAG_NEED_RTNL,
8517         },
8518         {
8519                 .cmd = NL80211_CMD_SET_STATION,
8520                 .doit = nl80211_set_station,
8521                 .policy = nl80211_policy,
8522                 .flags = GENL_ADMIN_PERM,
8523                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8524                                   NL80211_FLAG_NEED_RTNL,
8525         },
8526         {
8527                 .cmd = NL80211_CMD_NEW_STATION,
8528                 .doit = nl80211_new_station,
8529                 .policy = nl80211_policy,
8530                 .flags = GENL_ADMIN_PERM,
8531                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8532                                   NL80211_FLAG_NEED_RTNL,
8533         },
8534         {
8535                 .cmd = NL80211_CMD_DEL_STATION,
8536                 .doit = nl80211_del_station,
8537                 .policy = nl80211_policy,
8538                 .flags = GENL_ADMIN_PERM,
8539                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8540                                   NL80211_FLAG_NEED_RTNL,
8541         },
8542         {
8543                 .cmd = NL80211_CMD_GET_MPATH,
8544                 .doit = nl80211_get_mpath,
8545                 .dumpit = nl80211_dump_mpath,
8546                 .policy = nl80211_policy,
8547                 .flags = GENL_ADMIN_PERM,
8548                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8549                                   NL80211_FLAG_NEED_RTNL,
8550         },
8551         {
8552                 .cmd = NL80211_CMD_SET_MPATH,
8553                 .doit = nl80211_set_mpath,
8554                 .policy = nl80211_policy,
8555                 .flags = GENL_ADMIN_PERM,
8556                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8557                                   NL80211_FLAG_NEED_RTNL,
8558         },
8559         {
8560                 .cmd = NL80211_CMD_NEW_MPATH,
8561                 .doit = nl80211_new_mpath,
8562                 .policy = nl80211_policy,
8563                 .flags = GENL_ADMIN_PERM,
8564                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8565                                   NL80211_FLAG_NEED_RTNL,
8566         },
8567         {
8568                 .cmd = NL80211_CMD_DEL_MPATH,
8569                 .doit = nl80211_del_mpath,
8570                 .policy = nl80211_policy,
8571                 .flags = GENL_ADMIN_PERM,
8572                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8573                                   NL80211_FLAG_NEED_RTNL,
8574         },
8575         {
8576                 .cmd = NL80211_CMD_SET_BSS,
8577                 .doit = nl80211_set_bss,
8578                 .policy = nl80211_policy,
8579                 .flags = GENL_ADMIN_PERM,
8580                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8581                                   NL80211_FLAG_NEED_RTNL,
8582         },
8583         {
8584                 .cmd = NL80211_CMD_GET_REG,
8585                 .doit = nl80211_get_reg,
8586                 .policy = nl80211_policy,
8587                 /* can be retrieved by unprivileged users */
8588         },
8589         {
8590                 .cmd = NL80211_CMD_SET_REG,
8591                 .doit = nl80211_set_reg,
8592                 .policy = nl80211_policy,
8593                 .flags = GENL_ADMIN_PERM,
8594         },
8595         {
8596                 .cmd = NL80211_CMD_REQ_SET_REG,
8597                 .doit = nl80211_req_set_reg,
8598                 .policy = nl80211_policy,
8599                 .flags = GENL_ADMIN_PERM,
8600         },
8601         {
8602                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8603                 .doit = nl80211_get_mesh_config,
8604                 .policy = nl80211_policy,
8605                 /* can be retrieved by unprivileged users */
8606                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8607                                   NL80211_FLAG_NEED_RTNL,
8608         },
8609         {
8610                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8611                 .doit = nl80211_update_mesh_config,
8612                 .policy = nl80211_policy,
8613                 .flags = GENL_ADMIN_PERM,
8614                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8615                                   NL80211_FLAG_NEED_RTNL,
8616         },
8617         {
8618                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8619                 .doit = nl80211_trigger_scan,
8620                 .policy = nl80211_policy,
8621                 .flags = GENL_ADMIN_PERM,
8622                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8623                                   NL80211_FLAG_NEED_RTNL,
8624         },
8625         {
8626                 .cmd = NL80211_CMD_GET_SCAN,
8627                 .policy = nl80211_policy,
8628                 .dumpit = nl80211_dump_scan,
8629         },
8630         {
8631                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8632                 .doit = nl80211_start_sched_scan,
8633                 .policy = nl80211_policy,
8634                 .flags = GENL_ADMIN_PERM,
8635                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8636                                   NL80211_FLAG_NEED_RTNL,
8637         },
8638         {
8639                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8640                 .doit = nl80211_stop_sched_scan,
8641                 .policy = nl80211_policy,
8642                 .flags = GENL_ADMIN_PERM,
8643                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8644                                   NL80211_FLAG_NEED_RTNL,
8645         },
8646         {
8647                 .cmd = NL80211_CMD_AUTHENTICATE,
8648                 .doit = nl80211_authenticate,
8649                 .policy = nl80211_policy,
8650                 .flags = GENL_ADMIN_PERM,
8651                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8652                                   NL80211_FLAG_NEED_RTNL,
8653         },
8654         {
8655                 .cmd = NL80211_CMD_ASSOCIATE,
8656                 .doit = nl80211_associate,
8657                 .policy = nl80211_policy,
8658                 .flags = GENL_ADMIN_PERM,
8659                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8660                                   NL80211_FLAG_NEED_RTNL,
8661         },
8662         {
8663                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8664                 .doit = nl80211_deauthenticate,
8665                 .policy = nl80211_policy,
8666                 .flags = GENL_ADMIN_PERM,
8667                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8668                                   NL80211_FLAG_NEED_RTNL,
8669         },
8670         {
8671                 .cmd = NL80211_CMD_DISASSOCIATE,
8672                 .doit = nl80211_disassociate,
8673                 .policy = nl80211_policy,
8674                 .flags = GENL_ADMIN_PERM,
8675                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8676                                   NL80211_FLAG_NEED_RTNL,
8677         },
8678         {
8679                 .cmd = NL80211_CMD_JOIN_IBSS,
8680                 .doit = nl80211_join_ibss,
8681                 .policy = nl80211_policy,
8682                 .flags = GENL_ADMIN_PERM,
8683                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8684                                   NL80211_FLAG_NEED_RTNL,
8685         },
8686         {
8687                 .cmd = NL80211_CMD_LEAVE_IBSS,
8688                 .doit = nl80211_leave_ibss,
8689                 .policy = nl80211_policy,
8690                 .flags = GENL_ADMIN_PERM,
8691                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8692                                   NL80211_FLAG_NEED_RTNL,
8693         },
8694 #ifdef CONFIG_NL80211_TESTMODE
8695         {
8696                 .cmd = NL80211_CMD_TESTMODE,
8697                 .doit = nl80211_testmode_do,
8698                 .dumpit = nl80211_testmode_dump,
8699                 .policy = nl80211_policy,
8700                 .flags = GENL_ADMIN_PERM,
8701                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8702                                   NL80211_FLAG_NEED_RTNL,
8703         },
8704 #endif
8705         {
8706                 .cmd = NL80211_CMD_CONNECT,
8707                 .doit = nl80211_connect,
8708                 .policy = nl80211_policy,
8709                 .flags = GENL_ADMIN_PERM,
8710                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8711                                   NL80211_FLAG_NEED_RTNL,
8712         },
8713         {
8714                 .cmd = NL80211_CMD_DISCONNECT,
8715                 .doit = nl80211_disconnect,
8716                 .policy = nl80211_policy,
8717                 .flags = GENL_ADMIN_PERM,
8718                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8719                                   NL80211_FLAG_NEED_RTNL,
8720         },
8721         {
8722                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8723                 .doit = nl80211_wiphy_netns,
8724                 .policy = nl80211_policy,
8725                 .flags = GENL_ADMIN_PERM,
8726                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8727                                   NL80211_FLAG_NEED_RTNL,
8728         },
8729         {
8730                 .cmd = NL80211_CMD_GET_SURVEY,
8731                 .policy = nl80211_policy,
8732                 .dumpit = nl80211_dump_survey,
8733         },
8734         {
8735                 .cmd = NL80211_CMD_SET_PMKSA,
8736                 .doit = nl80211_setdel_pmksa,
8737                 .policy = nl80211_policy,
8738                 .flags = GENL_ADMIN_PERM,
8739                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8740                                   NL80211_FLAG_NEED_RTNL,
8741         },
8742         {
8743                 .cmd = NL80211_CMD_DEL_PMKSA,
8744                 .doit = nl80211_setdel_pmksa,
8745                 .policy = nl80211_policy,
8746                 .flags = GENL_ADMIN_PERM,
8747                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8748                                   NL80211_FLAG_NEED_RTNL,
8749         },
8750         {
8751                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8752                 .doit = nl80211_flush_pmksa,
8753                 .policy = nl80211_policy,
8754                 .flags = GENL_ADMIN_PERM,
8755                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8756                                   NL80211_FLAG_NEED_RTNL,
8757         },
8758         {
8759                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8760                 .doit = nl80211_remain_on_channel,
8761                 .policy = nl80211_policy,
8762                 .flags = GENL_ADMIN_PERM,
8763                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8764                                   NL80211_FLAG_NEED_RTNL,
8765         },
8766         {
8767                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8768                 .doit = nl80211_cancel_remain_on_channel,
8769                 .policy = nl80211_policy,
8770                 .flags = GENL_ADMIN_PERM,
8771                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8772                                   NL80211_FLAG_NEED_RTNL,
8773         },
8774         {
8775                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8776                 .doit = nl80211_set_tx_bitrate_mask,
8777                 .policy = nl80211_policy,
8778                 .flags = GENL_ADMIN_PERM,
8779                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8780                                   NL80211_FLAG_NEED_RTNL,
8781         },
8782         {
8783                 .cmd = NL80211_CMD_REGISTER_FRAME,
8784                 .doit = nl80211_register_mgmt,
8785                 .policy = nl80211_policy,
8786                 .flags = GENL_ADMIN_PERM,
8787                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8788                                   NL80211_FLAG_NEED_RTNL,
8789         },
8790         {
8791                 .cmd = NL80211_CMD_FRAME,
8792                 .doit = nl80211_tx_mgmt,
8793                 .policy = nl80211_policy,
8794                 .flags = GENL_ADMIN_PERM,
8795                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8796                                   NL80211_FLAG_NEED_RTNL,
8797         },
8798         {
8799                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8800                 .doit = nl80211_tx_mgmt_cancel_wait,
8801                 .policy = nl80211_policy,
8802                 .flags = GENL_ADMIN_PERM,
8803                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8804                                   NL80211_FLAG_NEED_RTNL,
8805         },
8806         {
8807                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8808                 .doit = nl80211_set_power_save,
8809                 .policy = nl80211_policy,
8810                 .flags = GENL_ADMIN_PERM,
8811                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8812                                   NL80211_FLAG_NEED_RTNL,
8813         },
8814         {
8815                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8816                 .doit = nl80211_get_power_save,
8817                 .policy = nl80211_policy,
8818                 /* can be retrieved by unprivileged users */
8819                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8820                                   NL80211_FLAG_NEED_RTNL,
8821         },
8822         {
8823                 .cmd = NL80211_CMD_SET_CQM,
8824                 .doit = nl80211_set_cqm,
8825                 .policy = nl80211_policy,
8826                 .flags = GENL_ADMIN_PERM,
8827                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8828                                   NL80211_FLAG_NEED_RTNL,
8829         },
8830         {
8831                 .cmd = NL80211_CMD_SET_CHANNEL,
8832                 .doit = nl80211_set_channel,
8833                 .policy = nl80211_policy,
8834                 .flags = GENL_ADMIN_PERM,
8835                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8836                                   NL80211_FLAG_NEED_RTNL,
8837         },
8838         {
8839                 .cmd = NL80211_CMD_SET_WDS_PEER,
8840                 .doit = nl80211_set_wds_peer,
8841                 .policy = nl80211_policy,
8842                 .flags = GENL_ADMIN_PERM,
8843                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8844                                   NL80211_FLAG_NEED_RTNL,
8845         },
8846         {
8847                 .cmd = NL80211_CMD_JOIN_MESH,
8848                 .doit = nl80211_join_mesh,
8849                 .policy = nl80211_policy,
8850                 .flags = GENL_ADMIN_PERM,
8851                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8852                                   NL80211_FLAG_NEED_RTNL,
8853         },
8854         {
8855                 .cmd = NL80211_CMD_LEAVE_MESH,
8856                 .doit = nl80211_leave_mesh,
8857                 .policy = nl80211_policy,
8858                 .flags = GENL_ADMIN_PERM,
8859                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8860                                   NL80211_FLAG_NEED_RTNL,
8861         },
8862 #ifdef CONFIG_PM
8863         {
8864                 .cmd = NL80211_CMD_GET_WOWLAN,
8865                 .doit = nl80211_get_wowlan,
8866                 .policy = nl80211_policy,
8867                 /* can be retrieved by unprivileged users */
8868                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8869                                   NL80211_FLAG_NEED_RTNL,
8870         },
8871         {
8872                 .cmd = NL80211_CMD_SET_WOWLAN,
8873                 .doit = nl80211_set_wowlan,
8874                 .policy = nl80211_policy,
8875                 .flags = GENL_ADMIN_PERM,
8876                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8877                                   NL80211_FLAG_NEED_RTNL,
8878         },
8879 #endif
8880         {
8881                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8882                 .doit = nl80211_set_rekey_data,
8883                 .policy = nl80211_policy,
8884                 .flags = GENL_ADMIN_PERM,
8885                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8886                                   NL80211_FLAG_NEED_RTNL,
8887         },
8888         {
8889                 .cmd = NL80211_CMD_TDLS_MGMT,
8890                 .doit = nl80211_tdls_mgmt,
8891                 .policy = nl80211_policy,
8892                 .flags = GENL_ADMIN_PERM,
8893                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8894                                   NL80211_FLAG_NEED_RTNL,
8895         },
8896         {
8897                 .cmd = NL80211_CMD_TDLS_OPER,
8898                 .doit = nl80211_tdls_oper,
8899                 .policy = nl80211_policy,
8900                 .flags = GENL_ADMIN_PERM,
8901                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8902                                   NL80211_FLAG_NEED_RTNL,
8903         },
8904         {
8905                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8906                 .doit = nl80211_register_unexpected_frame,
8907                 .policy = nl80211_policy,
8908                 .flags = GENL_ADMIN_PERM,
8909                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8910                                   NL80211_FLAG_NEED_RTNL,
8911         },
8912         {
8913                 .cmd = NL80211_CMD_PROBE_CLIENT,
8914                 .doit = nl80211_probe_client,
8915                 .policy = nl80211_policy,
8916                 .flags = GENL_ADMIN_PERM,
8917                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8918                                   NL80211_FLAG_NEED_RTNL,
8919         },
8920         {
8921                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8922                 .doit = nl80211_register_beacons,
8923                 .policy = nl80211_policy,
8924                 .flags = GENL_ADMIN_PERM,
8925                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8926                                   NL80211_FLAG_NEED_RTNL,
8927         },
8928         {
8929                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8930                 .doit = nl80211_set_noack_map,
8931                 .policy = nl80211_policy,
8932                 .flags = GENL_ADMIN_PERM,
8933                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8934                                   NL80211_FLAG_NEED_RTNL,
8935         },
8936         {
8937                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8938                 .doit = nl80211_start_p2p_device,
8939                 .policy = nl80211_policy,
8940                 .flags = GENL_ADMIN_PERM,
8941                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8942                                   NL80211_FLAG_NEED_RTNL,
8943         },
8944         {
8945                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8946                 .doit = nl80211_stop_p2p_device,
8947                 .policy = nl80211_policy,
8948                 .flags = GENL_ADMIN_PERM,
8949                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8950                                   NL80211_FLAG_NEED_RTNL,
8951         },
8952         {
8953                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8954                 .doit = nl80211_set_mcast_rate,
8955                 .policy = nl80211_policy,
8956                 .flags = GENL_ADMIN_PERM,
8957                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8958                                   NL80211_FLAG_NEED_RTNL,
8959         },
8960         {
8961                 .cmd = NL80211_CMD_SET_MAC_ACL,
8962                 .doit = nl80211_set_mac_acl,
8963                 .policy = nl80211_policy,
8964                 .flags = GENL_ADMIN_PERM,
8965                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8966                                   NL80211_FLAG_NEED_RTNL,
8967         },
8968         {
8969                 .cmd = NL80211_CMD_RADAR_DETECT,
8970                 .doit = nl80211_start_radar_detection,
8971                 .policy = nl80211_policy,
8972                 .flags = GENL_ADMIN_PERM,
8973                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8974                                   NL80211_FLAG_NEED_RTNL,
8975         },
8976         {
8977                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8978                 .doit = nl80211_get_protocol_features,
8979                 .policy = nl80211_policy,
8980         },
8981         {
8982                 .cmd = NL80211_CMD_UPDATE_FT_IES,
8983                 .doit = nl80211_update_ft_ies,
8984                 .policy = nl80211_policy,
8985                 .flags = GENL_ADMIN_PERM,
8986                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8987                                   NL80211_FLAG_NEED_RTNL,
8988         },
8989         {
8990                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
8991                 .doit = nl80211_crit_protocol_start,
8992                 .policy = nl80211_policy,
8993                 .flags = GENL_ADMIN_PERM,
8994                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8995                                   NL80211_FLAG_NEED_RTNL,
8996         },
8997         {
8998                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
8999                 .doit = nl80211_crit_protocol_stop,
9000                 .policy = nl80211_policy,
9001                 .flags = GENL_ADMIN_PERM,
9002                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9003                                   NL80211_FLAG_NEED_RTNL,
9004         }
9005 };
9006
9007 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9008         .name = "mlme",
9009 };
9010
9011 /* multicast groups */
9012 static struct genl_multicast_group nl80211_config_mcgrp = {
9013         .name = "config",
9014 };
9015 static struct genl_multicast_group nl80211_scan_mcgrp = {
9016         .name = "scan",
9017 };
9018 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9019         .name = "regulatory",
9020 };
9021
9022 /* notification functions */
9023
9024 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9025 {
9026         struct sk_buff *msg;
9027
9028         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9029         if (!msg)
9030                 return;
9031
9032         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
9033                                false, NULL, NULL, NULL) < 0) {
9034                 nlmsg_free(msg);
9035                 return;
9036         }
9037
9038         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9039                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9040 }
9041
9042 static int nl80211_add_scan_req(struct sk_buff *msg,
9043                                 struct cfg80211_registered_device *rdev)
9044 {
9045         struct cfg80211_scan_request *req = rdev->scan_req;
9046         struct nlattr *nest;
9047         int i;
9048
9049         lockdep_assert_held(&rdev->sched_scan_mtx);
9050
9051         if (WARN_ON(!req))
9052                 return 0;
9053
9054         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9055         if (!nest)
9056                 goto nla_put_failure;
9057         for (i = 0; i < req->n_ssids; i++) {
9058                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9059                         goto nla_put_failure;
9060         }
9061         nla_nest_end(msg, nest);
9062
9063         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9064         if (!nest)
9065                 goto nla_put_failure;
9066         for (i = 0; i < req->n_channels; i++) {
9067                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9068                         goto nla_put_failure;
9069         }
9070         nla_nest_end(msg, nest);
9071
9072         if (req->ie &&
9073             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9074                 goto nla_put_failure;
9075
9076         if (req->flags)
9077                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9078
9079         return 0;
9080  nla_put_failure:
9081         return -ENOBUFS;
9082 }
9083
9084 static int nl80211_send_scan_msg(struct sk_buff *msg,
9085                                  struct cfg80211_registered_device *rdev,
9086                                  struct wireless_dev *wdev,
9087                                  u32 portid, u32 seq, int flags,
9088                                  u32 cmd)
9089 {
9090         void *hdr;
9091
9092         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9093         if (!hdr)
9094                 return -1;
9095
9096         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9097             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9098                                          wdev->netdev->ifindex)) ||
9099             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9100                 goto nla_put_failure;
9101
9102         /* ignore errors and send incomplete event anyway */
9103         nl80211_add_scan_req(msg, rdev);
9104
9105         return genlmsg_end(msg, hdr);
9106
9107  nla_put_failure:
9108         genlmsg_cancel(msg, hdr);
9109         return -EMSGSIZE;
9110 }
9111
9112 static int
9113 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9114                             struct cfg80211_registered_device *rdev,
9115                             struct net_device *netdev,
9116                             u32 portid, u32 seq, int flags, u32 cmd)
9117 {
9118         void *hdr;
9119
9120         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9121         if (!hdr)
9122                 return -1;
9123
9124         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9125             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9126                 goto nla_put_failure;
9127
9128         return genlmsg_end(msg, hdr);
9129
9130  nla_put_failure:
9131         genlmsg_cancel(msg, hdr);
9132         return -EMSGSIZE;
9133 }
9134
9135 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9136                              struct wireless_dev *wdev)
9137 {
9138         struct sk_buff *msg;
9139
9140         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9141         if (!msg)
9142                 return;
9143
9144         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9145                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9146                 nlmsg_free(msg);
9147                 return;
9148         }
9149
9150         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9151                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9152 }
9153
9154 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9155                             struct wireless_dev *wdev)
9156 {
9157         struct sk_buff *msg;
9158
9159         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9160         if (!msg)
9161                 return;
9162
9163         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9164                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9165                 nlmsg_free(msg);
9166                 return;
9167         }
9168
9169         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9170                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9171 }
9172
9173 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9174                                struct wireless_dev *wdev)
9175 {
9176         struct sk_buff *msg;
9177
9178         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9179         if (!msg)
9180                 return;
9181
9182         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9183                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9184                 nlmsg_free(msg);
9185                 return;
9186         }
9187
9188         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9189                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9190 }
9191
9192 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9193                                      struct net_device *netdev)
9194 {
9195         struct sk_buff *msg;
9196
9197         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9198         if (!msg)
9199                 return;
9200
9201         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9202                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9203                 nlmsg_free(msg);
9204                 return;
9205         }
9206
9207         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9208                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9209 }
9210
9211 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9212                              struct net_device *netdev, u32 cmd)
9213 {
9214         struct sk_buff *msg;
9215
9216         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9217         if (!msg)
9218                 return;
9219
9220         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9221                 nlmsg_free(msg);
9222                 return;
9223         }
9224
9225         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9226                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9227 }
9228
9229 /*
9230  * This can happen on global regulatory changes or device specific settings
9231  * based on custom world regulatory domains.
9232  */
9233 void nl80211_send_reg_change_event(struct regulatory_request *request)
9234 {
9235         struct sk_buff *msg;
9236         void *hdr;
9237
9238         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9239         if (!msg)
9240                 return;
9241
9242         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9243         if (!hdr) {
9244                 nlmsg_free(msg);
9245                 return;
9246         }
9247
9248         /* Userspace can always count this one always being set */
9249         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9250                 goto nla_put_failure;
9251
9252         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9253                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9254                                NL80211_REGDOM_TYPE_WORLD))
9255                         goto nla_put_failure;
9256         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9257                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9258                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9259                         goto nla_put_failure;
9260         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9261                    request->intersect) {
9262                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9263                                NL80211_REGDOM_TYPE_INTERSECTION))
9264                         goto nla_put_failure;
9265         } else {
9266                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9267                                NL80211_REGDOM_TYPE_COUNTRY) ||
9268                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9269                                    request->alpha2))
9270                         goto nla_put_failure;
9271         }
9272
9273         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9274             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9275                 goto nla_put_failure;
9276
9277         genlmsg_end(msg, hdr);
9278
9279         rcu_read_lock();
9280         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9281                                 GFP_ATOMIC);
9282         rcu_read_unlock();
9283
9284         return;
9285
9286 nla_put_failure:
9287         genlmsg_cancel(msg, hdr);
9288         nlmsg_free(msg);
9289 }
9290
9291 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9292                                     struct net_device *netdev,
9293                                     const u8 *buf, size_t len,
9294                                     enum nl80211_commands cmd, gfp_t gfp)
9295 {
9296         struct sk_buff *msg;
9297         void *hdr;
9298
9299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9300         if (!msg)
9301                 return;
9302
9303         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9304         if (!hdr) {
9305                 nlmsg_free(msg);
9306                 return;
9307         }
9308
9309         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9310             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9311             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9312                 goto nla_put_failure;
9313
9314         genlmsg_end(msg, hdr);
9315
9316         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9317                                 nl80211_mlme_mcgrp.id, gfp);
9318         return;
9319
9320  nla_put_failure:
9321         genlmsg_cancel(msg, hdr);
9322         nlmsg_free(msg);
9323 }
9324
9325 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9326                           struct net_device *netdev, const u8 *buf,
9327                           size_t len, gfp_t gfp)
9328 {
9329         nl80211_send_mlme_event(rdev, netdev, buf, len,
9330                                 NL80211_CMD_AUTHENTICATE, gfp);
9331 }
9332
9333 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9334                            struct net_device *netdev, const u8 *buf,
9335                            size_t len, gfp_t gfp)
9336 {
9337         nl80211_send_mlme_event(rdev, netdev, buf, len,
9338                                 NL80211_CMD_ASSOCIATE, gfp);
9339 }
9340
9341 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9342                          struct net_device *netdev, const u8 *buf,
9343                          size_t len, gfp_t gfp)
9344 {
9345         nl80211_send_mlme_event(rdev, netdev, buf, len,
9346                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9347 }
9348
9349 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9350                            struct net_device *netdev, const u8 *buf,
9351                            size_t len, gfp_t gfp)
9352 {
9353         nl80211_send_mlme_event(rdev, netdev, buf, len,
9354                                 NL80211_CMD_DISASSOCIATE, gfp);
9355 }
9356
9357 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
9358                                  size_t len)
9359 {
9360         struct wireless_dev *wdev = dev->ieee80211_ptr;
9361         struct wiphy *wiphy = wdev->wiphy;
9362         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9363
9364         trace_cfg80211_send_unprot_deauth(dev);
9365         nl80211_send_mlme_event(rdev, dev, buf, len,
9366                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
9367 }
9368 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
9369
9370 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
9371                                    size_t len)
9372 {
9373         struct wireless_dev *wdev = dev->ieee80211_ptr;
9374         struct wiphy *wiphy = wdev->wiphy;
9375         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9376
9377         trace_cfg80211_send_unprot_disassoc(dev);
9378         nl80211_send_mlme_event(rdev, dev, buf, len,
9379                                 NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
9380 }
9381 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
9382
9383 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9384                                       struct net_device *netdev, int cmd,
9385                                       const u8 *addr, gfp_t gfp)
9386 {
9387         struct sk_buff *msg;
9388         void *hdr;
9389
9390         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9391         if (!msg)
9392                 return;
9393
9394         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9395         if (!hdr) {
9396                 nlmsg_free(msg);
9397                 return;
9398         }
9399
9400         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9401             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9402             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9403             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9404                 goto nla_put_failure;
9405
9406         genlmsg_end(msg, hdr);
9407
9408         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9409                                 nl80211_mlme_mcgrp.id, gfp);
9410         return;
9411
9412  nla_put_failure:
9413         genlmsg_cancel(msg, hdr);
9414         nlmsg_free(msg);
9415 }
9416
9417 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9418                                struct net_device *netdev, const u8 *addr,
9419                                gfp_t gfp)
9420 {
9421         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9422                                   addr, gfp);
9423 }
9424
9425 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9426                                 struct net_device *netdev, const u8 *addr,
9427                                 gfp_t gfp)
9428 {
9429         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9430                                   addr, gfp);
9431 }
9432
9433 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9434                                  struct net_device *netdev, const u8 *bssid,
9435                                  const u8 *req_ie, size_t req_ie_len,
9436                                  const u8 *resp_ie, size_t resp_ie_len,
9437                                  u16 status, gfp_t gfp)
9438 {
9439         struct sk_buff *msg;
9440         void *hdr;
9441
9442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9443         if (!msg)
9444                 return;
9445
9446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9447         if (!hdr) {
9448                 nlmsg_free(msg);
9449                 return;
9450         }
9451
9452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9453             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9454             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9455             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9456             (req_ie &&
9457              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9458             (resp_ie &&
9459              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9460                 goto nla_put_failure;
9461
9462         genlmsg_end(msg, hdr);
9463
9464         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9465                                 nl80211_mlme_mcgrp.id, gfp);
9466         return;
9467
9468  nla_put_failure:
9469         genlmsg_cancel(msg, hdr);
9470         nlmsg_free(msg);
9471
9472 }
9473
9474 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9475                          struct net_device *netdev, const u8 *bssid,
9476                          const u8 *req_ie, size_t req_ie_len,
9477                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9478 {
9479         struct sk_buff *msg;
9480         void *hdr;
9481
9482         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9483         if (!msg)
9484                 return;
9485
9486         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9487         if (!hdr) {
9488                 nlmsg_free(msg);
9489                 return;
9490         }
9491
9492         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9493             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9494             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9495             (req_ie &&
9496              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9497             (resp_ie &&
9498              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9499                 goto nla_put_failure;
9500
9501         genlmsg_end(msg, hdr);
9502
9503         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9504                                 nl80211_mlme_mcgrp.id, gfp);
9505         return;
9506
9507  nla_put_failure:
9508         genlmsg_cancel(msg, hdr);
9509         nlmsg_free(msg);
9510
9511 }
9512
9513 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9514                                struct net_device *netdev, u16 reason,
9515                                const u8 *ie, size_t ie_len, bool from_ap)
9516 {
9517         struct sk_buff *msg;
9518         void *hdr;
9519
9520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9521         if (!msg)
9522                 return;
9523
9524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9525         if (!hdr) {
9526                 nlmsg_free(msg);
9527                 return;
9528         }
9529
9530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9531             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9532             (from_ap && reason &&
9533              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9534             (from_ap &&
9535              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9536             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9537                 goto nla_put_failure;
9538
9539         genlmsg_end(msg, hdr);
9540
9541         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9542                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9543         return;
9544
9545  nla_put_failure:
9546         genlmsg_cancel(msg, hdr);
9547         nlmsg_free(msg);
9548
9549 }
9550
9551 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9552                              struct net_device *netdev, const u8 *bssid,
9553                              gfp_t gfp)
9554 {
9555         struct sk_buff *msg;
9556         void *hdr;
9557
9558         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9559         if (!msg)
9560                 return;
9561
9562         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9563         if (!hdr) {
9564                 nlmsg_free(msg);
9565                 return;
9566         }
9567
9568         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9569             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9570             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9571                 goto nla_put_failure;
9572
9573         genlmsg_end(msg, hdr);
9574
9575         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9576                                 nl80211_mlme_mcgrp.id, gfp);
9577         return;
9578
9579  nla_put_failure:
9580         genlmsg_cancel(msg, hdr);
9581         nlmsg_free(msg);
9582 }
9583
9584 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9585                                         const u8* ie, u8 ie_len, gfp_t gfp)
9586 {
9587         struct wireless_dev *wdev = dev->ieee80211_ptr;
9588         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9589         struct sk_buff *msg;
9590         void *hdr;
9591
9592         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9593                 return;
9594
9595         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9596
9597         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9598         if (!msg)
9599                 return;
9600
9601         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9602         if (!hdr) {
9603                 nlmsg_free(msg);
9604                 return;
9605         }
9606
9607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9608             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9609             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9610             (ie_len && ie &&
9611              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9612                 goto nla_put_failure;
9613
9614         genlmsg_end(msg, hdr);
9615
9616         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9617                                 nl80211_mlme_mcgrp.id, gfp);
9618         return;
9619
9620  nla_put_failure:
9621         genlmsg_cancel(msg, hdr);
9622         nlmsg_free(msg);
9623 }
9624 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9625
9626 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9627                                  struct net_device *netdev, const u8 *addr,
9628                                  enum nl80211_key_type key_type, int key_id,
9629                                  const u8 *tsc, gfp_t gfp)
9630 {
9631         struct sk_buff *msg;
9632         void *hdr;
9633
9634         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9635         if (!msg)
9636                 return;
9637
9638         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9639         if (!hdr) {
9640                 nlmsg_free(msg);
9641                 return;
9642         }
9643
9644         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9645             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9646             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9647             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9648             (key_id != -1 &&
9649              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9650             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9651                 goto nla_put_failure;
9652
9653         genlmsg_end(msg, hdr);
9654
9655         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9656                                 nl80211_mlme_mcgrp.id, gfp);
9657         return;
9658
9659  nla_put_failure:
9660         genlmsg_cancel(msg, hdr);
9661         nlmsg_free(msg);
9662 }
9663
9664 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9665                                     struct ieee80211_channel *channel_before,
9666                                     struct ieee80211_channel *channel_after)
9667 {
9668         struct sk_buff *msg;
9669         void *hdr;
9670         struct nlattr *nl_freq;
9671
9672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9673         if (!msg)
9674                 return;
9675
9676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9677         if (!hdr) {
9678                 nlmsg_free(msg);
9679                 return;
9680         }
9681
9682         /*
9683          * Since we are applying the beacon hint to a wiphy we know its
9684          * wiphy_idx is valid
9685          */
9686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9687                 goto nla_put_failure;
9688
9689         /* Before */
9690         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9691         if (!nl_freq)
9692                 goto nla_put_failure;
9693         if (nl80211_msg_put_channel(msg, channel_before, false))
9694                 goto nla_put_failure;
9695         nla_nest_end(msg, nl_freq);
9696
9697         /* After */
9698         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9699         if (!nl_freq)
9700                 goto nla_put_failure;
9701         if (nl80211_msg_put_channel(msg, channel_after, false))
9702                 goto nla_put_failure;
9703         nla_nest_end(msg, nl_freq);
9704
9705         genlmsg_end(msg, hdr);
9706
9707         rcu_read_lock();
9708         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9709                                 GFP_ATOMIC);
9710         rcu_read_unlock();
9711
9712         return;
9713
9714 nla_put_failure:
9715         genlmsg_cancel(msg, hdr);
9716         nlmsg_free(msg);
9717 }
9718
9719 static void nl80211_send_remain_on_chan_event(
9720         int cmd, struct cfg80211_registered_device *rdev,
9721         struct wireless_dev *wdev, u64 cookie,
9722         struct ieee80211_channel *chan,
9723         unsigned int duration, gfp_t gfp)
9724 {
9725         struct sk_buff *msg;
9726         void *hdr;
9727
9728         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9729         if (!msg)
9730                 return;
9731
9732         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9733         if (!hdr) {
9734                 nlmsg_free(msg);
9735                 return;
9736         }
9737
9738         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9739             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9740                                          wdev->netdev->ifindex)) ||
9741             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9742             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9743             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9744                         NL80211_CHAN_NO_HT) ||
9745             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9746                 goto nla_put_failure;
9747
9748         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9749             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9750                 goto nla_put_failure;
9751
9752         genlmsg_end(msg, hdr);
9753
9754         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9755                                 nl80211_mlme_mcgrp.id, gfp);
9756         return;
9757
9758  nla_put_failure:
9759         genlmsg_cancel(msg, hdr);
9760         nlmsg_free(msg);
9761 }
9762
9763 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9764                                struct ieee80211_channel *chan,
9765                                unsigned int duration, gfp_t gfp)
9766 {
9767         struct wiphy *wiphy = wdev->wiphy;
9768         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9769
9770         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9771         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9772                                           rdev, wdev, cookie, chan,
9773                                           duration, gfp);
9774 }
9775 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9776
9777 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9778                                         struct ieee80211_channel *chan,
9779                                         gfp_t gfp)
9780 {
9781         struct wiphy *wiphy = wdev->wiphy;
9782         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9783
9784         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9785         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9786                                           rdev, wdev, cookie, chan, 0, gfp);
9787 }
9788 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9789
9790 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9791                       struct station_info *sinfo, gfp_t gfp)
9792 {
9793         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9794         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9795         struct sk_buff *msg;
9796
9797         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9798
9799         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9800         if (!msg)
9801                 return;
9802
9803         if (nl80211_send_station(msg, 0, 0, 0,
9804                                  rdev, dev, mac_addr, sinfo) < 0) {
9805                 nlmsg_free(msg);
9806                 return;
9807         }
9808
9809         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9810                                 nl80211_mlme_mcgrp.id, gfp);
9811 }
9812 EXPORT_SYMBOL(cfg80211_new_sta);
9813
9814 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9815 {
9816         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9817         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9818         struct sk_buff *msg;
9819         void *hdr;
9820
9821         trace_cfg80211_del_sta(dev, mac_addr);
9822
9823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9824         if (!msg)
9825                 return;
9826
9827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9828         if (!hdr) {
9829                 nlmsg_free(msg);
9830                 return;
9831         }
9832
9833         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9834             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9835                 goto nla_put_failure;
9836
9837         genlmsg_end(msg, hdr);
9838
9839         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9840                                 nl80211_mlme_mcgrp.id, gfp);
9841         return;
9842
9843  nla_put_failure:
9844         genlmsg_cancel(msg, hdr);
9845         nlmsg_free(msg);
9846 }
9847 EXPORT_SYMBOL(cfg80211_del_sta);
9848
9849 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9850                           enum nl80211_connect_failed_reason reason,
9851                           gfp_t gfp)
9852 {
9853         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9854         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9855         struct sk_buff *msg;
9856         void *hdr;
9857
9858         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9859         if (!msg)
9860                 return;
9861
9862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9863         if (!hdr) {
9864                 nlmsg_free(msg);
9865                 return;
9866         }
9867
9868         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9869             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9870             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9871                 goto nla_put_failure;
9872
9873         genlmsg_end(msg, hdr);
9874
9875         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9876                                 nl80211_mlme_mcgrp.id, gfp);
9877         return;
9878
9879  nla_put_failure:
9880         genlmsg_cancel(msg, hdr);
9881         nlmsg_free(msg);
9882 }
9883 EXPORT_SYMBOL(cfg80211_conn_failed);
9884
9885 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9886                                        const u8 *addr, gfp_t gfp)
9887 {
9888         struct wireless_dev *wdev = dev->ieee80211_ptr;
9889         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9890         struct sk_buff *msg;
9891         void *hdr;
9892         int err;
9893         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9894
9895         if (!nlportid)
9896                 return false;
9897
9898         msg = nlmsg_new(100, gfp);
9899         if (!msg)
9900                 return true;
9901
9902         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9903         if (!hdr) {
9904                 nlmsg_free(msg);
9905                 return true;
9906         }
9907
9908         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9909             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9910             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9911                 goto nla_put_failure;
9912
9913         err = genlmsg_end(msg, hdr);
9914         if (err < 0) {
9915                 nlmsg_free(msg);
9916                 return true;
9917         }
9918
9919         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9920         return true;
9921
9922  nla_put_failure:
9923         genlmsg_cancel(msg, hdr);
9924         nlmsg_free(msg);
9925         return true;
9926 }
9927
9928 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9929                                 const u8 *addr, gfp_t gfp)
9930 {
9931         struct wireless_dev *wdev = dev->ieee80211_ptr;
9932         bool ret;
9933
9934         trace_cfg80211_rx_spurious_frame(dev, addr);
9935
9936         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9937                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9938                 trace_cfg80211_return_bool(false);
9939                 return false;
9940         }
9941         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9942                                          addr, gfp);
9943         trace_cfg80211_return_bool(ret);
9944         return ret;
9945 }
9946 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9947
9948 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9949                                         const u8 *addr, gfp_t gfp)
9950 {
9951         struct wireless_dev *wdev = dev->ieee80211_ptr;
9952         bool ret;
9953
9954         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9955
9956         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9957                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9958                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9959                 trace_cfg80211_return_bool(false);
9960                 return false;
9961         }
9962         ret = __nl80211_unexpected_frame(dev,
9963                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9964                                          addr, gfp);
9965         trace_cfg80211_return_bool(ret);
9966         return ret;
9967 }
9968 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9969
9970 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9971                       struct wireless_dev *wdev, u32 nlportid,
9972                       int freq, int sig_dbm,
9973                       const u8 *buf, size_t len, gfp_t gfp)
9974 {
9975         struct net_device *netdev = wdev->netdev;
9976         struct sk_buff *msg;
9977         void *hdr;
9978
9979         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9980         if (!msg)
9981                 return -ENOMEM;
9982
9983         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9984         if (!hdr) {
9985                 nlmsg_free(msg);
9986                 return -ENOMEM;
9987         }
9988
9989         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9990             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9991                                         netdev->ifindex)) ||
9992             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9993             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9994             (sig_dbm &&
9995              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9996             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9997                 goto nla_put_failure;
9998
9999         genlmsg_end(msg, hdr);
10000
10001         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10002
10003  nla_put_failure:
10004         genlmsg_cancel(msg, hdr);
10005         nlmsg_free(msg);
10006         return -ENOBUFS;
10007 }
10008
10009 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10010                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10011 {
10012         struct wiphy *wiphy = wdev->wiphy;
10013         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10014         struct net_device *netdev = wdev->netdev;
10015         struct sk_buff *msg;
10016         void *hdr;
10017
10018         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10019
10020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10021         if (!msg)
10022                 return;
10023
10024         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10025         if (!hdr) {
10026                 nlmsg_free(msg);
10027                 return;
10028         }
10029
10030         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10031             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10032                                    netdev->ifindex)) ||
10033             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10034             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10035             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10036             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10037                 goto nla_put_failure;
10038
10039         genlmsg_end(msg, hdr);
10040
10041         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10042                                 nl80211_mlme_mcgrp.id, gfp);
10043         return;
10044
10045  nla_put_failure:
10046         genlmsg_cancel(msg, hdr);
10047         nlmsg_free(msg);
10048 }
10049 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10050
10051 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10052                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10053                               gfp_t gfp)
10054 {
10055         struct wireless_dev *wdev = dev->ieee80211_ptr;
10056         struct wiphy *wiphy = wdev->wiphy;
10057         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10058         struct sk_buff *msg;
10059         struct nlattr *pinfoattr;
10060         void *hdr;
10061
10062         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10063
10064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10065         if (!msg)
10066                 return;
10067
10068         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10069         if (!hdr) {
10070                 nlmsg_free(msg);
10071                 return;
10072         }
10073
10074         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10075             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10076                 goto nla_put_failure;
10077
10078         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10079         if (!pinfoattr)
10080                 goto nla_put_failure;
10081
10082         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10083                         rssi_event))
10084                 goto nla_put_failure;
10085
10086         nla_nest_end(msg, pinfoattr);
10087
10088         genlmsg_end(msg, hdr);
10089
10090         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10091                                 nl80211_mlme_mcgrp.id, gfp);
10092         return;
10093
10094  nla_put_failure:
10095         genlmsg_cancel(msg, hdr);
10096         nlmsg_free(msg);
10097 }
10098 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10099
10100 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10101                                      struct net_device *netdev, const u8 *bssid,
10102                                      const u8 *replay_ctr, gfp_t gfp)
10103 {
10104         struct sk_buff *msg;
10105         struct nlattr *rekey_attr;
10106         void *hdr;
10107
10108         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10109         if (!msg)
10110                 return;
10111
10112         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10113         if (!hdr) {
10114                 nlmsg_free(msg);
10115                 return;
10116         }
10117
10118         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10119             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10120             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10121                 goto nla_put_failure;
10122
10123         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10124         if (!rekey_attr)
10125                 goto nla_put_failure;
10126
10127         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10128                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10129                 goto nla_put_failure;
10130
10131         nla_nest_end(msg, rekey_attr);
10132
10133         genlmsg_end(msg, hdr);
10134
10135         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10136                                 nl80211_mlme_mcgrp.id, gfp);
10137         return;
10138
10139  nla_put_failure:
10140         genlmsg_cancel(msg, hdr);
10141         nlmsg_free(msg);
10142 }
10143
10144 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10145                                const u8 *replay_ctr, gfp_t gfp)
10146 {
10147         struct wireless_dev *wdev = dev->ieee80211_ptr;
10148         struct wiphy *wiphy = wdev->wiphy;
10149         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10150
10151         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10152         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10153 }
10154 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10155
10156 static void
10157 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10158                                struct net_device *netdev, int index,
10159                                const u8 *bssid, bool preauth, gfp_t gfp)
10160 {
10161         struct sk_buff *msg;
10162         struct nlattr *attr;
10163         void *hdr;
10164
10165         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10166         if (!msg)
10167                 return;
10168
10169         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10170         if (!hdr) {
10171                 nlmsg_free(msg);
10172                 return;
10173         }
10174
10175         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10176             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10177                 goto nla_put_failure;
10178
10179         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10180         if (!attr)
10181                 goto nla_put_failure;
10182
10183         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10184             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10185             (preauth &&
10186              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10187                 goto nla_put_failure;
10188
10189         nla_nest_end(msg, attr);
10190
10191         genlmsg_end(msg, hdr);
10192
10193         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10194                                 nl80211_mlme_mcgrp.id, gfp);
10195         return;
10196
10197  nla_put_failure:
10198         genlmsg_cancel(msg, hdr);
10199         nlmsg_free(msg);
10200 }
10201
10202 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10203                                      const u8 *bssid, bool preauth, gfp_t gfp)
10204 {
10205         struct wireless_dev *wdev = dev->ieee80211_ptr;
10206         struct wiphy *wiphy = wdev->wiphy;
10207         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10208
10209         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10210         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10211 }
10212 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10213
10214 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10215                                      struct net_device *netdev,
10216                                      struct cfg80211_chan_def *chandef,
10217                                      gfp_t gfp)
10218 {
10219         struct sk_buff *msg;
10220         void *hdr;
10221
10222         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10223         if (!msg)
10224                 return;
10225
10226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10227         if (!hdr) {
10228                 nlmsg_free(msg);
10229                 return;
10230         }
10231
10232         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10233                 goto nla_put_failure;
10234
10235         if (nl80211_send_chandef(msg, chandef))
10236                 goto nla_put_failure;
10237
10238         genlmsg_end(msg, hdr);
10239
10240         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10241                                 nl80211_mlme_mcgrp.id, gfp);
10242         return;
10243
10244  nla_put_failure:
10245         genlmsg_cancel(msg, hdr);
10246         nlmsg_free(msg);
10247 }
10248
10249 void cfg80211_ch_switch_notify(struct net_device *dev,
10250                                struct cfg80211_chan_def *chandef)
10251 {
10252         struct wireless_dev *wdev = dev->ieee80211_ptr;
10253         struct wiphy *wiphy = wdev->wiphy;
10254         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10255
10256         trace_cfg80211_ch_switch_notify(dev, chandef);
10257
10258         wdev_lock(wdev);
10259
10260         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10261                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10262                 goto out;
10263
10264         wdev->channel = chandef->chan;
10265         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10266 out:
10267         wdev_unlock(wdev);
10268         return;
10269 }
10270 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10271
10272 void cfg80211_cqm_txe_notify(struct net_device *dev,
10273                              const u8 *peer, u32 num_packets,
10274                              u32 rate, u32 intvl, gfp_t gfp)
10275 {
10276         struct wireless_dev *wdev = dev->ieee80211_ptr;
10277         struct wiphy *wiphy = wdev->wiphy;
10278         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10279         struct sk_buff *msg;
10280         struct nlattr *pinfoattr;
10281         void *hdr;
10282
10283         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10284         if (!msg)
10285                 return;
10286
10287         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10288         if (!hdr) {
10289                 nlmsg_free(msg);
10290                 return;
10291         }
10292
10293         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10294             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10295             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10296                 goto nla_put_failure;
10297
10298         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10299         if (!pinfoattr)
10300                 goto nla_put_failure;
10301
10302         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10303                 goto nla_put_failure;
10304
10305         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10306                 goto nla_put_failure;
10307
10308         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10309                 goto nla_put_failure;
10310
10311         nla_nest_end(msg, pinfoattr);
10312
10313         genlmsg_end(msg, hdr);
10314
10315         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10316                                 nl80211_mlme_mcgrp.id, gfp);
10317         return;
10318
10319  nla_put_failure:
10320         genlmsg_cancel(msg, hdr);
10321         nlmsg_free(msg);
10322 }
10323 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10324
10325 void
10326 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10327                      struct cfg80211_chan_def *chandef,
10328                      enum nl80211_radar_event event,
10329                      struct net_device *netdev, gfp_t gfp)
10330 {
10331         struct sk_buff *msg;
10332         void *hdr;
10333
10334         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10335         if (!msg)
10336                 return;
10337
10338         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10339         if (!hdr) {
10340                 nlmsg_free(msg);
10341                 return;
10342         }
10343
10344         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10345                 goto nla_put_failure;
10346
10347         /* NOP and radar events don't need a netdev parameter */
10348         if (netdev) {
10349                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10350
10351                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10352                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10353                         goto nla_put_failure;
10354         }
10355
10356         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10357                 goto nla_put_failure;
10358
10359         if (nl80211_send_chandef(msg, chandef))
10360                 goto nla_put_failure;
10361
10362         if (genlmsg_end(msg, hdr) < 0) {
10363                 nlmsg_free(msg);
10364                 return;
10365         }
10366
10367         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10368                                 nl80211_mlme_mcgrp.id, gfp);
10369         return;
10370
10371  nla_put_failure:
10372         genlmsg_cancel(msg, hdr);
10373         nlmsg_free(msg);
10374 }
10375
10376 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10377                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10378 {
10379         struct wireless_dev *wdev = dev->ieee80211_ptr;
10380         struct wiphy *wiphy = wdev->wiphy;
10381         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10382         struct sk_buff *msg;
10383         struct nlattr *pinfoattr;
10384         void *hdr;
10385
10386         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10387
10388         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10389         if (!msg)
10390                 return;
10391
10392         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10393         if (!hdr) {
10394                 nlmsg_free(msg);
10395                 return;
10396         }
10397
10398         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10399             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10400             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10401                 goto nla_put_failure;
10402
10403         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10404         if (!pinfoattr)
10405                 goto nla_put_failure;
10406
10407         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10408                 goto nla_put_failure;
10409
10410         nla_nest_end(msg, pinfoattr);
10411
10412         genlmsg_end(msg, hdr);
10413
10414         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10415                                 nl80211_mlme_mcgrp.id, gfp);
10416         return;
10417
10418  nla_put_failure:
10419         genlmsg_cancel(msg, hdr);
10420         nlmsg_free(msg);
10421 }
10422 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10423
10424 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10425                            u64 cookie, bool acked, gfp_t gfp)
10426 {
10427         struct wireless_dev *wdev = dev->ieee80211_ptr;
10428         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10429         struct sk_buff *msg;
10430         void *hdr;
10431         int err;
10432
10433         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10434
10435         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10436
10437         if (!msg)
10438                 return;
10439
10440         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10441         if (!hdr) {
10442                 nlmsg_free(msg);
10443                 return;
10444         }
10445
10446         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10447             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10448             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10449             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10450             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10451                 goto nla_put_failure;
10452
10453         err = genlmsg_end(msg, hdr);
10454         if (err < 0) {
10455                 nlmsg_free(msg);
10456                 return;
10457         }
10458
10459         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10460                                 nl80211_mlme_mcgrp.id, gfp);
10461         return;
10462
10463  nla_put_failure:
10464         genlmsg_cancel(msg, hdr);
10465         nlmsg_free(msg);
10466 }
10467 EXPORT_SYMBOL(cfg80211_probe_status);
10468
10469 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10470                                  const u8 *frame, size_t len,
10471                                  int freq, int sig_dbm)
10472 {
10473         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10474         struct sk_buff *msg;
10475         void *hdr;
10476         struct cfg80211_beacon_registration *reg;
10477
10478         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10479
10480         spin_lock_bh(&rdev->beacon_registrations_lock);
10481         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10482                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10483                 if (!msg) {
10484                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10485                         return;
10486                 }
10487
10488                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10489                 if (!hdr)
10490                         goto nla_put_failure;
10491
10492                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10493                     (freq &&
10494                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10495                     (sig_dbm &&
10496                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10497                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10498                         goto nla_put_failure;
10499
10500                 genlmsg_end(msg, hdr);
10501
10502                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10503         }
10504         spin_unlock_bh(&rdev->beacon_registrations_lock);
10505         return;
10506
10507  nla_put_failure:
10508         spin_unlock_bh(&rdev->beacon_registrations_lock);
10509         if (hdr)
10510                 genlmsg_cancel(msg, hdr);
10511         nlmsg_free(msg);
10512 }
10513 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10514
10515 #ifdef CONFIG_PM
10516 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10517                                    struct cfg80211_wowlan_wakeup *wakeup,
10518                                    gfp_t gfp)
10519 {
10520         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10521         struct sk_buff *msg;
10522         void *hdr;
10523         int err, size = 200;
10524
10525         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10526
10527         if (wakeup)
10528                 size += wakeup->packet_present_len;
10529
10530         msg = nlmsg_new(size, gfp);
10531         if (!msg)
10532                 return;
10533
10534         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10535         if (!hdr)
10536                 goto free_msg;
10537
10538         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10539             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10540                 goto free_msg;
10541
10542         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10543                                         wdev->netdev->ifindex))
10544                 goto free_msg;
10545
10546         if (wakeup) {
10547                 struct nlattr *reasons;
10548
10549                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10550
10551                 if (wakeup->disconnect &&
10552                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10553                         goto free_msg;
10554                 if (wakeup->magic_pkt &&
10555                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10556                         goto free_msg;
10557                 if (wakeup->gtk_rekey_failure &&
10558                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10559                         goto free_msg;
10560                 if (wakeup->eap_identity_req &&
10561                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10562                         goto free_msg;
10563                 if (wakeup->four_way_handshake &&
10564                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10565                         goto free_msg;
10566                 if (wakeup->rfkill_release &&
10567                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10568                         goto free_msg;
10569
10570                 if (wakeup->pattern_idx >= 0 &&
10571                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10572                                 wakeup->pattern_idx))
10573                         goto free_msg;
10574
10575                 if (wakeup->tcp_match)
10576                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10577
10578                 if (wakeup->tcp_connlost)
10579                         nla_put_flag(msg,
10580                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10581
10582                 if (wakeup->tcp_nomoretokens)
10583                         nla_put_flag(msg,
10584                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10585
10586                 if (wakeup->packet) {
10587                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10588                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10589
10590                         if (!wakeup->packet_80211) {
10591                                 pkt_attr =
10592                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10593                                 len_attr =
10594                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10595                         }
10596
10597                         if (wakeup->packet_len &&
10598                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10599                                 goto free_msg;
10600
10601                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10602                                     wakeup->packet))
10603                                 goto free_msg;
10604                 }
10605
10606                 nla_nest_end(msg, reasons);
10607         }
10608
10609         err = genlmsg_end(msg, hdr);
10610         if (err < 0)
10611                 goto free_msg;
10612
10613         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10614                                 nl80211_mlme_mcgrp.id, gfp);
10615         return;
10616
10617  free_msg:
10618         nlmsg_free(msg);
10619 }
10620 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10621 #endif
10622
10623 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10624                                 enum nl80211_tdls_operation oper,
10625                                 u16 reason_code, gfp_t gfp)
10626 {
10627         struct wireless_dev *wdev = dev->ieee80211_ptr;
10628         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10629         struct sk_buff *msg;
10630         void *hdr;
10631         int err;
10632
10633         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10634                                          reason_code);
10635
10636         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10637         if (!msg)
10638                 return;
10639
10640         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10641         if (!hdr) {
10642                 nlmsg_free(msg);
10643                 return;
10644         }
10645
10646         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10647             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10648             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10649             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10650             (reason_code > 0 &&
10651              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10652                 goto nla_put_failure;
10653
10654         err = genlmsg_end(msg, hdr);
10655         if (err < 0) {
10656                 nlmsg_free(msg);
10657                 return;
10658         }
10659
10660         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10661                                 nl80211_mlme_mcgrp.id, gfp);
10662         return;
10663
10664  nla_put_failure:
10665         genlmsg_cancel(msg, hdr);
10666         nlmsg_free(msg);
10667 }
10668 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10669
10670 static int nl80211_netlink_notify(struct notifier_block * nb,
10671                                   unsigned long state,
10672                                   void *_notify)
10673 {
10674         struct netlink_notify *notify = _notify;
10675         struct cfg80211_registered_device *rdev;
10676         struct wireless_dev *wdev;
10677         struct cfg80211_beacon_registration *reg, *tmp;
10678
10679         if (state != NETLINK_URELEASE)
10680                 return NOTIFY_DONE;
10681
10682         rcu_read_lock();
10683
10684         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10685                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10686                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10687
10688                 spin_lock_bh(&rdev->beacon_registrations_lock);
10689                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10690                                          list) {
10691                         if (reg->nlportid == notify->portid) {
10692                                 list_del(&reg->list);
10693                                 kfree(reg);
10694                                 break;
10695                         }
10696                 }
10697                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10698         }
10699
10700         rcu_read_unlock();
10701
10702         return NOTIFY_DONE;
10703 }
10704
10705 static struct notifier_block nl80211_netlink_notifier = {
10706         .notifier_call = nl80211_netlink_notify,
10707 };
10708
10709 void cfg80211_ft_event(struct net_device *netdev,
10710                        struct cfg80211_ft_event_params *ft_event)
10711 {
10712         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10713         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10714         struct sk_buff *msg;
10715         void *hdr;
10716         int err;
10717
10718         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10719
10720         if (!ft_event->target_ap)
10721                 return;
10722
10723         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10724         if (!msg)
10725                 return;
10726
10727         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10728         if (!hdr) {
10729                 nlmsg_free(msg);
10730                 return;
10731         }
10732
10733         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10734         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10735         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10736         if (ft_event->ies)
10737                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10738         if (ft_event->ric_ies)
10739                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10740                         ft_event->ric_ies);
10741
10742         err = genlmsg_end(msg, hdr);
10743         if (err < 0) {
10744                 nlmsg_free(msg);
10745                 return;
10746         }
10747
10748         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10749                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10750 }
10751 EXPORT_SYMBOL(cfg80211_ft_event);
10752
10753 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10754 {
10755         struct cfg80211_registered_device *rdev;
10756         struct sk_buff *msg;
10757         void *hdr;
10758         u32 nlportid;
10759
10760         rdev = wiphy_to_dev(wdev->wiphy);
10761         if (!rdev->crit_proto_nlportid)
10762                 return;
10763
10764         nlportid = rdev->crit_proto_nlportid;
10765         rdev->crit_proto_nlportid = 0;
10766
10767         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10768         if (!msg)
10769                 return;
10770
10771         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10772         if (!hdr)
10773                 goto nla_put_failure;
10774
10775         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10776             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10777                 goto nla_put_failure;
10778
10779         genlmsg_end(msg, hdr);
10780
10781         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10782         return;
10783
10784  nla_put_failure:
10785         if (hdr)
10786                 genlmsg_cancel(msg, hdr);
10787         nlmsg_free(msg);
10788
10789 }
10790 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10791
10792 /* initialisation/exit functions */
10793
10794 int nl80211_init(void)
10795 {
10796         int err;
10797
10798         err = genl_register_family_with_ops(&nl80211_fam,
10799                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10800         if (err)
10801                 return err;
10802
10803         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10804         if (err)
10805                 goto err_out;
10806
10807         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10808         if (err)
10809                 goto err_out;
10810
10811         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10812         if (err)
10813                 goto err_out;
10814
10815         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10816         if (err)
10817                 goto err_out;
10818
10819 #ifdef CONFIG_NL80211_TESTMODE
10820         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10821         if (err)
10822                 goto err_out;
10823 #endif
10824
10825         err = netlink_register_notifier(&nl80211_netlink_notifier);
10826         if (err)
10827                 goto err_out;
10828
10829         return 0;
10830  err_out:
10831         genl_unregister_family(&nl80211_fam);
10832         return err;
10833 }
10834
10835 void nl80211_exit(void)
10836 {
10837         netlink_unregister_notifier(&nl80211_netlink_notifier);
10838         genl_unregister_family(&nl80211_fam);
10839 }