net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         ASSERT_RTNL();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         ASSERT_RTNL();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 130                                 if (wdev->identifier != (u32)wdev_id)
 131                                         continue;
 132                                 found = true;
 133                                 break;
 134                         }
 135
 136                         if (!found)
 137                                 tmp = NULL;
 138
 139                         if (rdev && tmp != rdev)
 140                                 return ERR_PTR(-EINVAL);
 141                         rdev = tmp;
 142                 }
 143         }
 144
 145         if (attrs[NL80211_ATTR_IFINDEX]) {
 146                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 147                 netdev = dev_get_by_index(netns, ifindex);
 148                 if (netdev) {
 149                         if (netdev->ieee80211_ptr)
 150                                 tmp = wiphy_to_dev(
 151                                                 netdev->ieee80211_ptr->wiphy);
 152                         else
 153                                 tmp = NULL;
 154
 155                         dev_put(netdev);
 156
 157                         /* not wireless device -- return error */
 158                         if (!tmp)
 159                                 return ERR_PTR(-EINVAL);
 160
 161                         /* mismatch -- return error */
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         rdev = tmp;
 166                 }
 167         }
 168
 169         if (!rdev)
 170                 return ERR_PTR(-ENODEV);
 171
 172         if (netns != wiphy_net(&rdev->wiphy))
 173                 return ERR_PTR(-ENODEV);
 174
 175         return rdev;
 176 }
 177
 178 /*
 179  * This function returns a pointer to the driver
 180  * that the genl_info item that is passed refers to.
 181  *
 182  * The result of this can be a PTR_ERR and hence must
 183  * be checked with IS_ERR() for errors.
 184  */
 185 static struct cfg80211_registered_device *
 186 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 187 {
 188         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 189 }
 190
 191 /* policy for the attributes */
 192 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 193         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 194         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 195                                       .len = 20-1 },
 196         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 197
 198         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 199         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 200         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 201         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 202         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 203
 204         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 205         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 206         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 207         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 208         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 209
 210         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 211         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 212         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 213
 214         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 215         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 216
 217         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 218         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 219                                     .len = WLAN_MAX_KEY_LEN },
 220         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 221         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 222         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 223         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 224         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 227         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 229                                        .len = IEEE80211_MAX_DATA_LEN },
 230         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 231                                        .len = IEEE80211_MAX_DATA_LEN },
 232         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 233         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 234         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 235         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 236                                                .len = NL80211_MAX_SUPP_RATES },
 237         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 238         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 239         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 240         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 241                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 242         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 243
 244         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 245         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 246
 247         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 248         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 249         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 250         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 251                                            .len = NL80211_MAX_SUPP_RATES },
 252         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 253
 254         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 256
 257         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 258
 259         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 261                               .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 263         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 264
 265         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 266                                 .len = IEEE80211_MAX_SSID_LEN },
 267         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 268         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 269         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 270         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 271         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 272         [NL80211_ATTR_STA_FLAGS2] = {
 273                 .len = sizeof(struct nl80211_sta_flag_update),
 274         },
 275         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 276         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 277         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 278         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 280         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 281         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 282         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 283         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 284                                  .len = WLAN_PMKID_LEN },
 285         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 286         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 287         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 289                                  .len = IEEE80211_MAX_DATA_LEN },
 290         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 291         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 293         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 296         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 297         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 300         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 301         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 303         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 304         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 306         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 308         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 309         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 310                                          .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 312                                          .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 314         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 317         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 318         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 319         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 320         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 323                                       .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 325         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 327                 .len = NL80211_HT_CAPABILITY_LEN
 328         },
 329         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 330         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 331         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 332         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 333         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 335         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 336         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 337         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 338         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 339         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 340         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 341         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 342         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 343         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 344         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 346                 .len = NL80211_VHT_CAPABILITY_LEN,
 347         },
 348         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 349         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 350                                   .len = IEEE80211_MAX_DATA_LEN },
 351         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 352 };
 353
 354 /* policy for the key attributes */
 355 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 356         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 357         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 358         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 359         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 360         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 361         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 362         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 363         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364 };
 365
 366 /* policy for the key default flags */
 367 static const struct nla_policy
 368 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 369         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 371 };
 372
 373 /* policy for WoWLAN attributes */
 374 static const struct nla_policy
 375 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 376         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 377         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 378         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 379         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 380         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 381         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 382         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 383         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 384         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 385 };
 386
 387 static const struct nla_policy
 388 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 389         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 390         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 391         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 392         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 393         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 394         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 395         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 396                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 397         },
 398         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 399                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 400         },
 401         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 402         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 403         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 404 };
 405
 406 /* policy for GTK rekey offload attributes */
 407 static const struct nla_policy
 408 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 409         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 410         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 411         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 412 };
 413
 414 static const struct nla_policy
 415 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 416         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 417                                                  .len = IEEE80211_MAX_SSID_LEN },
 418         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 419 };
 420
 421 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 422                                      struct netlink_callback *cb,
 423                                      struct cfg80211_registered_device **rdev,
 424                                      struct wireless_dev **wdev)
 425 {
 426         int err;
 427
 428         rtnl_lock();
 429
 430         if (!cb->args[0]) {
 431                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 432                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 433                                   nl80211_policy);
 434                 if (err)
 435                         goto out_unlock;
 436
 437                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 438                                                    nl80211_fam.attrbuf);
 439                 if (IS_ERR(*wdev)) {
 440                         err = PTR_ERR(*wdev);
 441                         goto out_unlock;
 442                 }
 443                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 444                 cb->args[0] = (*rdev)->wiphy_idx;
 445                 cb->args[1] = (*wdev)->identifier;
 446         } else {
 447                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
 448                 struct wireless_dev *tmp;
 449
 450                 if (!wiphy) {
 451                         err = -ENODEV;
 452                         goto out_unlock;
 453                 }
 454                 *rdev = wiphy_to_dev(wiphy);
 455                 *wdev = NULL;
 456
 457                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 458                         if (tmp->identifier == cb->args[1]) {
 459                                 *wdev = tmp;
 460                                 break;
 461                         }
 462                 }
 463
 464                 if (!*wdev) {
 465                         err = -ENODEV;
 466                         goto out_unlock;
 467                 }
 468         }
 469
 470         return 0;
 471  out_unlock:
 472         rtnl_unlock();
 473         return err;
 474 }
 475
 476 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 477 {
 478         rtnl_unlock();
 479 }
 480
 481 /* IE validation */
 482 static bool is_valid_ie_attr(const struct nlattr *attr)
 483 {
 484         const u8 *pos;
 485         int len;
 486
 487         if (!attr)
 488                 return true;
 489
 490         pos = nla_data(attr);
 491         len = nla_len(attr);
 492
 493         while (len) {
 494                 u8 elemlen;
 495
 496                 if (len < 2)
 497                         return false;
 498                 len -= 2;
 499
 500                 elemlen = pos[1];
 501                 if (elemlen > len)
 502                         return false;
 503
 504                 len -= elemlen;
 505                 pos += 2 + elemlen;
 506         }
 507
 508         return true;
 509 }
 510
 511 /* message building helper */
 512 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 513                                    int flags, u8 cmd)
 514 {
 515         /* since there is no private header just add the generic one */
 516         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 517 }
 518
 519 static int nl80211_msg_put_channel(struct sk_buff *msg,
 520                                    struct ieee80211_channel *chan,
 521                                    bool large)
 522 {
 523         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 524                         chan->center_freq))
 525                 goto nla_put_failure;
 526
 527         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 528             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 529                 goto nla_put_failure;
 530         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 531             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 532                 goto nla_put_failure;
 533         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 534             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 535                 goto nla_put_failure;
 536         if (chan->flags & IEEE80211_CHAN_RADAR) {
 537                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 538                         goto nla_put_failure;
 539                 if (large) {
 540                         u32 time;
 541
 542                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 543
 544                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 545                                         chan->dfs_state))
 546                                 goto nla_put_failure;
 547                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 548                                         time))
 549                                 goto nla_put_failure;
 550                 }
 551         }
 552
 553         if (large) {
 554                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 555                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 556                         goto nla_put_failure;
 557                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 558                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 559                         goto nla_put_failure;
 560                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 561                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 562                         goto nla_put_failure;
 563                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 564                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 565                         goto nla_put_failure;
 566         }
 567
 568         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 569                         DBM_TO_MBM(chan->max_power)))
 570                 goto nla_put_failure;
 571
 572         return 0;
 573
 574  nla_put_failure:
 575         return -ENOBUFS;
 576 }
 577
 578 /* netlink command implementations */
 579
 580 struct key_parse {
 581         struct key_params p;
 582         int idx;
 583         int type;
 584         bool def, defmgmt;
 585         bool def_uni, def_multi;
 586 };
 587
 588 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 589 {
 590         struct nlattr *tb[NL80211_KEY_MAX + 1];
 591         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 592                                    nl80211_key_policy);
 593         if (err)
 594                 return err;
 595
 596         k->def = !!tb[NL80211_KEY_DEFAULT];
 597         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 598
 599         if (k->def) {
 600                 k->def_uni = true;
 601                 k->def_multi = true;
 602         }
 603         if (k->defmgmt)
 604                 k->def_multi = true;
 605
 606         if (tb[NL80211_KEY_IDX])
 607                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 608
 609         if (tb[NL80211_KEY_DATA]) {
 610                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 611                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 612         }
 613
 614         if (tb[NL80211_KEY_SEQ]) {
 615                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 616                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 617         }
 618
 619         if (tb[NL80211_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 621
 622         if (tb[NL80211_KEY_TYPE]) {
 623                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 624                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 625                         return -EINVAL;
 626         }
 627
 628         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 629                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 630                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 631                                        tb[NL80211_KEY_DEFAULT_TYPES],
 632                                        nl80211_key_default_policy);
 633                 if (err)
 634                         return err;
 635
 636                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 637                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 638         }
 639
 640         return 0;
 641 }
 642
 643 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 644 {
 645         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 646                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 647                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 648         }
 649
 650         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 651                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 652                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 653         }
 654
 655         if (info->attrs[NL80211_ATTR_KEY_IDX])
 656                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 657
 658         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 659                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 660
 661         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 662         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 663
 664         if (k->def) {
 665                 k->def_uni = true;
 666                 k->def_multi = true;
 667         }
 668         if (k->defmgmt)
 669                 k->def_multi = true;
 670
 671         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 672                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 673                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 674                         return -EINVAL;
 675         }
 676
 677         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 678                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 679                 int err = nla_parse_nested(
 680                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 681                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 682                                 nl80211_key_default_policy);
 683                 if (err)
 684                         return err;
 685
 686                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 687                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 688         }
 689
 690         return 0;
 691 }
 692
 693 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 694 {
 695         int err;
 696
 697         memset(k, 0, sizeof(*k));
 698         k->idx = -1;
 699         k->type = -1;
 700
 701         if (info->attrs[NL80211_ATTR_KEY])
 702                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 703         else
 704                 err = nl80211_parse_key_old(info, k);
 705
 706         if (err)
 707                 return err;
 708
 709         if (k->def && k->defmgmt)
 710                 return -EINVAL;
 711
 712         if (k->defmgmt) {
 713                 if (k->def_uni || !k->def_multi)
 714                         return -EINVAL;
 715         }
 716
 717         if (k->idx != -1) {
 718                 if (k->defmgmt) {
 719                         if (k->idx < 4 || k->idx > 5)
 720                                 return -EINVAL;
 721                 } else if (k->def) {
 722                         if (k->idx < 0 || k->idx > 3)
 723                                 return -EINVAL;
 724                 } else {
 725                         if (k->idx < 0 || k->idx > 5)
 726                                 return -EINVAL;
 727                 }
 728         }
 729
 730         return 0;
 731 }
 732
 733 static struct cfg80211_cached_keys *
 734 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 735                        struct nlattr *keys, bool *no_ht)
 736 {
 737         struct key_parse parse;
 738         struct nlattr *key;
 739         struct cfg80211_cached_keys *result;
 740         int rem, err, def = 0;
 741
 742         result = kzalloc(sizeof(*result), GFP_KERNEL);
 743         if (!result)
 744                 return ERR_PTR(-ENOMEM);
 745
 746         result->def = -1;
 747         result->defmgmt = -1;
 748
 749         nla_for_each_nested(key, keys, rem) {
 750                 memset(&parse, 0, sizeof(parse));
 751                 parse.idx = -1;
 752
 753                 err = nl80211_parse_key_new(key, &parse);
 754                 if (err)
 755                         goto error;
 756                 err = -EINVAL;
 757                 if (!parse.p.key)
 758                         goto error;
 759                 if (parse.idx < 0 || parse.idx > 4)
 760                         goto error;
 761                 if (parse.def) {
 762                         if (def)
 763                                 goto error;
 764                         def = 1;
 765                         result->def = parse.idx;
 766                         if (!parse.def_uni || !parse.def_multi)
 767                                 goto error;
 768                 } else if (parse.defmgmt)
 769                         goto error;
 770                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 771                                                      parse.idx, false, NULL);
 772                 if (err)
 773                         goto error;
 774                 result->params[parse.idx].cipher = parse.p.cipher;
 775                 result->params[parse.idx].key_len = parse.p.key_len;
 776                 result->params[parse.idx].key = result->data[parse.idx];
 777                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 778
 779                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 780                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 781                         if (no_ht)
 782                                 *no_ht = true;
 783                 }
 784         }
 785
 786         return result;
 787  error:
 788         kfree(result);
 789         return ERR_PTR(err);
 790 }
 791
 792 static int nl80211_key_allowed(struct wireless_dev *wdev)
 793 {
 794         ASSERT_WDEV_LOCK(wdev);
 795
 796         switch (wdev->iftype) {
 797         case NL80211_IFTYPE_AP:
 798         case NL80211_IFTYPE_AP_VLAN:
 799         case NL80211_IFTYPE_P2P_GO:
 800         case NL80211_IFTYPE_MESH_POINT:
 801                 break;
 802         case NL80211_IFTYPE_ADHOC:
 803         case NL80211_IFTYPE_STATION:
 804         case NL80211_IFTYPE_P2P_CLIENT:
 805                 if (!wdev->current_bss)
 806                         return -ENOLINK;
 807                 break;
 808         default:
 809                 return -EINVAL;
 810         }
 811
 812         return 0;
 813 }
 814
 815 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 816 {
 817         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 818         int i;
 819
 820         if (!nl_modes)
 821                 goto nla_put_failure;
 822
 823         i = 0;
 824         while (ifmodes) {
 825                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 826                         goto nla_put_failure;
 827                 ifmodes >>= 1;
 828                 i++;
 829         }
 830
 831         nla_nest_end(msg, nl_modes);
 832         return 0;
 833
 834 nla_put_failure:
 835         return -ENOBUFS;
 836 }
 837
 838 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 839                                           struct sk_buff *msg,
 840                                           bool large)
 841 {
 842         struct nlattr *nl_combis;
 843         int i, j;
 844
 845         nl_combis = nla_nest_start(msg,
 846                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 847         if (!nl_combis)
 848                 goto nla_put_failure;
 849
 850         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 851                 const struct ieee80211_iface_combination *c;
 852                 struct nlattr *nl_combi, *nl_limits;
 853
 854                 c = &wiphy->iface_combinations[i];
 855
 856                 nl_combi = nla_nest_start(msg, i + 1);
 857                 if (!nl_combi)
 858                         goto nla_put_failure;
 859
 860                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 861                 if (!nl_limits)
 862                         goto nla_put_failure;
 863
 864                 for (j = 0; j < c->n_limits; j++) {
 865                         struct nlattr *nl_limit;
 866
 867                         nl_limit = nla_nest_start(msg, j + 1);
 868                         if (!nl_limit)
 869                                 goto nla_put_failure;
 870                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 871                                         c->limits[j].max))
 872                                 goto nla_put_failure;
 873                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 874                                                 c->limits[j].types))
 875                                 goto nla_put_failure;
 876                         nla_nest_end(msg, nl_limit);
 877                 }
 878
 879                 nla_nest_end(msg, nl_limits);
 880
 881                 if (c->beacon_int_infra_match &&
 882                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 883                         goto nla_put_failure;
 884                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 885                                 c->num_different_channels) ||
 886                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 887                                 c->max_interfaces))
 888                         goto nla_put_failure;
 889                 if (large &&
 890                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 891                                 c->radar_detect_widths))
 892                         goto nla_put_failure;
 893
 894                 nla_nest_end(msg, nl_combi);
 895         }
 896
 897         nla_nest_end(msg, nl_combis);
 898
 899         return 0;
 900 nla_put_failure:
 901         return -ENOBUFS;
 902 }
 903
 904 #ifdef CONFIG_PM
 905 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 906                                         struct sk_buff *msg)
 907 {
 908         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 909         struct nlattr *nl_tcp;
 910
 911         if (!tcp)
 912                 return 0;
 913
 914         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 915         if (!nl_tcp)
 916                 return -ENOBUFS;
 917
 918         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 919                         tcp->data_payload_max))
 920                 return -ENOBUFS;
 921
 922         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 923                         tcp->data_payload_max))
 924                 return -ENOBUFS;
 925
 926         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 927                 return -ENOBUFS;
 928
 929         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 930                                 sizeof(*tcp->tok), tcp->tok))
 931                 return -ENOBUFS;
 932
 933         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 934                         tcp->data_interval_max))
 935                 return -ENOBUFS;
 936
 937         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 938                         tcp->wake_payload_max))
 939                 return -ENOBUFS;
 940
 941         nla_nest_end(msg, nl_tcp);
 942         return 0;
 943 }
 944
 945 static int nl80211_send_wowlan(struct sk_buff *msg,
 946                                struct cfg80211_registered_device *dev,
 947                                bool large)
 948 {
 949         struct nlattr *nl_wowlan;
 950
 951         if (!dev->wiphy.wowlan)
 952                 return 0;
 953
 954         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 955         if (!nl_wowlan)
 956                 return -ENOBUFS;
 957
 958         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 959              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 960             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 961              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 962             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 963              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 964             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 965              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 966             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 967              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 968             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 969              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 970             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 971              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 972             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 973              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 974                 return -ENOBUFS;
 975
 976         if (dev->wiphy.wowlan->n_patterns) {
 977                 struct nl80211_wowlan_pattern_support pat = {
 978                         .max_patterns = dev->wiphy.wowlan->n_patterns,
 979                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
 980                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
 981                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
 982                 };
 983
 984                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 985                             sizeof(pat), &pat))
 986                         return -ENOBUFS;
 987         }
 988
 989         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
 990                 return -ENOBUFS;
 991
 992         nla_nest_end(msg, nl_wowlan);
 993
 994         return 0;
 995 }
 996 #endif
 997
 998 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
 999                                       struct ieee80211_supported_band *sband)
1000 {
1001         struct nlattr *nl_rates, *nl_rate;
1002         struct ieee80211_rate *rate;
1003         int i;
1004
1005         /* add HT info */
1006         if (sband->ht_cap.ht_supported &&
1007             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1008                      sizeof(sband->ht_cap.mcs),
1009                      &sband->ht_cap.mcs) ||
1010              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1011                          sband->ht_cap.cap) ||
1012              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1013                         sband->ht_cap.ampdu_factor) ||
1014              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1015                         sband->ht_cap.ampdu_density)))
1016                 return -ENOBUFS;
1017
1018         /* add VHT info */
1019         if (sband->vht_cap.vht_supported &&
1020             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1021                      sizeof(sband->vht_cap.vht_mcs),
1022                      &sband->vht_cap.vht_mcs) ||
1023              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1024                          sband->vht_cap.cap)))
1025                 return -ENOBUFS;
1026
1027         /* add bitrates */
1028         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1029         if (!nl_rates)
1030                 return -ENOBUFS;
1031
1032         for (i = 0; i < sband->n_bitrates; i++) {
1033                 nl_rate = nla_nest_start(msg, i);
1034                 if (!nl_rate)
1035                         return -ENOBUFS;
1036
1037                 rate = &sband->bitrates[i];
1038                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1039                                 rate->bitrate))
1040                         return -ENOBUFS;
1041                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1042                     nla_put_flag(msg,
1043                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1044                         return -ENOBUFS;
1045
1046                 nla_nest_end(msg, nl_rate);
1047         }
1048
1049         nla_nest_end(msg, nl_rates);
1050
1051         return 0;
1052 }
1053
1054 static int
1055 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1056                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1057 {
1058         u16 stypes;
1059         struct nlattr *nl_ftypes, *nl_ifs;
1060         enum nl80211_iftype ift;
1061         int i;
1062
1063         if (!mgmt_stypes)
1064                 return 0;
1065
1066         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1067         if (!nl_ifs)
1068                 return -ENOBUFS;
1069
1070         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1071                 nl_ftypes = nla_nest_start(msg, ift);
1072                 if (!nl_ftypes)
1073                         return -ENOBUFS;
1074                 i = 0;
1075                 stypes = mgmt_stypes[ift].tx;
1076                 while (stypes) {
1077                         if ((stypes & 1) &&
1078                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1079                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1080                                 return -ENOBUFS;
1081                         stypes >>= 1;
1082                         i++;
1083                 }
1084                 nla_nest_end(msg, nl_ftypes);
1085         }
1086
1087         nla_nest_end(msg, nl_ifs);
1088
1089         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1090         if (!nl_ifs)
1091                 return -ENOBUFS;
1092
1093         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1094                 nl_ftypes = nla_nest_start(msg, ift);
1095                 if (!nl_ftypes)
1096                         return -ENOBUFS;
1097                 i = 0;
1098                 stypes = mgmt_stypes[ift].rx;
1099                 while (stypes) {
1100                         if ((stypes & 1) &&
1101                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1102                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1103                                 return -ENOBUFS;
1104                         stypes >>= 1;
1105                         i++;
1106                 }
1107                 nla_nest_end(msg, nl_ftypes);
1108         }
1109         nla_nest_end(msg, nl_ifs);
1110
1111         return 0;
1112 }
1113
1114 struct nl80211_dump_wiphy_state {
1115         s64 filter_wiphy;
1116         long start;
1117         long split_start, band_start, chan_start;
1118         bool split;
1119 };
1120
1121 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1122                               struct sk_buff *msg, u32 portid, u32 seq,
1123                               int flags, struct nl80211_dump_wiphy_state *state)
1124 {
1125         void *hdr;
1126         struct nlattr *nl_bands, *nl_band;
1127         struct nlattr *nl_freqs, *nl_freq;
1128         struct nlattr *nl_cmds;
1129         enum ieee80211_band band;
1130         struct ieee80211_channel *chan;
1131         int i;
1132         const struct ieee80211_txrx_stypes *mgmt_stypes =
1133                                 dev->wiphy.mgmt_stypes;
1134         u32 features;
1135
1136         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1137         if (!hdr)
1138                 return -ENOBUFS;
1139
1140         if (WARN_ON(!state))
1141                 return -EINVAL;
1142
1143         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1144             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1145                            wiphy_name(&dev->wiphy)) ||
1146             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1147                         cfg80211_rdev_list_generation))
1148                 goto nla_put_failure;
1149
1150         switch (state->split_start) {
1151         case 0:
1152                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1153                                dev->wiphy.retry_short) ||
1154                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1155                                dev->wiphy.retry_long) ||
1156                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1157                                 dev->wiphy.frag_threshold) ||
1158                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1159                                 dev->wiphy.rts_threshold) ||
1160                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1161                                dev->wiphy.coverage_class) ||
1162                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1163                                dev->wiphy.max_scan_ssids) ||
1164                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1165                                dev->wiphy.max_sched_scan_ssids) ||
1166                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1167                                 dev->wiphy.max_scan_ie_len) ||
1168                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1169                                 dev->wiphy.max_sched_scan_ie_len) ||
1170                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1171                                dev->wiphy.max_match_sets))
1172                         goto nla_put_failure;
1173
1174                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1175                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1176                         goto nla_put_failure;
1177                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1178                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1179                         goto nla_put_failure;
1180                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1181                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1182                         goto nla_put_failure;
1183                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1184                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1185                         goto nla_put_failure;
1186                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1187                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1188                         goto nla_put_failure;
1189                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1190                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1191                         goto nla_put_failure;
1192                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1193                     nla_put_flag(msg, WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1194                         goto nla_put_failure;
1195
1196                 state->split_start++;
1197                 if (state->split)
1198                         break;
1199         case 1:
1200                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1201                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1202                             dev->wiphy.cipher_suites))
1203                         goto nla_put_failure;
1204
1205                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1206                                dev->wiphy.max_num_pmkids))
1207                         goto nla_put_failure;
1208
1209                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1210                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1211                         goto nla_put_failure;
1212
1213                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1214                                 dev->wiphy.available_antennas_tx) ||
1215                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1216                                 dev->wiphy.available_antennas_rx))
1217                         goto nla_put_failure;
1218
1219                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1220                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1221                                 dev->wiphy.probe_resp_offload))
1222                         goto nla_put_failure;
1223
1224                 if ((dev->wiphy.available_antennas_tx ||
1225                      dev->wiphy.available_antennas_rx) &&
1226                     dev->ops->get_antenna) {
1227                         u32 tx_ant = 0, rx_ant = 0;
1228                         int res;
1229                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1230                         if (!res) {
1231                                 if (nla_put_u32(msg,
1232                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1233                                                 tx_ant) ||
1234                                     nla_put_u32(msg,
1235                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1236                                                 rx_ant))
1237                                         goto nla_put_failure;
1238                         }
1239                 }
1240
1241                 state->split_start++;
1242                 if (state->split)
1243                         break;
1244         case 2:
1245                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1246                                         dev->wiphy.interface_modes))
1247                                 goto nla_put_failure;
1248                 state->split_start++;
1249                 if (state->split)
1250                         break;
1251         case 3:
1252                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1253                 if (!nl_bands)
1254                         goto nla_put_failure;
1255
1256                 for (band = state->band_start;
1257                      band < IEEE80211_NUM_BANDS; band++) {
1258                         struct ieee80211_supported_band *sband;
1259
1260                         sband = dev->wiphy.bands[band];
1261
1262                         if (!sband)
1263                                 continue;
1264
1265                         nl_band = nla_nest_start(msg, band);
1266                         if (!nl_band)
1267                                 goto nla_put_failure;
1268
1269                         switch (state->chan_start) {
1270                         case 0:
1271                                 if (nl80211_send_band_rateinfo(msg, sband))
1272                                         goto nla_put_failure;
1273                                 state->chan_start++;
1274                                 if (state->split)
1275                                         break;
1276                         default:
1277                                 /* add frequencies */
1278                                 nl_freqs = nla_nest_start(
1279                                         msg, NL80211_BAND_ATTR_FREQS);
1280                                 if (!nl_freqs)
1281                                         goto nla_put_failure;
1282
1283                                 for (i = state->chan_start - 1;
1284                                      i < sband->n_channels;
1285                                      i++) {
1286                                         nl_freq = nla_nest_start(msg, i);
1287                                         if (!nl_freq)
1288                                                 goto nla_put_failure;
1289
1290                                         chan = &sband->channels[i];
1291
1292                                         if (nl80211_msg_put_channel(
1293                                                         msg, chan,
1294                                                         state->split))
1295                                                 goto nla_put_failure;
1296
1297                                         nla_nest_end(msg, nl_freq);
1298                                         if (state->split)
1299                                                 break;
1300                                 }
1301                                 if (i < sband->n_channels)
1302                                         state->chan_start = i + 2;
1303                                 else
1304                                         state->chan_start = 0;
1305                                 nla_nest_end(msg, nl_freqs);
1306                         }
1307
1308                         nla_nest_end(msg, nl_band);
1309
1310                         if (state->split) {
1311                                 /* start again here */
1312                                 if (state->chan_start)
1313                                         band--;
1314                                 break;
1315                         }
1316                 }
1317                 nla_nest_end(msg, nl_bands);
1318
1319                 if (band < IEEE80211_NUM_BANDS)
1320                         state->band_start = band + 1;
1321                 else
1322                         state->band_start = 0;
1323
1324                 /* if bands & channels are done, continue outside */
1325                 if (state->band_start == 0 && state->chan_start == 0)
1326                         state->split_start++;
1327                 if (state->split)
1328                         break;
1329         case 4:
1330                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1331                 if (!nl_cmds)
1332                         goto nla_put_failure;
1333
1334                 i = 0;
1335 #define CMD(op, n)                                                      \
1336                  do {                                                   \
1337                         if (dev->ops->op) {                             \
1338                                 i++;                                    \
1339                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1340                                         goto nla_put_failure;           \
1341                         }                                               \
1342                 } while (0)
1343
1344                 CMD(add_virtual_intf, NEW_INTERFACE);
1345                 CMD(change_virtual_intf, SET_INTERFACE);
1346                 CMD(add_key, NEW_KEY);
1347                 CMD(start_ap, START_AP);
1348                 CMD(add_station, NEW_STATION);
1349                 CMD(add_mpath, NEW_MPATH);
1350                 CMD(update_mesh_config, SET_MESH_CONFIG);
1351                 CMD(change_bss, SET_BSS);
1352                 CMD(auth, AUTHENTICATE);
1353                 CMD(assoc, ASSOCIATE);
1354                 CMD(deauth, DEAUTHENTICATE);
1355                 CMD(disassoc, DISASSOCIATE);
1356                 CMD(join_ibss, JOIN_IBSS);
1357                 CMD(join_mesh, JOIN_MESH);
1358                 CMD(set_pmksa, SET_PMKSA);
1359                 CMD(del_pmksa, DEL_PMKSA);
1360                 CMD(flush_pmksa, FLUSH_PMKSA);
1361                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1362                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1363                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1364                 CMD(mgmt_tx, FRAME);
1365                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1366                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1367                         i++;
1368                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1369                                 goto nla_put_failure;
1370                 }
1371                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1372                     dev->ops->join_mesh) {
1373                         i++;
1374                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1375                                 goto nla_put_failure;
1376                 }
1377                 CMD(set_wds_peer, SET_WDS_PEER);
1378                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1379                         CMD(tdls_mgmt, TDLS_MGMT);
1380                         CMD(tdls_oper, TDLS_OPER);
1381                 }
1382                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1383                         CMD(sched_scan_start, START_SCHED_SCAN);
1384                 CMD(probe_client, PROBE_CLIENT);
1385                 CMD(set_noack_map, SET_NOACK_MAP);
1386                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1387                         i++;
1388                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1389                                 goto nla_put_failure;
1390                 }
1391                 CMD(start_p2p_device, START_P2P_DEVICE);
1392                 CMD(set_mcast_rate, SET_MCAST_RATE);
1393                 if (state->split) {
1394                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1395                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1396                 }
1397
1398 #ifdef CONFIG_NL80211_TESTMODE
1399                 CMD(testmode_cmd, TESTMODE);
1400 #endif
1401
1402 #undef CMD
1403
1404                 if (dev->ops->connect || dev->ops->auth) {
1405                         i++;
1406                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1407                                 goto nla_put_failure;
1408                 }
1409
1410                 if (dev->ops->disconnect || dev->ops->deauth) {
1411                         i++;
1412                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1413                                 goto nla_put_failure;
1414                 }
1415
1416                 nla_nest_end(msg, nl_cmds);
1417                 state->split_start++;
1418                 if (state->split)
1419                         break;
1420         case 5:
1421                 if (dev->ops->remain_on_channel &&
1422                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1423                     nla_put_u32(msg,
1424                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1425                                 dev->wiphy.max_remain_on_channel_duration))
1426                         goto nla_put_failure;
1427
1428                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1429                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1430                         goto nla_put_failure;
1431
1432                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1433                         goto nla_put_failure;
1434                 state->split_start++;
1435                 if (state->split)
1436                         break;
1437         case 6:
1438 #ifdef CONFIG_PM
1439                 if (nl80211_send_wowlan(msg, dev, state->split))
1440                         goto nla_put_failure;
1441                 state->split_start++;
1442                 if (state->split)
1443                         break;
1444 #else
1445                 state->split_start++;
1446 #endif
1447         case 7:
1448                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1449                                         dev->wiphy.software_iftypes))
1450                         goto nla_put_failure;
1451
1452                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1453                                                    state->split))
1454                         goto nla_put_failure;
1455
1456                 state->split_start++;
1457                 if (state->split)
1458                         break;
1459         case 8:
1460                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1461                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1462                                 dev->wiphy.ap_sme_capa))
1463                         goto nla_put_failure;
1464
1465                 features = dev->wiphy.features;
1466                 /*
1467                  * We can only add the per-channel limit information if the
1468                  * dump is split, otherwise it makes it too big. Therefore
1469                  * only advertise it in that case.
1470                  */
1471                 if (state->split)
1472                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1473                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1474                         goto nla_put_failure;
1475
1476                 if (dev->wiphy.ht_capa_mod_mask &&
1477                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1478                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1479                             dev->wiphy.ht_capa_mod_mask))
1480                         goto nla_put_failure;
1481
1482                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1483                     dev->wiphy.max_acl_mac_addrs &&
1484                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1485                                 dev->wiphy.max_acl_mac_addrs))
1486                         goto nla_put_failure;
1487
1488                 /*
1489                  * Any information below this point is only available to
1490                  * applications that can deal with it being split. This
1491                  * helps ensure that newly added capabilities don't break
1492                  * older tools by overrunning their buffers.
1493                  *
1494                  * We still increment split_start so that in the split
1495                  * case we'll continue with more data in the next round,
1496                  * but break unconditionally so unsplit data stops here.
1497                  */
1498                 state->split_start++;
1499                 break;
1500         case 9:
1501                 if (dev->wiphy.extended_capabilities &&
1502                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1503                              dev->wiphy.extended_capabilities_len,
1504                              dev->wiphy.extended_capabilities) ||
1505                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1506                              dev->wiphy.extended_capabilities_len,
1507                              dev->wiphy.extended_capabilities_mask)))
1508                         goto nla_put_failure;
1509
1510                 if (dev->wiphy.vht_capa_mod_mask &&
1511                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1512                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1513                             dev->wiphy.vht_capa_mod_mask))
1514                         goto nla_put_failure;
1515
1516                 /* done */
1517                 state->split_start = 0;
1518                 break;
1519         }
1520         return genlmsg_end(msg, hdr);
1521
1522  nla_put_failure:
1523         genlmsg_cancel(msg, hdr);
1524         return -EMSGSIZE;
1525 }
1526
1527 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1528                                     struct netlink_callback *cb,
1529                                     struct nl80211_dump_wiphy_state *state)
1530 {
1531         struct nlattr **tb = nl80211_fam.attrbuf;
1532         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1533                               tb, nl80211_fam.maxattr, nl80211_policy);
1534         /* ignore parse errors for backward compatibility */
1535         if (ret)
1536                 return 0;
1537
1538         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1539         if (tb[NL80211_ATTR_WIPHY])
1540                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1541         if (tb[NL80211_ATTR_WDEV])
1542                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1543         if (tb[NL80211_ATTR_IFINDEX]) {
1544                 struct net_device *netdev;
1545                 struct cfg80211_registered_device *rdev;
1546                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1547
1548                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1549                 if (!netdev)
1550                         return -ENODEV;
1551                 if (netdev->ieee80211_ptr) {
1552                         rdev = wiphy_to_dev(
1553                                 netdev->ieee80211_ptr->wiphy);
1554                         state->filter_wiphy = rdev->wiphy_idx;
1555                 }
1556                 dev_put(netdev);
1557         }
1558
1559         return 0;
1560 }
1561
1562 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1563 {
1564         int idx = 0, ret;
1565         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1566         struct cfg80211_registered_device *dev;
1567
1568         rtnl_lock();
1569         if (!state) {
1570                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1571                 if (!state)
1572                         return -ENOMEM;
1573                 state->filter_wiphy = -1;
1574                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1575                 if (ret) {
1576                         kfree(state);
1577                         rtnl_unlock();
1578                         return ret;
1579                 }
1580                 cb->args[0] = (long)state;
1581         }
1582
1583         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1584                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1585                         continue;
1586                 if (++idx <= state->start)
1587                         continue;
1588                 if (state->filter_wiphy != -1 &&
1589                     state->filter_wiphy != dev->wiphy_idx)
1590                         continue;
1591                 /* attempt to fit multiple wiphy data chunks into the skb */
1592                 do {
1593                         ret = nl80211_send_wiphy(dev, skb,
1594                                                  NETLINK_CB(cb->skb).portid,
1595                                                  cb->nlh->nlmsg_seq,
1596                                                  NLM_F_MULTI, state);
1597                         if (ret < 0) {
1598                                 /*
1599                                  * If sending the wiphy data didn't fit (ENOBUFS
1600                                  * or EMSGSIZE returned), this SKB is still
1601                                  * empty (so it's not too big because another
1602                                  * wiphy dataset is already in the skb) and
1603                                  * we've not tried to adjust the dump allocation
1604                                  * yet ... then adjust the alloc size to be
1605                                  * bigger, and return 1 but with the empty skb.
1606                                  * This results in an empty message being RX'ed
1607                                  * in userspace, but that is ignored.
1608                                  *
1609                                  * We can then retry with the larger buffer.
1610                                  */
1611                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1612                                     !skb->len &&
1613                                     cb->min_dump_alloc < 4096) {
1614                                         cb->min_dump_alloc = 4096;
1615                                         rtnl_unlock();
1616                                         return 1;
1617                                 }
1618                                 idx--;
1619                                 break;
1620                         }
1621                 } while (state->split_start > 0);
1622                 break;
1623         }
1624         rtnl_unlock();
1625
1626         state->start = idx;
1627
1628         return skb->len;
1629 }
1630
1631 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1632 {
1633         kfree((void *)cb->args[0]);
1634         return 0;
1635 }
1636
1637 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1638 {
1639         struct sk_buff *msg;
1640         struct cfg80211_registered_device *dev = info->user_ptr[0];
1641         struct nl80211_dump_wiphy_state state = {};
1642
1643         msg = nlmsg_new(4096, GFP_KERNEL);
1644         if (!msg)
1645                 return -ENOMEM;
1646
1647         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1648                                &state) < 0) {
1649                 nlmsg_free(msg);
1650                 return -ENOBUFS;
1651         }
1652
1653         return genlmsg_reply(msg, info);
1654 }
1655
1656 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1657         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1658         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1659         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1660         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1661         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1662 };
1663
1664 static int parse_txq_params(struct nlattr *tb[],
1665                             struct ieee80211_txq_params *txq_params)
1666 {
1667         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1668             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1669             !tb[NL80211_TXQ_ATTR_AIFS])
1670                 return -EINVAL;
1671
1672         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1673         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1674         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1675         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1676         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1677
1678         if (txq_params->ac >= NL80211_NUM_ACS)
1679                 return -EINVAL;
1680
1681         return 0;
1682 }
1683
1684 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1685 {
1686         /*
1687          * You can only set the channel explicitly for WDS interfaces,
1688          * all others have their channel managed via their respective
1689          * "establish a connection" command (connect, join, ...)
1690          *
1691          * For AP/GO and mesh mode, the channel can be set with the
1692          * channel userspace API, but is only stored and passed to the
1693          * low-level driver when the AP starts or the mesh is joined.
1694          * This is for backward compatibility, userspace can also give
1695          * the channel in the start-ap or join-mesh commands instead.
1696          *
1697          * Monitors are special as they are normally slaved to
1698          * whatever else is going on, so they have their own special
1699          * operation to set the monitor channel if possible.
1700          */
1701         return !wdev ||
1702                 wdev->iftype == NL80211_IFTYPE_AP ||
1703                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1704                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1705                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1706 }
1707
1708 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1709                                  struct genl_info *info,
1710                                  struct cfg80211_chan_def *chandef)
1711 {
1712         u32 control_freq;
1713
1714         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1715                 return -EINVAL;
1716
1717         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1718
1719         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1720         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1721         chandef->center_freq1 = control_freq;
1722         chandef->center_freq2 = 0;
1723
1724         /* Primary channel not allowed */
1725         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1726                 return -EINVAL;
1727
1728         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1729                 enum nl80211_channel_type chantype;
1730
1731                 chantype = nla_get_u32(
1732                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1733
1734                 switch (chantype) {
1735                 case NL80211_CHAN_NO_HT:
1736                 case NL80211_CHAN_HT20:
1737                 case NL80211_CHAN_HT40PLUS:
1738                 case NL80211_CHAN_HT40MINUS:
1739                         cfg80211_chandef_create(chandef, chandef->chan,
1740                                                 chantype);
1741                         break;
1742                 default:
1743                         return -EINVAL;
1744                 }
1745         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1746                 chandef->width =
1747                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1748                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1749                         chandef->center_freq1 =
1750                                 nla_get_u32(
1751                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1752                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1753                         chandef->center_freq2 =
1754                                 nla_get_u32(
1755                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1756         }
1757
1758         if (!cfg80211_chandef_valid(chandef))
1759                 return -EINVAL;
1760
1761         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1762                                      IEEE80211_CHAN_DISABLED))
1763                 return -EINVAL;
1764
1765         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1766              chandef->width == NL80211_CHAN_WIDTH_10) &&
1767             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1768                 return -EINVAL;
1769
1770         return 0;
1771 }
1772
1773 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1774                                  struct wireless_dev *wdev,
1775                                  struct genl_info *info)
1776 {
1777         struct cfg80211_chan_def chandef;
1778         int result;
1779         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1780
1781         if (wdev)
1782                 iftype = wdev->iftype;
1783
1784         if (!nl80211_can_set_dev_channel(wdev))
1785                 return -EOPNOTSUPP;
1786
1787         result = nl80211_parse_chandef(rdev, info, &chandef);
1788         if (result)
1789                 return result;
1790
1791         switch (iftype) {
1792         case NL80211_IFTYPE_AP:
1793         case NL80211_IFTYPE_P2P_GO:
1794                 if (wdev->beacon_interval) {
1795                         result = -EBUSY;
1796                         break;
1797                 }
1798                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1799                         result = -EINVAL;
1800                         break;
1801                 }
1802                 wdev->preset_chandef = chandef;
1803                 result = 0;
1804                 break;
1805         case NL80211_IFTYPE_MESH_POINT:
1806                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1807                 break;
1808         case NL80211_IFTYPE_MONITOR:
1809                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1810                 break;
1811         default:
1812                 result = -EINVAL;
1813         }
1814
1815         return result;
1816 }
1817
1818 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1819 {
1820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1821         struct net_device *netdev = info->user_ptr[1];
1822
1823         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1824 }
1825
1826 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1827 {
1828         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1829         struct net_device *dev = info->user_ptr[1];
1830         struct wireless_dev *wdev = dev->ieee80211_ptr;
1831         const u8 *bssid;
1832
1833         if (!info->attrs[NL80211_ATTR_MAC])
1834                 return -EINVAL;
1835
1836         if (netif_running(dev))
1837                 return -EBUSY;
1838
1839         if (!rdev->ops->set_wds_peer)
1840                 return -EOPNOTSUPP;
1841
1842         if (wdev->iftype != NL80211_IFTYPE_WDS)
1843                 return -EOPNOTSUPP;
1844
1845         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1846         return rdev_set_wds_peer(rdev, dev, bssid);
1847 }
1848
1849
1850 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1851 {
1852         struct cfg80211_registered_device *rdev;
1853         struct net_device *netdev = NULL;
1854         struct wireless_dev *wdev;
1855         int result = 0, rem_txq_params = 0;
1856         struct nlattr *nl_txq_params;
1857         u32 changed;
1858         u8 retry_short = 0, retry_long = 0;
1859         u32 frag_threshold = 0, rts_threshold = 0;
1860         u8 coverage_class = 0;
1861
1862         ASSERT_RTNL();
1863
1864         /*
1865          * Try to find the wiphy and netdev. Normally this
1866          * function shouldn't need the netdev, but this is
1867          * done for backward compatibility -- previously
1868          * setting the channel was done per wiphy, but now
1869          * it is per netdev. Previous userland like hostapd
1870          * also passed a netdev to set_wiphy, so that it is
1871          * possible to let that go to the right netdev!
1872          */
1873
1874         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1875                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1876
1877                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1878                 if (netdev && netdev->ieee80211_ptr)
1879                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1880                 else
1881                         netdev = NULL;
1882         }
1883
1884         if (!netdev) {
1885                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1886                                                   info->attrs);
1887                 if (IS_ERR(rdev))
1888                         return PTR_ERR(rdev);
1889                 wdev = NULL;
1890                 netdev = NULL;
1891                 result = 0;
1892         } else
1893                 wdev = netdev->ieee80211_ptr;
1894
1895         /*
1896          * end workaround code, by now the rdev is available
1897          * and locked, and wdev may or may not be NULL.
1898          */
1899
1900         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1901                 result = cfg80211_dev_rename(
1902                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1903
1904         if (result)
1905                 goto bad_res;
1906
1907         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1908                 struct ieee80211_txq_params txq_params;
1909                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1910
1911                 if (!rdev->ops->set_txq_params) {
1912                         result = -EOPNOTSUPP;
1913                         goto bad_res;
1914                 }
1915
1916                 if (!netdev) {
1917                         result = -EINVAL;
1918                         goto bad_res;
1919                 }
1920
1921                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1922                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1923                         result = -EINVAL;
1924                         goto bad_res;
1925                 }
1926
1927                 if (!netif_running(netdev)) {
1928                         result = -ENETDOWN;
1929                         goto bad_res;
1930                 }
1931
1932                 nla_for_each_nested(nl_txq_params,
1933                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1934                                     rem_txq_params) {
1935                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1936                                   nla_data(nl_txq_params),
1937                                   nla_len(nl_txq_params),
1938                                   txq_params_policy);
1939                         result = parse_txq_params(tb, &txq_params);
1940                         if (result)
1941                                 goto bad_res;
1942
1943                         result = rdev_set_txq_params(rdev, netdev,
1944                                                      &txq_params);
1945                         if (result)
1946                                 goto bad_res;
1947                 }
1948         }
1949
1950         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1951                 result = __nl80211_set_channel(rdev,
1952                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1953                                 info);
1954                 if (result)
1955                         goto bad_res;
1956         }
1957
1958         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1959                 struct wireless_dev *txp_wdev = wdev;
1960                 enum nl80211_tx_power_setting type;
1961                 int idx, mbm = 0;
1962
1963                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1964                         txp_wdev = NULL;
1965
1966                 if (!rdev->ops->set_tx_power) {
1967                         result = -EOPNOTSUPP;
1968                         goto bad_res;
1969                 }
1970
1971                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1972                 type = nla_get_u32(info->attrs[idx]);
1973
1974                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1975                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1976                         result = -EINVAL;
1977                         goto bad_res;
1978                 }
1979
1980                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1981                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1982                         mbm = nla_get_u32(info->attrs[idx]);
1983                 }
1984
1985                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1986                 if (result)
1987                         goto bad_res;
1988         }
1989
1990         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1991             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1992                 u32 tx_ant, rx_ant;
1993                 if ((!rdev->wiphy.available_antennas_tx &&
1994                      !rdev->wiphy.available_antennas_rx) ||
1995                     !rdev->ops->set_antenna) {
1996                         result = -EOPNOTSUPP;
1997                         goto bad_res;
1998                 }
1999
2000                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2001                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2002
2003                 /* reject antenna configurations which don't match the
2004                  * available antenna masks, except for the "all" mask */
2005                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2006                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2007                         result = -EINVAL;
2008                         goto bad_res;
2009                 }
2010
2011                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2012                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2013
2014                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2015                 if (result)
2016                         goto bad_res;
2017         }
2018
2019         changed = 0;
2020
2021         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2022                 retry_short = nla_get_u8(
2023                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2024                 if (retry_short == 0) {
2025                         result = -EINVAL;
2026                         goto bad_res;
2027                 }
2028                 changed |= WIPHY_PARAM_RETRY_SHORT;
2029         }
2030
2031         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2032                 retry_long = nla_get_u8(
2033                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2034                 if (retry_long == 0) {
2035                         result = -EINVAL;
2036                         goto bad_res;
2037                 }
2038                 changed |= WIPHY_PARAM_RETRY_LONG;
2039         }
2040
2041         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2042                 frag_threshold = nla_get_u32(
2043                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2044                 if (frag_threshold < 256) {
2045                         result = -EINVAL;
2046                         goto bad_res;
2047                 }
2048                 if (frag_threshold != (u32) -1) {
2049                         /*
2050                          * Fragments (apart from the last one) are required to
2051                          * have even length. Make the fragmentation code
2052                          * simpler by stripping LSB should someone try to use
2053                          * odd threshold value.
2054                          */
2055                         frag_threshold &= ~0x1;
2056                 }
2057                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2058         }
2059
2060         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2061                 rts_threshold = nla_get_u32(
2062                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2063                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2064         }
2065
2066         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2067                 coverage_class = nla_get_u8(
2068                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2069                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2070         }
2071
2072         if (changed) {
2073                 u8 old_retry_short, old_retry_long;
2074                 u32 old_frag_threshold, old_rts_threshold;
2075                 u8 old_coverage_class;
2076
2077                 if (!rdev->ops->set_wiphy_params) {
2078                         result = -EOPNOTSUPP;
2079                         goto bad_res;
2080                 }
2081
2082                 old_retry_short = rdev->wiphy.retry_short;
2083                 old_retry_long = rdev->wiphy.retry_long;
2084                 old_frag_threshold = rdev->wiphy.frag_threshold;
2085                 old_rts_threshold = rdev->wiphy.rts_threshold;
2086                 old_coverage_class = rdev->wiphy.coverage_class;
2087
2088                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2089                         rdev->wiphy.retry_short = retry_short;
2090                 if (changed & WIPHY_PARAM_RETRY_LONG)
2091                         rdev->wiphy.retry_long = retry_long;
2092                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2093                         rdev->wiphy.frag_threshold = frag_threshold;
2094                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2095                         rdev->wiphy.rts_threshold = rts_threshold;
2096                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2097                         rdev->wiphy.coverage_class = coverage_class;
2098
2099                 result = rdev_set_wiphy_params(rdev, changed);
2100                 if (result) {
2101                         rdev->wiphy.retry_short = old_retry_short;
2102                         rdev->wiphy.retry_long = old_retry_long;
2103                         rdev->wiphy.frag_threshold = old_frag_threshold;
2104                         rdev->wiphy.rts_threshold = old_rts_threshold;
2105                         rdev->wiphy.coverage_class = old_coverage_class;
2106                 }
2107         }
2108
2109  bad_res:
2110         if (netdev)
2111                 dev_put(netdev);
2112         return result;
2113 }
2114
2115 static inline u64 wdev_id(struct wireless_dev *wdev)
2116 {
2117         return (u64)wdev->identifier |
2118                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2119 }
2120
2121 static int nl80211_send_chandef(struct sk_buff *msg,
2122                                  struct cfg80211_chan_def *chandef)
2123 {
2124         WARN_ON(!cfg80211_chandef_valid(chandef));
2125
2126         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2127                         chandef->chan->center_freq))
2128                 return -ENOBUFS;
2129         switch (chandef->width) {
2130         case NL80211_CHAN_WIDTH_20_NOHT:
2131         case NL80211_CHAN_WIDTH_20:
2132         case NL80211_CHAN_WIDTH_40:
2133                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2134                                 cfg80211_get_chandef_type(chandef)))
2135                         return -ENOBUFS;
2136                 break;
2137         default:
2138                 break;
2139         }
2140         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2141                 return -ENOBUFS;
2142         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2143                 return -ENOBUFS;
2144         if (chandef->center_freq2 &&
2145             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2146                 return -ENOBUFS;
2147         return 0;
2148 }
2149
2150 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2151                               struct cfg80211_registered_device *rdev,
2152                               struct wireless_dev *wdev)
2153 {
2154         struct net_device *dev = wdev->netdev;
2155         void *hdr;
2156
2157         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2158         if (!hdr)
2159                 return -1;
2160
2161         if (dev &&
2162             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2163              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2164                 goto nla_put_failure;
2165
2166         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2167             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2168             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2169             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2170             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2171                         rdev->devlist_generation ^
2172                         (cfg80211_rdev_list_generation << 2)))
2173                 goto nla_put_failure;
2174
2175         if (rdev->ops->get_channel) {
2176                 int ret;
2177                 struct cfg80211_chan_def chandef;
2178
2179                 ret = rdev_get_channel(rdev, wdev, &chandef);
2180                 if (ret == 0) {
2181                         if (nl80211_send_chandef(msg, &chandef))
2182                                 goto nla_put_failure;
2183                 }
2184         }
2185
2186         if (wdev->ssid_len) {
2187                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2188                         goto nla_put_failure;
2189         }
2190
2191         return genlmsg_end(msg, hdr);
2192
2193  nla_put_failure:
2194         genlmsg_cancel(msg, hdr);
2195         return -EMSGSIZE;
2196 }
2197
2198 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2199 {
2200         int wp_idx = 0;
2201         int if_idx = 0;
2202         int wp_start = cb->args[0];
2203         int if_start = cb->args[1];
2204         struct cfg80211_registered_device *rdev;
2205         struct wireless_dev *wdev;
2206
2207         rtnl_lock();
2208         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2209                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2210                         continue;
2211                 if (wp_idx < wp_start) {
2212                         wp_idx++;
2213                         continue;
2214                 }
2215                 if_idx = 0;
2216
2217                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2218                         if (if_idx < if_start) {
2219                                 if_idx++;
2220                                 continue;
2221                         }
2222                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2223                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2224                                                rdev, wdev) < 0) {
2225                                 goto out;
2226                         }
2227                         if_idx++;
2228                 }
2229
2230                 wp_idx++;
2231         }
2232  out:
2233         rtnl_unlock();
2234
2235         cb->args[0] = wp_idx;
2236         cb->args[1] = if_idx;
2237
2238         return skb->len;
2239 }
2240
2241 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2242 {
2243         struct sk_buff *msg;
2244         struct cfg80211_registered_device *dev = info->user_ptr[0];
2245         struct wireless_dev *wdev = info->user_ptr[1];
2246
2247         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2248         if (!msg)
2249                 return -ENOMEM;
2250
2251         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2252                                dev, wdev) < 0) {
2253                 nlmsg_free(msg);
2254                 return -ENOBUFS;
2255         }
2256
2257         return genlmsg_reply(msg, info);
2258 }
2259
2260 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2261         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2262         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2263         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2264         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2265         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2266         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2267 };
2268
2269 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2270 {
2271         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2272         int flag;
2273
2274         *mntrflags = 0;
2275
2276         if (!nla)
2277                 return -EINVAL;
2278
2279         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2280                              nla, mntr_flags_policy))
2281                 return -EINVAL;
2282
2283         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2284                 if (flags[flag])
2285                         *mntrflags |= (1<<flag);
2286
2287         return 0;
2288 }
2289
2290 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2291                                struct net_device *netdev, u8 use_4addr,
2292                                enum nl80211_iftype iftype)
2293 {
2294         if (!use_4addr) {
2295                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2296                         return -EBUSY;
2297                 return 0;
2298         }
2299
2300         switch (iftype) {
2301         case NL80211_IFTYPE_AP_VLAN:
2302                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2303                         return 0;
2304                 break;
2305         case NL80211_IFTYPE_STATION:
2306                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2307                         return 0;
2308                 break;
2309         default:
2310                 break;
2311         }
2312
2313         return -EOPNOTSUPP;
2314 }
2315
2316 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2317 {
2318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2319         struct vif_params params;
2320         int err;
2321         enum nl80211_iftype otype, ntype;
2322         struct net_device *dev = info->user_ptr[1];
2323         u32 _flags, *flags = NULL;
2324         bool change = false;
2325
2326         memset(&params, 0, sizeof(params));
2327
2328         otype = ntype = dev->ieee80211_ptr->iftype;
2329
2330         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2331                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2332                 if (otype != ntype)
2333                         change = true;
2334                 if (ntype > NL80211_IFTYPE_MAX)
2335                         return -EINVAL;
2336         }
2337
2338         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2339                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2340
2341                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2342                         return -EINVAL;
2343                 if (netif_running(dev))
2344                         return -EBUSY;
2345
2346                 wdev_lock(wdev);
2347                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2348                              IEEE80211_MAX_MESH_ID_LEN);
2349                 wdev->mesh_id_up_len =
2350                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2351                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2352                        wdev->mesh_id_up_len);
2353                 wdev_unlock(wdev);
2354         }
2355
2356         if (info->attrs[NL80211_ATTR_4ADDR]) {
2357                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2358                 change = true;
2359                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2360                 if (err)
2361                         return err;
2362         } else {
2363                 params.use_4addr = -1;
2364         }
2365
2366         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2367                 if (ntype != NL80211_IFTYPE_MONITOR)
2368                         return -EINVAL;
2369                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2370                                           &_flags);
2371                 if (err)
2372                         return err;
2373
2374                 flags = &_flags;
2375                 change = true;
2376         }
2377
2378         if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
2379             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2380                 return -EOPNOTSUPP;
2381
2382         if (change)
2383                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2384         else
2385                 err = 0;
2386
2387         if (!err && params.use_4addr != -1)
2388                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2389
2390         return err;
2391 }
2392
2393 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2394 {
2395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2396         struct vif_params params;
2397         struct wireless_dev *wdev;
2398         struct sk_buff *msg;
2399         int err;
2400         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2401         u32 flags;
2402
2403         memset(&params, 0, sizeof(params));
2404
2405         if (!info->attrs[NL80211_ATTR_IFNAME])
2406                 return -EINVAL;
2407
2408         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2409                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2410                 if (type > NL80211_IFTYPE_MAX)
2411                         return -EINVAL;
2412         }
2413
2414         if (!rdev->ops->add_virtual_intf ||
2415             !(rdev->wiphy.interface_modes & (1 << type)))
2416                 return -EOPNOTSUPP;
2417
2418         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2419                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2420                            ETH_ALEN);
2421                 if (!is_valid_ether_addr(params.macaddr))
2422                         return -EADDRNOTAVAIL;
2423         }
2424
2425         if (info->attrs[NL80211_ATTR_4ADDR]) {
2426                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2427                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2428                 if (err)
2429                         return err;
2430         }
2431
2432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2433         if (!msg)
2434                 return -ENOMEM;
2435
2436         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2437                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2438                                   &flags);
2439
2440         if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
2441             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2442                 return -EOPNOTSUPP;
2443
2444         wdev = rdev_add_virtual_intf(rdev,
2445                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2446                                 type, err ? NULL : &flags, &params);
2447         if (IS_ERR(wdev)) {
2448                 nlmsg_free(msg);
2449                 return PTR_ERR(wdev);
2450         }
2451
2452         switch (type) {
2453         case NL80211_IFTYPE_MESH_POINT:
2454                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2455                         break;
2456                 wdev_lock(wdev);
2457                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2458                              IEEE80211_MAX_MESH_ID_LEN);
2459                 wdev->mesh_id_up_len =
2460                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2461                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2462                        wdev->mesh_id_up_len);
2463                 wdev_unlock(wdev);
2464                 break;
2465         case NL80211_IFTYPE_P2P_DEVICE:
2466                 /*
2467                  * P2P Device doesn't have a netdev, so doesn't go
2468                  * through the netdev notifier and must be added here
2469                  */
2470                 mutex_init(&wdev->mtx);
2471                 INIT_LIST_HEAD(&wdev->event_list);
2472                 spin_lock_init(&wdev->event_lock);
2473                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2474                 spin_lock_init(&wdev->mgmt_registrations_lock);
2475
2476                 wdev->identifier = ++rdev->wdev_id;
2477                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2478                 rdev->devlist_generation++;
2479                 break;
2480         default:
2481                 break;
2482         }
2483
2484         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2485                                rdev, wdev) < 0) {
2486                 nlmsg_free(msg);
2487                 return -ENOBUFS;
2488         }
2489
2490         return genlmsg_reply(msg, info);
2491 }
2492
2493 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2494 {
2495         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2496         struct wireless_dev *wdev = info->user_ptr[1];
2497
2498         if (!rdev->ops->del_virtual_intf)
2499                 return -EOPNOTSUPP;
2500
2501         /*
2502          * If we remove a wireless device without a netdev then clear
2503          * user_ptr[1] so that nl80211_post_doit won't dereference it
2504          * to check if it needs to do dev_put(). Otherwise it crashes
2505          * since the wdev has been freed, unlike with a netdev where
2506          * we need the dev_put() for the netdev to really be freed.
2507          */
2508         if (!wdev->netdev)
2509                 info->user_ptr[1] = NULL;
2510
2511         return rdev_del_virtual_intf(rdev, wdev);
2512 }
2513
2514 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2515 {
2516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2517         struct net_device *dev = info->user_ptr[1];
2518         u16 noack_map;
2519
2520         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2521                 return -EINVAL;
2522
2523         if (!rdev->ops->set_noack_map)
2524                 return -EOPNOTSUPP;
2525
2526         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2527
2528         return rdev_set_noack_map(rdev, dev, noack_map);
2529 }
2530
2531 struct get_key_cookie {
2532         struct sk_buff *msg;
2533         int error;
2534         int idx;
2535 };
2536
2537 static void get_key_callback(void *c, struct key_params *params)
2538 {
2539         struct nlattr *key;
2540         struct get_key_cookie *cookie = c;
2541
2542         if ((params->key &&
2543              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2544                      params->key_len, params->key)) ||
2545             (params->seq &&
2546              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2547                      params->seq_len, params->seq)) ||
2548             (params->cipher &&
2549              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2550                          params->cipher)))
2551                 goto nla_put_failure;
2552
2553         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2554         if (!key)
2555                 goto nla_put_failure;
2556
2557         if ((params->key &&
2558              nla_put(cookie->msg, NL80211_KEY_DATA,
2559                      params->key_len, params->key)) ||
2560             (params->seq &&
2561              nla_put(cookie->msg, NL80211_KEY_SEQ,
2562                      params->seq_len, params->seq)) ||
2563             (params->cipher &&
2564              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2565                          params->cipher)))
2566                 goto nla_put_failure;
2567
2568         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2569                 goto nla_put_failure;
2570
2571         nla_nest_end(cookie->msg, key);
2572
2573         return;
2574  nla_put_failure:
2575         cookie->error = 1;
2576 }
2577
2578 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2579 {
2580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2581         int err;
2582         struct net_device *dev = info->user_ptr[1];
2583         u8 key_idx = 0;
2584         const u8 *mac_addr = NULL;
2585         bool pairwise;
2586         struct get_key_cookie cookie = {
2587                 .error = 0,
2588         };
2589         void *hdr;
2590         struct sk_buff *msg;
2591
2592         if (info->attrs[NL80211_ATTR_KEY_IDX])
2593                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2594
2595         if (key_idx > 5)
2596                 return -EINVAL;
2597
2598         if (info->attrs[NL80211_ATTR_MAC])
2599                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2600
2601         pairwise = !!mac_addr;
2602         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2603                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2604                 if (kt >= NUM_NL80211_KEYTYPES)
2605                         return -EINVAL;
2606                 if (kt != NL80211_KEYTYPE_GROUP &&
2607                     kt != NL80211_KEYTYPE_PAIRWISE)
2608                         return -EINVAL;
2609                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2610         }
2611
2612         if (!rdev->ops->get_key)
2613                 return -EOPNOTSUPP;
2614
2615         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2616         if (!msg)
2617                 return -ENOMEM;
2618
2619         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2620                              NL80211_CMD_NEW_KEY);
2621         if (IS_ERR(hdr))
2622                 return PTR_ERR(hdr);
2623
2624         cookie.msg = msg;
2625         cookie.idx = key_idx;
2626
2627         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2628             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2629                 goto nla_put_failure;
2630         if (mac_addr &&
2631             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2632                 goto nla_put_failure;
2633
2634         if (pairwise && mac_addr &&
2635             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2636                 return -ENOENT;
2637
2638         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2639                            get_key_callback);
2640
2641         if (err)
2642                 goto free_msg;
2643
2644         if (cookie.error)
2645                 goto nla_put_failure;
2646
2647         genlmsg_end(msg, hdr);
2648         return genlmsg_reply(msg, info);
2649
2650  nla_put_failure:
2651         err = -ENOBUFS;
2652  free_msg:
2653         nlmsg_free(msg);
2654         return err;
2655 }
2656
2657 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2658 {
2659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2660         struct key_parse key;
2661         int err;
2662         struct net_device *dev = info->user_ptr[1];
2663
2664         err = nl80211_parse_key(info, &key);
2665         if (err)
2666                 return err;
2667
2668         if (key.idx < 0)
2669                 return -EINVAL;
2670
2671         /* only support setting default key */
2672         if (!key.def && !key.defmgmt)
2673                 return -EINVAL;
2674
2675         wdev_lock(dev->ieee80211_ptr);
2676
2677         if (key.def) {
2678                 if (!rdev->ops->set_default_key) {
2679                         err = -EOPNOTSUPP;
2680                         goto out;
2681                 }
2682
2683                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2684                 if (err)
2685                         goto out;
2686
2687                 err = rdev_set_default_key(rdev, dev, key.idx,
2688                                                  key.def_uni, key.def_multi);
2689
2690                 if (err)
2691                         goto out;
2692
2693 #ifdef CONFIG_CFG80211_WEXT
2694                 dev->ieee80211_ptr->wext.default_key = key.idx;
2695 #endif
2696         } else {
2697                 if (key.def_uni || !key.def_multi) {
2698                         err = -EINVAL;
2699                         goto out;
2700                 }
2701
2702                 if (!rdev->ops->set_default_mgmt_key) {
2703                         err = -EOPNOTSUPP;
2704                         goto out;
2705                 }
2706
2707                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2708                 if (err)
2709                         goto out;
2710
2711                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2712                 if (err)
2713                         goto out;
2714
2715 #ifdef CONFIG_CFG80211_WEXT
2716                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2717 #endif
2718         }
2719
2720  out:
2721         wdev_unlock(dev->ieee80211_ptr);
2722
2723         return err;
2724 }
2725
2726 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2727 {
2728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2729         int err;
2730         struct net_device *dev = info->user_ptr[1];
2731         struct key_parse key;
2732         const u8 *mac_addr = NULL;
2733
2734         err = nl80211_parse_key(info, &key);
2735         if (err)
2736                 return err;
2737
2738         if (!key.p.key)
2739                 return -EINVAL;
2740
2741         if (info->attrs[NL80211_ATTR_MAC])
2742                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2743
2744         if (key.type == -1) {
2745                 if (mac_addr)
2746                         key.type = NL80211_KEYTYPE_PAIRWISE;
2747                 else
2748                         key.type = NL80211_KEYTYPE_GROUP;
2749         }
2750
2751         /* for now */
2752         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2753             key.type != NL80211_KEYTYPE_GROUP)
2754                 return -EINVAL;
2755
2756         if (!rdev->ops->add_key)
2757                 return -EOPNOTSUPP;
2758
2759         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2760                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2761                                            mac_addr))
2762                 return -EINVAL;
2763
2764         wdev_lock(dev->ieee80211_ptr);
2765         err = nl80211_key_allowed(dev->ieee80211_ptr);
2766         if (!err)
2767                 err = rdev_add_key(rdev, dev, key.idx,
2768                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2769                                     mac_addr, &key.p);
2770         wdev_unlock(dev->ieee80211_ptr);
2771
2772         return err;
2773 }
2774
2775 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2776 {
2777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2778         int err;
2779         struct net_device *dev = info->user_ptr[1];
2780         u8 *mac_addr = NULL;
2781         struct key_parse key;
2782
2783         err = nl80211_parse_key(info, &key);
2784         if (err)
2785                 return err;
2786
2787         if (info->attrs[NL80211_ATTR_MAC])
2788                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2789
2790         if (key.type == -1) {
2791                 if (mac_addr)
2792                         key.type = NL80211_KEYTYPE_PAIRWISE;
2793                 else
2794                         key.type = NL80211_KEYTYPE_GROUP;
2795         }
2796
2797         /* for now */
2798         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2799             key.type != NL80211_KEYTYPE_GROUP)
2800                 return -EINVAL;
2801
2802         if (!rdev->ops->del_key)
2803                 return -EOPNOTSUPP;
2804
2805         wdev_lock(dev->ieee80211_ptr);
2806         err = nl80211_key_allowed(dev->ieee80211_ptr);
2807
2808         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2809             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2810                 err = -ENOENT;
2811
2812         if (!err)
2813                 err = rdev_del_key(rdev, dev, key.idx,
2814                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2815                                    mac_addr);
2816
2817 #ifdef CONFIG_CFG80211_WEXT
2818         if (!err) {
2819                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2820                         dev->ieee80211_ptr->wext.default_key = -1;
2821                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2822                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2823         }
2824 #endif
2825         wdev_unlock(dev->ieee80211_ptr);
2826
2827         return err;
2828 }
2829
2830 /* This function returns an error or the number of nested attributes */
2831 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2832 {
2833         struct nlattr *attr;
2834         int n_entries = 0, tmp;
2835
2836         nla_for_each_nested(attr, nl_attr, tmp) {
2837                 if (nla_len(attr) != ETH_ALEN)
2838                         return -EINVAL;
2839
2840                 n_entries++;
2841         }
2842
2843         return n_entries;
2844 }
2845
2846 /*
2847  * This function parses ACL information and allocates memory for ACL data.
2848  * On successful return, the calling function is responsible to free the
2849  * ACL buffer returned by this function.
2850  */
2851 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2852                                                 struct genl_info *info)
2853 {
2854         enum nl80211_acl_policy acl_policy;
2855         struct nlattr *attr;
2856         struct cfg80211_acl_data *acl;
2857         int i = 0, n_entries, tmp;
2858
2859         if (!wiphy->max_acl_mac_addrs)
2860                 return ERR_PTR(-EOPNOTSUPP);
2861
2862         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2863                 return ERR_PTR(-EINVAL);
2864
2865         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2866         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2867             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2868                 return ERR_PTR(-EINVAL);
2869
2870         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2871                 return ERR_PTR(-EINVAL);
2872
2873         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2874         if (n_entries < 0)
2875                 return ERR_PTR(n_entries);
2876
2877         if (n_entries > wiphy->max_acl_mac_addrs)
2878                 return ERR_PTR(-ENOTSUPP);
2879
2880         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2881                       GFP_KERNEL);
2882         if (!acl)
2883                 return ERR_PTR(-ENOMEM);
2884
2885         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2886                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2887                 i++;
2888         }
2889
2890         acl->n_acl_entries = n_entries;
2891         acl->acl_policy = acl_policy;
2892
2893         return acl;
2894 }
2895
2896 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2897 {
2898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2899         struct net_device *dev = info->user_ptr[1];
2900         struct cfg80211_acl_data *acl;
2901         int err;
2902
2903         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2904             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2905                 return -EOPNOTSUPP;
2906
2907         if (!dev->ieee80211_ptr->beacon_interval)
2908                 return -EINVAL;
2909
2910         acl = parse_acl_data(&rdev->wiphy, info);
2911         if (IS_ERR(acl))
2912                 return PTR_ERR(acl);
2913
2914         err = rdev_set_mac_acl(rdev, dev, acl);
2915
2916         kfree(acl);
2917
2918         return err;
2919 }
2920
2921 static int nl80211_parse_beacon(struct nlattr *attrs[],
2922                                 struct cfg80211_beacon_data *bcn)
2923 {
2924         bool haveinfo = false;
2925
2926         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
2927             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
2928             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2929             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2930                 return -EINVAL;
2931
2932         memset(bcn, 0, sizeof(*bcn));
2933
2934         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
2935                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
2936                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
2937                 if (!bcn->head_len)
2938                         return -EINVAL;
2939                 haveinfo = true;
2940         }
2941
2942         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
2943                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
2944                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
2945                 haveinfo = true;
2946         }
2947
2948         if (!haveinfo)
2949                 return -EINVAL;
2950
2951         if (attrs[NL80211_ATTR_IE]) {
2952                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
2953                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
2954         }
2955
2956         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2957                 bcn->proberesp_ies =
2958                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
2959                 bcn->proberesp_ies_len =
2960                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
2961         }
2962
2963         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2964                 bcn->assocresp_ies =
2965                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2966                 bcn->assocresp_ies_len =
2967                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2968         }
2969
2970         if (attrs[NL80211_ATTR_PROBE_RESP]) {
2971                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
2972                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
2973         }
2974
2975         return 0;
2976 }
2977
2978 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2979                                    struct cfg80211_ap_settings *params)
2980 {
2981         struct wireless_dev *wdev;
2982         bool ret = false;
2983
2984         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2985                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2986                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2987                         continue;
2988
2989                 if (!wdev->preset_chandef.chan)
2990                         continue;
2991
2992                 params->chandef = wdev->preset_chandef;
2993                 ret = true;
2994                 break;
2995         }
2996
2997         return ret;
2998 }
2999
3000 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3001                                     enum nl80211_auth_type auth_type,
3002                                     enum nl80211_commands cmd)
3003 {
3004         if (auth_type > NL80211_AUTHTYPE_MAX)
3005                 return false;
3006
3007         switch (cmd) {
3008         case NL80211_CMD_AUTHENTICATE:
3009                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3010                     auth_type == NL80211_AUTHTYPE_SAE)
3011                         return false;
3012                 return true;
3013         case NL80211_CMD_CONNECT:
3014         case NL80211_CMD_START_AP:
3015                 /* SAE not supported yet */
3016                 if (auth_type == NL80211_AUTHTYPE_SAE)
3017                         return false;
3018                 return true;
3019         default:
3020                 return false;
3021         }
3022 }
3023
3024 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3025 {
3026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3027         struct net_device *dev = info->user_ptr[1];
3028         struct wireless_dev *wdev = dev->ieee80211_ptr;
3029         struct cfg80211_ap_settings params;
3030         int err;
3031         u8 radar_detect_width = 0;
3032
3033         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3034             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3035                 return -EOPNOTSUPP;
3036
3037         if (!rdev->ops->start_ap)
3038                 return -EOPNOTSUPP;
3039
3040         if (wdev->beacon_interval)
3041                 return -EALREADY;
3042
3043         memset(&params, 0, sizeof(params));
3044
3045         /* these are required for START_AP */
3046         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3047             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3048             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3049                 return -EINVAL;
3050
3051         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3052         if (err)
3053                 return err;
3054
3055         params.beacon_interval =
3056                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3057         params.dtim_period =
3058                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3059
3060         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3061         if (err)
3062                 return err;
3063
3064         /*
3065          * In theory, some of these attributes should be required here
3066          * but since they were not used when the command was originally
3067          * added, keep them optional for old user space programs to let
3068          * them continue to work with drivers that do not need the
3069          * additional information -- drivers must check!
3070          */
3071         if (info->attrs[NL80211_ATTR_SSID]) {
3072                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3073                 params.ssid_len =
3074                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3075                 if (params.ssid_len == 0 ||
3076                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3077                         return -EINVAL;
3078         }
3079
3080         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3081                 params.hidden_ssid = nla_get_u32(
3082                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3083                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3084                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3085                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3086                         return -EINVAL;
3087         }
3088
3089         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3090
3091         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3092                 params.auth_type = nla_get_u32(
3093                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3094                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3095                                              NL80211_CMD_START_AP))
3096                         return -EINVAL;
3097         } else
3098                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3099
3100         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3101                                       NL80211_MAX_NR_CIPHER_SUITES);
3102         if (err)
3103                 return err;
3104
3105         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3106                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3107                         return -EOPNOTSUPP;
3108                 params.inactivity_timeout = nla_get_u16(
3109                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3110         }
3111
3112         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3113                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3114                         return -EINVAL;
3115                 params.p2p_ctwindow =
3116                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3117                 if (params.p2p_ctwindow > 127)
3118                         return -EINVAL;
3119                 if (params.p2p_ctwindow != 0 &&
3120                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3121                         return -EINVAL;
3122         }
3123
3124         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3125                 u8 tmp;
3126
3127                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3128                         return -EINVAL;
3129                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3130                 if (tmp > 1)
3131                         return -EINVAL;
3132                 params.p2p_opp_ps = tmp;
3133                 if (params.p2p_opp_ps != 0 &&
3134                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3135                         return -EINVAL;
3136         }
3137
3138         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3139                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3140                 if (err)
3141                         return err;
3142         } else if (wdev->preset_chandef.chan) {
3143                 params.chandef = wdev->preset_chandef;
3144         } else if (!nl80211_get_ap_channel(rdev, &params))
3145                 return -EINVAL;
3146
3147         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3148                 return -EINVAL;
3149
3150         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3151         if (err < 0)
3152                 return err;
3153         if (err) {
3154                 radar_detect_width = BIT(params.chandef.width);
3155                 params.radar_required = true;
3156         }
3157
3158         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3159                                            params.chandef.chan,
3160                                            CHAN_MODE_SHARED,
3161                                            radar_detect_width);
3162         if (err)
3163                 return err;
3164
3165         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3166                 params.acl = parse_acl_data(&rdev->wiphy, info);
3167                 if (IS_ERR(params.acl))
3168                         return PTR_ERR(params.acl);
3169         }
3170
3171         err = rdev_start_ap(rdev, dev, &params);
3172         if (!err) {
3173                 wdev->preset_chandef = params.chandef;
3174                 wdev->beacon_interval = params.beacon_interval;
3175                 wdev->channel = params.chandef.chan;
3176                 wdev->ssid_len = params.ssid_len;
3177                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3178         }
3179
3180         kfree(params.acl);
3181
3182         return err;
3183 }
3184
3185 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3186 {
3187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3188         struct net_device *dev = info->user_ptr[1];
3189         struct wireless_dev *wdev = dev->ieee80211_ptr;
3190         struct cfg80211_beacon_data params;
3191         int err;
3192
3193         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3194             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3195                 return -EOPNOTSUPP;
3196
3197         if (!rdev->ops->change_beacon)
3198                 return -EOPNOTSUPP;
3199
3200         if (!wdev->beacon_interval)
3201                 return -EINVAL;
3202
3203         err = nl80211_parse_beacon(info->attrs, &params);
3204         if (err)
3205                 return err;
3206
3207         return rdev_change_beacon(rdev, dev, &params);
3208 }
3209
3210 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3211 {
3212         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3213         struct net_device *dev = info->user_ptr[1];
3214
3215         return cfg80211_stop_ap(rdev, dev);
3216 }
3217
3218 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3219         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3220         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3221         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3222         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3223         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3224         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3225 };
3226
3227 static int parse_station_flags(struct genl_info *info,
3228                                enum nl80211_iftype iftype,
3229                                struct station_parameters *params)
3230 {
3231         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3232         struct nlattr *nla;
3233         int flag;
3234
3235         /*
3236          * Try parsing the new attribute first so userspace
3237          * can specify both for older kernels.
3238          */
3239         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3240         if (nla) {
3241                 struct nl80211_sta_flag_update *sta_flags;
3242
3243                 sta_flags = nla_data(nla);
3244                 params->sta_flags_mask = sta_flags->mask;
3245                 params->sta_flags_set = sta_flags->set;
3246                 params->sta_flags_set &= params->sta_flags_mask;
3247                 if ((params->sta_flags_mask |
3248                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3249                         return -EINVAL;
3250                 return 0;
3251         }
3252
3253         /* if present, parse the old attribute */
3254
3255         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3256         if (!nla)
3257                 return 0;
3258
3259         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3260                              nla, sta_flags_policy))
3261                 return -EINVAL;
3262
3263         /*
3264          * Only allow certain flags for interface types so that
3265          * other attributes are silently ignored. Remember that
3266          * this is backward compatibility code with old userspace
3267          * and shouldn't be hit in other cases anyway.
3268          */
3269         switch (iftype) {
3270         case NL80211_IFTYPE_AP:
3271         case NL80211_IFTYPE_AP_VLAN:
3272         case NL80211_IFTYPE_P2P_GO:
3273                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3274                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3275                                          BIT(NL80211_STA_FLAG_WME) |
3276                                          BIT(NL80211_STA_FLAG_MFP);
3277                 break;
3278         case NL80211_IFTYPE_P2P_CLIENT:
3279         case NL80211_IFTYPE_STATION:
3280                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3281                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3282                 break;
3283         case NL80211_IFTYPE_MESH_POINT:
3284                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3285                                          BIT(NL80211_STA_FLAG_MFP) |
3286                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3287         default:
3288                 return -EINVAL;
3289         }
3290
3291         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3292                 if (flags[flag]) {
3293                         params->sta_flags_set |= (1<<flag);
3294
3295                         /* no longer support new API additions in old API */
3296                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3297                                 return -EINVAL;
3298                 }
3299         }
3300
3301         return 0;
3302 }
3303
3304 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3305                                  int attr)
3306 {
3307         struct nlattr *rate;
3308         u32 bitrate;
3309         u16 bitrate_compat;
3310
3311         rate = nla_nest_start(msg, attr);
3312         if (!rate)
3313                 return false;
3314
3315         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3316         bitrate = cfg80211_calculate_bitrate(info);
3317         /* report 16-bit bitrate only if we can */
3318         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3319         if (bitrate > 0 &&
3320             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3321                 return false;
3322         if (bitrate_compat > 0 &&
3323             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3324                 return false;
3325
3326         if (info->flags & RATE_INFO_FLAGS_MCS) {
3327                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3328                         return false;
3329                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3330                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3331                         return false;
3332                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3333                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3334                         return false;
3335         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3336                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3337                         return false;
3338                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3339                         return false;
3340                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3341                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3342                         return false;
3343                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3344                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3345                         return false;
3346                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3347                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3348                         return false;
3349                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3350                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3351                         return false;
3352                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3353                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3354                         return false;
3355         }
3356
3357         nla_nest_end(msg, rate);
3358         return true;
3359 }
3360
3361 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3362                                int id)
3363 {
3364         void *attr;
3365         int i = 0;
3366
3367         if (!mask)
3368                 return true;
3369
3370         attr = nla_nest_start(msg, id);
3371         if (!attr)
3372                 return false;
3373
3374         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3375                 if (!(mask & BIT(i)))
3376                         continue;
3377
3378                 if (nla_put_u8(msg, i, signal[i]))
3379                         return false;
3380         }
3381
3382         nla_nest_end(msg, attr);
3383
3384         return true;
3385 }
3386
3387 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3388                                 int flags,
3389                                 struct cfg80211_registered_device *rdev,
3390                                 struct net_device *dev,
3391                                 const u8 *mac_addr, struct station_info *sinfo)
3392 {
3393         void *hdr;
3394         struct nlattr *sinfoattr, *bss_param;
3395
3396         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3397         if (!hdr)
3398                 return -1;
3399
3400         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3401             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3402             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3403                 goto nla_put_failure;
3404
3405         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3406         if (!sinfoattr)
3407                 goto nla_put_failure;
3408         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3409             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3410                         sinfo->connected_time))
3411                 goto nla_put_failure;
3412         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3413             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3414                         sinfo->inactive_time))
3415                 goto nla_put_failure;
3416         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3417                               STATION_INFO_RX_BYTES64)) &&
3418             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3419                         (u32)sinfo->rx_bytes))
3420                 goto nla_put_failure;
3421         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3422                               STATION_INFO_TX_BYTES64)) &&
3423             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3424                         (u32)sinfo->tx_bytes))
3425                 goto nla_put_failure;
3426         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3427             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3428                         sinfo->rx_bytes))
3429                 goto nla_put_failure;
3430         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3431             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3432                         sinfo->tx_bytes))
3433                 goto nla_put_failure;
3434         if ((sinfo->filled & STATION_INFO_LLID) &&
3435             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3436                 goto nla_put_failure;
3437         if ((sinfo->filled & STATION_INFO_PLID) &&
3438             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3439                 goto nla_put_failure;
3440         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3441             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3442                        sinfo->plink_state))
3443                 goto nla_put_failure;
3444         switch (rdev->wiphy.signal_type) {
3445         case CFG80211_SIGNAL_TYPE_MBM:
3446                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3447                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3448                                sinfo->signal))
3449                         goto nla_put_failure;
3450                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3451                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3452                                sinfo->signal_avg))
3453                         goto nla_put_failure;
3454                 break;
3455         default:
3456                 break;
3457         }
3458         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3459                 if (!nl80211_put_signal(msg, sinfo->chains,
3460                                         sinfo->chain_signal,
3461                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3462                         goto nla_put_failure;
3463         }
3464         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3465                 if (!nl80211_put_signal(msg, sinfo->chains,
3466                                         sinfo->chain_signal_avg,
3467                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3468                         goto nla_put_failure;
3469         }
3470         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3471                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3472                                           NL80211_STA_INFO_TX_BITRATE))
3473                         goto nla_put_failure;
3474         }
3475         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3476                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3477                                           NL80211_STA_INFO_RX_BITRATE))
3478                         goto nla_put_failure;
3479         }
3480         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3481             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3482                         sinfo->rx_packets))
3483                 goto nla_put_failure;
3484         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3485             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3486                         sinfo->tx_packets))
3487                 goto nla_put_failure;
3488         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3489             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3490                         sinfo->tx_retries))
3491                 goto nla_put_failure;
3492         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3493             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3494                         sinfo->tx_failed))
3495                 goto nla_put_failure;
3496         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3497             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3498                         sinfo->beacon_loss_count))
3499                 goto nla_put_failure;
3500         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3501             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3502                         sinfo->local_pm))
3503                 goto nla_put_failure;
3504         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3505             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3506                         sinfo->peer_pm))
3507                 goto nla_put_failure;
3508         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3509             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3510                         sinfo->nonpeer_pm))
3511                 goto nla_put_failure;
3512         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3513                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3514                 if (!bss_param)
3515                         goto nla_put_failure;
3516
3517                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3518                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3519                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3520                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3521                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3522                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3523                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3524                                sinfo->bss_param.dtim_period) ||
3525                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3526                                 sinfo->bss_param.beacon_interval))
3527                         goto nla_put_failure;
3528
3529                 nla_nest_end(msg, bss_param);
3530         }
3531         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3532             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3533                     sizeof(struct nl80211_sta_flag_update),
3534                     &sinfo->sta_flags))
3535                 goto nla_put_failure;
3536         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3537                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3538                             sinfo->t_offset))
3539                 goto nla_put_failure;
3540         nla_nest_end(msg, sinfoattr);
3541
3542         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3543             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3544                     sinfo->assoc_req_ies))
3545                 goto nla_put_failure;
3546
3547         return genlmsg_end(msg, hdr);
3548
3549  nla_put_failure:
3550         genlmsg_cancel(msg, hdr);
3551         return -EMSGSIZE;
3552 }
3553
3554 static int nl80211_dump_station(struct sk_buff *skb,
3555                                 struct netlink_callback *cb)
3556 {
3557         struct station_info sinfo;
3558         struct cfg80211_registered_device *dev;
3559         struct wireless_dev *wdev;
3560         u8 mac_addr[ETH_ALEN];
3561         int sta_idx = cb->args[2];
3562         int err;
3563
3564         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3565         if (err)
3566                 return err;
3567
3568         if (!wdev->netdev) {
3569                 err = -EINVAL;
3570                 goto out_err;
3571         }
3572
3573         if (!dev->ops->dump_station) {
3574                 err = -EOPNOTSUPP;
3575                 goto out_err;
3576         }
3577
3578         while (1) {
3579                 memset(&sinfo, 0, sizeof(sinfo));
3580                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3581                                         mac_addr, &sinfo);
3582                 if (err == -ENOENT)
3583                         break;
3584                 if (err)
3585                         goto out_err;
3586
3587                 if (nl80211_send_station(skb,
3588                                 NETLINK_CB(cb->skb).portid,
3589                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3590                                 dev, wdev->netdev, mac_addr,
3591                                 &sinfo) < 0)
3592                         goto out;
3593
3594                 sta_idx++;
3595         }
3596
3597
3598  out:
3599         cb->args[2] = sta_idx;
3600         err = skb->len;
3601  out_err:
3602         nl80211_finish_wdev_dump(dev);
3603
3604         return err;
3605 }
3606
3607 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3608 {
3609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3610         struct net_device *dev = info->user_ptr[1];
3611         struct station_info sinfo;
3612         struct sk_buff *msg;
3613         u8 *mac_addr = NULL;
3614         int err;
3615
3616         memset(&sinfo, 0, sizeof(sinfo));
3617
3618         if (!info->attrs[NL80211_ATTR_MAC])
3619                 return -EINVAL;
3620
3621         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3622
3623         if (!rdev->ops->get_station)
3624                 return -EOPNOTSUPP;
3625
3626         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3627         if (err)
3628                 return err;
3629
3630         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3631         if (!msg)
3632                 return -ENOMEM;
3633
3634         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3635                                  rdev, dev, mac_addr, &sinfo) < 0) {
3636                 nlmsg_free(msg);
3637                 return -ENOBUFS;
3638         }
3639
3640         return genlmsg_reply(msg, info);
3641 }
3642
3643 int cfg80211_check_station_change(struct wiphy *wiphy,
3644                                   struct station_parameters *params,
3645                                   enum cfg80211_station_type statype)
3646 {
3647         if (params->listen_interval != -1)
3648                 return -EINVAL;
3649         if (params->aid)
3650                 return -EINVAL;
3651
3652         /* When you run into this, adjust the code below for the new flag */
3653         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3654
3655         switch (statype) {
3656         case CFG80211_STA_MESH_PEER_KERNEL:
3657         case CFG80211_STA_MESH_PEER_USER:
3658                 /*
3659                  * No ignoring the TDLS flag here -- the userspace mesh
3660                  * code doesn't have the bug of including TDLS in the
3661                  * mask everywhere.
3662                  */
3663                 if (params->sta_flags_mask &
3664                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3665                                   BIT(NL80211_STA_FLAG_MFP) |
3666                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3667                         return -EINVAL;
3668                 break;
3669         case CFG80211_STA_TDLS_PEER_SETUP:
3670         case CFG80211_STA_TDLS_PEER_ACTIVE:
3671                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3672                         return -EINVAL;
3673                 /* ignore since it can't change */
3674                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3675                 break;
3676         default:
3677                 /* disallow mesh-specific things */
3678                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3679                         return -EINVAL;
3680                 if (params->local_pm)
3681                         return -EINVAL;
3682                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3683                         return -EINVAL;
3684         }
3685
3686         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3687             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3688                 /* TDLS can't be set, ... */
3689                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3690                         return -EINVAL;
3691                 /*
3692                  * ... but don't bother the driver with it. This works around
3693                  * a hostapd/wpa_supplicant issue -- it always includes the
3694                  * TLDS_PEER flag in the mask even for AP mode.
3695                  */
3696                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3697         }
3698
3699         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3700                 /* reject other things that can't change */
3701                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3702                         return -EINVAL;
3703                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3704                         return -EINVAL;
3705                 if (params->supported_rates)
3706                         return -EINVAL;
3707                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3708                         return -EINVAL;
3709         }
3710
3711         if (statype != CFG80211_STA_AP_CLIENT) {
3712                 if (params->vlan)
3713                         return -EINVAL;
3714         }
3715
3716         switch (statype) {
3717         case CFG80211_STA_AP_MLME_CLIENT:
3718                 /* Use this only for authorizing/unauthorizing a station */
3719                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3720                         return -EOPNOTSUPP;
3721                 break;
3722         case CFG80211_STA_AP_CLIENT:
3723                 /* accept only the listed bits */
3724                 if (params->sta_flags_mask &
3725                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3726                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3727                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3728                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3729                                   BIT(NL80211_STA_FLAG_WME) |
3730                                   BIT(NL80211_STA_FLAG_MFP)))
3731                         return -EINVAL;
3732
3733                 /* but authenticated/associated only if driver handles it */
3734                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3735                     params->sta_flags_mask &
3736                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3737                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3738                         return -EINVAL;
3739                 break;
3740         case CFG80211_STA_IBSS:
3741         case CFG80211_STA_AP_STA:
3742                 /* reject any changes other than AUTHORIZED */
3743                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3744                         return -EINVAL;
3745                 break;
3746         case CFG80211_STA_TDLS_PEER_SETUP:
3747                 /* reject any changes other than AUTHORIZED or WME */
3748                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3749                                                BIT(NL80211_STA_FLAG_WME)))
3750                         return -EINVAL;
3751                 /* force (at least) rates when authorizing */
3752                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3753                     !params->supported_rates)
3754                         return -EINVAL;
3755                 break;
3756         case CFG80211_STA_TDLS_PEER_ACTIVE:
3757                 /* reject any changes */
3758                 return -EINVAL;
3759         case CFG80211_STA_MESH_PEER_KERNEL:
3760                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3761                         return -EINVAL;
3762                 break;
3763         case CFG80211_STA_MESH_PEER_USER:
3764                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3765                         return -EINVAL;
3766                 break;
3767         }
3768
3769         return 0;
3770 }
3771 EXPORT_SYMBOL(cfg80211_check_station_change);
3772
3773 /*
3774  * Get vlan interface making sure it is running and on the right wiphy.
3775  */
3776 static struct net_device *get_vlan(struct genl_info *info,
3777                                    struct cfg80211_registered_device *rdev)
3778 {
3779         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3780         struct net_device *v;
3781         int ret;
3782
3783         if (!vlanattr)
3784                 return NULL;
3785
3786         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3787         if (!v)
3788                 return ERR_PTR(-ENODEV);
3789
3790         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3791                 ret = -EINVAL;
3792                 goto error;
3793         }
3794
3795         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3796             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3797             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3798                 ret = -EINVAL;
3799                 goto error;
3800         }
3801
3802         if (!netif_running(v)) {
3803                 ret = -ENETDOWN;
3804                 goto error;
3805         }
3806
3807         return v;
3808  error:
3809         dev_put(v);
3810         return ERR_PTR(ret);
3811 }
3812
3813 static struct nla_policy
3814 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3815         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3816         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3817 };
3818
3819 static int nl80211_parse_sta_wme(struct genl_info *info,
3820                                  struct station_parameters *params)
3821 {
3822         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3823         struct nlattr *nla;
3824         int err;
3825
3826         /* parse WME attributes if present */
3827         if (!info->attrs[NL80211_ATTR_STA_WME])
3828                 return 0;
3829
3830         nla = info->attrs[NL80211_ATTR_STA_WME];
3831         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3832                                nl80211_sta_wme_policy);
3833         if (err)
3834                 return err;
3835
3836         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3837                 params->uapsd_queues = nla_get_u8(
3838                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3839         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3840                 return -EINVAL;
3841
3842         if (tb[NL80211_STA_WME_MAX_SP])
3843                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3844
3845         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3846                 return -EINVAL;
3847
3848         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3849
3850         return 0;
3851 }
3852
3853 static int nl80211_set_station_tdls(struct genl_info *info,
3854                                     struct station_parameters *params)
3855 {
3856         /* Dummy STA entry gets updated once the peer capabilities are known */
3857         if (info->attrs[NL80211_ATTR_PEER_AID])
3858                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3859         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3860                 params->ht_capa =
3861                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3862         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3863                 params->vht_capa =
3864                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3865
3866         return nl80211_parse_sta_wme(info, params);
3867 }
3868
3869 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3870 {
3871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3872         struct net_device *dev = info->user_ptr[1];
3873         struct station_parameters params;
3874         u8 *mac_addr;
3875         int err;
3876
3877         memset(&params, 0, sizeof(params));
3878
3879         params.listen_interval = -1;
3880
3881         if (!rdev->ops->change_station)
3882                 return -EOPNOTSUPP;
3883
3884         if (info->attrs[NL80211_ATTR_STA_AID])
3885                 return -EINVAL;
3886
3887         if (!info->attrs[NL80211_ATTR_MAC])
3888                 return -EINVAL;
3889
3890         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3891
3892         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3893                 params.supported_rates =
3894                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3895                 params.supported_rates_len =
3896                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3897         }
3898
3899         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3900                 params.capability =
3901                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3902                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3903         }
3904
3905         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3906                 params.ext_capab =
3907                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3908                 params.ext_capab_len =
3909                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3910         }
3911
3912         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3913                 return -EINVAL;
3914
3915         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3916                 return -EINVAL;
3917
3918         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3919                 params.plink_action =
3920                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3921                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3922                         return -EINVAL;
3923         }
3924
3925         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3926                 params.plink_state =
3927                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3928                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3929                         return -EINVAL;
3930                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3931         }
3932
3933         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3934                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3935                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3936
3937                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3938                     pm > NL80211_MESH_POWER_MAX)
3939                         return -EINVAL;
3940
3941                 params.local_pm = pm;
3942         }
3943
3944         /* Include parameters for TDLS peer (will check later) */
3945         err = nl80211_set_station_tdls(info, &params);
3946         if (err)
3947                 return err;
3948
3949         params.vlan = get_vlan(info, rdev);
3950         if (IS_ERR(params.vlan))
3951                 return PTR_ERR(params.vlan);
3952
3953         switch (dev->ieee80211_ptr->iftype) {
3954         case NL80211_IFTYPE_AP:
3955         case NL80211_IFTYPE_AP_VLAN:
3956         case NL80211_IFTYPE_P2P_GO:
3957         case NL80211_IFTYPE_P2P_CLIENT:
3958         case NL80211_IFTYPE_STATION:
3959         case NL80211_IFTYPE_ADHOC:
3960         case NL80211_IFTYPE_MESH_POINT:
3961                 break;
3962         default:
3963                 err = -EOPNOTSUPP;
3964                 goto out_put_vlan;
3965         }
3966
3967         /* driver will call cfg80211_check_station_change() */
3968         err = rdev_change_station(rdev, dev, mac_addr, &params);
3969
3970  out_put_vlan:
3971         if (params.vlan)
3972                 dev_put(params.vlan);
3973
3974         return err;
3975 }
3976
3977 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3978 {
3979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3980         int err;
3981         struct net_device *dev = info->user_ptr[1];
3982         struct station_parameters params;
3983         u8 *mac_addr = NULL;
3984
3985         memset(&params, 0, sizeof(params));
3986
3987         if (!rdev->ops->add_station)
3988                 return -EOPNOTSUPP;
3989
3990         if (!info->attrs[NL80211_ATTR_MAC])
3991                 return -EINVAL;
3992
3993         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3994                 return -EINVAL;
3995
3996         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3997                 return -EINVAL;
3998
3999         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4000             !info->attrs[NL80211_ATTR_PEER_AID])
4001                 return -EINVAL;
4002
4003         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4004         params.supported_rates =
4005                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4006         params.supported_rates_len =
4007                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4008         params.listen_interval =
4009                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4010
4011         if (info->attrs[NL80211_ATTR_PEER_AID])
4012                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4013         else
4014                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4015         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4016                 return -EINVAL;
4017
4018         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4019                 params.capability =
4020                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4021                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4022         }
4023
4024         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4025                 params.ext_capab =
4026                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4027                 params.ext_capab_len =
4028                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4029         }
4030
4031         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4032                 params.ht_capa =
4033                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4034
4035         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4036                 params.vht_capa =
4037                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4038
4039         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4040                 params.plink_action =
4041                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4042                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4043                         return -EINVAL;
4044         }
4045
4046         err = nl80211_parse_sta_wme(info, &params);
4047         if (err)
4048                 return err;
4049
4050         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4051                 return -EINVAL;
4052
4053         /* When you run into this, adjust the code below for the new flag */
4054         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4055
4056         switch (dev->ieee80211_ptr->iftype) {
4057         case NL80211_IFTYPE_AP:
4058         case NL80211_IFTYPE_AP_VLAN:
4059         case NL80211_IFTYPE_P2P_GO:
4060                 /* ignore WME attributes if iface/sta is not capable */
4061                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4062                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4063                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4064
4065                 /* TDLS peers cannot be added */
4066                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4067                     info->attrs[NL80211_ATTR_PEER_AID])
4068                         return -EINVAL;
4069                 /* but don't bother the driver with it */
4070                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4071
4072                 /* allow authenticated/associated only if driver handles it */
4073                 if (!(rdev->wiphy.features &
4074                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4075                     params.sta_flags_mask &
4076                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4077                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4078                         return -EINVAL;
4079
4080                 /* must be last in here for error handling */
4081                 params.vlan = get_vlan(info, rdev);
4082                 if (IS_ERR(params.vlan))
4083                         return PTR_ERR(params.vlan);
4084                 break;
4085         case NL80211_IFTYPE_MESH_POINT:
4086                 /* ignore uAPSD data */
4087                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4088
4089                 /* associated is disallowed */
4090                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4091                         return -EINVAL;
4092                 /* TDLS peers cannot be added */
4093                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4094                     info->attrs[NL80211_ATTR_PEER_AID])
4095                         return -EINVAL;
4096                 break;
4097         case NL80211_IFTYPE_STATION:
4098         case NL80211_IFTYPE_P2P_CLIENT:
4099                 /* ignore uAPSD data */
4100                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4101
4102                 /* these are disallowed */
4103                 if (params.sta_flags_mask &
4104                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4105                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4106                         return -EINVAL;
4107                 /* Only TDLS peers can be added */
4108                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4109                         return -EINVAL;
4110                 /* Can only add if TDLS ... */
4111                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4112                         return -EOPNOTSUPP;
4113                 /* ... with external setup is supported */
4114                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4115                         return -EOPNOTSUPP;
4116                 /*
4117                  * Older wpa_supplicant versions always mark the TDLS peer
4118                  * as authorized, but it shouldn't yet be.
4119                  */
4120                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4121                 break;
4122         default:
4123                 return -EOPNOTSUPP;
4124         }
4125
4126         /* be aware of params.vlan when changing code here */
4127
4128         err = rdev_add_station(rdev, dev, mac_addr, &params);
4129
4130         if (params.vlan)
4131                 dev_put(params.vlan);
4132         return err;
4133 }
4134
4135 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4136 {
4137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4138         struct net_device *dev = info->user_ptr[1];
4139         u8 *mac_addr = NULL;
4140
4141         if (info->attrs[NL80211_ATTR_MAC])
4142                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4143
4144         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4145             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4146             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4147             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4148                 return -EINVAL;
4149
4150         if (!rdev->ops->del_station)
4151                 return -EOPNOTSUPP;
4152
4153         return rdev_del_station(rdev, dev, mac_addr);
4154 }
4155
4156 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4157                                 int flags, struct net_device *dev,
4158                                 u8 *dst, u8 *next_hop,
4159                                 struct mpath_info *pinfo)
4160 {
4161         void *hdr;
4162         struct nlattr *pinfoattr;
4163
4164         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4165         if (!hdr)
4166                 return -1;
4167
4168         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4169             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4170             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4171             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4172                 goto nla_put_failure;
4173
4174         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4175         if (!pinfoattr)
4176                 goto nla_put_failure;
4177         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4178             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4179                         pinfo->frame_qlen))
4180                 goto nla_put_failure;
4181         if (((pinfo->filled & MPATH_INFO_SN) &&
4182              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4183             ((pinfo->filled & MPATH_INFO_METRIC) &&
4184              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4185                          pinfo->metric)) ||
4186             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4187              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4188                          pinfo->exptime)) ||
4189             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4190              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4191                         pinfo->flags)) ||
4192             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4193              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4194                          pinfo->discovery_timeout)) ||
4195             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4196              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4197                         pinfo->discovery_retries)))
4198                 goto nla_put_failure;
4199
4200         nla_nest_end(msg, pinfoattr);
4201
4202         return genlmsg_end(msg, hdr);
4203
4204  nla_put_failure:
4205         genlmsg_cancel(msg, hdr);
4206         return -EMSGSIZE;
4207 }
4208
4209 static int nl80211_dump_mpath(struct sk_buff *skb,
4210                               struct netlink_callback *cb)
4211 {
4212         struct mpath_info pinfo;
4213         struct cfg80211_registered_device *dev;
4214         struct wireless_dev *wdev;
4215         u8 dst[ETH_ALEN];
4216         u8 next_hop[ETH_ALEN];
4217         int path_idx = cb->args[2];
4218         int err;
4219
4220         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4221         if (err)
4222                 return err;
4223
4224         if (!dev->ops->dump_mpath) {
4225                 err = -EOPNOTSUPP;
4226                 goto out_err;
4227         }
4228
4229         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4230                 err = -EOPNOTSUPP;
4231                 goto out_err;
4232         }
4233
4234         while (1) {
4235                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4236                                       next_hop, &pinfo);
4237                 if (err == -ENOENT)
4238                         break;
4239                 if (err)
4240                         goto out_err;
4241
4242                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4243                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4244                                        wdev->netdev, dst, next_hop,
4245                                        &pinfo) < 0)
4246                         goto out;
4247
4248                 path_idx++;
4249         }
4250
4251
4252  out:
4253         cb->args[2] = path_idx;
4254         err = skb->len;
4255  out_err:
4256         nl80211_finish_wdev_dump(dev);
4257         return err;
4258 }
4259
4260 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4261 {
4262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4263         int err;
4264         struct net_device *dev = info->user_ptr[1];
4265         struct mpath_info pinfo;
4266         struct sk_buff *msg;
4267         u8 *dst = NULL;
4268         u8 next_hop[ETH_ALEN];
4269
4270         memset(&pinfo, 0, sizeof(pinfo));
4271
4272         if (!info->attrs[NL80211_ATTR_MAC])
4273                 return -EINVAL;
4274
4275         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4276
4277         if (!rdev->ops->get_mpath)
4278                 return -EOPNOTSUPP;
4279
4280         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4281                 return -EOPNOTSUPP;
4282
4283         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4284         if (err)
4285                 return err;
4286
4287         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4288         if (!msg)
4289                 return -ENOMEM;
4290
4291         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4292                                  dev, dst, next_hop, &pinfo) < 0) {
4293                 nlmsg_free(msg);
4294                 return -ENOBUFS;
4295         }
4296
4297         return genlmsg_reply(msg, info);
4298 }
4299
4300 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4301 {
4302         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4303         struct net_device *dev = info->user_ptr[1];
4304         u8 *dst = NULL;
4305         u8 *next_hop = NULL;
4306
4307         if (!info->attrs[NL80211_ATTR_MAC])
4308                 return -EINVAL;
4309
4310         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4311                 return -EINVAL;
4312
4313         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4314         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4315
4316         if (!rdev->ops->change_mpath)
4317                 return -EOPNOTSUPP;
4318
4319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4320                 return -EOPNOTSUPP;
4321
4322         return rdev_change_mpath(rdev, dev, dst, next_hop);
4323 }
4324
4325 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4326 {
4327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4328         struct net_device *dev = info->user_ptr[1];
4329         u8 *dst = NULL;
4330         u8 *next_hop = NULL;
4331
4332         if (!info->attrs[NL80211_ATTR_MAC])
4333                 return -EINVAL;
4334
4335         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4336                 return -EINVAL;
4337
4338         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4339         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4340
4341         if (!rdev->ops->add_mpath)
4342                 return -EOPNOTSUPP;
4343
4344         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4345                 return -EOPNOTSUPP;
4346
4347         return rdev_add_mpath(rdev, dev, dst, next_hop);
4348 }
4349
4350 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4351 {
4352         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4353         struct net_device *dev = info->user_ptr[1];
4354         u8 *dst = NULL;
4355
4356         if (info->attrs[NL80211_ATTR_MAC])
4357                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4358
4359         if (!rdev->ops->del_mpath)
4360                 return -EOPNOTSUPP;
4361
4362         return rdev_del_mpath(rdev, dev, dst);
4363 }
4364
4365 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4366 {
4367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4368         struct net_device *dev = info->user_ptr[1];
4369         struct bss_parameters params;
4370
4371         memset(&params, 0, sizeof(params));
4372         /* default to not changing parameters */
4373         params.use_cts_prot = -1;
4374         params.use_short_preamble = -1;
4375         params.use_short_slot_time = -1;
4376         params.ap_isolate = -1;
4377         params.ht_opmode = -1;
4378         params.p2p_ctwindow = -1;
4379         params.p2p_opp_ps = -1;
4380
4381         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4382                 params.use_cts_prot =
4383                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4384         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4385                 params.use_short_preamble =
4386                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4387         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4388                 params.use_short_slot_time =
4389                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4390         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4391                 params.basic_rates =
4392                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4393                 params.basic_rates_len =
4394                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4395         }
4396         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4397                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4398         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4399                 params.ht_opmode =
4400                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4401
4402         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4403                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4404                         return -EINVAL;
4405                 params.p2p_ctwindow =
4406                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4407                 if (params.p2p_ctwindow < 0)
4408                         return -EINVAL;
4409                 if (params.p2p_ctwindow != 0 &&
4410                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4411                         return -EINVAL;
4412         }
4413
4414         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4415                 u8 tmp;
4416
4417                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4418                         return -EINVAL;
4419                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4420                 if (tmp > 1)
4421                         return -EINVAL;
4422                 params.p2p_opp_ps = tmp;
4423                 if (params.p2p_opp_ps &&
4424                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4425                         return -EINVAL;
4426         }
4427
4428         if (!rdev->ops->change_bss)
4429                 return -EOPNOTSUPP;
4430
4431         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4432             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4433                 return -EOPNOTSUPP;
4434
4435         return rdev_change_bss(rdev, dev, &params);
4436 }
4437
4438 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4439         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4440         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4441         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4442         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4443         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4444         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4445 };
4446
4447 static int parse_reg_rule(struct nlattr *tb[],
4448         struct ieee80211_reg_rule *reg_rule)
4449 {
4450         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4451         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4452
4453         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4454                 return -EINVAL;
4455         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4456                 return -EINVAL;
4457         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4458                 return -EINVAL;
4459         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4460                 return -EINVAL;
4461         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4462                 return -EINVAL;
4463
4464         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4465
4466         freq_range->start_freq_khz =
4467                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4468         freq_range->end_freq_khz =
4469                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4470         freq_range->max_bandwidth_khz =
4471                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4472
4473         power_rule->max_eirp =
4474                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4475
4476         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4477                 power_rule->max_antenna_gain =
4478                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4479
4480         return 0;
4481 }
4482
4483 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4484 {
4485         int r;
4486         char *data = NULL;
4487         enum nl80211_user_reg_hint_type user_reg_hint_type;
4488
4489         /*
4490          * You should only get this when cfg80211 hasn't yet initialized
4491          * completely when built-in to the kernel right between the time
4492          * window between nl80211_init() and regulatory_init(), if that is
4493          * even possible.
4494          */
4495         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4496                 return -EINPROGRESS;
4497
4498         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4499                 return -EINVAL;
4500
4501         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4502
4503         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4504                 user_reg_hint_type =
4505                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4506         else
4507                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4508
4509         switch (user_reg_hint_type) {
4510         case NL80211_USER_REG_HINT_USER:
4511         case NL80211_USER_REG_HINT_CELL_BASE:
4512                 break;
4513         default:
4514                 return -EINVAL;
4515         }
4516
4517         r = regulatory_hint_user(data, user_reg_hint_type);
4518
4519         return r;
4520 }
4521
4522 static int nl80211_get_mesh_config(struct sk_buff *skb,
4523                                    struct genl_info *info)
4524 {
4525         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4526         struct net_device *dev = info->user_ptr[1];
4527         struct wireless_dev *wdev = dev->ieee80211_ptr;
4528         struct mesh_config cur_params;
4529         int err = 0;
4530         void *hdr;
4531         struct nlattr *pinfoattr;
4532         struct sk_buff *msg;
4533
4534         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4535                 return -EOPNOTSUPP;
4536
4537         if (!rdev->ops->get_mesh_config)
4538                 return -EOPNOTSUPP;
4539
4540         wdev_lock(wdev);
4541         /* If not connected, get default parameters */
4542         if (!wdev->mesh_id_len)
4543                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4544         else
4545                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4546         wdev_unlock(wdev);
4547
4548         if (err)
4549                 return err;
4550
4551         /* Draw up a netlink message to send back */
4552         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4553         if (!msg)
4554                 return -ENOMEM;
4555         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4556                              NL80211_CMD_GET_MESH_CONFIG);
4557         if (!hdr)
4558                 goto out;
4559         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4560         if (!pinfoattr)
4561                 goto nla_put_failure;
4562         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4563             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4564                         cur_params.dot11MeshRetryTimeout) ||
4565             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4566                         cur_params.dot11MeshConfirmTimeout) ||
4567             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4568                         cur_params.dot11MeshHoldingTimeout) ||
4569             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4570                         cur_params.dot11MeshMaxPeerLinks) ||
4571             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4572                        cur_params.dot11MeshMaxRetries) ||
4573             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4574                        cur_params.dot11MeshTTL) ||
4575             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4576                        cur_params.element_ttl) ||
4577             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4578                        cur_params.auto_open_plinks) ||
4579             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4580                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4581             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4582                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4583             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4584                         cur_params.path_refresh_time) ||
4585             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4586                         cur_params.min_discovery_timeout) ||
4587             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4588                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4589             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4590                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4591             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4592                         cur_params.dot11MeshHWMPperrMinInterval) ||
4593             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4594                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4595             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4596                        cur_params.dot11MeshHWMPRootMode) ||
4597             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4598                         cur_params.dot11MeshHWMPRannInterval) ||
4599             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4600                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4601             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4602                        cur_params.dot11MeshForwarding) ||
4603             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4604                         cur_params.rssi_threshold) ||
4605             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4606                         cur_params.ht_opmode) ||
4607             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4608                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4609             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4610                         cur_params.dot11MeshHWMProotInterval) ||
4611             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4612                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4613             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4614                         cur_params.power_mode) ||
4615             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4616                         cur_params.dot11MeshAwakeWindowDuration) ||
4617             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4618                         cur_params.plink_timeout))
4619                 goto nla_put_failure;
4620         nla_nest_end(msg, pinfoattr);
4621         genlmsg_end(msg, hdr);
4622         return genlmsg_reply(msg, info);
4623
4624  nla_put_failure:
4625         genlmsg_cancel(msg, hdr);
4626  out:
4627         nlmsg_free(msg);
4628         return -ENOBUFS;
4629 }
4630
4631 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4632         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4633         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4634         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4635         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4636         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4637         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4638         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4639         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4640         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4641         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4642         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4643         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4644         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4645         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4646         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4647         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4648         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4649         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4650         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4651         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4652         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4653         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4654         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4655         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4656         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4657         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4658         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4659         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4660 };
4661
4662 static const struct nla_policy
4663         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4664         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4665         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4666         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4667         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4668         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4669         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4670         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4671                                     .len = IEEE80211_MAX_DATA_LEN },
4672         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4673 };
4674
4675 static int nl80211_parse_mesh_config(struct genl_info *info,
4676                                      struct mesh_config *cfg,
4677                                      u32 *mask_out)
4678 {
4679         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4680         u32 mask = 0;
4681
4682 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4683 do {                                                                        \
4684         if (tb[attr]) {                                                     \
4685                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4686                         return -EINVAL;                                     \
4687                 cfg->param = fn(tb[attr]);                                  \
4688                 mask |= (1 << (attr - 1));                                  \
4689         }                                                                   \
4690 } while (0)
4691
4692
4693         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4694                 return -EINVAL;
4695         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4696                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4697                              nl80211_meshconf_params_policy))
4698                 return -EINVAL;
4699
4700         /* This makes sure that there aren't more than 32 mesh config
4701          * parameters (otherwise our bitfield scheme would not work.) */
4702         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4703
4704         /* Fill in the params struct */
4705         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4706                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4707                                   nla_get_u16);
4708         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4709                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4710                                   nla_get_u16);
4711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4712                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4713                                   nla_get_u16);
4714         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4715                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4716                                   nla_get_u16);
4717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4718                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4719                                   nla_get_u8);
4720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4721                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4722         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4723                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4724                                   nla_get_u8);
4725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4726                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4727                                   nla_get_u8);
4728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4729                                   1, 255, mask,
4730                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4731                                   nla_get_u32);
4732         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4733                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4734                                   nla_get_u8);
4735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4736                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4737                                   nla_get_u32);
4738         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4739                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4740                                   nla_get_u16);
4741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4742                                   1, 65535, mask,
4743                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4744                                   nla_get_u32);
4745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4746                                   1, 65535, mask,
4747                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4748                                   nla_get_u16);
4749         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4750                                   1, 65535, mask,
4751                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4752                                   nla_get_u16);
4753         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4754                                   dot11MeshHWMPnetDiameterTraversalTime,
4755                                   1, 65535, mask,
4756                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4757                                   nla_get_u16);
4758         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4759                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4760                                   nla_get_u8);
4761         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4762                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4763                                   nla_get_u16);
4764         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4765                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4766                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4767                                   nla_get_u8);
4768         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4769                                   mask, NL80211_MESHCONF_FORWARDING,
4770                                   nla_get_u8);
4771         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4772                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4773                                   nla_get_u32);
4774         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4775                                   mask, NL80211_MESHCONF_HT_OPMODE,
4776                                   nla_get_u16);
4777         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4778                                   1, 65535, mask,
4779                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4780                                   nla_get_u32);
4781         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4782                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4783                                   nla_get_u16);
4784         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4785                                   dot11MeshHWMPconfirmationInterval,
4786                                   1, 65535, mask,
4787                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4788                                   nla_get_u16);
4789         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4790                                   NL80211_MESH_POWER_ACTIVE,
4791                                   NL80211_MESH_POWER_MAX,
4792                                   mask, NL80211_MESHCONF_POWER_MODE,
4793                                   nla_get_u32);
4794         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4795                                   0, 65535, mask,
4796                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4797         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4798                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4799                                   nla_get_u32);
4800         if (mask_out)
4801                 *mask_out = mask;
4802
4803         return 0;
4804
4805 #undef FILL_IN_MESH_PARAM_IF_SET
4806 }
4807
4808 static int nl80211_parse_mesh_setup(struct genl_info *info,
4809                                      struct mesh_setup *setup)
4810 {
4811         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4812         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4813
4814         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4815                 return -EINVAL;
4816         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4817                              info->attrs[NL80211_ATTR_MESH_SETUP],
4818                              nl80211_mesh_setup_params_policy))
4819                 return -EINVAL;
4820
4821         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4822                 setup->sync_method =
4823                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4824                  IEEE80211_SYNC_METHOD_VENDOR :
4825                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4826
4827         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4828                 setup->path_sel_proto =
4829                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4830                  IEEE80211_PATH_PROTOCOL_VENDOR :
4831                  IEEE80211_PATH_PROTOCOL_HWMP;
4832
4833         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4834                 setup->path_metric =
4835                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4836                  IEEE80211_PATH_METRIC_VENDOR :
4837                  IEEE80211_PATH_METRIC_AIRTIME;
4838
4839
4840         if (tb[NL80211_MESH_SETUP_IE]) {
4841                 struct nlattr *ieattr =
4842                         tb[NL80211_MESH_SETUP_IE];
4843                 if (!is_valid_ie_attr(ieattr))
4844                         return -EINVAL;
4845                 setup->ie = nla_data(ieattr);
4846                 setup->ie_len = nla_len(ieattr);
4847         }
4848         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4849             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4850                 return -EINVAL;
4851         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4852         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4853         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4854         if (setup->is_secure)
4855                 setup->user_mpm = true;
4856
4857         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4858                 if (!setup->user_mpm)
4859                         return -EINVAL;
4860                 setup->auth_id =
4861                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4862         }
4863
4864         return 0;
4865 }
4866
4867 static int nl80211_update_mesh_config(struct sk_buff *skb,
4868                                       struct genl_info *info)
4869 {
4870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4871         struct net_device *dev = info->user_ptr[1];
4872         struct wireless_dev *wdev = dev->ieee80211_ptr;
4873         struct mesh_config cfg;
4874         u32 mask;
4875         int err;
4876
4877         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4878                 return -EOPNOTSUPP;
4879
4880         if (!rdev->ops->update_mesh_config)
4881                 return -EOPNOTSUPP;
4882
4883         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4884         if (err)
4885                 return err;
4886
4887         wdev_lock(wdev);
4888         if (!wdev->mesh_id_len)
4889                 err = -ENOLINK;
4890
4891         if (!err)
4892                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4893
4894         wdev_unlock(wdev);
4895
4896         return err;
4897 }
4898
4899 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4900 {
4901         const struct ieee80211_regdomain *regdom;
4902         struct sk_buff *msg;
4903         void *hdr = NULL;
4904         struct nlattr *nl_reg_rules;
4905         unsigned int i;
4906
4907         if (!cfg80211_regdomain)
4908                 return -EINVAL;
4909
4910         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4911         if (!msg)
4912                 return -ENOBUFS;
4913
4914         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4915                              NL80211_CMD_GET_REG);
4916         if (!hdr)
4917                 goto put_failure;
4918
4919         if (reg_last_request_cell_base() &&
4920             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4921                         NL80211_USER_REG_HINT_CELL_BASE))
4922                 goto nla_put_failure;
4923
4924         rcu_read_lock();
4925         regdom = rcu_dereference(cfg80211_regdomain);
4926
4927         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4928             (regdom->dfs_region &&
4929              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4930                 goto nla_put_failure_rcu;
4931
4932         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4933         if (!nl_reg_rules)
4934                 goto nla_put_failure_rcu;
4935
4936         for (i = 0; i < regdom->n_reg_rules; i++) {
4937                 struct nlattr *nl_reg_rule;
4938                 const struct ieee80211_reg_rule *reg_rule;
4939                 const struct ieee80211_freq_range *freq_range;
4940                 const struct ieee80211_power_rule *power_rule;
4941
4942                 reg_rule = &regdom->reg_rules[i];
4943                 freq_range = &reg_rule->freq_range;
4944                 power_rule = &reg_rule->power_rule;
4945
4946                 nl_reg_rule = nla_nest_start(msg, i);
4947                 if (!nl_reg_rule)
4948                         goto nla_put_failure_rcu;
4949
4950                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4951                                 reg_rule->flags) ||
4952                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4953                                 freq_range->start_freq_khz) ||
4954                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4955                                 freq_range->end_freq_khz) ||
4956                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4957                                 freq_range->max_bandwidth_khz) ||
4958                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4959                                 power_rule->max_antenna_gain) ||
4960                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4961                                 power_rule->max_eirp))
4962                         goto nla_put_failure_rcu;
4963
4964                 nla_nest_end(msg, nl_reg_rule);
4965         }
4966         rcu_read_unlock();
4967
4968         nla_nest_end(msg, nl_reg_rules);
4969
4970         genlmsg_end(msg, hdr);
4971         return genlmsg_reply(msg, info);
4972
4973 nla_put_failure_rcu:
4974         rcu_read_unlock();
4975 nla_put_failure:
4976         genlmsg_cancel(msg, hdr);
4977 put_failure:
4978         nlmsg_free(msg);
4979         return -EMSGSIZE;
4980 }
4981
4982 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4983 {
4984         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4985         struct nlattr *nl_reg_rule;
4986         char *alpha2 = NULL;
4987         int rem_reg_rules = 0, r = 0;
4988         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4989         u8 dfs_region = 0;
4990         struct ieee80211_regdomain *rd = NULL;
4991
4992         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4993                 return -EINVAL;
4994
4995         if (!info->attrs[NL80211_ATTR_REG_RULES])
4996                 return -EINVAL;
4997
4998         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4999
5000         if (info->attrs[NL80211_ATTR_DFS_REGION])
5001                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5002
5003         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5004                             rem_reg_rules) {
5005                 num_rules++;
5006                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5007                         return -EINVAL;
5008         }
5009
5010         size_of_regd = sizeof(struct ieee80211_regdomain) +
5011                        num_rules * sizeof(struct ieee80211_reg_rule);
5012
5013         rd = kzalloc(size_of_regd, GFP_KERNEL);
5014         if (!rd)
5015                 return -ENOMEM;
5016
5017         rd->n_reg_rules = num_rules;
5018         rd->alpha2[0] = alpha2[0];
5019         rd->alpha2[1] = alpha2[1];
5020
5021         /*
5022          * Disable DFS master mode if the DFS region was
5023          * not supported or known on this kernel.
5024          */
5025         if (reg_supported_dfs_region(dfs_region))
5026                 rd->dfs_region = dfs_region;
5027
5028         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5029                             rem_reg_rules) {
5030                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5031                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5032                           reg_rule_policy);
5033                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5034                 if (r)
5035                         goto bad_reg;
5036
5037                 rule_idx++;
5038
5039                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5040                         r = -EINVAL;
5041                         goto bad_reg;
5042                 }
5043         }
5044
5045         r = set_regdom(rd);
5046         /* set_regdom took ownership */
5047         rd = NULL;
5048
5049  bad_reg:
5050         kfree(rd);
5051         return r;
5052 }
5053
5054 static int validate_scan_freqs(struct nlattr *freqs)
5055 {
5056         struct nlattr *attr1, *attr2;
5057         int n_channels = 0, tmp1, tmp2;
5058
5059         nla_for_each_nested(attr1, freqs, tmp1) {
5060                 n_channels++;
5061                 /*
5062                  * Some hardware has a limited channel list for
5063                  * scanning, and it is pretty much nonsensical
5064                  * to scan for a channel twice, so disallow that
5065                  * and don't require drivers to check that the
5066                  * channel list they get isn't longer than what
5067                  * they can scan, as long as they can scan all
5068                  * the channels they registered at once.
5069                  */
5070                 nla_for_each_nested(attr2, freqs, tmp2)
5071                         if (attr1 != attr2 &&
5072                             nla_get_u32(attr1) == nla_get_u32(attr2))
5073                                 return 0;
5074         }
5075
5076         return n_channels;
5077 }
5078
5079 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5080 {
5081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5082         struct wireless_dev *wdev = info->user_ptr[1];
5083         struct cfg80211_scan_request *request;
5084         struct nlattr *attr;
5085         struct wiphy *wiphy;
5086         int err, tmp, n_ssids = 0, n_channels, i;
5087         size_t ie_len;
5088
5089         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5090                 return -EINVAL;
5091
5092         wiphy = &rdev->wiphy;
5093
5094         if (!rdev->ops->scan)
5095                 return -EOPNOTSUPP;
5096
5097         if (rdev->scan_req) {
5098                 err = -EBUSY;
5099                 goto unlock;
5100         }
5101
5102         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5103                 n_channels = validate_scan_freqs(
5104                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5105                 if (!n_channels) {
5106                         err = -EINVAL;
5107                         goto unlock;
5108                 }
5109         } else {
5110                 enum ieee80211_band band;
5111                 n_channels = 0;
5112
5113                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5114                         if (wiphy->bands[band])
5115                                 n_channels += wiphy->bands[band]->n_channels;
5116         }
5117
5118         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5119                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5120                         n_ssids++;
5121
5122         if (n_ssids > wiphy->max_scan_ssids) {
5123                 err = -EINVAL;
5124                 goto unlock;
5125         }
5126
5127         if (info->attrs[NL80211_ATTR_IE])
5128                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5129         else
5130                 ie_len = 0;
5131
5132         if (ie_len > wiphy->max_scan_ie_len) {
5133                 err = -EINVAL;
5134                 goto unlock;
5135         }
5136
5137         request = kzalloc(sizeof(*request)
5138                         + sizeof(*request->ssids) * n_ssids
5139                         + sizeof(*request->channels) * n_channels
5140                         + ie_len, GFP_KERNEL);
5141         if (!request) {
5142                 err = -ENOMEM;
5143                 goto unlock;
5144         }
5145
5146         if (n_ssids)
5147                 request->ssids = (void *)&request->channels[n_channels];
5148         request->n_ssids = n_ssids;
5149         if (ie_len) {
5150                 if (request->ssids)
5151                         request->ie = (void *)(request->ssids + n_ssids);
5152                 else
5153                         request->ie = (void *)(request->channels + n_channels);
5154         }
5155
5156         i = 0;
5157         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5158                 /* user specified, bail out if channel not found */
5159                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5160                         struct ieee80211_channel *chan;
5161
5162                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5163
5164                         if (!chan) {
5165                                 err = -EINVAL;
5166                                 goto out_free;
5167                         }
5168
5169                         /* ignore disabled channels */
5170                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5171                                 continue;
5172
5173                         request->channels[i] = chan;
5174                         i++;
5175                 }
5176         } else {
5177                 enum ieee80211_band band;
5178
5179                 /* all channels */
5180                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5181                         int j;
5182                         if (!wiphy->bands[band])
5183                                 continue;
5184                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5185                                 struct ieee80211_channel *chan;
5186
5187                                 chan = &wiphy->bands[band]->channels[j];
5188
5189                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5190                                         continue;
5191
5192                                 request->channels[i] = chan;
5193                                 i++;
5194                         }
5195                 }
5196         }
5197
5198         if (!i) {
5199                 err = -EINVAL;
5200                 goto out_free;
5201         }
5202
5203         request->n_channels = i;
5204
5205         i = 0;
5206         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5207                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5208                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5209                                 err = -EINVAL;
5210                                 goto out_free;
5211                         }
5212                         request->ssids[i].ssid_len = nla_len(attr);
5213                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5214                         i++;
5215                 }
5216         }
5217
5218         if (info->attrs[NL80211_ATTR_IE]) {
5219                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5220                 memcpy((void *)request->ie,
5221                        nla_data(info->attrs[NL80211_ATTR_IE]),
5222                        request->ie_len);
5223         }
5224
5225         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5226                 if (wiphy->bands[i])
5227                         request->rates[i] =
5228                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5229
5230         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5231                 nla_for_each_nested(attr,
5232                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5233                                     tmp) {
5234                         enum ieee80211_band band = nla_type(attr);
5235
5236                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5237                                 err = -EINVAL;
5238                                 goto out_free;
5239                         }
5240                         err = ieee80211_get_ratemask(wiphy->bands[band],
5241                                                      nla_data(attr),
5242                                                      nla_len(attr),
5243                                                      &request->rates[band]);
5244                         if (err)
5245                                 goto out_free;
5246                 }
5247         }
5248
5249         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5250                 request->flags = nla_get_u32(
5251                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5252                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5253                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5254                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5255                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5256                         err = -EOPNOTSUPP;
5257                         goto out_free;
5258                 }
5259         }
5260
5261         request->no_cck =
5262                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5263
5264         request->wdev = wdev;
5265         request->wiphy = &rdev->wiphy;
5266         request->scan_start = jiffies;
5267
5268         rdev->scan_req = request;
5269         err = rdev_scan(rdev, request);
5270
5271         if (!err) {
5272                 nl80211_send_scan_start(rdev, wdev);
5273                 if (wdev->netdev)
5274                         dev_hold(wdev->netdev);
5275         } else {
5276  out_free:
5277                 rdev->scan_req = NULL;
5278                 kfree(request);
5279         }
5280
5281  unlock:
5282         return err;
5283 }
5284
5285 static int nl80211_start_sched_scan(struct sk_buff *skb,
5286                                     struct genl_info *info)
5287 {
5288         struct cfg80211_sched_scan_request *request;
5289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5290         struct net_device *dev = info->user_ptr[1];
5291         struct nlattr *attr;
5292         struct wiphy *wiphy;
5293         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5294         u32 interval;
5295         enum ieee80211_band band;
5296         size_t ie_len;
5297         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5298
5299         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5300             !rdev->ops->sched_scan_start)
5301                 return -EOPNOTSUPP;
5302
5303         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5304                 return -EINVAL;
5305
5306         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5307                 return -EINVAL;
5308
5309         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5310         if (interval == 0)
5311                 return -EINVAL;
5312
5313         wiphy = &rdev->wiphy;
5314
5315         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5316                 n_channels = validate_scan_freqs(
5317                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5318                 if (!n_channels)
5319                         return -EINVAL;
5320         } else {
5321                 n_channels = 0;
5322
5323                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5324                         if (wiphy->bands[band])
5325                                 n_channels += wiphy->bands[band]->n_channels;
5326         }
5327
5328         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5329                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5330                                     tmp)
5331                         n_ssids++;
5332
5333         if (n_ssids > wiphy->max_sched_scan_ssids)
5334                 return -EINVAL;
5335
5336         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5337                 nla_for_each_nested(attr,
5338                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5339                                     tmp)
5340                         n_match_sets++;
5341
5342         if (n_match_sets > wiphy->max_match_sets)
5343                 return -EINVAL;
5344
5345         if (info->attrs[NL80211_ATTR_IE])
5346                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5347         else
5348                 ie_len = 0;
5349
5350         if (ie_len > wiphy->max_sched_scan_ie_len)
5351                 return -EINVAL;
5352
5353         if (rdev->sched_scan_req) {
5354                 err = -EINPROGRESS;
5355                 goto out;
5356         }
5357
5358         request = kzalloc(sizeof(*request)
5359                         + sizeof(*request->ssids) * n_ssids
5360                         + sizeof(*request->match_sets) * n_match_sets
5361                         + sizeof(*request->channels) * n_channels
5362                         + ie_len, GFP_KERNEL);
5363         if (!request) {
5364                 err = -ENOMEM;
5365                 goto out;
5366         }
5367
5368         if (n_ssids)
5369                 request->ssids = (void *)&request->channels[n_channels];
5370         request->n_ssids = n_ssids;
5371         if (ie_len) {
5372                 if (request->ssids)
5373                         request->ie = (void *)(request->ssids + n_ssids);
5374                 else
5375                         request->ie = (void *)(request->channels + n_channels);
5376         }
5377
5378         if (n_match_sets) {
5379                 if (request->ie)
5380                         request->match_sets = (void *)(request->ie + ie_len);
5381                 else if (request->ssids)
5382                         request->match_sets =
5383                                 (void *)(request->ssids + n_ssids);
5384                 else
5385                         request->match_sets =
5386                                 (void *)(request->channels + n_channels);
5387         }
5388         request->n_match_sets = n_match_sets;
5389
5390         i = 0;
5391         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5392                 /* user specified, bail out if channel not found */
5393                 nla_for_each_nested(attr,
5394                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5395                                     tmp) {
5396                         struct ieee80211_channel *chan;
5397
5398                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5399
5400                         if (!chan) {
5401                                 err = -EINVAL;
5402                                 goto out_free;
5403                         }
5404
5405                         /* ignore disabled channels */
5406                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5407                                 continue;
5408
5409                         request->channels[i] = chan;
5410                         i++;
5411                 }
5412         } else {
5413                 /* all channels */
5414                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5415                         int j;
5416                         if (!wiphy->bands[band])
5417                                 continue;
5418                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5419                                 struct ieee80211_channel *chan;
5420
5421                                 chan = &wiphy->bands[band]->channels[j];
5422
5423                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5424                                         continue;
5425
5426                                 request->channels[i] = chan;
5427                                 i++;
5428                         }
5429                 }
5430         }
5431
5432         if (!i) {
5433                 err = -EINVAL;
5434                 goto out_free;
5435         }
5436
5437         request->n_channels = i;
5438
5439         i = 0;
5440         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5441                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5442                                     tmp) {
5443                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5444                                 err = -EINVAL;
5445                                 goto out_free;
5446                         }
5447                         request->ssids[i].ssid_len = nla_len(attr);
5448                         memcpy(request->ssids[i].ssid, nla_data(attr),
5449                                nla_len(attr));
5450                         i++;
5451                 }
5452         }
5453
5454         i = 0;
5455         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5456                 nla_for_each_nested(attr,
5457                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5458                                     tmp) {
5459                         struct nlattr *ssid, *rssi;
5460
5461                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5462                                   nla_data(attr), nla_len(attr),
5463                                   nl80211_match_policy);
5464                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5465                         if (ssid) {
5466                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5467                                         err = -EINVAL;
5468                                         goto out_free;
5469                                 }
5470                                 memcpy(request->match_sets[i].ssid.ssid,
5471                                        nla_data(ssid), nla_len(ssid));
5472                                 request->match_sets[i].ssid.ssid_len =
5473                                         nla_len(ssid);
5474                         }
5475                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5476                         if (rssi)
5477                                 request->rssi_thold = nla_get_u32(rssi);
5478                         else
5479                                 request->rssi_thold =
5480                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5481                         i++;
5482                 }
5483         }
5484
5485         if (info->attrs[NL80211_ATTR_IE]) {
5486                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5487                 memcpy((void *)request->ie,
5488                        nla_data(info->attrs[NL80211_ATTR_IE]),
5489                        request->ie_len);
5490         }
5491
5492         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5493                 request->flags = nla_get_u32(
5494                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5495                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5496                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5497                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5498                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5499                         err = -EOPNOTSUPP;
5500                         goto out_free;
5501                 }
5502         }
5503
5504         request->dev = dev;
5505         request->wiphy = &rdev->wiphy;
5506         request->interval = interval;
5507         request->scan_start = jiffies;
5508
5509         err = rdev_sched_scan_start(rdev, dev, request);
5510         if (!err) {
5511                 rdev->sched_scan_req = request;
5512                 nl80211_send_sched_scan(rdev, dev,
5513                                         NL80211_CMD_START_SCHED_SCAN);
5514                 goto out;
5515         }
5516
5517 out_free:
5518         kfree(request);
5519 out:
5520         return err;
5521 }
5522
5523 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5524                                    struct genl_info *info)
5525 {
5526         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5527
5528         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5529             !rdev->ops->sched_scan_stop)
5530                 return -EOPNOTSUPP;
5531
5532         return __cfg80211_stop_sched_scan(rdev, false);
5533 }
5534
5535 static int nl80211_start_radar_detection(struct sk_buff *skb,
5536                                          struct genl_info *info)
5537 {
5538         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5539         struct net_device *dev = info->user_ptr[1];
5540         struct wireless_dev *wdev = dev->ieee80211_ptr;
5541         struct cfg80211_chan_def chandef;
5542         int err;
5543
5544         err = nl80211_parse_chandef(rdev, info, &chandef);
5545         if (err)
5546                 return err;
5547
5548         if (wdev->cac_started)
5549                 return -EBUSY;
5550
5551         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5552         if (err < 0)
5553                 return err;
5554
5555         if (err == 0)
5556                 return -EINVAL;
5557
5558         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5559                 return -EINVAL;
5560
5561         if (!rdev->ops->start_radar_detection)
5562                 return -EOPNOTSUPP;
5563
5564         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5565                                            chandef.chan, CHAN_MODE_SHARED,
5566                                            BIT(chandef.width));
5567         if (err)
5568                 return err;
5569
5570         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5571         if (!err) {
5572                 wdev->channel = chandef.chan;
5573                 wdev->cac_started = true;
5574                 wdev->cac_start_time = jiffies;
5575         }
5576         return err;
5577 }
5578
5579 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5580                             u32 seq, int flags,
5581                             struct cfg80211_registered_device *rdev,
5582                             struct wireless_dev *wdev,
5583                             struct cfg80211_internal_bss *intbss)
5584 {
5585         struct cfg80211_bss *res = &intbss->pub;
5586         const struct cfg80211_bss_ies *ies;
5587         void *hdr;
5588         struct nlattr *bss;
5589         bool tsf = false;
5590
5591         ASSERT_WDEV_LOCK(wdev);
5592
5593         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5594                              NL80211_CMD_NEW_SCAN_RESULTS);
5595         if (!hdr)
5596                 return -1;
5597
5598         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5599
5600         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5601                 goto nla_put_failure;
5602         if (wdev->netdev &&
5603             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5604                 goto nla_put_failure;
5605         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5606                 goto nla_put_failure;
5607
5608         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5609         if (!bss)
5610                 goto nla_put_failure;
5611         if ((!is_zero_ether_addr(res->bssid) &&
5612              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5613                 goto nla_put_failure;
5614
5615         rcu_read_lock();
5616         ies = rcu_dereference(res->ies);
5617         if (ies) {
5618                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5619                         goto fail_unlock_rcu;
5620                 tsf = true;
5621                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5622                                         ies->len, ies->data))
5623                         goto fail_unlock_rcu;
5624         }
5625         ies = rcu_dereference(res->beacon_ies);
5626         if (ies) {
5627                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5628                         goto fail_unlock_rcu;
5629                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5630                                         ies->len, ies->data))
5631                         goto fail_unlock_rcu;
5632         }
5633         rcu_read_unlock();
5634
5635         if (res->beacon_interval &&
5636             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5637                 goto nla_put_failure;
5638         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5639             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5640             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5641                         jiffies_to_msecs(jiffies - intbss->ts)))
5642                 goto nla_put_failure;
5643
5644         switch (rdev->wiphy.signal_type) {
5645         case CFG80211_SIGNAL_TYPE_MBM:
5646                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5647                         goto nla_put_failure;
5648                 break;
5649         case CFG80211_SIGNAL_TYPE_UNSPEC:
5650                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5651                         goto nla_put_failure;
5652                 break;
5653         default:
5654                 break;
5655         }
5656
5657         switch (wdev->iftype) {
5658         case NL80211_IFTYPE_P2P_CLIENT:
5659         case NL80211_IFTYPE_STATION:
5660                 if (intbss == wdev->current_bss &&
5661                     nla_put_u32(msg, NL80211_BSS_STATUS,
5662                                 NL80211_BSS_STATUS_ASSOCIATED))
5663                         goto nla_put_failure;
5664                 break;
5665         case NL80211_IFTYPE_ADHOC:
5666                 if (intbss == wdev->current_bss &&
5667                     nla_put_u32(msg, NL80211_BSS_STATUS,
5668                                 NL80211_BSS_STATUS_IBSS_JOINED))
5669                         goto nla_put_failure;
5670                 break;
5671         default:
5672                 break;
5673         }
5674
5675         nla_nest_end(msg, bss);
5676
5677         return genlmsg_end(msg, hdr);
5678
5679  fail_unlock_rcu:
5680         rcu_read_unlock();
5681  nla_put_failure:
5682         genlmsg_cancel(msg, hdr);
5683         return -EMSGSIZE;
5684 }
5685
5686 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5687 {
5688         struct cfg80211_registered_device *rdev;
5689         struct cfg80211_internal_bss *scan;
5690         struct wireless_dev *wdev;
5691         int start = cb->args[2], idx = 0;
5692         int err;
5693
5694         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5695         if (err)
5696                 return err;
5697
5698         wdev_lock(wdev);
5699         spin_lock_bh(&rdev->bss_lock);
5700         cfg80211_bss_expire(rdev);
5701
5702         cb->seq = rdev->bss_generation;
5703
5704         list_for_each_entry(scan, &rdev->bss_list, list) {
5705                 if (++idx <= start)
5706                         continue;
5707                 if (nl80211_send_bss(skb, cb,
5708                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5709                                 rdev, wdev, scan) < 0) {
5710                         idx--;
5711                         break;
5712                 }
5713         }
5714
5715         spin_unlock_bh(&rdev->bss_lock);
5716         wdev_unlock(wdev);
5717
5718         cb->args[2] = idx;
5719         nl80211_finish_wdev_dump(rdev);
5720
5721         return skb->len;
5722 }
5723
5724 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5725                                 int flags, struct net_device *dev,
5726                                 struct survey_info *survey)
5727 {
5728         void *hdr;
5729         struct nlattr *infoattr;
5730
5731         hdr = nl80211hdr_put(msg, portid, seq, flags,
5732                              NL80211_CMD_NEW_SURVEY_RESULTS);
5733         if (!hdr)
5734                 return -ENOMEM;
5735
5736         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5737                 goto nla_put_failure;
5738
5739         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5740         if (!infoattr)
5741                 goto nla_put_failure;
5742
5743         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5744                         survey->channel->center_freq))
5745                 goto nla_put_failure;
5746
5747         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5748             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5749                 goto nla_put_failure;
5750         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5751             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5752                 goto nla_put_failure;
5753         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5754             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5755                         survey->channel_time))
5756                 goto nla_put_failure;
5757         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5758             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5759                         survey->channel_time_busy))
5760                 goto nla_put_failure;
5761         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5762             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5763                         survey->channel_time_ext_busy))
5764                 goto nla_put_failure;
5765         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5766             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5767                         survey->channel_time_rx))
5768                 goto nla_put_failure;
5769         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5770             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5771                         survey->channel_time_tx))
5772                 goto nla_put_failure;
5773
5774         nla_nest_end(msg, infoattr);
5775
5776         return genlmsg_end(msg, hdr);
5777
5778  nla_put_failure:
5779         genlmsg_cancel(msg, hdr);
5780         return -EMSGSIZE;
5781 }
5782
5783 static int nl80211_dump_survey(struct sk_buff *skb,
5784                         struct netlink_callback *cb)
5785 {
5786         struct survey_info survey;
5787         struct cfg80211_registered_device *dev;
5788         struct wireless_dev *wdev;
5789         int survey_idx = cb->args[2];
5790         int res;
5791
5792         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5793         if (res)
5794                 return res;
5795
5796         if (!wdev->netdev) {
5797                 res = -EINVAL;
5798                 goto out_err;
5799         }
5800
5801         if (!dev->ops->dump_survey) {
5802                 res = -EOPNOTSUPP;
5803                 goto out_err;
5804         }
5805
5806         while (1) {
5807                 struct ieee80211_channel *chan;
5808
5809                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5810                 if (res == -ENOENT)
5811                         break;
5812                 if (res)
5813                         goto out_err;
5814
5815                 /* Survey without a channel doesn't make sense */
5816                 if (!survey.channel) {
5817                         res = -EINVAL;
5818                         goto out;
5819                 }
5820
5821                 chan = ieee80211_get_channel(&dev->wiphy,
5822                                              survey.channel->center_freq);
5823                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5824                         survey_idx++;
5825                         continue;
5826                 }
5827
5828                 if (nl80211_send_survey(skb,
5829                                 NETLINK_CB(cb->skb).portid,
5830                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5831                                 wdev->netdev, &survey) < 0)
5832                         goto out;
5833                 survey_idx++;
5834         }
5835
5836  out:
5837         cb->args[2] = survey_idx;
5838         res = skb->len;
5839  out_err:
5840         nl80211_finish_wdev_dump(dev);
5841         return res;
5842 }
5843
5844 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5845 {
5846         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5847                                   NL80211_WPA_VERSION_2));
5848 }
5849
5850 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5851 {
5852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5853         struct net_device *dev = info->user_ptr[1];
5854         struct ieee80211_channel *chan;
5855         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5856         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5857         enum nl80211_auth_type auth_type;
5858         struct key_parse key;
5859         bool local_state_change;
5860
5861         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5862                 return -EINVAL;
5863
5864         if (!info->attrs[NL80211_ATTR_MAC])
5865                 return -EINVAL;
5866
5867         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5868                 return -EINVAL;
5869
5870         if (!info->attrs[NL80211_ATTR_SSID])
5871                 return -EINVAL;
5872
5873         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5874                 return -EINVAL;
5875
5876         err = nl80211_parse_key(info, &key);
5877         if (err)
5878                 return err;
5879
5880         if (key.idx >= 0) {
5881                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5882                         return -EINVAL;
5883                 if (!key.p.key || !key.p.key_len)
5884                         return -EINVAL;
5885                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5886                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5887                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5888                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5889                         return -EINVAL;
5890                 if (key.idx > 4)
5891                         return -EINVAL;
5892         } else {
5893                 key.p.key_len = 0;
5894                 key.p.key = NULL;
5895         }
5896
5897         if (key.idx >= 0) {
5898                 int i;
5899                 bool ok = false;
5900                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5901                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5902                                 ok = true;
5903                                 break;
5904                         }
5905                 }
5906                 if (!ok)
5907                         return -EINVAL;
5908         }
5909
5910         if (!rdev->ops->auth)
5911                 return -EOPNOTSUPP;
5912
5913         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5914             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5915                 return -EOPNOTSUPP;
5916
5917         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5918         chan = ieee80211_get_channel(&rdev->wiphy,
5919                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5920         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5921                 return -EINVAL;
5922
5923         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5924         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5925
5926         if (info->attrs[NL80211_ATTR_IE]) {
5927                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5928                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5929         }
5930
5931         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5932         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5933                 return -EINVAL;
5934
5935         if (auth_type == NL80211_AUTHTYPE_SAE &&
5936             !info->attrs[NL80211_ATTR_SAE_DATA])
5937                 return -EINVAL;
5938
5939         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5940                 if (auth_type != NL80211_AUTHTYPE_SAE)
5941                         return -EINVAL;
5942                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5943                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5944                 /* need to include at least Auth Transaction and Status Code */
5945                 if (sae_data_len < 4)
5946                         return -EINVAL;
5947         }
5948
5949         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5950
5951         /*
5952          * Since we no longer track auth state, ignore
5953          * requests to only change local state.
5954          */
5955         if (local_state_change)
5956                 return 0;
5957
5958         wdev_lock(dev->ieee80211_ptr);
5959         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5960                                  ssid, ssid_len, ie, ie_len,
5961                                  key.p.key, key.p.key_len, key.idx,
5962                                  sae_data, sae_data_len);
5963         wdev_unlock(dev->ieee80211_ptr);
5964         return err;
5965 }
5966
5967 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5968                                    struct genl_info *info,
5969                                    struct cfg80211_crypto_settings *settings,
5970                                    int cipher_limit)
5971 {
5972         memset(settings, 0, sizeof(*settings));
5973
5974         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5975
5976         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5977                 u16 proto;
5978                 proto = nla_get_u16(
5979                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5980                 settings->control_port_ethertype = cpu_to_be16(proto);
5981                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5982                     proto != ETH_P_PAE)
5983                         return -EINVAL;
5984                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5985                         settings->control_port_no_encrypt = true;
5986         } else
5987                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5988
5989         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5990                 void *data;
5991                 int len, i;
5992
5993                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5994                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5995                 settings->n_ciphers_pairwise = len / sizeof(u32);
5996
5997                 if (len % sizeof(u32))
5998                         return -EINVAL;
5999
6000                 if (settings->n_ciphers_pairwise > cipher_limit)
6001                         return -EINVAL;
6002
6003                 memcpy(settings->ciphers_pairwise, data, len);
6004
6005                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6006                         if (!cfg80211_supported_cipher_suite(
6007                                         &rdev->wiphy,
6008                                         settings->ciphers_pairwise[i]))
6009                                 return -EINVAL;
6010         }
6011
6012         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6013                 settings->cipher_group =
6014                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6015                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6016                                                      settings->cipher_group))
6017                         return -EINVAL;
6018         }
6019
6020         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6021                 settings->wpa_versions =
6022                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6023                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6024                         return -EINVAL;
6025         }
6026
6027         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6028                 void *data;
6029                 int len;
6030
6031                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6032                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6033                 settings->n_akm_suites = len / sizeof(u32);
6034
6035                 if (len % sizeof(u32))
6036                         return -EINVAL;
6037
6038                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6039                         return -EINVAL;
6040
6041                 memcpy(settings->akm_suites, data, len);
6042         }
6043
6044         return 0;
6045 }
6046
6047 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6048 {
6049         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6050         struct net_device *dev = info->user_ptr[1];
6051         struct ieee80211_channel *chan;
6052         struct cfg80211_assoc_request req = {};
6053         const u8 *bssid, *ssid;
6054         int err, ssid_len = 0;
6055
6056         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6057                 return -EINVAL;
6058
6059         if (!info->attrs[NL80211_ATTR_MAC] ||
6060             !info->attrs[NL80211_ATTR_SSID] ||
6061             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6062                 return -EINVAL;
6063
6064         if (!rdev->ops->assoc)
6065                 return -EOPNOTSUPP;
6066
6067         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6068             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6069                 return -EOPNOTSUPP;
6070
6071         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6072
6073         chan = ieee80211_get_channel(&rdev->wiphy,
6074                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6075         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6076                 return -EINVAL;
6077
6078         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6079         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6080
6081         if (info->attrs[NL80211_ATTR_IE]) {
6082                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6083                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6084         }
6085
6086         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6087                 enum nl80211_mfp mfp =
6088                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6089                 if (mfp == NL80211_MFP_REQUIRED)
6090                         req.use_mfp = true;
6091                 else if (mfp != NL80211_MFP_NO)
6092                         return -EINVAL;
6093         }
6094
6095         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6096                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6097
6098         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6099                 req.flags |= ASSOC_REQ_DISABLE_HT;
6100
6101         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6102                 memcpy(&req.ht_capa_mask,
6103                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6104                        sizeof(req.ht_capa_mask));
6105
6106         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6107                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6108                         return -EINVAL;
6109                 memcpy(&req.ht_capa,
6110                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6111                        sizeof(req.ht_capa));
6112         }
6113
6114         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6115                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6116
6117         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6118                 memcpy(&req.vht_capa_mask,
6119                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6120                        sizeof(req.vht_capa_mask));
6121
6122         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6123                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6124                         return -EINVAL;
6125                 memcpy(&req.vht_capa,
6126                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6127                        sizeof(req.vht_capa));
6128         }
6129
6130         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6131         if (!err) {
6132                 wdev_lock(dev->ieee80211_ptr);
6133                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6134                                           ssid, ssid_len, &req);
6135                 wdev_unlock(dev->ieee80211_ptr);
6136         }
6137
6138         return err;
6139 }
6140
6141 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6142 {
6143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6144         struct net_device *dev = info->user_ptr[1];
6145         const u8 *ie = NULL, *bssid;
6146         int ie_len = 0, err;
6147         u16 reason_code;
6148         bool local_state_change;
6149
6150         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6151                 return -EINVAL;
6152
6153         if (!info->attrs[NL80211_ATTR_MAC])
6154                 return -EINVAL;
6155
6156         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6157                 return -EINVAL;
6158
6159         if (!rdev->ops->deauth)
6160                 return -EOPNOTSUPP;
6161
6162         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6163             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6164                 return -EOPNOTSUPP;
6165
6166         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6167
6168         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6169         if (reason_code == 0) {
6170                 /* Reason Code 0 is reserved */
6171                 return -EINVAL;
6172         }
6173
6174         if (info->attrs[NL80211_ATTR_IE]) {
6175                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6176                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6177         }
6178
6179         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6180
6181         wdev_lock(dev->ieee80211_ptr);
6182         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6183                                    local_state_change);
6184         wdev_unlock(dev->ieee80211_ptr);
6185         return err;
6186 }
6187
6188 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6189 {
6190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6191         struct net_device *dev = info->user_ptr[1];
6192         const u8 *ie = NULL, *bssid;
6193         int ie_len = 0, err;
6194         u16 reason_code;
6195         bool local_state_change;
6196
6197         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6198                 return -EINVAL;
6199
6200         if (!info->attrs[NL80211_ATTR_MAC])
6201                 return -EINVAL;
6202
6203         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6204                 return -EINVAL;
6205
6206         if (!rdev->ops->disassoc)
6207                 return -EOPNOTSUPP;
6208
6209         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6210             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6211                 return -EOPNOTSUPP;
6212
6213         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6214
6215         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6216         if (reason_code == 0) {
6217                 /* Reason Code 0 is reserved */
6218                 return -EINVAL;
6219         }
6220
6221         if (info->attrs[NL80211_ATTR_IE]) {
6222                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6223                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6224         }
6225
6226         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6227
6228         wdev_lock(dev->ieee80211_ptr);
6229         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6230                                      local_state_change);
6231         wdev_unlock(dev->ieee80211_ptr);
6232         return err;
6233 }
6234
6235 static bool
6236 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6237                          int mcast_rate[IEEE80211_NUM_BANDS],
6238                          int rateval)
6239 {
6240         struct wiphy *wiphy = &rdev->wiphy;
6241         bool found = false;
6242         int band, i;
6243
6244         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6245                 struct ieee80211_supported_band *sband;
6246
6247                 sband = wiphy->bands[band];
6248                 if (!sband)
6249                         continue;
6250
6251                 for (i = 0; i < sband->n_bitrates; i++) {
6252                         if (sband->bitrates[i].bitrate == rateval) {
6253                                 mcast_rate[band] = i + 1;
6254                                 found = true;
6255                                 break;
6256                         }
6257                 }
6258         }
6259
6260         return found;
6261 }
6262
6263 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6264 {
6265         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6266         struct net_device *dev = info->user_ptr[1];
6267         struct cfg80211_ibss_params ibss;
6268         struct wiphy *wiphy;
6269         struct cfg80211_cached_keys *connkeys = NULL;
6270         int err;
6271
6272         memset(&ibss, 0, sizeof(ibss));
6273
6274         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6275                 return -EINVAL;
6276
6277         if (!info->attrs[NL80211_ATTR_SSID] ||
6278             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6279                 return -EINVAL;
6280
6281         ibss.beacon_interval = 100;
6282
6283         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6284                 ibss.beacon_interval =
6285                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6286                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6287                         return -EINVAL;
6288         }
6289
6290         if (!rdev->ops->join_ibss)
6291                 return -EOPNOTSUPP;
6292
6293         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6294                 return -EOPNOTSUPP;
6295
6296         wiphy = &rdev->wiphy;
6297
6298         if (info->attrs[NL80211_ATTR_MAC]) {
6299                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6300
6301                 if (!is_valid_ether_addr(ibss.bssid))
6302                         return -EINVAL;
6303         }
6304         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6305         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6306
6307         if (info->attrs[NL80211_ATTR_IE]) {
6308                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6309                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6310         }
6311
6312         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6313         if (err)
6314                 return err;
6315
6316         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6317                 return -EINVAL;
6318
6319         switch (ibss.chandef.width) {
6320         case NL80211_CHAN_WIDTH_20_NOHT:
6321                 break;
6322         case NL80211_CHAN_WIDTH_20:
6323         case NL80211_CHAN_WIDTH_40:
6324                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6325                         break;
6326         default:
6327                 return -EINVAL;
6328         }
6329
6330         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6331         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6332
6333         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6334                 u8 *rates =
6335                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6336                 int n_rates =
6337                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6338                 struct ieee80211_supported_band *sband =
6339                         wiphy->bands[ibss.chandef.chan->band];
6340
6341                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6342                                              &ibss.basic_rates);
6343                 if (err)
6344                         return err;
6345         }
6346
6347         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6348             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6349                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6350                 return -EINVAL;
6351
6352         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6353                 bool no_ht = false;
6354
6355                 connkeys = nl80211_parse_connkeys(rdev,
6356                                           info->attrs[NL80211_ATTR_KEYS],
6357                                           &no_ht);
6358                 if (IS_ERR(connkeys))
6359                         return PTR_ERR(connkeys);
6360
6361                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6362                     no_ht) {
6363                         kfree(connkeys);
6364                         return -EINVAL;
6365                 }
6366         }
6367
6368         ibss.control_port =
6369                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6370
6371         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6372         if (err)
6373                 kfree(connkeys);
6374         return err;
6375 }
6376
6377 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6378 {
6379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6380         struct net_device *dev = info->user_ptr[1];
6381
6382         if (!rdev->ops->leave_ibss)
6383                 return -EOPNOTSUPP;
6384
6385         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6386                 return -EOPNOTSUPP;
6387
6388         return cfg80211_leave_ibss(rdev, dev, false);
6389 }
6390
6391 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6392 {
6393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6394         struct net_device *dev = info->user_ptr[1];
6395         int mcast_rate[IEEE80211_NUM_BANDS];
6396         u32 nla_rate;
6397         int err;
6398
6399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6400             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6401                 return -EOPNOTSUPP;
6402
6403         if (!rdev->ops->set_mcast_rate)
6404                 return -EOPNOTSUPP;
6405
6406         memset(mcast_rate, 0, sizeof(mcast_rate));
6407
6408         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6409                 return -EINVAL;
6410
6411         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6412         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6413                 return -EINVAL;
6414
6415         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6416
6417         return err;
6418 }
6419
6420
6421 #ifdef CONFIG_NL80211_TESTMODE
6422 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6423         .name = "testmode",
6424 };
6425
6426 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6427 {
6428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6429         int err;
6430
6431         if (!info->attrs[NL80211_ATTR_TESTDATA])
6432                 return -EINVAL;
6433
6434         err = -EOPNOTSUPP;
6435         if (rdev->ops->testmode_cmd) {
6436                 rdev->testmode_info = info;
6437                 err = rdev_testmode_cmd(rdev,
6438                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6439                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6440                 rdev->testmode_info = NULL;
6441         }
6442
6443         return err;
6444 }
6445
6446 static int nl80211_testmode_dump(struct sk_buff *skb,
6447                                  struct netlink_callback *cb)
6448 {
6449         struct cfg80211_registered_device *rdev;
6450         int err;
6451         long phy_idx;
6452         void *data = NULL;
6453         int data_len = 0;
6454
6455         rtnl_lock();
6456
6457         if (cb->args[0]) {
6458                 /*
6459                  * 0 is a valid index, but not valid for args[0],
6460                  * so we need to offset by 1.
6461                  */
6462                 phy_idx = cb->args[0] - 1;
6463         } else {
6464                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6465                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6466                                   nl80211_policy);
6467                 if (err)
6468                         goto out_err;
6469
6470                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6471                                                   nl80211_fam.attrbuf);
6472                 if (IS_ERR(rdev)) {
6473                         err = PTR_ERR(rdev);
6474                         goto out_err;
6475                 }
6476                 phy_idx = rdev->wiphy_idx;
6477                 rdev = NULL;
6478
6479                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6480                         cb->args[1] =
6481                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6482         }
6483
6484         if (cb->args[1]) {
6485                 data = nla_data((void *)cb->args[1]);
6486                 data_len = nla_len((void *)cb->args[1]);
6487         }
6488
6489         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6490         if (!rdev) {
6491                 err = -ENOENT;
6492                 goto out_err;
6493         }
6494
6495         if (!rdev->ops->testmode_dump) {
6496                 err = -EOPNOTSUPP;
6497                 goto out_err;
6498         }
6499
6500         while (1) {
6501                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6502                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6503                                            NL80211_CMD_TESTMODE);
6504                 struct nlattr *tmdata;
6505
6506                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6507                         genlmsg_cancel(skb, hdr);
6508                         break;
6509                 }
6510
6511                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6512                 if (!tmdata) {
6513                         genlmsg_cancel(skb, hdr);
6514                         break;
6515                 }
6516                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6517                 nla_nest_end(skb, tmdata);
6518
6519                 if (err == -ENOBUFS || err == -ENOENT) {
6520                         genlmsg_cancel(skb, hdr);
6521                         break;
6522                 } else if (err) {
6523                         genlmsg_cancel(skb, hdr);
6524                         goto out_err;
6525                 }
6526
6527                 genlmsg_end(skb, hdr);
6528         }
6529
6530         err = skb->len;
6531         /* see above */
6532         cb->args[0] = phy_idx + 1;
6533  out_err:
6534         rtnl_unlock();
6535         return err;
6536 }
6537
6538 static struct sk_buff *
6539 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6540                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6541 {
6542         struct sk_buff *skb;
6543         void *hdr;
6544         struct nlattr *data;
6545
6546         skb = nlmsg_new(approxlen + 100, gfp);
6547         if (!skb)
6548                 return NULL;
6549
6550         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6551         if (!hdr) {
6552                 kfree_skb(skb);
6553                 return NULL;
6554         }
6555
6556         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6557                 goto nla_put_failure;
6558         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6559
6560         ((void **)skb->cb)[0] = rdev;
6561         ((void **)skb->cb)[1] = hdr;
6562         ((void **)skb->cb)[2] = data;
6563
6564         return skb;
6565
6566  nla_put_failure:
6567         kfree_skb(skb);
6568         return NULL;
6569 }
6570
6571 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6572                                                   int approxlen)
6573 {
6574         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6575
6576         if (WARN_ON(!rdev->testmode_info))
6577                 return NULL;
6578
6579         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6580                                 rdev->testmode_info->snd_portid,
6581                                 rdev->testmode_info->snd_seq,
6582                                 GFP_KERNEL);
6583 }
6584 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6585
6586 int cfg80211_testmode_reply(struct sk_buff *skb)
6587 {
6588         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6589         void *hdr = ((void **)skb->cb)[1];
6590         struct nlattr *data = ((void **)skb->cb)[2];
6591
6592         if (WARN_ON(!rdev->testmode_info)) {
6593                 kfree_skb(skb);
6594                 return -EINVAL;
6595         }
6596
6597         nla_nest_end(skb, data);
6598         genlmsg_end(skb, hdr);
6599         return genlmsg_reply(skb, rdev->testmode_info);
6600 }
6601 EXPORT_SYMBOL(cfg80211_testmode_reply);
6602
6603 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6604                                                   int approxlen, gfp_t gfp)
6605 {
6606         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6607
6608         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6609 }
6610 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6611
6612 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6613 {
6614         void *hdr = ((void **)skb->cb)[1];
6615         struct nlattr *data = ((void **)skb->cb)[2];
6616
6617         nla_nest_end(skb, data);
6618         genlmsg_end(skb, hdr);
6619         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6620 }
6621 EXPORT_SYMBOL(cfg80211_testmode_event);
6622 #endif
6623
6624 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6625 {
6626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6627         struct net_device *dev = info->user_ptr[1];
6628         struct cfg80211_connect_params connect;
6629         struct wiphy *wiphy;
6630         struct cfg80211_cached_keys *connkeys = NULL;
6631         int err;
6632
6633         memset(&connect, 0, sizeof(connect));
6634
6635         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6636                 return -EINVAL;
6637
6638         if (!info->attrs[NL80211_ATTR_SSID] ||
6639             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6640                 return -EINVAL;
6641
6642         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6643                 connect.auth_type =
6644                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6645                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6646                                              NL80211_CMD_CONNECT))
6647                         return -EINVAL;
6648         } else
6649                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6650
6651         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6652
6653         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6654                                       NL80211_MAX_NR_CIPHER_SUITES);
6655         if (err)
6656                 return err;
6657
6658         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6659             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6660                 return -EOPNOTSUPP;
6661
6662         wiphy = &rdev->wiphy;
6663
6664         connect.bg_scan_period = -1;
6665         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6666                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6667                 connect.bg_scan_period =
6668                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6669         }
6670
6671         if (info->attrs[NL80211_ATTR_MAC])
6672                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6673         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6674         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6675
6676         if (info->attrs[NL80211_ATTR_IE]) {
6677                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6678                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6679         }
6680
6681         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6682                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6683                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6684                     connect.mfp != NL80211_MFP_NO)
6685                         return -EINVAL;
6686         } else {
6687                 connect.mfp = NL80211_MFP_NO;
6688         }
6689
6690         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6691                 connect.channel =
6692                         ieee80211_get_channel(wiphy,
6693                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6694                 if (!connect.channel ||
6695                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6696                         return -EINVAL;
6697         }
6698
6699         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6700                 connkeys = nl80211_parse_connkeys(rdev,
6701                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6702                 if (IS_ERR(connkeys))
6703                         return PTR_ERR(connkeys);
6704         }
6705
6706         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6707                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6708
6709         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6710                 memcpy(&connect.ht_capa_mask,
6711                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6712                        sizeof(connect.ht_capa_mask));
6713
6714         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6715                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6716                         kfree(connkeys);
6717                         return -EINVAL;
6718                 }
6719                 memcpy(&connect.ht_capa,
6720                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6721                        sizeof(connect.ht_capa));
6722         }
6723
6724         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6725                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6726
6727         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6728                 memcpy(&connect.vht_capa_mask,
6729                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6730                        sizeof(connect.vht_capa_mask));
6731
6732         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6733                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6734                         kfree(connkeys);
6735                         return -EINVAL;
6736                 }
6737                 memcpy(&connect.vht_capa,
6738                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6739                        sizeof(connect.vht_capa));
6740         }
6741
6742         wdev_lock(dev->ieee80211_ptr);
6743         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
6744         wdev_unlock(dev->ieee80211_ptr);
6745         if (err)
6746                 kfree(connkeys);
6747         return err;
6748 }
6749
6750 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6751 {
6752         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6753         struct net_device *dev = info->user_ptr[1];
6754         u16 reason;
6755         int ret;
6756
6757         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6758                 reason = WLAN_REASON_DEAUTH_LEAVING;
6759         else
6760                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6761
6762         if (reason == 0)
6763                 return -EINVAL;
6764
6765         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6766             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6767                 return -EOPNOTSUPP;
6768
6769         wdev_lock(dev->ieee80211_ptr);
6770         ret = cfg80211_disconnect(rdev, dev, reason, true);
6771         wdev_unlock(dev->ieee80211_ptr);
6772         return ret;
6773 }
6774
6775 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6776 {
6777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6778         struct net *net;
6779         int err;
6780         u32 pid;
6781
6782         if (!info->attrs[NL80211_ATTR_PID])
6783                 return -EINVAL;
6784
6785         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6786
6787         net = get_net_ns_by_pid(pid);
6788         if (IS_ERR(net))
6789                 return PTR_ERR(net);
6790
6791         err = 0;
6792
6793         /* check if anything to do */
6794         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6795                 err = cfg80211_switch_netns(rdev, net);
6796
6797         put_net(net);
6798         return err;
6799 }
6800
6801 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6802 {
6803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6804         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6805                         struct cfg80211_pmksa *pmksa) = NULL;
6806         struct net_device *dev = info->user_ptr[1];
6807         struct cfg80211_pmksa pmksa;
6808
6809         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6810
6811         if (!info->attrs[NL80211_ATTR_MAC])
6812                 return -EINVAL;
6813
6814         if (!info->attrs[NL80211_ATTR_PMKID])
6815                 return -EINVAL;
6816
6817         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6818         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6819
6820         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6821             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6822                 return -EOPNOTSUPP;
6823
6824         switch (info->genlhdr->cmd) {
6825         case NL80211_CMD_SET_PMKSA:
6826                 rdev_ops = rdev->ops->set_pmksa;
6827                 break;
6828         case NL80211_CMD_DEL_PMKSA:
6829                 rdev_ops = rdev->ops->del_pmksa;
6830                 break;
6831         default:
6832                 WARN_ON(1);
6833                 break;
6834         }
6835
6836         if (!rdev_ops)
6837                 return -EOPNOTSUPP;
6838
6839         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6840 }
6841
6842 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6843 {
6844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6845         struct net_device *dev = info->user_ptr[1];
6846
6847         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6848             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6849                 return -EOPNOTSUPP;
6850
6851         if (!rdev->ops->flush_pmksa)
6852                 return -EOPNOTSUPP;
6853
6854         return rdev_flush_pmksa(rdev, dev);
6855 }
6856
6857 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6858 {
6859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6860         struct net_device *dev = info->user_ptr[1];
6861         u8 action_code, dialog_token;
6862         u16 status_code;
6863         u8 *peer;
6864
6865         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6866             !rdev->ops->tdls_mgmt)
6867                 return -EOPNOTSUPP;
6868
6869         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6870             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6871             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6872             !info->attrs[NL80211_ATTR_IE] ||
6873             !info->attrs[NL80211_ATTR_MAC])
6874                 return -EINVAL;
6875
6876         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6877         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6878         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6879         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6880
6881         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6882                               dialog_token, status_code,
6883                               nla_data(info->attrs[NL80211_ATTR_IE]),
6884                               nla_len(info->attrs[NL80211_ATTR_IE]));
6885 }
6886
6887 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6888 {
6889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6890         struct net_device *dev = info->user_ptr[1];
6891         enum nl80211_tdls_operation operation;
6892         u8 *peer;
6893
6894         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6895             !rdev->ops->tdls_oper)
6896                 return -EOPNOTSUPP;
6897
6898         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6899             !info->attrs[NL80211_ATTR_MAC])
6900                 return -EINVAL;
6901
6902         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6903         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6904
6905         return rdev_tdls_oper(rdev, dev, peer, operation);
6906 }
6907
6908 static int nl80211_remain_on_channel(struct sk_buff *skb,
6909                                      struct genl_info *info)
6910 {
6911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6912         struct wireless_dev *wdev = info->user_ptr[1];
6913         struct cfg80211_chan_def chandef;
6914         struct sk_buff *msg;
6915         void *hdr;
6916         u64 cookie;
6917         u32 duration;
6918         int err;
6919
6920         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6921             !info->attrs[NL80211_ATTR_DURATION])
6922                 return -EINVAL;
6923
6924         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6925
6926         if (!rdev->ops->remain_on_channel ||
6927             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6928                 return -EOPNOTSUPP;
6929
6930         /*
6931          * We should be on that channel for at least a minimum amount of
6932          * time (10ms) but no longer than the driver supports.
6933          */
6934         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6935             duration > rdev->wiphy.max_remain_on_channel_duration)
6936                 return -EINVAL;
6937
6938         err = nl80211_parse_chandef(rdev, info, &chandef);
6939         if (err)
6940                 return err;
6941
6942         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6943         if (!msg)
6944                 return -ENOMEM;
6945
6946         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6947                              NL80211_CMD_REMAIN_ON_CHANNEL);
6948
6949         if (IS_ERR(hdr)) {
6950                 err = PTR_ERR(hdr);
6951                 goto free_msg;
6952         }
6953
6954         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6955                                      duration, &cookie);
6956
6957         if (err)
6958                 goto free_msg;
6959
6960         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6961                 goto nla_put_failure;
6962
6963         genlmsg_end(msg, hdr);
6964
6965         return genlmsg_reply(msg, info);
6966
6967  nla_put_failure:
6968         err = -ENOBUFS;
6969  free_msg:
6970         nlmsg_free(msg);
6971         return err;
6972 }
6973
6974 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6975                                             struct genl_info *info)
6976 {
6977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6978         struct wireless_dev *wdev = info->user_ptr[1];
6979         u64 cookie;
6980
6981         if (!info->attrs[NL80211_ATTR_COOKIE])
6982                 return -EINVAL;
6983
6984         if (!rdev->ops->cancel_remain_on_channel)
6985                 return -EOPNOTSUPP;
6986
6987         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6988
6989         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6990 }
6991
6992 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6993                            u8 *rates, u8 rates_len)
6994 {
6995         u8 i;
6996         u32 mask = 0;
6997
6998         for (i = 0; i < rates_len; i++) {
6999                 int rate = (rates[i] & 0x7f) * 5;
7000                 int ridx;
7001                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7002                         struct ieee80211_rate *srate =
7003                                 &sband->bitrates[ridx];
7004                         if (rate == srate->bitrate) {
7005                                 mask |= 1 << ridx;
7006                                 break;
7007                         }
7008                 }
7009                 if (ridx == sband->n_bitrates)
7010                         return 0; /* rate not found */
7011         }
7012
7013         return mask;
7014 }
7015
7016 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7017                                u8 *rates, u8 rates_len,
7018                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7019 {
7020         u8 i;
7021
7022         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7023
7024         for (i = 0; i < rates_len; i++) {
7025                 int ridx, rbit;
7026
7027                 ridx = rates[i] / 8;
7028                 rbit = BIT(rates[i] % 8);
7029
7030                 /* check validity */
7031                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7032                         return false;
7033
7034                 /* check availability */
7035                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7036                         mcs[ridx] |= rbit;
7037                 else
7038                         return false;
7039         }
7040
7041         return true;
7042 }
7043
7044 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7045         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7046                                     .len = NL80211_MAX_SUPP_RATES },
7047         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7048                                  .len = NL80211_MAX_SUPP_HT_RATES },
7049 };
7050
7051 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7052                                        struct genl_info *info)
7053 {
7054         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7055         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7056         struct cfg80211_bitrate_mask mask;
7057         int rem, i;
7058         struct net_device *dev = info->user_ptr[1];
7059         struct nlattr *tx_rates;
7060         struct ieee80211_supported_band *sband;
7061
7062         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7063                 return -EINVAL;
7064
7065         if (!rdev->ops->set_bitrate_mask)
7066                 return -EOPNOTSUPP;
7067
7068         memset(&mask, 0, sizeof(mask));
7069         /* Default to all rates enabled */
7070         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7071                 sband = rdev->wiphy.bands[i];
7072                 mask.control[i].legacy =
7073                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7074                 if (sband)
7075                         memcpy(mask.control[i].mcs,
7076                                sband->ht_cap.mcs.rx_mask,
7077                                sizeof(mask.control[i].mcs));
7078                 else
7079                         memset(mask.control[i].mcs, 0,
7080                                sizeof(mask.control[i].mcs));
7081         }
7082
7083         /*
7084          * The nested attribute uses enum nl80211_band as the index. This maps
7085          * directly to the enum ieee80211_band values used in cfg80211.
7086          */
7087         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7088         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7089         {
7090                 enum ieee80211_band band = nla_type(tx_rates);
7091                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7092                         return -EINVAL;
7093                 sband = rdev->wiphy.bands[band];
7094                 if (sband == NULL)
7095                         return -EINVAL;
7096                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7097                           nla_len(tx_rates), nl80211_txattr_policy);
7098                 if (tb[NL80211_TXRATE_LEGACY]) {
7099                         mask.control[band].legacy = rateset_to_mask(
7100                                 sband,
7101                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7102                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7103                         if ((mask.control[band].legacy == 0) &&
7104                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7105                                 return -EINVAL;
7106                 }
7107                 if (tb[NL80211_TXRATE_MCS]) {
7108                         if (!ht_rateset_to_mask(
7109                                         sband,
7110                                         nla_data(tb[NL80211_TXRATE_MCS]),
7111                                         nla_len(tb[NL80211_TXRATE_MCS]),
7112                                         mask.control[band].mcs))
7113                                 return -EINVAL;
7114                 }
7115
7116                 if (mask.control[band].legacy == 0) {
7117                         /* don't allow empty legacy rates if HT
7118                          * is not even supported. */
7119                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7120                                 return -EINVAL;
7121
7122                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7123                                 if (mask.control[band].mcs[i])
7124                                         break;
7125
7126                         /* legacy and mcs rates may not be both empty */
7127                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7128                                 return -EINVAL;
7129                 }
7130         }
7131
7132         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7133 }
7134
7135 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7136 {
7137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7138         struct wireless_dev *wdev = info->user_ptr[1];
7139         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7140
7141         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7142                 return -EINVAL;
7143
7144         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7145                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7146
7147         switch (wdev->iftype) {
7148         case NL80211_IFTYPE_STATION:
7149         case NL80211_IFTYPE_ADHOC:
7150         case NL80211_IFTYPE_P2P_CLIENT:
7151         case NL80211_IFTYPE_AP:
7152         case NL80211_IFTYPE_AP_VLAN:
7153         case NL80211_IFTYPE_MESH_POINT:
7154         case NL80211_IFTYPE_P2P_GO:
7155         case NL80211_IFTYPE_P2P_DEVICE:
7156                 break;
7157         default:
7158                 return -EOPNOTSUPP;
7159         }
7160
7161         /* not much point in registering if we can't reply */
7162         if (!rdev->ops->mgmt_tx)
7163                 return -EOPNOTSUPP;
7164
7165         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7166                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7167                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7168 }
7169
7170 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7171 {
7172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7173         struct wireless_dev *wdev = info->user_ptr[1];
7174         struct cfg80211_chan_def chandef;
7175         int err;
7176         void *hdr = NULL;
7177         u64 cookie;
7178         struct sk_buff *msg = NULL;
7179         unsigned int wait = 0;
7180         bool offchan, no_cck, dont_wait_for_ack;
7181
7182         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7183
7184         if (!info->attrs[NL80211_ATTR_FRAME])
7185                 return -EINVAL;
7186
7187         if (!rdev->ops->mgmt_tx)
7188                 return -EOPNOTSUPP;
7189
7190         switch (wdev->iftype) {
7191         case NL80211_IFTYPE_P2P_DEVICE:
7192                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7193                         return -EINVAL;
7194         case NL80211_IFTYPE_STATION:
7195         case NL80211_IFTYPE_ADHOC:
7196         case NL80211_IFTYPE_P2P_CLIENT:
7197         case NL80211_IFTYPE_AP:
7198         case NL80211_IFTYPE_AP_VLAN:
7199         case NL80211_IFTYPE_MESH_POINT:
7200         case NL80211_IFTYPE_P2P_GO:
7201                 break;
7202         default:
7203                 return -EOPNOTSUPP;
7204         }
7205
7206         if (info->attrs[NL80211_ATTR_DURATION]) {
7207                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7208                         return -EINVAL;
7209                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7210
7211                 /*
7212                  * We should wait on the channel for at least a minimum amount
7213                  * of time (10ms) but no longer than the driver supports.
7214                  */
7215                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7216                     wait > rdev->wiphy.max_remain_on_channel_duration)
7217                         return -EINVAL;
7218
7219         }
7220
7221         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7222
7223         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7224                 return -EINVAL;
7225
7226         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7227
7228         /* get the channel if any has been specified, otherwise pass NULL to
7229          * the driver. The latter will use the current one
7230          */
7231         chandef.chan = NULL;
7232         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7233                 err = nl80211_parse_chandef(rdev, info, &chandef);
7234                 if (err)
7235                         return err;
7236         }
7237
7238         if (!chandef.chan && offchan)
7239                 return -EINVAL;
7240
7241         if (!dont_wait_for_ack) {
7242                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7243                 if (!msg)
7244                         return -ENOMEM;
7245
7246                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7247                                      NL80211_CMD_FRAME);
7248
7249                 if (IS_ERR(hdr)) {
7250                         err = PTR_ERR(hdr);
7251                         goto free_msg;
7252                 }
7253         }
7254
7255         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7256                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7257                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7258                                     no_cck, dont_wait_for_ack, &cookie);
7259         if (err)
7260                 goto free_msg;
7261
7262         if (msg) {
7263                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7264                         goto nla_put_failure;
7265
7266                 genlmsg_end(msg, hdr);
7267                 return genlmsg_reply(msg, info);
7268         }
7269
7270         return 0;
7271
7272  nla_put_failure:
7273         err = -ENOBUFS;
7274  free_msg:
7275         nlmsg_free(msg);
7276         return err;
7277 }
7278
7279 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7280 {
7281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7282         struct wireless_dev *wdev = info->user_ptr[1];
7283         u64 cookie;
7284
7285         if (!info->attrs[NL80211_ATTR_COOKIE])
7286                 return -EINVAL;
7287
7288         if (!rdev->ops->mgmt_tx_cancel_wait)
7289                 return -EOPNOTSUPP;
7290
7291         switch (wdev->iftype) {
7292         case NL80211_IFTYPE_STATION:
7293         case NL80211_IFTYPE_ADHOC:
7294         case NL80211_IFTYPE_P2P_CLIENT:
7295         case NL80211_IFTYPE_AP:
7296         case NL80211_IFTYPE_AP_VLAN:
7297         case NL80211_IFTYPE_P2P_GO:
7298         case NL80211_IFTYPE_P2P_DEVICE:
7299                 break;
7300         default:
7301                 return -EOPNOTSUPP;
7302         }
7303
7304         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7305
7306         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7307 }
7308
7309 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7310 {
7311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7312         struct wireless_dev *wdev;
7313         struct net_device *dev = info->user_ptr[1];
7314         u8 ps_state;
7315         bool state;
7316         int err;
7317
7318         if (!info->attrs[NL80211_ATTR_PS_STATE])
7319                 return -EINVAL;
7320
7321         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7322
7323         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7324                 return -EINVAL;
7325
7326         wdev = dev->ieee80211_ptr;
7327
7328         if (!rdev->ops->set_power_mgmt)
7329                 return -EOPNOTSUPP;
7330
7331         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7332
7333         if (state == wdev->ps)
7334                 return 0;
7335
7336         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7337         if (!err)
7338                 wdev->ps = state;
7339         return err;
7340 }
7341
7342 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7343 {
7344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7345         enum nl80211_ps_state ps_state;
7346         struct wireless_dev *wdev;
7347         struct net_device *dev = info->user_ptr[1];
7348         struct sk_buff *msg;
7349         void *hdr;
7350         int err;
7351
7352         wdev = dev->ieee80211_ptr;
7353
7354         if (!rdev->ops->set_power_mgmt)
7355                 return -EOPNOTSUPP;
7356
7357         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7358         if (!msg)
7359                 return -ENOMEM;
7360
7361         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7362                              NL80211_CMD_GET_POWER_SAVE);
7363         if (!hdr) {
7364                 err = -ENOBUFS;
7365                 goto free_msg;
7366         }
7367
7368         if (wdev->ps)
7369                 ps_state = NL80211_PS_ENABLED;
7370         else
7371                 ps_state = NL80211_PS_DISABLED;
7372
7373         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7374                 goto nla_put_failure;
7375
7376         genlmsg_end(msg, hdr);
7377         return genlmsg_reply(msg, info);
7378
7379  nla_put_failure:
7380         err = -ENOBUFS;
7381  free_msg:
7382         nlmsg_free(msg);
7383         return err;
7384 }
7385
7386 static struct nla_policy
7387 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7388         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7389         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7390         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7391         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7392         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7393         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7394 };
7395
7396 static int nl80211_set_cqm_txe(struct genl_info *info,
7397                                u32 rate, u32 pkts, u32 intvl)
7398 {
7399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7400         struct wireless_dev *wdev;
7401         struct net_device *dev = info->user_ptr[1];
7402
7403         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7404                 return -EINVAL;
7405
7406         wdev = dev->ieee80211_ptr;
7407
7408         if (!rdev->ops->set_cqm_txe_config)
7409                 return -EOPNOTSUPP;
7410
7411         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7412             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7413                 return -EOPNOTSUPP;
7414
7415         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7416 }
7417
7418 static int nl80211_set_cqm_rssi(struct genl_info *info,
7419                                 s32 threshold, u32 hysteresis)
7420 {
7421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7422         struct wireless_dev *wdev;
7423         struct net_device *dev = info->user_ptr[1];
7424
7425         if (threshold > 0)
7426                 return -EINVAL;
7427
7428         wdev = dev->ieee80211_ptr;
7429
7430         if (!rdev->ops->set_cqm_rssi_config)
7431                 return -EOPNOTSUPP;
7432
7433         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7434             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7435                 return -EOPNOTSUPP;
7436
7437         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7438 }
7439
7440 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7441 {
7442         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7443         struct nlattr *cqm;
7444         int err;
7445
7446         cqm = info->attrs[NL80211_ATTR_CQM];
7447         if (!cqm) {
7448                 err = -EINVAL;
7449                 goto out;
7450         }
7451
7452         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7453                                nl80211_attr_cqm_policy);
7454         if (err)
7455                 goto out;
7456
7457         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7458             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7459                 s32 threshold;
7460                 u32 hysteresis;
7461                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7462                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7463                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7464         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7465                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7466                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7467                 u32 rate, pkts, intvl;
7468                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7469                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7470                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7471                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7472         } else
7473                 err = -EINVAL;
7474
7475 out:
7476         return err;
7477 }
7478
7479 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7480 {
7481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7482         struct net_device *dev = info->user_ptr[1];
7483         struct mesh_config cfg;
7484         struct mesh_setup setup;
7485         int err;
7486
7487         /* start with default */
7488         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7489         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7490
7491         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7492                 /* and parse parameters if given */
7493                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7494                 if (err)
7495                         return err;
7496         }
7497
7498         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7499             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7500                 return -EINVAL;
7501
7502         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7503         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7504
7505         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7506             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7507                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7508                         return -EINVAL;
7509
7510         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7511                 setup.beacon_interval =
7512                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7513                 if (setup.beacon_interval < 10 ||
7514                     setup.beacon_interval > 10000)
7515                         return -EINVAL;
7516         }
7517
7518         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7519                 setup.dtim_period =
7520                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7521                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7522                         return -EINVAL;
7523         }
7524
7525         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7526                 /* parse additional setup parameters if given */
7527                 err = nl80211_parse_mesh_setup(info, &setup);
7528                 if (err)
7529                         return err;
7530         }
7531
7532         if (setup.user_mpm)
7533                 cfg.auto_open_plinks = false;
7534
7535         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7536                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7537                 if (err)
7538                         return err;
7539         } else {
7540                 /* cfg80211_join_mesh() will sort it out */
7541                 setup.chandef.chan = NULL;
7542         }
7543
7544         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7545                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7546                 int n_rates =
7547                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7548                 struct ieee80211_supported_band *sband;
7549
7550                 if (!setup.chandef.chan)
7551                         return -EINVAL;
7552
7553                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7554
7555                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7556                                              &setup.basic_rates);
7557                 if (err)
7558                         return err;
7559         }
7560
7561         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7562 }
7563
7564 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7565 {
7566         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7567         struct net_device *dev = info->user_ptr[1];
7568
7569         return cfg80211_leave_mesh(rdev, dev);
7570 }
7571
7572 #ifdef CONFIG_PM
7573 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7574                                         struct cfg80211_registered_device *rdev)
7575 {
7576         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7577         struct nlattr *nl_pats, *nl_pat;
7578         int i, pat_len;
7579
7580         if (!wowlan->n_patterns)
7581                 return 0;
7582
7583         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7584         if (!nl_pats)
7585                 return -ENOBUFS;
7586
7587         for (i = 0; i < wowlan->n_patterns; i++) {
7588                 nl_pat = nla_nest_start(msg, i + 1);
7589                 if (!nl_pat)
7590                         return -ENOBUFS;
7591                 pat_len = wowlan->patterns[i].pattern_len;
7592                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7593                             DIV_ROUND_UP(pat_len, 8),
7594                             wowlan->patterns[i].mask) ||
7595                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7596                             pat_len, wowlan->patterns[i].pattern) ||
7597                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7598                                 wowlan->patterns[i].pkt_offset))
7599                         return -ENOBUFS;
7600                 nla_nest_end(msg, nl_pat);
7601         }
7602         nla_nest_end(msg, nl_pats);
7603
7604         return 0;
7605 }
7606
7607 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7608                                    struct cfg80211_wowlan_tcp *tcp)
7609 {
7610         struct nlattr *nl_tcp;
7611
7612         if (!tcp)
7613                 return 0;
7614
7615         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7616         if (!nl_tcp)
7617                 return -ENOBUFS;
7618
7619         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7620             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7621             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7622             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7623             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7624             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7625                     tcp->payload_len, tcp->payload) ||
7626             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7627                         tcp->data_interval) ||
7628             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7629                     tcp->wake_len, tcp->wake_data) ||
7630             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7631                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7632                 return -ENOBUFS;
7633
7634         if (tcp->payload_seq.len &&
7635             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7636                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7637                 return -ENOBUFS;
7638
7639         if (tcp->payload_tok.len &&
7640             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7641                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7642                     &tcp->payload_tok))
7643                 return -ENOBUFS;
7644
7645         nla_nest_end(msg, nl_tcp);
7646
7647         return 0;
7648 }
7649
7650 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7651 {
7652         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7653         struct sk_buff *msg;
7654         void *hdr;
7655         u32 size = NLMSG_DEFAULT_SIZE;
7656
7657         if (!rdev->wiphy.wowlan)
7658                 return -EOPNOTSUPP;
7659
7660         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7661                 /* adjust size to have room for all the data */
7662                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7663                         rdev->wiphy.wowlan_config->tcp->payload_len +
7664                         rdev->wiphy.wowlan_config->tcp->wake_len +
7665                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7666         }
7667
7668         msg = nlmsg_new(size, GFP_KERNEL);
7669         if (!msg)
7670                 return -ENOMEM;
7671
7672         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7673                              NL80211_CMD_GET_WOWLAN);
7674         if (!hdr)
7675                 goto nla_put_failure;
7676
7677         if (rdev->wiphy.wowlan_config) {
7678                 struct nlattr *nl_wowlan;
7679
7680                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7681                 if (!nl_wowlan)
7682                         goto nla_put_failure;
7683
7684                 if ((rdev->wiphy.wowlan_config->any &&
7685                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7686                     (rdev->wiphy.wowlan_config->disconnect &&
7687                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7688                     (rdev->wiphy.wowlan_config->magic_pkt &&
7689                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7690                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7691                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7692                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7693                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7694                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7695                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7696                     (rdev->wiphy.wowlan_config->rfkill_release &&
7697                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7698                         goto nla_put_failure;
7699
7700                 if (nl80211_send_wowlan_patterns(msg, rdev))
7701                         goto nla_put_failure;
7702
7703                 if (nl80211_send_wowlan_tcp(msg,
7704                                             rdev->wiphy.wowlan_config->tcp))
7705                         goto nla_put_failure;
7706
7707                 nla_nest_end(msg, nl_wowlan);
7708         }
7709
7710         genlmsg_end(msg, hdr);
7711         return genlmsg_reply(msg, info);
7712
7713 nla_put_failure:
7714         nlmsg_free(msg);
7715         return -ENOBUFS;
7716 }
7717
7718 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7719                                     struct nlattr *attr,
7720                                     struct cfg80211_wowlan *trig)
7721 {
7722         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7723         struct cfg80211_wowlan_tcp *cfg;
7724         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7725         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7726         u32 size;
7727         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7728         int err, port;
7729
7730         if (!rdev->wiphy.wowlan->tcp)
7731                 return -EINVAL;
7732
7733         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7734                         nla_data(attr), nla_len(attr),
7735                         nl80211_wowlan_tcp_policy);
7736         if (err)
7737                 return err;
7738
7739         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7740             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7741             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7742             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7743             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7744             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7745             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7746             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7747                 return -EINVAL;
7748
7749         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7750         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
7751                 return -EINVAL;
7752
7753         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7754                         rdev->wiphy.wowlan->tcp->data_interval_max ||
7755             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7756                 return -EINVAL;
7757
7758         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7759         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
7760                 return -EINVAL;
7761
7762         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7763         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7764                 return -EINVAL;
7765
7766         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7767                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7768
7769                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7770                 tokens_size = tokln - sizeof(*tok);
7771
7772                 if (!tok->len || tokens_size % tok->len)
7773                         return -EINVAL;
7774                 if (!rdev->wiphy.wowlan->tcp->tok)
7775                         return -EINVAL;
7776                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
7777                         return -EINVAL;
7778                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
7779                         return -EINVAL;
7780                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
7781                         return -EINVAL;
7782                 if (tok->offset + tok->len > data_size)
7783                         return -EINVAL;
7784         }
7785
7786         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7787                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7788                 if (!rdev->wiphy.wowlan->tcp->seq)
7789                         return -EINVAL;
7790                 if (seq->len == 0 || seq->len > 4)
7791                         return -EINVAL;
7792                 if (seq->len + seq->offset > data_size)
7793                         return -EINVAL;
7794         }
7795
7796         size = sizeof(*cfg);
7797         size += data_size;
7798         size += wake_size + wake_mask_size;
7799         size += tokens_size;
7800
7801         cfg = kzalloc(size, GFP_KERNEL);
7802         if (!cfg)
7803                 return -ENOMEM;
7804         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7805         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7806         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7807                ETH_ALEN);
7808         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7809                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7810         else
7811                 port = 0;
7812 #ifdef CONFIG_INET
7813         /* allocate a socket and port for it and use it */
7814         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7815                             IPPROTO_TCP, &cfg->sock, 1);
7816         if (err) {
7817                 kfree(cfg);
7818                 return err;
7819         }
7820         if (inet_csk_get_port(cfg->sock->sk, port)) {
7821                 sock_release(cfg->sock);
7822                 kfree(cfg);
7823                 return -EADDRINUSE;
7824         }
7825         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7826 #else
7827         if (!port) {
7828                 kfree(cfg);
7829                 return -EINVAL;
7830         }
7831         cfg->src_port = port;
7832 #endif
7833
7834         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7835         cfg->payload_len = data_size;
7836         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7837         memcpy((void *)cfg->payload,
7838                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7839                data_size);
7840         if (seq)
7841                 cfg->payload_seq = *seq;
7842         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7843         cfg->wake_len = wake_size;
7844         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7845         memcpy((void *)cfg->wake_data,
7846                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7847                wake_size);
7848         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7849                          data_size + wake_size;
7850         memcpy((void *)cfg->wake_mask,
7851                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7852                wake_mask_size);
7853         if (tok) {
7854                 cfg->tokens_size = tokens_size;
7855                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7856         }
7857
7858         trig->tcp = cfg;
7859
7860         return 0;
7861 }
7862
7863 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7864 {
7865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7866         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7867         struct cfg80211_wowlan new_triggers = {};
7868         struct cfg80211_wowlan *ntrig;
7869         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
7870         int err, i;
7871         bool prev_enabled = rdev->wiphy.wowlan_config;
7872
7873         if (!wowlan)
7874                 return -EOPNOTSUPP;
7875
7876         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7877                 cfg80211_rdev_free_wowlan(rdev);
7878                 rdev->wiphy.wowlan_config = NULL;
7879                 goto set_wakeup;
7880         }
7881
7882         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7883                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7884                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7885                         nl80211_wowlan_policy);
7886         if (err)
7887                 return err;
7888
7889         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7890                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7891                         return -EINVAL;
7892                 new_triggers.any = true;
7893         }
7894
7895         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7896                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7897                         return -EINVAL;
7898                 new_triggers.disconnect = true;
7899         }
7900
7901         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7902                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7903                         return -EINVAL;
7904                 new_triggers.magic_pkt = true;
7905         }
7906
7907         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7908                 return -EINVAL;
7909
7910         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7911                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7912                         return -EINVAL;
7913                 new_triggers.gtk_rekey_failure = true;
7914         }
7915
7916         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7917                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7918                         return -EINVAL;
7919                 new_triggers.eap_identity_req = true;
7920         }
7921
7922         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7923                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7924                         return -EINVAL;
7925                 new_triggers.four_way_handshake = true;
7926         }
7927
7928         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7929                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7930                         return -EINVAL;
7931                 new_triggers.rfkill_release = true;
7932         }
7933
7934         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7935                 struct nlattr *pat;
7936                 int n_patterns = 0;
7937                 int rem, pat_len, mask_len, pkt_offset;
7938                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7939
7940                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7941                                     rem)
7942                         n_patterns++;
7943                 if (n_patterns > wowlan->n_patterns)
7944                         return -EINVAL;
7945
7946                 new_triggers.patterns = kcalloc(n_patterns,
7947                                                 sizeof(new_triggers.patterns[0]),
7948                                                 GFP_KERNEL);
7949                 if (!new_triggers.patterns)
7950                         return -ENOMEM;
7951
7952                 new_triggers.n_patterns = n_patterns;
7953                 i = 0;
7954
7955                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7956                                     rem) {
7957                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7958                                   nla_data(pat), nla_len(pat), NULL);
7959                         err = -EINVAL;
7960                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7961                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7962                                 goto error;
7963                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7964                         mask_len = DIV_ROUND_UP(pat_len, 8);
7965                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7966                             mask_len)
7967                                 goto error;
7968                         if (pat_len > wowlan->pattern_max_len ||
7969                             pat_len < wowlan->pattern_min_len)
7970                                 goto error;
7971
7972                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7973                                 pkt_offset = 0;
7974                         else
7975                                 pkt_offset = nla_get_u32(
7976                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7977                         if (pkt_offset > wowlan->max_pkt_offset)
7978                                 goto error;
7979                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7980
7981                         new_triggers.patterns[i].mask =
7982                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7983                         if (!new_triggers.patterns[i].mask) {
7984                                 err = -ENOMEM;
7985                                 goto error;
7986                         }
7987                         new_triggers.patterns[i].pattern =
7988                                 new_triggers.patterns[i].mask + mask_len;
7989                         memcpy(new_triggers.patterns[i].mask,
7990                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7991                                mask_len);
7992                         new_triggers.patterns[i].pattern_len = pat_len;
7993                         memcpy(new_triggers.patterns[i].pattern,
7994                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7995                                pat_len);
7996                         i++;
7997                 }
7998         }
7999
8000         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8001                 err = nl80211_parse_wowlan_tcp(
8002                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8003                         &new_triggers);
8004                 if (err)
8005                         goto error;
8006         }
8007
8008         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8009         if (!ntrig) {
8010                 err = -ENOMEM;
8011                 goto error;
8012         }
8013         cfg80211_rdev_free_wowlan(rdev);
8014         rdev->wiphy.wowlan_config = ntrig;
8015
8016  set_wakeup:
8017         if (rdev->ops->set_wakeup &&
8018             prev_enabled != !!rdev->wiphy.wowlan_config)
8019                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8020
8021         return 0;
8022  error:
8023         for (i = 0; i < new_triggers.n_patterns; i++)
8024                 kfree(new_triggers.patterns[i].mask);
8025         kfree(new_triggers.patterns);
8026         if (new_triggers.tcp && new_triggers.tcp->sock)
8027                 sock_release(new_triggers.tcp->sock);
8028         kfree(new_triggers.tcp);
8029         return err;
8030 }
8031 #endif
8032
8033 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8034 {
8035         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8036         struct net_device *dev = info->user_ptr[1];
8037         struct wireless_dev *wdev = dev->ieee80211_ptr;
8038         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8039         struct cfg80211_gtk_rekey_data rekey_data;
8040         int err;
8041
8042         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8043                 return -EINVAL;
8044
8045         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8046                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8047                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8048                         nl80211_rekey_policy);
8049         if (err)
8050                 return err;
8051
8052         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8053                 return -ERANGE;
8054         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8055                 return -ERANGE;
8056         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8057                 return -ERANGE;
8058
8059         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8060                NL80211_KEK_LEN);
8061         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8062                NL80211_KCK_LEN);
8063         memcpy(rekey_data.replay_ctr,
8064                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8065                NL80211_REPLAY_CTR_LEN);
8066
8067         wdev_lock(wdev);
8068         if (!wdev->current_bss) {
8069                 err = -ENOTCONN;
8070                 goto out;
8071         }
8072
8073         if (!rdev->ops->set_rekey_data) {
8074                 err = -EOPNOTSUPP;
8075                 goto out;
8076         }
8077
8078         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8079  out:
8080         wdev_unlock(wdev);
8081         return err;
8082 }
8083
8084 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8085                                              struct genl_info *info)
8086 {
8087         struct net_device *dev = info->user_ptr[1];
8088         struct wireless_dev *wdev = dev->ieee80211_ptr;
8089
8090         if (wdev->iftype != NL80211_IFTYPE_AP &&
8091             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8092                 return -EINVAL;
8093
8094         if (wdev->ap_unexpected_nlportid)
8095                 return -EBUSY;
8096
8097         wdev->ap_unexpected_nlportid = info->snd_portid;
8098         return 0;
8099 }
8100
8101 static int nl80211_probe_client(struct sk_buff *skb,
8102                                 struct genl_info *info)
8103 {
8104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8105         struct net_device *dev = info->user_ptr[1];
8106         struct wireless_dev *wdev = dev->ieee80211_ptr;
8107         struct sk_buff *msg;
8108         void *hdr;
8109         const u8 *addr;
8110         u64 cookie;
8111         int err;
8112
8113         if (wdev->iftype != NL80211_IFTYPE_AP &&
8114             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8115                 return -EOPNOTSUPP;
8116
8117         if (!info->attrs[NL80211_ATTR_MAC])
8118                 return -EINVAL;
8119
8120         if (!rdev->ops->probe_client)
8121                 return -EOPNOTSUPP;
8122
8123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8124         if (!msg)
8125                 return -ENOMEM;
8126
8127         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8128                              NL80211_CMD_PROBE_CLIENT);
8129
8130         if (IS_ERR(hdr)) {
8131                 err = PTR_ERR(hdr);
8132                 goto free_msg;
8133         }
8134
8135         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8136
8137         err = rdev_probe_client(rdev, dev, addr, &cookie);
8138         if (err)
8139                 goto free_msg;
8140
8141         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8142                 goto nla_put_failure;
8143
8144         genlmsg_end(msg, hdr);
8145
8146         return genlmsg_reply(msg, info);
8147
8148  nla_put_failure:
8149         err = -ENOBUFS;
8150  free_msg:
8151         nlmsg_free(msg);
8152         return err;
8153 }
8154
8155 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8156 {
8157         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8158         struct cfg80211_beacon_registration *reg, *nreg;
8159         int rv;
8160
8161         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8162                 return -EOPNOTSUPP;
8163
8164         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8165         if (!nreg)
8166                 return -ENOMEM;
8167
8168         /* First, check if already registered. */
8169         spin_lock_bh(&rdev->beacon_registrations_lock);
8170         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8171                 if (reg->nlportid == info->snd_portid) {
8172                         rv = -EALREADY;
8173                         goto out_err;
8174                 }
8175         }
8176         /* Add it to the list */
8177         nreg->nlportid = info->snd_portid;
8178         list_add(&nreg->list, &rdev->beacon_registrations);
8179
8180         spin_unlock_bh(&rdev->beacon_registrations_lock);
8181
8182         return 0;
8183 out_err:
8184         spin_unlock_bh(&rdev->beacon_registrations_lock);
8185         kfree(nreg);
8186         return rv;
8187 }
8188
8189 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8190 {
8191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8192         struct wireless_dev *wdev = info->user_ptr[1];
8193         int err;
8194
8195         if (!rdev->ops->start_p2p_device)
8196                 return -EOPNOTSUPP;
8197
8198         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8199                 return -EOPNOTSUPP;
8200
8201         if (wdev->p2p_started)
8202                 return 0;
8203
8204         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8205         if (err)
8206                 return err;
8207
8208         err = rdev_start_p2p_device(rdev, wdev);
8209         if (err)
8210                 return err;
8211
8212         wdev->p2p_started = true;
8213         rdev->opencount++;
8214
8215         return 0;
8216 }
8217
8218 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8219 {
8220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8221         struct wireless_dev *wdev = info->user_ptr[1];
8222
8223         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8224                 return -EOPNOTSUPP;
8225
8226         if (!rdev->ops->stop_p2p_device)
8227                 return -EOPNOTSUPP;
8228
8229         cfg80211_stop_p2p_device(rdev, wdev);
8230
8231         return 0;
8232 }
8233
8234 static int nl80211_get_protocol_features(struct sk_buff *skb,
8235                                          struct genl_info *info)
8236 {
8237         void *hdr;
8238         struct sk_buff *msg;
8239
8240         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8241         if (!msg)
8242                 return -ENOMEM;
8243
8244         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8245                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8246         if (!hdr)
8247                 goto nla_put_failure;
8248
8249         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8250                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8251                 goto nla_put_failure;
8252
8253         genlmsg_end(msg, hdr);
8254         return genlmsg_reply(msg, info);
8255
8256  nla_put_failure:
8257         kfree_skb(msg);
8258         return -ENOBUFS;
8259 }
8260
8261 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8262 {
8263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8264         struct cfg80211_update_ft_ies_params ft_params;
8265         struct net_device *dev = info->user_ptr[1];
8266
8267         if (!rdev->ops->update_ft_ies)
8268                 return -EOPNOTSUPP;
8269
8270         if (!info->attrs[NL80211_ATTR_MDID] ||
8271             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8272                 return -EINVAL;
8273
8274         memset(&ft_params, 0, sizeof(ft_params));
8275         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8276         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8277         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8278
8279         return rdev_update_ft_ies(rdev, dev, &ft_params);
8280 }
8281
8282 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8283                                        struct genl_info *info)
8284 {
8285         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8286         struct wireless_dev *wdev = info->user_ptr[1];
8287         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8288         u16 duration;
8289         int ret;
8290
8291         if (!rdev->ops->crit_proto_start)
8292                 return -EOPNOTSUPP;
8293
8294         if (WARN_ON(!rdev->ops->crit_proto_stop))
8295                 return -EINVAL;
8296
8297         if (rdev->crit_proto_nlportid)
8298                 return -EBUSY;
8299
8300         /* determine protocol if provided */
8301         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8302                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8303
8304         if (proto >= NUM_NL80211_CRIT_PROTO)
8305                 return -EINVAL;
8306
8307         /* timeout must be provided */
8308         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8309                 return -EINVAL;
8310
8311         duration =
8312                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8313
8314         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8315                 return -ERANGE;
8316
8317         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8318         if (!ret)
8319                 rdev->crit_proto_nlportid = info->snd_portid;
8320
8321         return ret;
8322 }
8323
8324 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8325                                       struct genl_info *info)
8326 {
8327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8328         struct wireless_dev *wdev = info->user_ptr[1];
8329
8330         if (!rdev->ops->crit_proto_stop)
8331                 return -EOPNOTSUPP;
8332
8333         if (rdev->crit_proto_nlportid) {
8334                 rdev->crit_proto_nlportid = 0;
8335                 rdev_crit_proto_stop(rdev, wdev);
8336         }
8337         return 0;
8338 }
8339
8340 #define NL80211_FLAG_NEED_WIPHY         0x01
8341 #define NL80211_FLAG_NEED_NETDEV        0x02
8342 #define NL80211_FLAG_NEED_RTNL          0x04
8343 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8344 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8345                                          NL80211_FLAG_CHECK_NETDEV_UP)
8346 #define NL80211_FLAG_NEED_WDEV          0x10
8347 /* If a netdev is associated, it must be UP, P2P must be started */
8348 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8349                                          NL80211_FLAG_CHECK_NETDEV_UP)
8350
8351 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8352                             struct genl_info *info)
8353 {
8354         struct cfg80211_registered_device *rdev;
8355         struct wireless_dev *wdev;
8356         struct net_device *dev;
8357         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8358
8359         if (rtnl)
8360                 rtnl_lock();
8361
8362         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8363                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8364                 if (IS_ERR(rdev)) {
8365                         if (rtnl)
8366                                 rtnl_unlock();
8367                         return PTR_ERR(rdev);
8368                 }
8369                 info->user_ptr[0] = rdev;
8370         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8371                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8372                 ASSERT_RTNL();
8373
8374                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8375                                                   info->attrs);
8376                 if (IS_ERR(wdev)) {
8377                         if (rtnl)
8378                                 rtnl_unlock();
8379                         return PTR_ERR(wdev);
8380                 }
8381
8382                 dev = wdev->netdev;
8383                 rdev = wiphy_to_dev(wdev->wiphy);
8384
8385                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8386                         if (!dev) {
8387                                 if (rtnl)
8388                                         rtnl_unlock();
8389                                 return -EINVAL;
8390                         }
8391
8392                         info->user_ptr[1] = dev;
8393                 } else {
8394                         info->user_ptr[1] = wdev;
8395                 }
8396
8397                 if (dev) {
8398                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8399                             !netif_running(dev)) {
8400                                 if (rtnl)
8401                                         rtnl_unlock();
8402                                 return -ENETDOWN;
8403                         }
8404
8405                         dev_hold(dev);
8406                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8407                         if (!wdev->p2p_started) {
8408                                 if (rtnl)
8409                                         rtnl_unlock();
8410                                 return -ENETDOWN;
8411                         }
8412                 }
8413
8414                 info->user_ptr[0] = rdev;
8415         }
8416
8417         return 0;
8418 }
8419
8420 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8421                               struct genl_info *info)
8422 {
8423         if (info->user_ptr[1]) {
8424                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8425                         struct wireless_dev *wdev = info->user_ptr[1];
8426
8427                         if (wdev->netdev)
8428                                 dev_put(wdev->netdev);
8429                 } else {
8430                         dev_put(info->user_ptr[1]);
8431                 }
8432         }
8433         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8434                 rtnl_unlock();
8435 }
8436
8437 static struct genl_ops nl80211_ops[] = {
8438         {
8439                 .cmd = NL80211_CMD_GET_WIPHY,
8440                 .doit = nl80211_get_wiphy,
8441                 .dumpit = nl80211_dump_wiphy,
8442                 .done = nl80211_dump_wiphy_done,
8443                 .policy = nl80211_policy,
8444                 /* can be retrieved by unprivileged users */
8445                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8446                                   NL80211_FLAG_NEED_RTNL,
8447         },
8448         {
8449                 .cmd = NL80211_CMD_SET_WIPHY,
8450                 .doit = nl80211_set_wiphy,
8451                 .policy = nl80211_policy,
8452                 .flags = GENL_ADMIN_PERM,
8453                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8454         },
8455         {
8456                 .cmd = NL80211_CMD_GET_INTERFACE,
8457                 .doit = nl80211_get_interface,
8458                 .dumpit = nl80211_dump_interface,
8459                 .policy = nl80211_policy,
8460                 /* can be retrieved by unprivileged users */
8461                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8462                                   NL80211_FLAG_NEED_RTNL,
8463         },
8464         {
8465                 .cmd = NL80211_CMD_SET_INTERFACE,
8466                 .doit = nl80211_set_interface,
8467                 .policy = nl80211_policy,
8468                 .flags = GENL_ADMIN_PERM,
8469                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8470                                   NL80211_FLAG_NEED_RTNL,
8471         },
8472         {
8473                 .cmd = NL80211_CMD_NEW_INTERFACE,
8474                 .doit = nl80211_new_interface,
8475                 .policy = nl80211_policy,
8476                 .flags = GENL_ADMIN_PERM,
8477                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8478                                   NL80211_FLAG_NEED_RTNL,
8479         },
8480         {
8481                 .cmd = NL80211_CMD_DEL_INTERFACE,
8482                 .doit = nl80211_del_interface,
8483                 .policy = nl80211_policy,
8484                 .flags = GENL_ADMIN_PERM,
8485                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8486                                   NL80211_FLAG_NEED_RTNL,
8487         },
8488         {
8489                 .cmd = NL80211_CMD_GET_KEY,
8490                 .doit = nl80211_get_key,
8491                 .policy = nl80211_policy,
8492                 .flags = GENL_ADMIN_PERM,
8493                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8494                                   NL80211_FLAG_NEED_RTNL,
8495         },
8496         {
8497                 .cmd = NL80211_CMD_SET_KEY,
8498                 .doit = nl80211_set_key,
8499                 .policy = nl80211_policy,
8500                 .flags = GENL_ADMIN_PERM,
8501                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8502                                   NL80211_FLAG_NEED_RTNL,
8503         },
8504         {
8505                 .cmd = NL80211_CMD_NEW_KEY,
8506                 .doit = nl80211_new_key,
8507                 .policy = nl80211_policy,
8508                 .flags = GENL_ADMIN_PERM,
8509                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8510                                   NL80211_FLAG_NEED_RTNL,
8511         },
8512         {
8513                 .cmd = NL80211_CMD_DEL_KEY,
8514                 .doit = nl80211_del_key,
8515                 .policy = nl80211_policy,
8516                 .flags = GENL_ADMIN_PERM,
8517                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8518                                   NL80211_FLAG_NEED_RTNL,
8519         },
8520         {
8521                 .cmd = NL80211_CMD_SET_BEACON,
8522                 .policy = nl80211_policy,
8523                 .flags = GENL_ADMIN_PERM,
8524                 .doit = nl80211_set_beacon,
8525                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8526                                   NL80211_FLAG_NEED_RTNL,
8527         },
8528         {
8529                 .cmd = NL80211_CMD_START_AP,
8530                 .policy = nl80211_policy,
8531                 .flags = GENL_ADMIN_PERM,
8532                 .doit = nl80211_start_ap,
8533                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8534                                   NL80211_FLAG_NEED_RTNL,
8535         },
8536         {
8537                 .cmd = NL80211_CMD_STOP_AP,
8538                 .policy = nl80211_policy,
8539                 .flags = GENL_ADMIN_PERM,
8540                 .doit = nl80211_stop_ap,
8541                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8542                                   NL80211_FLAG_NEED_RTNL,
8543         },
8544         {
8545                 .cmd = NL80211_CMD_GET_STATION,
8546                 .doit = nl80211_get_station,
8547                 .dumpit = nl80211_dump_station,
8548                 .policy = nl80211_policy,
8549                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8550                                   NL80211_FLAG_NEED_RTNL,
8551         },
8552         {
8553                 .cmd = NL80211_CMD_SET_STATION,
8554                 .doit = nl80211_set_station,
8555                 .policy = nl80211_policy,
8556                 .flags = GENL_ADMIN_PERM,
8557                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8558                                   NL80211_FLAG_NEED_RTNL,
8559         },
8560         {
8561                 .cmd = NL80211_CMD_NEW_STATION,
8562                 .doit = nl80211_new_station,
8563                 .policy = nl80211_policy,
8564                 .flags = GENL_ADMIN_PERM,
8565                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8566                                   NL80211_FLAG_NEED_RTNL,
8567         },
8568         {
8569                 .cmd = NL80211_CMD_DEL_STATION,
8570                 .doit = nl80211_del_station,
8571                 .policy = nl80211_policy,
8572                 .flags = GENL_ADMIN_PERM,
8573                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8574                                   NL80211_FLAG_NEED_RTNL,
8575         },
8576         {
8577                 .cmd = NL80211_CMD_GET_MPATH,
8578                 .doit = nl80211_get_mpath,
8579                 .dumpit = nl80211_dump_mpath,
8580                 .policy = nl80211_policy,
8581                 .flags = GENL_ADMIN_PERM,
8582                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8583                                   NL80211_FLAG_NEED_RTNL,
8584         },
8585         {
8586                 .cmd = NL80211_CMD_SET_MPATH,
8587                 .doit = nl80211_set_mpath,
8588                 .policy = nl80211_policy,
8589                 .flags = GENL_ADMIN_PERM,
8590                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8591                                   NL80211_FLAG_NEED_RTNL,
8592         },
8593         {
8594                 .cmd = NL80211_CMD_NEW_MPATH,
8595                 .doit = nl80211_new_mpath,
8596                 .policy = nl80211_policy,
8597                 .flags = GENL_ADMIN_PERM,
8598                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8599                                   NL80211_FLAG_NEED_RTNL,
8600         },
8601         {
8602                 .cmd = NL80211_CMD_DEL_MPATH,
8603                 .doit = nl80211_del_mpath,
8604                 .policy = nl80211_policy,
8605                 .flags = GENL_ADMIN_PERM,
8606                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8607                                   NL80211_FLAG_NEED_RTNL,
8608         },
8609         {
8610                 .cmd = NL80211_CMD_SET_BSS,
8611                 .doit = nl80211_set_bss,
8612                 .policy = nl80211_policy,
8613                 .flags = GENL_ADMIN_PERM,
8614                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8615                                   NL80211_FLAG_NEED_RTNL,
8616         },
8617         {
8618                 .cmd = NL80211_CMD_GET_REG,
8619                 .doit = nl80211_get_reg,
8620                 .policy = nl80211_policy,
8621                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8622                 /* can be retrieved by unprivileged users */
8623         },
8624         {
8625                 .cmd = NL80211_CMD_SET_REG,
8626                 .doit = nl80211_set_reg,
8627                 .policy = nl80211_policy,
8628                 .flags = GENL_ADMIN_PERM,
8629                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8630         },
8631         {
8632                 .cmd = NL80211_CMD_REQ_SET_REG,
8633                 .doit = nl80211_req_set_reg,
8634                 .policy = nl80211_policy,
8635                 .flags = GENL_ADMIN_PERM,
8636         },
8637         {
8638                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8639                 .doit = nl80211_get_mesh_config,
8640                 .policy = nl80211_policy,
8641                 /* can be retrieved by unprivileged users */
8642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8643                                   NL80211_FLAG_NEED_RTNL,
8644         },
8645         {
8646                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8647                 .doit = nl80211_update_mesh_config,
8648                 .policy = nl80211_policy,
8649                 .flags = GENL_ADMIN_PERM,
8650                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8651                                   NL80211_FLAG_NEED_RTNL,
8652         },
8653         {
8654                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8655                 .doit = nl80211_trigger_scan,
8656                 .policy = nl80211_policy,
8657                 .flags = GENL_ADMIN_PERM,
8658                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8659                                   NL80211_FLAG_NEED_RTNL,
8660         },
8661         {
8662                 .cmd = NL80211_CMD_GET_SCAN,
8663                 .policy = nl80211_policy,
8664                 .dumpit = nl80211_dump_scan,
8665         },
8666         {
8667                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8668                 .doit = nl80211_start_sched_scan,
8669                 .policy = nl80211_policy,
8670                 .flags = GENL_ADMIN_PERM,
8671                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8672                                   NL80211_FLAG_NEED_RTNL,
8673         },
8674         {
8675                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8676                 .doit = nl80211_stop_sched_scan,
8677                 .policy = nl80211_policy,
8678                 .flags = GENL_ADMIN_PERM,
8679                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8680                                   NL80211_FLAG_NEED_RTNL,
8681         },
8682         {
8683                 .cmd = NL80211_CMD_AUTHENTICATE,
8684                 .doit = nl80211_authenticate,
8685                 .policy = nl80211_policy,
8686                 .flags = GENL_ADMIN_PERM,
8687                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8688                                   NL80211_FLAG_NEED_RTNL,
8689         },
8690         {
8691                 .cmd = NL80211_CMD_ASSOCIATE,
8692                 .doit = nl80211_associate,
8693                 .policy = nl80211_policy,
8694                 .flags = GENL_ADMIN_PERM,
8695                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8696                                   NL80211_FLAG_NEED_RTNL,
8697         },
8698         {
8699                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8700                 .doit = nl80211_deauthenticate,
8701                 .policy = nl80211_policy,
8702                 .flags = GENL_ADMIN_PERM,
8703                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8704                                   NL80211_FLAG_NEED_RTNL,
8705         },
8706         {
8707                 .cmd = NL80211_CMD_DISASSOCIATE,
8708                 .doit = nl80211_disassociate,
8709                 .policy = nl80211_policy,
8710                 .flags = GENL_ADMIN_PERM,
8711                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8712                                   NL80211_FLAG_NEED_RTNL,
8713         },
8714         {
8715                 .cmd = NL80211_CMD_JOIN_IBSS,
8716                 .doit = nl80211_join_ibss,
8717                 .policy = nl80211_policy,
8718                 .flags = GENL_ADMIN_PERM,
8719                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8720                                   NL80211_FLAG_NEED_RTNL,
8721         },
8722         {
8723                 .cmd = NL80211_CMD_LEAVE_IBSS,
8724                 .doit = nl80211_leave_ibss,
8725                 .policy = nl80211_policy,
8726                 .flags = GENL_ADMIN_PERM,
8727                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8728                                   NL80211_FLAG_NEED_RTNL,
8729         },
8730 #ifdef CONFIG_NL80211_TESTMODE
8731         {
8732                 .cmd = NL80211_CMD_TESTMODE,
8733                 .doit = nl80211_testmode_do,
8734                 .dumpit = nl80211_testmode_dump,
8735                 .policy = nl80211_policy,
8736                 .flags = GENL_ADMIN_PERM,
8737                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8738                                   NL80211_FLAG_NEED_RTNL,
8739         },
8740 #endif
8741         {
8742                 .cmd = NL80211_CMD_CONNECT,
8743                 .doit = nl80211_connect,
8744                 .policy = nl80211_policy,
8745                 .flags = GENL_ADMIN_PERM,
8746                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8747                                   NL80211_FLAG_NEED_RTNL,
8748         },
8749         {
8750                 .cmd = NL80211_CMD_DISCONNECT,
8751                 .doit = nl80211_disconnect,
8752                 .policy = nl80211_policy,
8753                 .flags = GENL_ADMIN_PERM,
8754                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8755                                   NL80211_FLAG_NEED_RTNL,
8756         },
8757         {
8758                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8759                 .doit = nl80211_wiphy_netns,
8760                 .policy = nl80211_policy,
8761                 .flags = GENL_ADMIN_PERM,
8762                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8763                                   NL80211_FLAG_NEED_RTNL,
8764         },
8765         {
8766                 .cmd = NL80211_CMD_GET_SURVEY,
8767                 .policy = nl80211_policy,
8768                 .dumpit = nl80211_dump_survey,
8769         },
8770         {
8771                 .cmd = NL80211_CMD_SET_PMKSA,
8772                 .doit = nl80211_setdel_pmksa,
8773                 .policy = nl80211_policy,
8774                 .flags = GENL_ADMIN_PERM,
8775                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8776                                   NL80211_FLAG_NEED_RTNL,
8777         },
8778         {
8779                 .cmd = NL80211_CMD_DEL_PMKSA,
8780                 .doit = nl80211_setdel_pmksa,
8781                 .policy = nl80211_policy,
8782                 .flags = GENL_ADMIN_PERM,
8783                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8784                                   NL80211_FLAG_NEED_RTNL,
8785         },
8786         {
8787                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8788                 .doit = nl80211_flush_pmksa,
8789                 .policy = nl80211_policy,
8790                 .flags = GENL_ADMIN_PERM,
8791                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8792                                   NL80211_FLAG_NEED_RTNL,
8793         },
8794         {
8795                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8796                 .doit = nl80211_remain_on_channel,
8797                 .policy = nl80211_policy,
8798                 .flags = GENL_ADMIN_PERM,
8799                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8800                                   NL80211_FLAG_NEED_RTNL,
8801         },
8802         {
8803                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8804                 .doit = nl80211_cancel_remain_on_channel,
8805                 .policy = nl80211_policy,
8806                 .flags = GENL_ADMIN_PERM,
8807                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8808                                   NL80211_FLAG_NEED_RTNL,
8809         },
8810         {
8811                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8812                 .doit = nl80211_set_tx_bitrate_mask,
8813                 .policy = nl80211_policy,
8814                 .flags = GENL_ADMIN_PERM,
8815                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8816                                   NL80211_FLAG_NEED_RTNL,
8817         },
8818         {
8819                 .cmd = NL80211_CMD_REGISTER_FRAME,
8820                 .doit = nl80211_register_mgmt,
8821                 .policy = nl80211_policy,
8822                 .flags = GENL_ADMIN_PERM,
8823                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8824                                   NL80211_FLAG_NEED_RTNL,
8825         },
8826         {
8827                 .cmd = NL80211_CMD_FRAME,
8828                 .doit = nl80211_tx_mgmt,
8829                 .policy = nl80211_policy,
8830                 .flags = GENL_ADMIN_PERM,
8831                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8832                                   NL80211_FLAG_NEED_RTNL,
8833         },
8834         {
8835                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8836                 .doit = nl80211_tx_mgmt_cancel_wait,
8837                 .policy = nl80211_policy,
8838                 .flags = GENL_ADMIN_PERM,
8839                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8840                                   NL80211_FLAG_NEED_RTNL,
8841         },
8842         {
8843                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8844                 .doit = nl80211_set_power_save,
8845                 .policy = nl80211_policy,
8846                 .flags = GENL_ADMIN_PERM,
8847                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8848                                   NL80211_FLAG_NEED_RTNL,
8849         },
8850         {
8851                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8852                 .doit = nl80211_get_power_save,
8853                 .policy = nl80211_policy,
8854                 /* can be retrieved by unprivileged users */
8855                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8856                                   NL80211_FLAG_NEED_RTNL,
8857         },
8858         {
8859                 .cmd = NL80211_CMD_SET_CQM,
8860                 .doit = nl80211_set_cqm,
8861                 .policy = nl80211_policy,
8862                 .flags = GENL_ADMIN_PERM,
8863                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8864                                   NL80211_FLAG_NEED_RTNL,
8865         },
8866         {
8867                 .cmd = NL80211_CMD_SET_CHANNEL,
8868                 .doit = nl80211_set_channel,
8869                 .policy = nl80211_policy,
8870                 .flags = GENL_ADMIN_PERM,
8871                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8872                                   NL80211_FLAG_NEED_RTNL,
8873         },
8874         {
8875                 .cmd = NL80211_CMD_SET_WDS_PEER,
8876                 .doit = nl80211_set_wds_peer,
8877                 .policy = nl80211_policy,
8878                 .flags = GENL_ADMIN_PERM,
8879                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8880                                   NL80211_FLAG_NEED_RTNL,
8881         },
8882         {
8883                 .cmd = NL80211_CMD_JOIN_MESH,
8884                 .doit = nl80211_join_mesh,
8885                 .policy = nl80211_policy,
8886                 .flags = GENL_ADMIN_PERM,
8887                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8888                                   NL80211_FLAG_NEED_RTNL,
8889         },
8890         {
8891                 .cmd = NL80211_CMD_LEAVE_MESH,
8892                 .doit = nl80211_leave_mesh,
8893                 .policy = nl80211_policy,
8894                 .flags = GENL_ADMIN_PERM,
8895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8896                                   NL80211_FLAG_NEED_RTNL,
8897         },
8898 #ifdef CONFIG_PM
8899         {
8900                 .cmd = NL80211_CMD_GET_WOWLAN,
8901                 .doit = nl80211_get_wowlan,
8902                 .policy = nl80211_policy,
8903                 /* can be retrieved by unprivileged users */
8904                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8905                                   NL80211_FLAG_NEED_RTNL,
8906         },
8907         {
8908                 .cmd = NL80211_CMD_SET_WOWLAN,
8909                 .doit = nl80211_set_wowlan,
8910                 .policy = nl80211_policy,
8911                 .flags = GENL_ADMIN_PERM,
8912                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8913                                   NL80211_FLAG_NEED_RTNL,
8914         },
8915 #endif
8916         {
8917                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8918                 .doit = nl80211_set_rekey_data,
8919                 .policy = nl80211_policy,
8920                 .flags = GENL_ADMIN_PERM,
8921                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8922                                   NL80211_FLAG_NEED_RTNL,
8923         },
8924         {
8925                 .cmd = NL80211_CMD_TDLS_MGMT,
8926                 .doit = nl80211_tdls_mgmt,
8927                 .policy = nl80211_policy,
8928                 .flags = GENL_ADMIN_PERM,
8929                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8930                                   NL80211_FLAG_NEED_RTNL,
8931         },
8932         {
8933                 .cmd = NL80211_CMD_TDLS_OPER,
8934                 .doit = nl80211_tdls_oper,
8935                 .policy = nl80211_policy,
8936                 .flags = GENL_ADMIN_PERM,
8937                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8938                                   NL80211_FLAG_NEED_RTNL,
8939         },
8940         {
8941                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8942                 .doit = nl80211_register_unexpected_frame,
8943                 .policy = nl80211_policy,
8944                 .flags = GENL_ADMIN_PERM,
8945                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8946                                   NL80211_FLAG_NEED_RTNL,
8947         },
8948         {
8949                 .cmd = NL80211_CMD_PROBE_CLIENT,
8950                 .doit = nl80211_probe_client,
8951                 .policy = nl80211_policy,
8952                 .flags = GENL_ADMIN_PERM,
8953                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8954                                   NL80211_FLAG_NEED_RTNL,
8955         },
8956         {
8957                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8958                 .doit = nl80211_register_beacons,
8959                 .policy = nl80211_policy,
8960                 .flags = GENL_ADMIN_PERM,
8961                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8962                                   NL80211_FLAG_NEED_RTNL,
8963         },
8964         {
8965                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8966                 .doit = nl80211_set_noack_map,
8967                 .policy = nl80211_policy,
8968                 .flags = GENL_ADMIN_PERM,
8969                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8970                                   NL80211_FLAG_NEED_RTNL,
8971         },
8972         {
8973                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8974                 .doit = nl80211_start_p2p_device,
8975                 .policy = nl80211_policy,
8976                 .flags = GENL_ADMIN_PERM,
8977                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8978                                   NL80211_FLAG_NEED_RTNL,
8979         },
8980         {
8981                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8982                 .doit = nl80211_stop_p2p_device,
8983                 .policy = nl80211_policy,
8984                 .flags = GENL_ADMIN_PERM,
8985                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8986                                   NL80211_FLAG_NEED_RTNL,
8987         },
8988         {
8989                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8990                 .doit = nl80211_set_mcast_rate,
8991                 .policy = nl80211_policy,
8992                 .flags = GENL_ADMIN_PERM,
8993                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8994                                   NL80211_FLAG_NEED_RTNL,
8995         },
8996         {
8997                 .cmd = NL80211_CMD_SET_MAC_ACL,
8998                 .doit = nl80211_set_mac_acl,
8999                 .policy = nl80211_policy,
9000                 .flags = GENL_ADMIN_PERM,
9001                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9002                                   NL80211_FLAG_NEED_RTNL,
9003         },
9004         {
9005                 .cmd = NL80211_CMD_RADAR_DETECT,
9006                 .doit = nl80211_start_radar_detection,
9007                 .policy = nl80211_policy,
9008                 .flags = GENL_ADMIN_PERM,
9009                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9010                                   NL80211_FLAG_NEED_RTNL,
9011         },
9012         {
9013                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9014                 .doit = nl80211_get_protocol_features,
9015                 .policy = nl80211_policy,
9016         },
9017         {
9018                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9019                 .doit = nl80211_update_ft_ies,
9020                 .policy = nl80211_policy,
9021                 .flags = GENL_ADMIN_PERM,
9022                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9023                                   NL80211_FLAG_NEED_RTNL,
9024         },
9025         {
9026                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9027                 .doit = nl80211_crit_protocol_start,
9028                 .policy = nl80211_policy,
9029                 .flags = GENL_ADMIN_PERM,
9030                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9031                                   NL80211_FLAG_NEED_RTNL,
9032         },
9033         {
9034                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9035                 .doit = nl80211_crit_protocol_stop,
9036                 .policy = nl80211_policy,
9037                 .flags = GENL_ADMIN_PERM,
9038                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9039                                   NL80211_FLAG_NEED_RTNL,
9040         }
9041 };
9042
9043 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9044         .name = "mlme",
9045 };
9046
9047 /* multicast groups */
9048 static struct genl_multicast_group nl80211_config_mcgrp = {
9049         .name = "config",
9050 };
9051 static struct genl_multicast_group nl80211_scan_mcgrp = {
9052         .name = "scan",
9053 };
9054 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9055         .name = "regulatory",
9056 };
9057
9058 /* notification functions */
9059
9060 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9061 {
9062         struct sk_buff *msg;
9063         struct nl80211_dump_wiphy_state state = {};
9064
9065         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9066         if (!msg)
9067                 return;
9068
9069         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9070                 nlmsg_free(msg);
9071                 return;
9072         }
9073
9074         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9075                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9076 }
9077
9078 static int nl80211_add_scan_req(struct sk_buff *msg,
9079                                 struct cfg80211_registered_device *rdev)
9080 {
9081         struct cfg80211_scan_request *req = rdev->scan_req;
9082         struct nlattr *nest;
9083         int i;
9084
9085         if (WARN_ON(!req))
9086                 return 0;
9087
9088         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9089         if (!nest)
9090                 goto nla_put_failure;
9091         for (i = 0; i < req->n_ssids; i++) {
9092                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9093                         goto nla_put_failure;
9094         }
9095         nla_nest_end(msg, nest);
9096
9097         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9098         if (!nest)
9099                 goto nla_put_failure;
9100         for (i = 0; i < req->n_channels; i++) {
9101                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9102                         goto nla_put_failure;
9103         }
9104         nla_nest_end(msg, nest);
9105
9106         if (req->ie &&
9107             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9108                 goto nla_put_failure;
9109
9110         if (req->flags)
9111                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9112
9113         return 0;
9114  nla_put_failure:
9115         return -ENOBUFS;
9116 }
9117
9118 static int nl80211_send_scan_msg(struct sk_buff *msg,
9119                                  struct cfg80211_registered_device *rdev,
9120                                  struct wireless_dev *wdev,
9121                                  u32 portid, u32 seq, int flags,
9122                                  u32 cmd)
9123 {
9124         void *hdr;
9125
9126         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9127         if (!hdr)
9128                 return -1;
9129
9130         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9131             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9132                                          wdev->netdev->ifindex)) ||
9133             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9134                 goto nla_put_failure;
9135
9136         /* ignore errors and send incomplete event anyway */
9137         nl80211_add_scan_req(msg, rdev);
9138
9139         return genlmsg_end(msg, hdr);
9140
9141  nla_put_failure:
9142         genlmsg_cancel(msg, hdr);
9143         return -EMSGSIZE;
9144 }
9145
9146 static int
9147 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9148                             struct cfg80211_registered_device *rdev,
9149                             struct net_device *netdev,
9150                             u32 portid, u32 seq, int flags, u32 cmd)
9151 {
9152         void *hdr;
9153
9154         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9155         if (!hdr)
9156                 return -1;
9157
9158         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9159             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9160                 goto nla_put_failure;
9161
9162         return genlmsg_end(msg, hdr);
9163
9164  nla_put_failure:
9165         genlmsg_cancel(msg, hdr);
9166         return -EMSGSIZE;
9167 }
9168
9169 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9170                              struct wireless_dev *wdev)
9171 {
9172         struct sk_buff *msg;
9173
9174         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9175         if (!msg)
9176                 return;
9177
9178         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9179                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9180                 nlmsg_free(msg);
9181                 return;
9182         }
9183
9184         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9185                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9186 }
9187
9188 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9189                             struct wireless_dev *wdev)
9190 {
9191         struct sk_buff *msg;
9192
9193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9194         if (!msg)
9195                 return;
9196
9197         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9198                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9199                 nlmsg_free(msg);
9200                 return;
9201         }
9202
9203         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9204                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9205 }
9206
9207 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9208                                struct wireless_dev *wdev)
9209 {
9210         struct sk_buff *msg;
9211
9212         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9213         if (!msg)
9214                 return;
9215
9216         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9217                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9218                 nlmsg_free(msg);
9219                 return;
9220         }
9221
9222         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9223                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9224 }
9225
9226 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9227                                      struct net_device *netdev)
9228 {
9229         struct sk_buff *msg;
9230
9231         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9232         if (!msg)
9233                 return;
9234
9235         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9236                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9237                 nlmsg_free(msg);
9238                 return;
9239         }
9240
9241         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9242                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9243 }
9244
9245 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9246                              struct net_device *netdev, u32 cmd)
9247 {
9248         struct sk_buff *msg;
9249
9250         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9251         if (!msg)
9252                 return;
9253
9254         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9255                 nlmsg_free(msg);
9256                 return;
9257         }
9258
9259         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9260                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9261 }
9262
9263 /*
9264  * This can happen on global regulatory changes or device specific settings
9265  * based on custom world regulatory domains.
9266  */
9267 void nl80211_send_reg_change_event(struct regulatory_request *request)
9268 {
9269         struct sk_buff *msg;
9270         void *hdr;
9271
9272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9273         if (!msg)
9274                 return;
9275
9276         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9277         if (!hdr) {
9278                 nlmsg_free(msg);
9279                 return;
9280         }
9281
9282         /* Userspace can always count this one always being set */
9283         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9284                 goto nla_put_failure;
9285
9286         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9287                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9288                                NL80211_REGDOM_TYPE_WORLD))
9289                         goto nla_put_failure;
9290         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9291                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9292                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9293                         goto nla_put_failure;
9294         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9295                    request->intersect) {
9296                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9297                                NL80211_REGDOM_TYPE_INTERSECTION))
9298                         goto nla_put_failure;
9299         } else {
9300                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9301                                NL80211_REGDOM_TYPE_COUNTRY) ||
9302                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9303                                    request->alpha2))
9304                         goto nla_put_failure;
9305         }
9306
9307         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9308             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9309                 goto nla_put_failure;
9310
9311         genlmsg_end(msg, hdr);
9312
9313         rcu_read_lock();
9314         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9315                                 GFP_ATOMIC);
9316         rcu_read_unlock();
9317
9318         return;
9319
9320 nla_put_failure:
9321         genlmsg_cancel(msg, hdr);
9322         nlmsg_free(msg);
9323 }
9324
9325 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9326                                     struct net_device *netdev,
9327                                     const u8 *buf, size_t len,
9328                                     enum nl80211_commands cmd, gfp_t gfp)
9329 {
9330         struct sk_buff *msg;
9331         void *hdr;
9332
9333         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9334         if (!msg)
9335                 return;
9336
9337         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9338         if (!hdr) {
9339                 nlmsg_free(msg);
9340                 return;
9341         }
9342
9343         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9344             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9345             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9346                 goto nla_put_failure;
9347
9348         genlmsg_end(msg, hdr);
9349
9350         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9351                                 nl80211_mlme_mcgrp.id, gfp);
9352         return;
9353
9354  nla_put_failure:
9355         genlmsg_cancel(msg, hdr);
9356         nlmsg_free(msg);
9357 }
9358
9359 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9360                           struct net_device *netdev, const u8 *buf,
9361                           size_t len, gfp_t gfp)
9362 {
9363         nl80211_send_mlme_event(rdev, netdev, buf, len,
9364                                 NL80211_CMD_AUTHENTICATE, gfp);
9365 }
9366
9367 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9368                            struct net_device *netdev, const u8 *buf,
9369                            size_t len, gfp_t gfp)
9370 {
9371         nl80211_send_mlme_event(rdev, netdev, buf, len,
9372                                 NL80211_CMD_ASSOCIATE, gfp);
9373 }
9374
9375 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9376                          struct net_device *netdev, const u8 *buf,
9377                          size_t len, gfp_t gfp)
9378 {
9379         nl80211_send_mlme_event(rdev, netdev, buf, len,
9380                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9381 }
9382
9383 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9384                            struct net_device *netdev, const u8 *buf,
9385                            size_t len, gfp_t gfp)
9386 {
9387         nl80211_send_mlme_event(rdev, netdev, buf, len,
9388                                 NL80211_CMD_DISASSOCIATE, gfp);
9389 }
9390
9391 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9392                                   size_t len)
9393 {
9394         struct wireless_dev *wdev = dev->ieee80211_ptr;
9395         struct wiphy *wiphy = wdev->wiphy;
9396         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9397         const struct ieee80211_mgmt *mgmt = (void *)buf;
9398         u32 cmd;
9399
9400         if (WARN_ON(len < 2))
9401                 return;
9402
9403         if (ieee80211_is_deauth(mgmt->frame_control))
9404                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9405         else
9406                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9407
9408         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9409         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9410 }
9411 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9412
9413 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9414                                       struct net_device *netdev, int cmd,
9415                                       const u8 *addr, gfp_t gfp)
9416 {
9417         struct sk_buff *msg;
9418         void *hdr;
9419
9420         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9421         if (!msg)
9422                 return;
9423
9424         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9425         if (!hdr) {
9426                 nlmsg_free(msg);
9427                 return;
9428         }
9429
9430         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9431             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9432             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9433             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9434                 goto nla_put_failure;
9435
9436         genlmsg_end(msg, hdr);
9437
9438         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9439                                 nl80211_mlme_mcgrp.id, gfp);
9440         return;
9441
9442  nla_put_failure:
9443         genlmsg_cancel(msg, hdr);
9444         nlmsg_free(msg);
9445 }
9446
9447 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9448                                struct net_device *netdev, const u8 *addr,
9449                                gfp_t gfp)
9450 {
9451         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9452                                   addr, gfp);
9453 }
9454
9455 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9456                                 struct net_device *netdev, const u8 *addr,
9457                                 gfp_t gfp)
9458 {
9459         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9460                                   addr, gfp);
9461 }
9462
9463 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9464                                  struct net_device *netdev, const u8 *bssid,
9465                                  const u8 *req_ie, size_t req_ie_len,
9466                                  const u8 *resp_ie, size_t resp_ie_len,
9467                                  u16 status, gfp_t gfp)
9468 {
9469         struct sk_buff *msg;
9470         void *hdr;
9471
9472         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9473         if (!msg)
9474                 return;
9475
9476         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9477         if (!hdr) {
9478                 nlmsg_free(msg);
9479                 return;
9480         }
9481
9482         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9483             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9484             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9485             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9486             (req_ie &&
9487              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9488             (resp_ie &&
9489              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9490                 goto nla_put_failure;
9491
9492         genlmsg_end(msg, hdr);
9493
9494         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9495                                 nl80211_mlme_mcgrp.id, gfp);
9496         return;
9497
9498  nla_put_failure:
9499         genlmsg_cancel(msg, hdr);
9500         nlmsg_free(msg);
9501
9502 }
9503
9504 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9505                          struct net_device *netdev, const u8 *bssid,
9506                          const u8 *req_ie, size_t req_ie_len,
9507                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9508 {
9509         struct sk_buff *msg;
9510         void *hdr;
9511
9512         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9513         if (!msg)
9514                 return;
9515
9516         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9517         if (!hdr) {
9518                 nlmsg_free(msg);
9519                 return;
9520         }
9521
9522         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9523             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9524             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9525             (req_ie &&
9526              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9527             (resp_ie &&
9528              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9529                 goto nla_put_failure;
9530
9531         genlmsg_end(msg, hdr);
9532
9533         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9534                                 nl80211_mlme_mcgrp.id, gfp);
9535         return;
9536
9537  nla_put_failure:
9538         genlmsg_cancel(msg, hdr);
9539         nlmsg_free(msg);
9540
9541 }
9542
9543 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9544                                struct net_device *netdev, u16 reason,
9545                                const u8 *ie, size_t ie_len, bool from_ap)
9546 {
9547         struct sk_buff *msg;
9548         void *hdr;
9549
9550         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9551         if (!msg)
9552                 return;
9553
9554         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9555         if (!hdr) {
9556                 nlmsg_free(msg);
9557                 return;
9558         }
9559
9560         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9561             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9562             (from_ap && reason &&
9563              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9564             (from_ap &&
9565              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9566             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9567                 goto nla_put_failure;
9568
9569         genlmsg_end(msg, hdr);
9570
9571         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9572                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9573         return;
9574
9575  nla_put_failure:
9576         genlmsg_cancel(msg, hdr);
9577         nlmsg_free(msg);
9578
9579 }
9580
9581 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9582                              struct net_device *netdev, const u8 *bssid,
9583                              gfp_t gfp)
9584 {
9585         struct sk_buff *msg;
9586         void *hdr;
9587
9588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9589         if (!msg)
9590                 return;
9591
9592         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9593         if (!hdr) {
9594                 nlmsg_free(msg);
9595                 return;
9596         }
9597
9598         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9599             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9600             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9601                 goto nla_put_failure;
9602
9603         genlmsg_end(msg, hdr);
9604
9605         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9606                                 nl80211_mlme_mcgrp.id, gfp);
9607         return;
9608
9609  nla_put_failure:
9610         genlmsg_cancel(msg, hdr);
9611         nlmsg_free(msg);
9612 }
9613
9614 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9615                                         const u8* ie, u8 ie_len, gfp_t gfp)
9616 {
9617         struct wireless_dev *wdev = dev->ieee80211_ptr;
9618         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9619         struct sk_buff *msg;
9620         void *hdr;
9621
9622         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9623                 return;
9624
9625         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9626
9627         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9628         if (!msg)
9629                 return;
9630
9631         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9632         if (!hdr) {
9633                 nlmsg_free(msg);
9634                 return;
9635         }
9636
9637         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9638             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9639             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9640             (ie_len && ie &&
9641              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9642                 goto nla_put_failure;
9643
9644         genlmsg_end(msg, hdr);
9645
9646         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9647                                 nl80211_mlme_mcgrp.id, gfp);
9648         return;
9649
9650  nla_put_failure:
9651         genlmsg_cancel(msg, hdr);
9652         nlmsg_free(msg);
9653 }
9654 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9655
9656 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9657                                  struct net_device *netdev, const u8 *addr,
9658                                  enum nl80211_key_type key_type, int key_id,
9659                                  const u8 *tsc, gfp_t gfp)
9660 {
9661         struct sk_buff *msg;
9662         void *hdr;
9663
9664         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9665         if (!msg)
9666                 return;
9667
9668         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9669         if (!hdr) {
9670                 nlmsg_free(msg);
9671                 return;
9672         }
9673
9674         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9675             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9676             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9677             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9678             (key_id != -1 &&
9679              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9680             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9681                 goto nla_put_failure;
9682
9683         genlmsg_end(msg, hdr);
9684
9685         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9686                                 nl80211_mlme_mcgrp.id, gfp);
9687         return;
9688
9689  nla_put_failure:
9690         genlmsg_cancel(msg, hdr);
9691         nlmsg_free(msg);
9692 }
9693
9694 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9695                                     struct ieee80211_channel *channel_before,
9696                                     struct ieee80211_channel *channel_after)
9697 {
9698         struct sk_buff *msg;
9699         void *hdr;
9700         struct nlattr *nl_freq;
9701
9702         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9703         if (!msg)
9704                 return;
9705
9706         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9707         if (!hdr) {
9708                 nlmsg_free(msg);
9709                 return;
9710         }
9711
9712         /*
9713          * Since we are applying the beacon hint to a wiphy we know its
9714          * wiphy_idx is valid
9715          */
9716         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9717                 goto nla_put_failure;
9718
9719         /* Before */
9720         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9721         if (!nl_freq)
9722                 goto nla_put_failure;
9723         if (nl80211_msg_put_channel(msg, channel_before, false))
9724                 goto nla_put_failure;
9725         nla_nest_end(msg, nl_freq);
9726
9727         /* After */
9728         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9729         if (!nl_freq)
9730                 goto nla_put_failure;
9731         if (nl80211_msg_put_channel(msg, channel_after, false))
9732                 goto nla_put_failure;
9733         nla_nest_end(msg, nl_freq);
9734
9735         genlmsg_end(msg, hdr);
9736
9737         rcu_read_lock();
9738         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9739                                 GFP_ATOMIC);
9740         rcu_read_unlock();
9741
9742         return;
9743
9744 nla_put_failure:
9745         genlmsg_cancel(msg, hdr);
9746         nlmsg_free(msg);
9747 }
9748
9749 static void nl80211_send_remain_on_chan_event(
9750         int cmd, struct cfg80211_registered_device *rdev,
9751         struct wireless_dev *wdev, u64 cookie,
9752         struct ieee80211_channel *chan,
9753         unsigned int duration, gfp_t gfp)
9754 {
9755         struct sk_buff *msg;
9756         void *hdr;
9757
9758         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9759         if (!msg)
9760                 return;
9761
9762         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9763         if (!hdr) {
9764                 nlmsg_free(msg);
9765                 return;
9766         }
9767
9768         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9769             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9770                                          wdev->netdev->ifindex)) ||
9771             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9772             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9773             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9774                         NL80211_CHAN_NO_HT) ||
9775             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9776                 goto nla_put_failure;
9777
9778         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9779             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9780                 goto nla_put_failure;
9781
9782         genlmsg_end(msg, hdr);
9783
9784         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9785                                 nl80211_mlme_mcgrp.id, gfp);
9786         return;
9787
9788  nla_put_failure:
9789         genlmsg_cancel(msg, hdr);
9790         nlmsg_free(msg);
9791 }
9792
9793 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9794                                struct ieee80211_channel *chan,
9795                                unsigned int duration, gfp_t gfp)
9796 {
9797         struct wiphy *wiphy = wdev->wiphy;
9798         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9799
9800         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9801         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9802                                           rdev, wdev, cookie, chan,
9803                                           duration, gfp);
9804 }
9805 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9806
9807 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9808                                         struct ieee80211_channel *chan,
9809                                         gfp_t gfp)
9810 {
9811         struct wiphy *wiphy = wdev->wiphy;
9812         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9813
9814         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9815         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9816                                           rdev, wdev, cookie, chan, 0, gfp);
9817 }
9818 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9819
9820 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9821                       struct station_info *sinfo, gfp_t gfp)
9822 {
9823         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9824         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9825         struct sk_buff *msg;
9826
9827         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9828
9829         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9830         if (!msg)
9831                 return;
9832
9833         if (nl80211_send_station(msg, 0, 0, 0,
9834                                  rdev, dev, mac_addr, sinfo) < 0) {
9835                 nlmsg_free(msg);
9836                 return;
9837         }
9838
9839         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9840                                 nl80211_mlme_mcgrp.id, gfp);
9841 }
9842 EXPORT_SYMBOL(cfg80211_new_sta);
9843
9844 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9845 {
9846         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9847         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9848         struct sk_buff *msg;
9849         void *hdr;
9850
9851         trace_cfg80211_del_sta(dev, mac_addr);
9852
9853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9854         if (!msg)
9855                 return;
9856
9857         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9858         if (!hdr) {
9859                 nlmsg_free(msg);
9860                 return;
9861         }
9862
9863         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9864             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9865                 goto nla_put_failure;
9866
9867         genlmsg_end(msg, hdr);
9868
9869         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9870                                 nl80211_mlme_mcgrp.id, gfp);
9871         return;
9872
9873  nla_put_failure:
9874         genlmsg_cancel(msg, hdr);
9875         nlmsg_free(msg);
9876 }
9877 EXPORT_SYMBOL(cfg80211_del_sta);
9878
9879 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9880                           enum nl80211_connect_failed_reason reason,
9881                           gfp_t gfp)
9882 {
9883         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9884         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9885         struct sk_buff *msg;
9886         void *hdr;
9887
9888         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9889         if (!msg)
9890                 return;
9891
9892         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9893         if (!hdr) {
9894                 nlmsg_free(msg);
9895                 return;
9896         }
9897
9898         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9899             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9900             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9901                 goto nla_put_failure;
9902
9903         genlmsg_end(msg, hdr);
9904
9905         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9906                                 nl80211_mlme_mcgrp.id, gfp);
9907         return;
9908
9909  nla_put_failure:
9910         genlmsg_cancel(msg, hdr);
9911         nlmsg_free(msg);
9912 }
9913 EXPORT_SYMBOL(cfg80211_conn_failed);
9914
9915 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9916                                        const u8 *addr, gfp_t gfp)
9917 {
9918         struct wireless_dev *wdev = dev->ieee80211_ptr;
9919         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9920         struct sk_buff *msg;
9921         void *hdr;
9922         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9923
9924         if (!nlportid)
9925                 return false;
9926
9927         msg = nlmsg_new(100, gfp);
9928         if (!msg)
9929                 return true;
9930
9931         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9932         if (!hdr) {
9933                 nlmsg_free(msg);
9934                 return true;
9935         }
9936
9937         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9938             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9939             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9940                 goto nla_put_failure;
9941
9942         genlmsg_end(msg, hdr);
9943         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9944         return true;
9945
9946  nla_put_failure:
9947         genlmsg_cancel(msg, hdr);
9948         nlmsg_free(msg);
9949         return true;
9950 }
9951
9952 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9953                                 const u8 *addr, gfp_t gfp)
9954 {
9955         struct wireless_dev *wdev = dev->ieee80211_ptr;
9956         bool ret;
9957
9958         trace_cfg80211_rx_spurious_frame(dev, addr);
9959
9960         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9961                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9962                 trace_cfg80211_return_bool(false);
9963                 return false;
9964         }
9965         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9966                                          addr, gfp);
9967         trace_cfg80211_return_bool(ret);
9968         return ret;
9969 }
9970 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9971
9972 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9973                                         const u8 *addr, gfp_t gfp)
9974 {
9975         struct wireless_dev *wdev = dev->ieee80211_ptr;
9976         bool ret;
9977
9978         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9979
9980         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9981                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9982                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9983                 trace_cfg80211_return_bool(false);
9984                 return false;
9985         }
9986         ret = __nl80211_unexpected_frame(dev,
9987                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9988                                          addr, gfp);
9989         trace_cfg80211_return_bool(ret);
9990         return ret;
9991 }
9992 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9993
9994 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9995                       struct wireless_dev *wdev, u32 nlportid,
9996                       int freq, int sig_dbm,
9997                       const u8 *buf, size_t len, gfp_t gfp)
9998 {
9999         struct net_device *netdev = wdev->netdev;
10000         struct sk_buff *msg;
10001         void *hdr;
10002
10003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10004         if (!msg)
10005                 return -ENOMEM;
10006
10007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10008         if (!hdr) {
10009                 nlmsg_free(msg);
10010                 return -ENOMEM;
10011         }
10012
10013         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10014             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10015                                         netdev->ifindex)) ||
10016             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10017             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10018             (sig_dbm &&
10019              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10020             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10021                 goto nla_put_failure;
10022
10023         genlmsg_end(msg, hdr);
10024
10025         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10026
10027  nla_put_failure:
10028         genlmsg_cancel(msg, hdr);
10029         nlmsg_free(msg);
10030         return -ENOBUFS;
10031 }
10032
10033 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10034                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10035 {
10036         struct wiphy *wiphy = wdev->wiphy;
10037         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10038         struct net_device *netdev = wdev->netdev;
10039         struct sk_buff *msg;
10040         void *hdr;
10041
10042         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10043
10044         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10045         if (!msg)
10046                 return;
10047
10048         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10049         if (!hdr) {
10050                 nlmsg_free(msg);
10051                 return;
10052         }
10053
10054         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10055             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10056                                    netdev->ifindex)) ||
10057             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10058             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10059             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10060             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10061                 goto nla_put_failure;
10062
10063         genlmsg_end(msg, hdr);
10064
10065         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
10066         return;
10067
10068  nla_put_failure:
10069         genlmsg_cancel(msg, hdr);
10070         nlmsg_free(msg);
10071 }
10072 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10073
10074 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10075                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10076                               gfp_t gfp)
10077 {
10078         struct wireless_dev *wdev = dev->ieee80211_ptr;
10079         struct wiphy *wiphy = wdev->wiphy;
10080         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10081         struct sk_buff *msg;
10082         struct nlattr *pinfoattr;
10083         void *hdr;
10084
10085         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10086
10087         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10088         if (!msg)
10089                 return;
10090
10091         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10092         if (!hdr) {
10093                 nlmsg_free(msg);
10094                 return;
10095         }
10096
10097         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10098             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10099                 goto nla_put_failure;
10100
10101         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10102         if (!pinfoattr)
10103                 goto nla_put_failure;
10104
10105         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10106                         rssi_event))
10107                 goto nla_put_failure;
10108
10109         nla_nest_end(msg, pinfoattr);
10110
10111         genlmsg_end(msg, hdr);
10112
10113         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10114                                 nl80211_mlme_mcgrp.id, gfp);
10115         return;
10116
10117  nla_put_failure:
10118         genlmsg_cancel(msg, hdr);
10119         nlmsg_free(msg);
10120 }
10121 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10122
10123 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10124                                      struct net_device *netdev, const u8 *bssid,
10125                                      const u8 *replay_ctr, gfp_t gfp)
10126 {
10127         struct sk_buff *msg;
10128         struct nlattr *rekey_attr;
10129         void *hdr;
10130
10131         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10132         if (!msg)
10133                 return;
10134
10135         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10136         if (!hdr) {
10137                 nlmsg_free(msg);
10138                 return;
10139         }
10140
10141         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10142             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10143             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10144                 goto nla_put_failure;
10145
10146         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10147         if (!rekey_attr)
10148                 goto nla_put_failure;
10149
10150         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10151                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10152                 goto nla_put_failure;
10153
10154         nla_nest_end(msg, rekey_attr);
10155
10156         genlmsg_end(msg, hdr);
10157
10158         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10159                                 nl80211_mlme_mcgrp.id, gfp);
10160         return;
10161
10162  nla_put_failure:
10163         genlmsg_cancel(msg, hdr);
10164         nlmsg_free(msg);
10165 }
10166
10167 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10168                                const u8 *replay_ctr, gfp_t gfp)
10169 {
10170         struct wireless_dev *wdev = dev->ieee80211_ptr;
10171         struct wiphy *wiphy = wdev->wiphy;
10172         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10173
10174         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10175         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10176 }
10177 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10178
10179 static void
10180 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10181                                struct net_device *netdev, int index,
10182                                const u8 *bssid, bool preauth, gfp_t gfp)
10183 {
10184         struct sk_buff *msg;
10185         struct nlattr *attr;
10186         void *hdr;
10187
10188         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10189         if (!msg)
10190                 return;
10191
10192         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10193         if (!hdr) {
10194                 nlmsg_free(msg);
10195                 return;
10196         }
10197
10198         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10199             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10200                 goto nla_put_failure;
10201
10202         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10203         if (!attr)
10204                 goto nla_put_failure;
10205
10206         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10207             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10208             (preauth &&
10209              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10210                 goto nla_put_failure;
10211
10212         nla_nest_end(msg, attr);
10213
10214         genlmsg_end(msg, hdr);
10215
10216         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10217                                 nl80211_mlme_mcgrp.id, gfp);
10218         return;
10219
10220  nla_put_failure:
10221         genlmsg_cancel(msg, hdr);
10222         nlmsg_free(msg);
10223 }
10224
10225 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10226                                      const u8 *bssid, bool preauth, gfp_t gfp)
10227 {
10228         struct wireless_dev *wdev = dev->ieee80211_ptr;
10229         struct wiphy *wiphy = wdev->wiphy;
10230         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10231
10232         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10233         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10234 }
10235 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10236
10237 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10238                                      struct net_device *netdev,
10239                                      struct cfg80211_chan_def *chandef,
10240                                      gfp_t gfp)
10241 {
10242         struct sk_buff *msg;
10243         void *hdr;
10244
10245         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10246         if (!msg)
10247                 return;
10248
10249         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10250         if (!hdr) {
10251                 nlmsg_free(msg);
10252                 return;
10253         }
10254
10255         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10256                 goto nla_put_failure;
10257
10258         if (nl80211_send_chandef(msg, chandef))
10259                 goto nla_put_failure;
10260
10261         genlmsg_end(msg, hdr);
10262
10263         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10264                                 nl80211_mlme_mcgrp.id, gfp);
10265         return;
10266
10267  nla_put_failure:
10268         genlmsg_cancel(msg, hdr);
10269         nlmsg_free(msg);
10270 }
10271
10272 void cfg80211_ch_switch_notify(struct net_device *dev,
10273                                struct cfg80211_chan_def *chandef)
10274 {
10275         struct wireless_dev *wdev = dev->ieee80211_ptr;
10276         struct wiphy *wiphy = wdev->wiphy;
10277         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10278
10279         trace_cfg80211_ch_switch_notify(dev, chandef);
10280
10281         wdev_lock(wdev);
10282
10283         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10284                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10285                 goto out;
10286
10287         wdev->channel = chandef->chan;
10288         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10289 out:
10290         wdev_unlock(wdev);
10291         return;
10292 }
10293 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10294
10295 void cfg80211_cqm_txe_notify(struct net_device *dev,
10296                              const u8 *peer, u32 num_packets,
10297                              u32 rate, u32 intvl, gfp_t gfp)
10298 {
10299         struct wireless_dev *wdev = dev->ieee80211_ptr;
10300         struct wiphy *wiphy = wdev->wiphy;
10301         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10302         struct sk_buff *msg;
10303         struct nlattr *pinfoattr;
10304         void *hdr;
10305
10306         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10307         if (!msg)
10308                 return;
10309
10310         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10311         if (!hdr) {
10312                 nlmsg_free(msg);
10313                 return;
10314         }
10315
10316         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10317             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10318             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10319                 goto nla_put_failure;
10320
10321         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10322         if (!pinfoattr)
10323                 goto nla_put_failure;
10324
10325         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10326                 goto nla_put_failure;
10327
10328         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10329                 goto nla_put_failure;
10330
10331         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10332                 goto nla_put_failure;
10333
10334         nla_nest_end(msg, pinfoattr);
10335
10336         genlmsg_end(msg, hdr);
10337
10338         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10339                                 nl80211_mlme_mcgrp.id, gfp);
10340         return;
10341
10342  nla_put_failure:
10343         genlmsg_cancel(msg, hdr);
10344         nlmsg_free(msg);
10345 }
10346 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10347
10348 void
10349 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10350                      struct cfg80211_chan_def *chandef,
10351                      enum nl80211_radar_event event,
10352                      struct net_device *netdev, gfp_t gfp)
10353 {
10354         struct sk_buff *msg;
10355         void *hdr;
10356
10357         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10358         if (!msg)
10359                 return;
10360
10361         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10362         if (!hdr) {
10363                 nlmsg_free(msg);
10364                 return;
10365         }
10366
10367         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10368                 goto nla_put_failure;
10369
10370         /* NOP and radar events don't need a netdev parameter */
10371         if (netdev) {
10372                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10373
10374                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10375                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10376                         goto nla_put_failure;
10377         }
10378
10379         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10380                 goto nla_put_failure;
10381
10382         if (nl80211_send_chandef(msg, chandef))
10383                 goto nla_put_failure;
10384
10385         genlmsg_end(msg, hdr);
10386
10387         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10388                                 nl80211_mlme_mcgrp.id, gfp);
10389         return;
10390
10391  nla_put_failure:
10392         genlmsg_cancel(msg, hdr);
10393         nlmsg_free(msg);
10394 }
10395
10396 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10397                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10398 {
10399         struct wireless_dev *wdev = dev->ieee80211_ptr;
10400         struct wiphy *wiphy = wdev->wiphy;
10401         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10402         struct sk_buff *msg;
10403         struct nlattr *pinfoattr;
10404         void *hdr;
10405
10406         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10407
10408         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10409         if (!msg)
10410                 return;
10411
10412         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10413         if (!hdr) {
10414                 nlmsg_free(msg);
10415                 return;
10416         }
10417
10418         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10419             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10420             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10421                 goto nla_put_failure;
10422
10423         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10424         if (!pinfoattr)
10425                 goto nla_put_failure;
10426
10427         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10428                 goto nla_put_failure;
10429
10430         nla_nest_end(msg, pinfoattr);
10431
10432         genlmsg_end(msg, hdr);
10433
10434         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10435                                 nl80211_mlme_mcgrp.id, gfp);
10436         return;
10437
10438  nla_put_failure:
10439         genlmsg_cancel(msg, hdr);
10440         nlmsg_free(msg);
10441 }
10442 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10443
10444 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10445                            u64 cookie, bool acked, gfp_t gfp)
10446 {
10447         struct wireless_dev *wdev = dev->ieee80211_ptr;
10448         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10449         struct sk_buff *msg;
10450         void *hdr;
10451
10452         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10453
10454         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10455
10456         if (!msg)
10457                 return;
10458
10459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10460         if (!hdr) {
10461                 nlmsg_free(msg);
10462                 return;
10463         }
10464
10465         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10466             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10467             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10468             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10469             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10470                 goto nla_put_failure;
10471
10472         genlmsg_end(msg, hdr);
10473
10474         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10475                                 nl80211_mlme_mcgrp.id, gfp);
10476         return;
10477
10478  nla_put_failure:
10479         genlmsg_cancel(msg, hdr);
10480         nlmsg_free(msg);
10481 }
10482 EXPORT_SYMBOL(cfg80211_probe_status);
10483
10484 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10485                                  const u8 *frame, size_t len,
10486                                  int freq, int sig_dbm)
10487 {
10488         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10489         struct sk_buff *msg;
10490         void *hdr;
10491         struct cfg80211_beacon_registration *reg;
10492
10493         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10494
10495         spin_lock_bh(&rdev->beacon_registrations_lock);
10496         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10497                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10498                 if (!msg) {
10499                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10500                         return;
10501                 }
10502
10503                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10504                 if (!hdr)
10505                         goto nla_put_failure;
10506
10507                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10508                     (freq &&
10509                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10510                     (sig_dbm &&
10511                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10512                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10513                         goto nla_put_failure;
10514
10515                 genlmsg_end(msg, hdr);
10516
10517                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10518         }
10519         spin_unlock_bh(&rdev->beacon_registrations_lock);
10520         return;
10521
10522  nla_put_failure:
10523         spin_unlock_bh(&rdev->beacon_registrations_lock);
10524         if (hdr)
10525                 genlmsg_cancel(msg, hdr);
10526         nlmsg_free(msg);
10527 }
10528 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10529
10530 #ifdef CONFIG_PM
10531 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10532                                    struct cfg80211_wowlan_wakeup *wakeup,
10533                                    gfp_t gfp)
10534 {
10535         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10536         struct sk_buff *msg;
10537         void *hdr;
10538         int size = 200;
10539
10540         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10541
10542         if (wakeup)
10543                 size += wakeup->packet_present_len;
10544
10545         msg = nlmsg_new(size, gfp);
10546         if (!msg)
10547                 return;
10548
10549         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10550         if (!hdr)
10551                 goto free_msg;
10552
10553         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10554             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10555                 goto free_msg;
10556
10557         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10558                                         wdev->netdev->ifindex))
10559                 goto free_msg;
10560
10561         if (wakeup) {
10562                 struct nlattr *reasons;
10563
10564                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10565
10566                 if (wakeup->disconnect &&
10567                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10568                         goto free_msg;
10569                 if (wakeup->magic_pkt &&
10570                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10571                         goto free_msg;
10572                 if (wakeup->gtk_rekey_failure &&
10573                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10574                         goto free_msg;
10575                 if (wakeup->eap_identity_req &&
10576                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10577                         goto free_msg;
10578                 if (wakeup->four_way_handshake &&
10579                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10580                         goto free_msg;
10581                 if (wakeup->rfkill_release &&
10582                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10583                         goto free_msg;
10584
10585                 if (wakeup->pattern_idx >= 0 &&
10586                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10587                                 wakeup->pattern_idx))
10588                         goto free_msg;
10589
10590                 if (wakeup->tcp_match)
10591                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10592
10593                 if (wakeup->tcp_connlost)
10594                         nla_put_flag(msg,
10595                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10596
10597                 if (wakeup->tcp_nomoretokens)
10598                         nla_put_flag(msg,
10599                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10600
10601                 if (wakeup->packet) {
10602                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10603                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10604
10605                         if (!wakeup->packet_80211) {
10606                                 pkt_attr =
10607                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10608                                 len_attr =
10609                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10610                         }
10611
10612                         if (wakeup->packet_len &&
10613                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10614                                 goto free_msg;
10615
10616                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10617                                     wakeup->packet))
10618                                 goto free_msg;
10619                 }
10620
10621                 nla_nest_end(msg, reasons);
10622         }
10623
10624         genlmsg_end(msg, hdr);
10625
10626         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10627                                 nl80211_mlme_mcgrp.id, gfp);
10628         return;
10629
10630  free_msg:
10631         nlmsg_free(msg);
10632 }
10633 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10634 #endif
10635
10636 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10637                                 enum nl80211_tdls_operation oper,
10638                                 u16 reason_code, gfp_t gfp)
10639 {
10640         struct wireless_dev *wdev = dev->ieee80211_ptr;
10641         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10642         struct sk_buff *msg;
10643         void *hdr;
10644
10645         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10646                                          reason_code);
10647
10648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10649         if (!msg)
10650                 return;
10651
10652         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10653         if (!hdr) {
10654                 nlmsg_free(msg);
10655                 return;
10656         }
10657
10658         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10659             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10660             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10661             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10662             (reason_code > 0 &&
10663              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10664                 goto nla_put_failure;
10665
10666         genlmsg_end(msg, hdr);
10667
10668         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10669                                 nl80211_mlme_mcgrp.id, gfp);
10670         return;
10671
10672  nla_put_failure:
10673         genlmsg_cancel(msg, hdr);
10674         nlmsg_free(msg);
10675 }
10676 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10677
10678 static int nl80211_netlink_notify(struct notifier_block * nb,
10679                                   unsigned long state,
10680                                   void *_notify)
10681 {
10682         struct netlink_notify *notify = _notify;
10683         struct cfg80211_registered_device *rdev;
10684         struct wireless_dev *wdev;
10685         struct cfg80211_beacon_registration *reg, *tmp;
10686
10687         if (state != NETLINK_URELEASE)
10688                 return NOTIFY_DONE;
10689
10690         rcu_read_lock();
10691
10692         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10693                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10694                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10695
10696                 spin_lock_bh(&rdev->beacon_registrations_lock);
10697                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10698                                          list) {
10699                         if (reg->nlportid == notify->portid) {
10700                                 list_del(&reg->list);
10701                                 kfree(reg);
10702                                 break;
10703                         }
10704                 }
10705                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10706         }
10707
10708         rcu_read_unlock();
10709
10710         return NOTIFY_DONE;
10711 }
10712
10713 static struct notifier_block nl80211_netlink_notifier = {
10714         .notifier_call = nl80211_netlink_notify,
10715 };
10716
10717 void cfg80211_ft_event(struct net_device *netdev,
10718                        struct cfg80211_ft_event_params *ft_event)
10719 {
10720         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10721         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10722         struct sk_buff *msg;
10723         void *hdr;
10724
10725         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10726
10727         if (!ft_event->target_ap)
10728                 return;
10729
10730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10731         if (!msg)
10732                 return;
10733
10734         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10735         if (!hdr) {
10736                 nlmsg_free(msg);
10737                 return;
10738         }
10739
10740         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10741         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10742         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10743         if (ft_event->ies)
10744                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10745         if (ft_event->ric_ies)
10746                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10747                         ft_event->ric_ies);
10748
10749         genlmsg_end(msg, hdr);
10750
10751         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10752                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10753 }
10754 EXPORT_SYMBOL(cfg80211_ft_event);
10755
10756 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10757 {
10758         struct cfg80211_registered_device *rdev;
10759         struct sk_buff *msg;
10760         void *hdr;
10761         u32 nlportid;
10762
10763         rdev = wiphy_to_dev(wdev->wiphy);
10764         if (!rdev->crit_proto_nlportid)
10765                 return;
10766
10767         nlportid = rdev->crit_proto_nlportid;
10768         rdev->crit_proto_nlportid = 0;
10769
10770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10771         if (!msg)
10772                 return;
10773
10774         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10775         if (!hdr)
10776                 goto nla_put_failure;
10777
10778         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10779             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10780                 goto nla_put_failure;
10781
10782         genlmsg_end(msg, hdr);
10783
10784         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10785         return;
10786
10787  nla_put_failure:
10788         if (hdr)
10789                 genlmsg_cancel(msg, hdr);
10790         nlmsg_free(msg);
10791
10792 }
10793 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10794
10795 /* initialisation/exit functions */
10796
10797 int nl80211_init(void)
10798 {
10799         int err;
10800
10801         err = genl_register_family_with_ops(&nl80211_fam,
10802                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10803         if (err)
10804                 return err;
10805
10806         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10807         if (err)
10808                 goto err_out;
10809
10810         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10811         if (err)
10812                 goto err_out;
10813
10814         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10815         if (err)
10816                 goto err_out;
10817
10818         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10819         if (err)
10820                 goto err_out;
10821
10822 #ifdef CONFIG_NL80211_TESTMODE
10823         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10824         if (err)
10825                 goto err_out;
10826 #endif
10827
10828         err = netlink_register_notifier(&nl80211_netlink_notifier);
10829         if (err)
10830                 goto err_out;
10831
10832         return 0;
10833  err_out:
10834         genl_unregister_family(&nl80211_fam);
10835         return err;
10836 }
10837
10838 void nl80211_exit(void)
10839 {
10840         netlink_unregister_notifier(&nl80211_netlink_notifier);
10841         genl_unregister_family(&nl80211_fam);
10842 }