net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  63         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  64         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  65         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  66         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 399         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 400 };
 401
 402 /* policy for the key attributes */
 403 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 404         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 405         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 406         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 407         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 408         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 409         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 410         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 411         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 412 };
 413
 414 /* policy for the key default flags */
 415 static const struct nla_policy
 416 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 417         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 418         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 419 };
 420
 421 /* policy for WoWLAN attributes */
 422 static const struct nla_policy
 423 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 424         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 425         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 426         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 427         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 428         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 432         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 433         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 434 };
 435
 436 static const struct nla_policy
 437 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 438         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 439         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 440         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 441         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 442         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 443         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 444         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 445                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 446         },
 447         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 448                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 449         },
 450         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 451         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 452         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 453 };
 454
 455 /* policy for coalesce rule attributes */
 456 static const struct nla_policy
 457 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 458         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 459         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 460         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 461 };
 462
 463 /* policy for GTK rekey offload attributes */
 464 static const struct nla_policy
 465 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 466         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 467         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 468         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 469 };
 470
 471 static const struct nla_policy
 472 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 473         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 474                                                  .len = IEEE80211_MAX_SSID_LEN },
 475         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 476 };
 477
 478 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 479                                      struct netlink_callback *cb,
 480                                      struct cfg80211_registered_device **rdev,
 481                                      struct wireless_dev **wdev)
 482 {
 483         int err;
 484
 485         rtnl_lock();
 486
 487         if (!cb->args[0]) {
 488                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 489                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 490                                   nl80211_policy);
 491                 if (err)
 492                         goto out_unlock;
 493
 494                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 495                                                    nl80211_fam.attrbuf);
 496                 if (IS_ERR(*wdev)) {
 497                         err = PTR_ERR(*wdev);
 498                         goto out_unlock;
 499                 }
 500                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 501                 /* 0 is the first index - add 1 to parse only once */
 502                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 503                 cb->args[1] = (*wdev)->identifier;
 504         } else {
 505                 /* subtract the 1 again here */
 506                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 507                 struct wireless_dev *tmp;
 508
 509                 if (!wiphy) {
 510                         err = -ENODEV;
 511                         goto out_unlock;
 512                 }
 513                 *rdev = wiphy_to_rdev(wiphy);
 514                 *wdev = NULL;
 515
 516                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 517                         if (tmp->identifier == cb->args[1]) {
 518                                 *wdev = tmp;
 519                                 break;
 520                         }
 521                 }
 522
 523                 if (!*wdev) {
 524                         err = -ENODEV;
 525                         goto out_unlock;
 526                 }
 527         }
 528
 529         return 0;
 530  out_unlock:
 531         rtnl_unlock();
 532         return err;
 533 }
 534
 535 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 536 {
 537         rtnl_unlock();
 538 }
 539
 540 /* IE validation */
 541 static bool is_valid_ie_attr(const struct nlattr *attr)
 542 {
 543         const u8 *pos;
 544         int len;
 545
 546         if (!attr)
 547                 return true;
 548
 549         pos = nla_data(attr);
 550         len = nla_len(attr);
 551
 552         while (len) {
 553                 u8 elemlen;
 554
 555                 if (len < 2)
 556                         return false;
 557                 len -= 2;
 558
 559                 elemlen = pos[1];
 560                 if (elemlen > len)
 561                         return false;
 562
 563                 len -= elemlen;
 564                 pos += 2 + elemlen;
 565         }
 566
 567         return true;
 568 }
 569
 570 /* message building helper */
 571 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 572                                    int flags, u8 cmd)
 573 {
 574         /* since there is no private header just add the generic one */
 575         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 576 }
 577
 578 static int nl80211_msg_put_channel(struct sk_buff *msg,
 579                                    struct ieee80211_channel *chan,
 580                                    bool large)
 581 {
 582         /* Some channels must be completely excluded from the
 583          * list to protect old user-space tools from breaking
 584          */
 585         if (!large && chan->flags &
 586             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 587                 return 0;
 588
 589         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 590                         chan->center_freq))
 591                 goto nla_put_failure;
 592
 593         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 594             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 595                 goto nla_put_failure;
 596         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 597                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 598                         goto nla_put_failure;
 599                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 600                         goto nla_put_failure;
 601         }
 602         if (chan->flags & IEEE80211_CHAN_RADAR) {
 603                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 604                         goto nla_put_failure;
 605                 if (large) {
 606                         u32 time;
 607
 608                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 609
 610                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 611                                         chan->dfs_state))
 612                                 goto nla_put_failure;
 613                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 614                                         time))
 615                                 goto nla_put_failure;
 616                         if (nla_put_u32(msg,
 617                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 618                                         chan->dfs_cac_ms))
 619                                 goto nla_put_failure;
 620                 }
 621         }
 622
 623         if (large) {
 624                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 625                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 626                         goto nla_put_failure;
 627                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 628                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 629                         goto nla_put_failure;
 630                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 631                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 632                         goto nla_put_failure;
 633                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 634                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 635                         goto nla_put_failure;
 636                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 637                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 638                         goto nla_put_failure;
 639                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 640                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 641                         goto nla_put_failure;
 642                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 643                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 644                         goto nla_put_failure;
 645                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 646                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 647                         goto nla_put_failure;
 648         }
 649
 650         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 651                         DBM_TO_MBM(chan->max_power)))
 652                 goto nla_put_failure;
 653
 654         return 0;
 655
 656  nla_put_failure:
 657         return -ENOBUFS;
 658 }
 659
 660 /* netlink command implementations */
 661
 662 struct key_parse {
 663         struct key_params p;
 664         int idx;
 665         int type;
 666         bool def, defmgmt;
 667         bool def_uni, def_multi;
 668 };
 669
 670 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 671 {
 672         struct nlattr *tb[NL80211_KEY_MAX + 1];
 673         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 674                                    nl80211_key_policy);
 675         if (err)
 676                 return err;
 677
 678         k->def = !!tb[NL80211_KEY_DEFAULT];
 679         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 680
 681         if (k->def) {
 682                 k->def_uni = true;
 683                 k->def_multi = true;
 684         }
 685         if (k->defmgmt)
 686                 k->def_multi = true;
 687
 688         if (tb[NL80211_KEY_IDX])
 689                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 690
 691         if (tb[NL80211_KEY_DATA]) {
 692                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 693                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 694         }
 695
 696         if (tb[NL80211_KEY_SEQ]) {
 697                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 698                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 699         }
 700
 701         if (tb[NL80211_KEY_CIPHER])
 702                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 703
 704         if (tb[NL80211_KEY_TYPE]) {
 705                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 706                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 707                         return -EINVAL;
 708         }
 709
 710         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 711                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 712                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 713                                        tb[NL80211_KEY_DEFAULT_TYPES],
 714                                        nl80211_key_default_policy);
 715                 if (err)
 716                         return err;
 717
 718                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 719                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 720         }
 721
 722         return 0;
 723 }
 724
 725 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 726 {
 727         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 728                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 729                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 730         }
 731
 732         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 733                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 734                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 735         }
 736
 737         if (info->attrs[NL80211_ATTR_KEY_IDX])
 738                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 739
 740         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 741                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 742
 743         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 744         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 745
 746         if (k->def) {
 747                 k->def_uni = true;
 748                 k->def_multi = true;
 749         }
 750         if (k->defmgmt)
 751                 k->def_multi = true;
 752
 753         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 754                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 755                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 756                         return -EINVAL;
 757         }
 758
 759         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 760                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 761                 int err = nla_parse_nested(
 762                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 763                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 764                                 nl80211_key_default_policy);
 765                 if (err)
 766                         return err;
 767
 768                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 769                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 770         }
 771
 772         return 0;
 773 }
 774
 775 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 776 {
 777         int err;
 778
 779         memset(k, 0, sizeof(*k));
 780         k->idx = -1;
 781         k->type = -1;
 782
 783         if (info->attrs[NL80211_ATTR_KEY])
 784                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 785         else
 786                 err = nl80211_parse_key_old(info, k);
 787
 788         if (err)
 789                 return err;
 790
 791         if (k->def && k->defmgmt)
 792                 return -EINVAL;
 793
 794         if (k->defmgmt) {
 795                 if (k->def_uni || !k->def_multi)
 796                         return -EINVAL;
 797         }
 798
 799         if (k->idx != -1) {
 800                 if (k->defmgmt) {
 801                         if (k->idx < 4 || k->idx > 5)
 802                                 return -EINVAL;
 803                 } else if (k->def) {
 804                         if (k->idx < 0 || k->idx > 3)
 805                                 return -EINVAL;
 806                 } else {
 807                         if (k->idx < 0 || k->idx > 5)
 808                                 return -EINVAL;
 809                 }
 810         }
 811
 812         return 0;
 813 }
 814
 815 static struct cfg80211_cached_keys *
 816 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 817                        struct nlattr *keys, bool *no_ht)
 818 {
 819         struct key_parse parse;
 820         struct nlattr *key;
 821         struct cfg80211_cached_keys *result;
 822         int rem, err, def = 0;
 823
 824         result = kzalloc(sizeof(*result), GFP_KERNEL);
 825         if (!result)
 826                 return ERR_PTR(-ENOMEM);
 827
 828         result->def = -1;
 829         result->defmgmt = -1;
 830
 831         nla_for_each_nested(key, keys, rem) {
 832                 memset(&parse, 0, sizeof(parse));
 833                 parse.idx = -1;
 834
 835                 err = nl80211_parse_key_new(key, &parse);
 836                 if (err)
 837                         goto error;
 838                 err = -EINVAL;
 839                 if (!parse.p.key)
 840                         goto error;
 841                 if (parse.idx < 0 || parse.idx > 4)
 842                         goto error;
 843                 if (parse.def) {
 844                         if (def)
 845                                 goto error;
 846                         def = 1;
 847                         result->def = parse.idx;
 848                         if (!parse.def_uni || !parse.def_multi)
 849                                 goto error;
 850                 } else if (parse.defmgmt)
 851                         goto error;
 852                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 853                                                      parse.idx, false, NULL);
 854                 if (err)
 855                         goto error;
 856                 result->params[parse.idx].cipher = parse.p.cipher;
 857                 result->params[parse.idx].key_len = parse.p.key_len;
 858                 result->params[parse.idx].key = result->data[parse.idx];
 859                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 860
 861                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 862                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 863                         if (no_ht)
 864                                 *no_ht = true;
 865                 }
 866         }
 867
 868         return result;
 869  error:
 870         kfree(result);
 871         return ERR_PTR(err);
 872 }
 873
 874 static int nl80211_key_allowed(struct wireless_dev *wdev)
 875 {
 876         ASSERT_WDEV_LOCK(wdev);
 877
 878         switch (wdev->iftype) {
 879         case NL80211_IFTYPE_AP:
 880         case NL80211_IFTYPE_AP_VLAN:
 881         case NL80211_IFTYPE_P2P_GO:
 882         case NL80211_IFTYPE_MESH_POINT:
 883                 break;
 884         case NL80211_IFTYPE_ADHOC:
 885         case NL80211_IFTYPE_STATION:
 886         case NL80211_IFTYPE_P2P_CLIENT:
 887                 if (!wdev->current_bss)
 888                         return -ENOLINK;
 889                 break;
 890         case NL80211_IFTYPE_UNSPECIFIED:
 891         case NL80211_IFTYPE_OCB:
 892         case NL80211_IFTYPE_MONITOR:
 893         case NL80211_IFTYPE_P2P_DEVICE:
 894         case NL80211_IFTYPE_WDS:
 895         case NUM_NL80211_IFTYPES:
 896                 return -EINVAL;
 897         }
 898
 899         return 0;
 900 }
 901
 902 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 903                                                         struct nlattr *tb)
 904 {
 905         struct ieee80211_channel *chan;
 906
 907         if (tb == NULL)
 908                 return NULL;
 909         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 910         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 911                 return NULL;
 912         return chan;
 913 }
 914
 915 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 916 {
 917         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 918         int i;
 919
 920         if (!nl_modes)
 921                 goto nla_put_failure;
 922
 923         i = 0;
 924         while (ifmodes) {
 925                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 926                         goto nla_put_failure;
 927                 ifmodes >>= 1;
 928                 i++;
 929         }
 930
 931         nla_nest_end(msg, nl_modes);
 932         return 0;
 933
 934 nla_put_failure:
 935         return -ENOBUFS;
 936 }
 937
 938 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 939                                           struct sk_buff *msg,
 940                                           bool large)
 941 {
 942         struct nlattr *nl_combis;
 943         int i, j;
 944
 945         nl_combis = nla_nest_start(msg,
 946                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 947         if (!nl_combis)
 948                 goto nla_put_failure;
 949
 950         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 951                 const struct ieee80211_iface_combination *c;
 952                 struct nlattr *nl_combi, *nl_limits;
 953
 954                 c = &wiphy->iface_combinations[i];
 955
 956                 nl_combi = nla_nest_start(msg, i + 1);
 957                 if (!nl_combi)
 958                         goto nla_put_failure;
 959
 960                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 961                 if (!nl_limits)
 962                         goto nla_put_failure;
 963
 964                 for (j = 0; j < c->n_limits; j++) {
 965                         struct nlattr *nl_limit;
 966
 967                         nl_limit = nla_nest_start(msg, j + 1);
 968                         if (!nl_limit)
 969                                 goto nla_put_failure;
 970                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 971                                         c->limits[j].max))
 972                                 goto nla_put_failure;
 973                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 974                                                 c->limits[j].types))
 975                                 goto nla_put_failure;
 976                         nla_nest_end(msg, nl_limit);
 977                 }
 978
 979                 nla_nest_end(msg, nl_limits);
 980
 981                 if (c->beacon_int_infra_match &&
 982                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 983                         goto nla_put_failure;
 984                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 985                                 c->num_different_channels) ||
 986                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 987                                 c->max_interfaces))
 988                         goto nla_put_failure;
 989                 if (large &&
 990                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 991                                 c->radar_detect_widths) ||
 992                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 993                                 c->radar_detect_regions)))
 994                         goto nla_put_failure;
 995
 996                 nla_nest_end(msg, nl_combi);
 997         }
 998
 999         nla_nest_end(msg, nl_combis);
1000
1001         return 0;
1002 nla_put_failure:
1003         return -ENOBUFS;
1004 }
1005
1006 #ifdef CONFIG_PM
1007 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1008                                         struct sk_buff *msg)
1009 {
1010         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1011         struct nlattr *nl_tcp;
1012
1013         if (!tcp)
1014                 return 0;
1015
1016         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1017         if (!nl_tcp)
1018                 return -ENOBUFS;
1019
1020         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1021                         tcp->data_payload_max))
1022                 return -ENOBUFS;
1023
1024         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1025                         tcp->data_payload_max))
1026                 return -ENOBUFS;
1027
1028         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1029                 return -ENOBUFS;
1030
1031         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1032                                 sizeof(*tcp->tok), tcp->tok))
1033                 return -ENOBUFS;
1034
1035         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1036                         tcp->data_interval_max))
1037                 return -ENOBUFS;
1038
1039         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1040                         tcp->wake_payload_max))
1041                 return -ENOBUFS;
1042
1043         nla_nest_end(msg, nl_tcp);
1044         return 0;
1045 }
1046
1047 static int nl80211_send_wowlan(struct sk_buff *msg,
1048                                struct cfg80211_registered_device *rdev,
1049                                bool large)
1050 {
1051         struct nlattr *nl_wowlan;
1052
1053         if (!rdev->wiphy.wowlan)
1054                 return 0;
1055
1056         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1057         if (!nl_wowlan)
1058                 return -ENOBUFS;
1059
1060         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1061              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1062             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1063              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1064             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1065              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1066             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1067              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1068             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1069              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1070             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1076                 return -ENOBUFS;
1077
1078         if (rdev->wiphy.wowlan->n_patterns) {
1079                 struct nl80211_pattern_support pat = {
1080                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1081                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1082                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1083                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1084                 };
1085
1086                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1087                             sizeof(pat), &pat))
1088                         return -ENOBUFS;
1089         }
1090
1091         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1092             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1093                         rdev->wiphy.wowlan->max_nd_match_sets))
1094                 return -ENOBUFS;
1095
1096         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1097                 return -ENOBUFS;
1098
1099         /* TODO: send wowlan net detect */
1100
1101         nla_nest_end(msg, nl_wowlan);
1102
1103         return 0;
1104 }
1105 #endif
1106
1107 static int nl80211_send_coalesce(struct sk_buff *msg,
1108                                  struct cfg80211_registered_device *rdev)
1109 {
1110         struct nl80211_coalesce_rule_support rule;
1111
1112         if (!rdev->wiphy.coalesce)
1113                 return 0;
1114
1115         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1116         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1117         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1118         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1119         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1120         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1121
1122         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1123                 return -ENOBUFS;
1124
1125         return 0;
1126 }
1127
1128 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1129                                       struct ieee80211_supported_band *sband)
1130 {
1131         struct nlattr *nl_rates, *nl_rate;
1132         struct ieee80211_rate *rate;
1133         int i;
1134
1135         /* add HT info */
1136         if (sband->ht_cap.ht_supported &&
1137             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1138                      sizeof(sband->ht_cap.mcs),
1139                      &sband->ht_cap.mcs) ||
1140              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1141                          sband->ht_cap.cap) ||
1142              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1143                         sband->ht_cap.ampdu_factor) ||
1144              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1145                         sband->ht_cap.ampdu_density)))
1146                 return -ENOBUFS;
1147
1148         /* add VHT info */
1149         if (sband->vht_cap.vht_supported &&
1150             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1151                      sizeof(sband->vht_cap.vht_mcs),
1152                      &sband->vht_cap.vht_mcs) ||
1153              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1154                          sband->vht_cap.cap)))
1155                 return -ENOBUFS;
1156
1157         /* add bitrates */
1158         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1159         if (!nl_rates)
1160                 return -ENOBUFS;
1161
1162         for (i = 0; i < sband->n_bitrates; i++) {
1163                 nl_rate = nla_nest_start(msg, i);
1164                 if (!nl_rate)
1165                         return -ENOBUFS;
1166
1167                 rate = &sband->bitrates[i];
1168                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1169                                 rate->bitrate))
1170                         return -ENOBUFS;
1171                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1172                     nla_put_flag(msg,
1173                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1174                         return -ENOBUFS;
1175
1176                 nla_nest_end(msg, nl_rate);
1177         }
1178
1179         nla_nest_end(msg, nl_rates);
1180
1181         return 0;
1182 }
1183
1184 static int
1185 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1186                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1187 {
1188         u16 stypes;
1189         struct nlattr *nl_ftypes, *nl_ifs;
1190         enum nl80211_iftype ift;
1191         int i;
1192
1193         if (!mgmt_stypes)
1194                 return 0;
1195
1196         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1197         if (!nl_ifs)
1198                 return -ENOBUFS;
1199
1200         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1201                 nl_ftypes = nla_nest_start(msg, ift);
1202                 if (!nl_ftypes)
1203                         return -ENOBUFS;
1204                 i = 0;
1205                 stypes = mgmt_stypes[ift].tx;
1206                 while (stypes) {
1207                         if ((stypes & 1) &&
1208                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1209                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1210                                 return -ENOBUFS;
1211                         stypes >>= 1;
1212                         i++;
1213                 }
1214                 nla_nest_end(msg, nl_ftypes);
1215         }
1216
1217         nla_nest_end(msg, nl_ifs);
1218
1219         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1220         if (!nl_ifs)
1221                 return -ENOBUFS;
1222
1223         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1224                 nl_ftypes = nla_nest_start(msg, ift);
1225                 if (!nl_ftypes)
1226                         return -ENOBUFS;
1227                 i = 0;
1228                 stypes = mgmt_stypes[ift].rx;
1229                 while (stypes) {
1230                         if ((stypes & 1) &&
1231                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1232                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1233                                 return -ENOBUFS;
1234                         stypes >>= 1;
1235                         i++;
1236                 }
1237                 nla_nest_end(msg, nl_ftypes);
1238         }
1239         nla_nest_end(msg, nl_ifs);
1240
1241         return 0;
1242 }
1243
1244 struct nl80211_dump_wiphy_state {
1245         s64 filter_wiphy;
1246         long start;
1247         long split_start, band_start, chan_start;
1248         bool split;
1249 };
1250
1251 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1252                               enum nl80211_commands cmd,
1253                               struct sk_buff *msg, u32 portid, u32 seq,
1254                               int flags, struct nl80211_dump_wiphy_state *state)
1255 {
1256         void *hdr;
1257         struct nlattr *nl_bands, *nl_band;
1258         struct nlattr *nl_freqs, *nl_freq;
1259         struct nlattr *nl_cmds;
1260         enum ieee80211_band band;
1261         struct ieee80211_channel *chan;
1262         int i;
1263         const struct ieee80211_txrx_stypes *mgmt_stypes =
1264                                 rdev->wiphy.mgmt_stypes;
1265         u32 features;
1266
1267         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1268         if (!hdr)
1269                 return -ENOBUFS;
1270
1271         if (WARN_ON(!state))
1272                 return -EINVAL;
1273
1274         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1275             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1276                            wiphy_name(&rdev->wiphy)) ||
1277             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1278                         cfg80211_rdev_list_generation))
1279                 goto nla_put_failure;
1280
1281         if (cmd != NL80211_CMD_NEW_WIPHY)
1282                 goto finish;
1283
1284         switch (state->split_start) {
1285         case 0:
1286                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1287                                rdev->wiphy.retry_short) ||
1288                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1289                                rdev->wiphy.retry_long) ||
1290                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1291                                 rdev->wiphy.frag_threshold) ||
1292                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1293                                 rdev->wiphy.rts_threshold) ||
1294                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1295                                rdev->wiphy.coverage_class) ||
1296                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1297                                rdev->wiphy.max_scan_ssids) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1299                                rdev->wiphy.max_sched_scan_ssids) ||
1300                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1301                                 rdev->wiphy.max_scan_ie_len) ||
1302                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1303                                 rdev->wiphy.max_sched_scan_ie_len) ||
1304                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1305                                rdev->wiphy.max_match_sets))
1306                         goto nla_put_failure;
1307
1308                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1309                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1310                         goto nla_put_failure;
1311                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1312                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1313                         goto nla_put_failure;
1314                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1315                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1316                         goto nla_put_failure;
1317                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1318                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1319                         goto nla_put_failure;
1320                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1321                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1322                         goto nla_put_failure;
1323                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1324                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1325                         goto nla_put_failure;
1326                 state->split_start++;
1327                 if (state->split)
1328                         break;
1329         case 1:
1330                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1331                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1332                             rdev->wiphy.cipher_suites))
1333                         goto nla_put_failure;
1334
1335                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1336                                rdev->wiphy.max_num_pmkids))
1337                         goto nla_put_failure;
1338
1339                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1340                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1341                         goto nla_put_failure;
1342
1343                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1344                                 rdev->wiphy.available_antennas_tx) ||
1345                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1346                                 rdev->wiphy.available_antennas_rx))
1347                         goto nla_put_failure;
1348
1349                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1350                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1351                                 rdev->wiphy.probe_resp_offload))
1352                         goto nla_put_failure;
1353
1354                 if ((rdev->wiphy.available_antennas_tx ||
1355                      rdev->wiphy.available_antennas_rx) &&
1356                     rdev->ops->get_antenna) {
1357                         u32 tx_ant = 0, rx_ant = 0;
1358                         int res;
1359                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1360                         if (!res) {
1361                                 if (nla_put_u32(msg,
1362                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1363                                                 tx_ant) ||
1364                                     nla_put_u32(msg,
1365                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1366                                                 rx_ant))
1367                                         goto nla_put_failure;
1368                         }
1369                 }
1370
1371                 state->split_start++;
1372                 if (state->split)
1373                         break;
1374         case 2:
1375                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1376                                         rdev->wiphy.interface_modes))
1377                                 goto nla_put_failure;
1378                 state->split_start++;
1379                 if (state->split)
1380                         break;
1381         case 3:
1382                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1383                 if (!nl_bands)
1384                         goto nla_put_failure;
1385
1386                 for (band = state->band_start;
1387                      band < IEEE80211_NUM_BANDS; band++) {
1388                         struct ieee80211_supported_band *sband;
1389
1390                         sband = rdev->wiphy.bands[band];
1391
1392                         if (!sband)
1393                                 continue;
1394
1395                         nl_band = nla_nest_start(msg, band);
1396                         if (!nl_band)
1397                                 goto nla_put_failure;
1398
1399                         switch (state->chan_start) {
1400                         case 0:
1401                                 if (nl80211_send_band_rateinfo(msg, sband))
1402                                         goto nla_put_failure;
1403                                 state->chan_start++;
1404                                 if (state->split)
1405                                         break;
1406                         default:
1407                                 /* add frequencies */
1408                                 nl_freqs = nla_nest_start(
1409                                         msg, NL80211_BAND_ATTR_FREQS);
1410                                 if (!nl_freqs)
1411                                         goto nla_put_failure;
1412
1413                                 for (i = state->chan_start - 1;
1414                                      i < sband->n_channels;
1415                                      i++) {
1416                                         nl_freq = nla_nest_start(msg, i);
1417                                         if (!nl_freq)
1418                                                 goto nla_put_failure;
1419
1420                                         chan = &sband->channels[i];
1421
1422                                         if (nl80211_msg_put_channel(
1423                                                         msg, chan,
1424                                                         state->split))
1425                                                 goto nla_put_failure;
1426
1427                                         nla_nest_end(msg, nl_freq);
1428                                         if (state->split)
1429                                                 break;
1430                                 }
1431                                 if (i < sband->n_channels)
1432                                         state->chan_start = i + 2;
1433                                 else
1434                                         state->chan_start = 0;
1435                                 nla_nest_end(msg, nl_freqs);
1436                         }
1437
1438                         nla_nest_end(msg, nl_band);
1439
1440                         if (state->split) {
1441                                 /* start again here */
1442                                 if (state->chan_start)
1443                                         band--;
1444                                 break;
1445                         }
1446                 }
1447                 nla_nest_end(msg, nl_bands);
1448
1449                 if (band < IEEE80211_NUM_BANDS)
1450                         state->band_start = band + 1;
1451                 else
1452                         state->band_start = 0;
1453
1454                 /* if bands & channels are done, continue outside */
1455                 if (state->band_start == 0 && state->chan_start == 0)
1456                         state->split_start++;
1457                 if (state->split)
1458                         break;
1459         case 4:
1460                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1461                 if (!nl_cmds)
1462                         goto nla_put_failure;
1463
1464                 i = 0;
1465 #define CMD(op, n)                                                      \
1466                  do {                                                   \
1467                         if (rdev->ops->op) {                            \
1468                                 i++;                                    \
1469                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1470                                         goto nla_put_failure;           \
1471                         }                                               \
1472                 } while (0)
1473
1474                 CMD(add_virtual_intf, NEW_INTERFACE);
1475                 CMD(change_virtual_intf, SET_INTERFACE);
1476                 CMD(add_key, NEW_KEY);
1477                 CMD(start_ap, START_AP);
1478                 CMD(add_station, NEW_STATION);
1479                 CMD(add_mpath, NEW_MPATH);
1480                 CMD(update_mesh_config, SET_MESH_CONFIG);
1481                 CMD(change_bss, SET_BSS);
1482                 CMD(auth, AUTHENTICATE);
1483                 CMD(assoc, ASSOCIATE);
1484                 CMD(deauth, DEAUTHENTICATE);
1485                 CMD(disassoc, DISASSOCIATE);
1486                 CMD(join_ibss, JOIN_IBSS);
1487                 CMD(join_mesh, JOIN_MESH);
1488                 CMD(set_pmksa, SET_PMKSA);
1489                 CMD(del_pmksa, DEL_PMKSA);
1490                 CMD(flush_pmksa, FLUSH_PMKSA);
1491                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1492                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1493                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1494                 CMD(mgmt_tx, FRAME);
1495                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1496                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1497                         i++;
1498                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1499                                 goto nla_put_failure;
1500                 }
1501                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1502                     rdev->ops->join_mesh) {
1503                         i++;
1504                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1505                                 goto nla_put_failure;
1506                 }
1507                 CMD(set_wds_peer, SET_WDS_PEER);
1508                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1509                         CMD(tdls_mgmt, TDLS_MGMT);
1510                         CMD(tdls_oper, TDLS_OPER);
1511                 }
1512                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1513                         CMD(sched_scan_start, START_SCHED_SCAN);
1514                 CMD(probe_client, PROBE_CLIENT);
1515                 CMD(set_noack_map, SET_NOACK_MAP);
1516                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1517                         i++;
1518                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1519                                 goto nla_put_failure;
1520                 }
1521                 CMD(start_p2p_device, START_P2P_DEVICE);
1522                 CMD(set_mcast_rate, SET_MCAST_RATE);
1523 #ifdef CONFIG_NL80211_TESTMODE
1524                 CMD(testmode_cmd, TESTMODE);
1525 #endif
1526                 if (state->split) {
1527                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1528                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1529                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1530                                 CMD(channel_switch, CHANNEL_SWITCH);
1531                         CMD(set_qos_map, SET_QOS_MAP);
1532                         if (rdev->wiphy.features &
1533                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1534                                 CMD(add_tx_ts, ADD_TX_TS);
1535                 }
1536                 /* add into the if now */
1537 #undef CMD
1538
1539                 if (rdev->ops->connect || rdev->ops->auth) {
1540                         i++;
1541                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1542                                 goto nla_put_failure;
1543                 }
1544
1545                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1546                         i++;
1547                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1548                                 goto nla_put_failure;
1549                 }
1550
1551                 nla_nest_end(msg, nl_cmds);
1552                 state->split_start++;
1553                 if (state->split)
1554                         break;
1555         case 5:
1556                 if (rdev->ops->remain_on_channel &&
1557                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1558                     nla_put_u32(msg,
1559                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1560                                 rdev->wiphy.max_remain_on_channel_duration))
1561                         goto nla_put_failure;
1562
1563                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1564                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1565                         goto nla_put_failure;
1566
1567                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1568                         goto nla_put_failure;
1569                 state->split_start++;
1570                 if (state->split)
1571                         break;
1572         case 6:
1573 #ifdef CONFIG_PM
1574                 if (nl80211_send_wowlan(msg, rdev, state->split))
1575                         goto nla_put_failure;
1576                 state->split_start++;
1577                 if (state->split)
1578                         break;
1579 #else
1580                 state->split_start++;
1581 #endif
1582         case 7:
1583                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1584                                         rdev->wiphy.software_iftypes))
1585                         goto nla_put_failure;
1586
1587                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1588                                                    state->split))
1589                         goto nla_put_failure;
1590
1591                 state->split_start++;
1592                 if (state->split)
1593                         break;
1594         case 8:
1595                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1596                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1597                                 rdev->wiphy.ap_sme_capa))
1598                         goto nla_put_failure;
1599
1600                 features = rdev->wiphy.features;
1601                 /*
1602                  * We can only add the per-channel limit information if the
1603                  * dump is split, otherwise it makes it too big. Therefore
1604                  * only advertise it in that case.
1605                  */
1606                 if (state->split)
1607                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1608                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1609                         goto nla_put_failure;
1610
1611                 if (rdev->wiphy.ht_capa_mod_mask &&
1612                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1613                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1614                             rdev->wiphy.ht_capa_mod_mask))
1615                         goto nla_put_failure;
1616
1617                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1618                     rdev->wiphy.max_acl_mac_addrs &&
1619                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1620                                 rdev->wiphy.max_acl_mac_addrs))
1621                         goto nla_put_failure;
1622
1623                 /*
1624                  * Any information below this point is only available to
1625                  * applications that can deal with it being split. This
1626                  * helps ensure that newly added capabilities don't break
1627                  * older tools by overrunning their buffers.
1628                  *
1629                  * We still increment split_start so that in the split
1630                  * case we'll continue with more data in the next round,
1631                  * but break unconditionally so unsplit data stops here.
1632                  */
1633                 state->split_start++;
1634                 break;
1635         case 9:
1636                 if (rdev->wiphy.extended_capabilities &&
1637                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1638                              rdev->wiphy.extended_capabilities_len,
1639                              rdev->wiphy.extended_capabilities) ||
1640                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1641                              rdev->wiphy.extended_capabilities_len,
1642                              rdev->wiphy.extended_capabilities_mask)))
1643                         goto nla_put_failure;
1644
1645                 if (rdev->wiphy.vht_capa_mod_mask &&
1646                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1647                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1648                             rdev->wiphy.vht_capa_mod_mask))
1649                         goto nla_put_failure;
1650
1651                 state->split_start++;
1652                 break;
1653         case 10:
1654                 if (nl80211_send_coalesce(msg, rdev))
1655                         goto nla_put_failure;
1656
1657                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1658                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1659                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1660                         goto nla_put_failure;
1661
1662                 if (rdev->wiphy.max_ap_assoc_sta &&
1663                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1664                                 rdev->wiphy.max_ap_assoc_sta))
1665                         goto nla_put_failure;
1666
1667                 state->split_start++;
1668                 break;
1669         case 11:
1670                 if (rdev->wiphy.n_vendor_commands) {
1671                         const struct nl80211_vendor_cmd_info *info;
1672                         struct nlattr *nested;
1673
1674                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1675                         if (!nested)
1676                                 goto nla_put_failure;
1677
1678                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1679                                 info = &rdev->wiphy.vendor_commands[i].info;
1680                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1681                                         goto nla_put_failure;
1682                         }
1683                         nla_nest_end(msg, nested);
1684                 }
1685
1686                 if (rdev->wiphy.n_vendor_events) {
1687                         const struct nl80211_vendor_cmd_info *info;
1688                         struct nlattr *nested;
1689
1690                         nested = nla_nest_start(msg,
1691                                                 NL80211_ATTR_VENDOR_EVENTS);
1692                         if (!nested)
1693                                 goto nla_put_failure;
1694
1695                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1696                                 info = &rdev->wiphy.vendor_events[i];
1697                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1698                                         goto nla_put_failure;
1699                         }
1700                         nla_nest_end(msg, nested);
1701                 }
1702                 state->split_start++;
1703                 break;
1704         case 12:
1705                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1706                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1707                                rdev->wiphy.max_num_csa_counters))
1708                         goto nla_put_failure;
1709
1710                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1711                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1712                         goto nla_put_failure;
1713
1714                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1715                             sizeof(rdev->wiphy.ext_features),
1716                             rdev->wiphy.ext_features))
1717                         goto nla_put_failure;
1718
1719                 /* done */
1720                 state->split_start = 0;
1721                 break;
1722         }
1723  finish:
1724         genlmsg_end(msg, hdr);
1725         return 0;
1726
1727  nla_put_failure:
1728         genlmsg_cancel(msg, hdr);
1729         return -EMSGSIZE;
1730 }
1731
1732 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1733                                     struct netlink_callback *cb,
1734                                     struct nl80211_dump_wiphy_state *state)
1735 {
1736         struct nlattr **tb = nl80211_fam.attrbuf;
1737         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1738                               tb, nl80211_fam.maxattr, nl80211_policy);
1739         /* ignore parse errors for backward compatibility */
1740         if (ret)
1741                 return 0;
1742
1743         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1744         if (tb[NL80211_ATTR_WIPHY])
1745                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1746         if (tb[NL80211_ATTR_WDEV])
1747                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1748         if (tb[NL80211_ATTR_IFINDEX]) {
1749                 struct net_device *netdev;
1750                 struct cfg80211_registered_device *rdev;
1751                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1752
1753                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1754                 if (!netdev)
1755                         return -ENODEV;
1756                 if (netdev->ieee80211_ptr) {
1757                         rdev = wiphy_to_rdev(
1758                                 netdev->ieee80211_ptr->wiphy);
1759                         state->filter_wiphy = rdev->wiphy_idx;
1760                 }
1761         }
1762
1763         return 0;
1764 }
1765
1766 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1767 {
1768         int idx = 0, ret;
1769         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1770         struct cfg80211_registered_device *rdev;
1771
1772         rtnl_lock();
1773         if (!state) {
1774                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1775                 if (!state) {
1776                         rtnl_unlock();
1777                         return -ENOMEM;
1778                 }
1779                 state->filter_wiphy = -1;
1780                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1781                 if (ret) {
1782                         kfree(state);
1783                         rtnl_unlock();
1784                         return ret;
1785                 }
1786                 cb->args[0] = (long)state;
1787         }
1788
1789         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1790                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1791                         continue;
1792                 if (++idx <= state->start)
1793                         continue;
1794                 if (state->filter_wiphy != -1 &&
1795                     state->filter_wiphy != rdev->wiphy_idx)
1796                         continue;
1797                 /* attempt to fit multiple wiphy data chunks into the skb */
1798                 do {
1799                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1800                                                  skb,
1801                                                  NETLINK_CB(cb->skb).portid,
1802                                                  cb->nlh->nlmsg_seq,
1803                                                  NLM_F_MULTI, state);
1804                         if (ret < 0) {
1805                                 /*
1806                                  * If sending the wiphy data didn't fit (ENOBUFS
1807                                  * or EMSGSIZE returned), this SKB is still
1808                                  * empty (so it's not too big because another
1809                                  * wiphy dataset is already in the skb) and
1810                                  * we've not tried to adjust the dump allocation
1811                                  * yet ... then adjust the alloc size to be
1812                                  * bigger, and return 1 but with the empty skb.
1813                                  * This results in an empty message being RX'ed
1814                                  * in userspace, but that is ignored.
1815                                  *
1816                                  * We can then retry with the larger buffer.
1817                                  */
1818                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1819                                     !skb->len && !state->split &&
1820                                     cb->min_dump_alloc < 4096) {
1821                                         cb->min_dump_alloc = 4096;
1822                                         state->split_start = 0;
1823                                         rtnl_unlock();
1824                                         return 1;
1825                                 }
1826                                 idx--;
1827                                 break;
1828                         }
1829                 } while (state->split_start > 0);
1830                 break;
1831         }
1832         rtnl_unlock();
1833
1834         state->start = idx;
1835
1836         return skb->len;
1837 }
1838
1839 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1840 {
1841         kfree((void *)cb->args[0]);
1842         return 0;
1843 }
1844
1845 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1846 {
1847         struct sk_buff *msg;
1848         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1849         struct nl80211_dump_wiphy_state state = {};
1850
1851         msg = nlmsg_new(4096, GFP_KERNEL);
1852         if (!msg)
1853                 return -ENOMEM;
1854
1855         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1856                                info->snd_portid, info->snd_seq, 0,
1857                                &state) < 0) {
1858                 nlmsg_free(msg);
1859                 return -ENOBUFS;
1860         }
1861
1862         return genlmsg_reply(msg, info);
1863 }
1864
1865 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1866         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1867         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1868         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1869         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1870         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1871 };
1872
1873 static int parse_txq_params(struct nlattr *tb[],
1874                             struct ieee80211_txq_params *txq_params)
1875 {
1876         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1877             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1878             !tb[NL80211_TXQ_ATTR_AIFS])
1879                 return -EINVAL;
1880
1881         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1882         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1883         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1884         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1885         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1886
1887         if (txq_params->ac >= NL80211_NUM_ACS)
1888                 return -EINVAL;
1889
1890         return 0;
1891 }
1892
1893 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1894 {
1895         /*
1896          * You can only set the channel explicitly for WDS interfaces,
1897          * all others have their channel managed via their respective
1898          * "establish a connection" command (connect, join, ...)
1899          *
1900          * For AP/GO and mesh mode, the channel can be set with the
1901          * channel userspace API, but is only stored and passed to the
1902          * low-level driver when the AP starts or the mesh is joined.
1903          * This is for backward compatibility, userspace can also give
1904          * the channel in the start-ap or join-mesh commands instead.
1905          *
1906          * Monitors are special as they are normally slaved to
1907          * whatever else is going on, so they have their own special
1908          * operation to set the monitor channel if possible.
1909          */
1910         return !wdev ||
1911                 wdev->iftype == NL80211_IFTYPE_AP ||
1912                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1913                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1914                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1915 }
1916
1917 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1918                                  struct genl_info *info,
1919                                  struct cfg80211_chan_def *chandef)
1920 {
1921         u32 control_freq;
1922
1923         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1924                 return -EINVAL;
1925
1926         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1927
1928         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1929         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1930         chandef->center_freq1 = control_freq;
1931         chandef->center_freq2 = 0;
1932
1933         /* Primary channel not allowed */
1934         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1935                 return -EINVAL;
1936
1937         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1938                 enum nl80211_channel_type chantype;
1939
1940                 chantype = nla_get_u32(
1941                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1942
1943                 switch (chantype) {
1944                 case NL80211_CHAN_NO_HT:
1945                 case NL80211_CHAN_HT20:
1946                 case NL80211_CHAN_HT40PLUS:
1947                 case NL80211_CHAN_HT40MINUS:
1948                         cfg80211_chandef_create(chandef, chandef->chan,
1949                                                 chantype);
1950                         break;
1951                 default:
1952                         return -EINVAL;
1953                 }
1954         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1955                 chandef->width =
1956                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1957                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1958                         chandef->center_freq1 =
1959                                 nla_get_u32(
1960                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1961                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1962                         chandef->center_freq2 =
1963                                 nla_get_u32(
1964                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1965         }
1966
1967         if (!cfg80211_chandef_valid(chandef))
1968                 return -EINVAL;
1969
1970         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1971                                      IEEE80211_CHAN_DISABLED))
1972                 return -EINVAL;
1973
1974         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1975              chandef->width == NL80211_CHAN_WIDTH_10) &&
1976             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1977                 return -EINVAL;
1978
1979         return 0;
1980 }
1981
1982 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1983                                  struct net_device *dev,
1984                                  struct genl_info *info)
1985 {
1986         struct cfg80211_chan_def chandef;
1987         int result;
1988         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1989         struct wireless_dev *wdev = NULL;
1990
1991         if (dev)
1992                 wdev = dev->ieee80211_ptr;
1993         if (!nl80211_can_set_dev_channel(wdev))
1994                 return -EOPNOTSUPP;
1995         if (wdev)
1996                 iftype = wdev->iftype;
1997
1998         result = nl80211_parse_chandef(rdev, info, &chandef);
1999         if (result)
2000                 return result;
2001
2002         switch (iftype) {
2003         case NL80211_IFTYPE_AP:
2004         case NL80211_IFTYPE_P2P_GO:
2005                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
2006                         result = -EINVAL;
2007                         break;
2008                 }
2009                 if (wdev->beacon_interval) {
2010                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2011                             !(rdev->wiphy.features &
2012                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2013                                 result = -EBUSY;
2014                                 break;
2015                         }
2016
2017                         /* Only allow dynamic channel width changes */
2018                         if (chandef.chan != wdev->preset_chandef.chan) {
2019                                 result = -EBUSY;
2020                                 break;
2021                         }
2022                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2023                         if (result)
2024                                 break;
2025                 }
2026                 wdev->preset_chandef = chandef;
2027                 result = 0;
2028                 break;
2029         case NL80211_IFTYPE_MESH_POINT:
2030                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2031                 break;
2032         case NL80211_IFTYPE_MONITOR:
2033                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2034                 break;
2035         default:
2036                 result = -EINVAL;
2037         }
2038
2039         return result;
2040 }
2041
2042 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2043 {
2044         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2045         struct net_device *netdev = info->user_ptr[1];
2046
2047         return __nl80211_set_channel(rdev, netdev, info);
2048 }
2049
2050 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2051 {
2052         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2053         struct net_device *dev = info->user_ptr[1];
2054         struct wireless_dev *wdev = dev->ieee80211_ptr;
2055         const u8 *bssid;
2056
2057         if (!info->attrs[NL80211_ATTR_MAC])
2058                 return -EINVAL;
2059
2060         if (netif_running(dev))
2061                 return -EBUSY;
2062
2063         if (!rdev->ops->set_wds_peer)
2064                 return -EOPNOTSUPP;
2065
2066         if (wdev->iftype != NL80211_IFTYPE_WDS)
2067                 return -EOPNOTSUPP;
2068
2069         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2070         return rdev_set_wds_peer(rdev, dev, bssid);
2071 }
2072
2073
2074 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2075 {
2076         struct cfg80211_registered_device *rdev;
2077         struct net_device *netdev = NULL;
2078         struct wireless_dev *wdev;
2079         int result = 0, rem_txq_params = 0;
2080         struct nlattr *nl_txq_params;
2081         u32 changed;
2082         u8 retry_short = 0, retry_long = 0;
2083         u32 frag_threshold = 0, rts_threshold = 0;
2084         u8 coverage_class = 0;
2085
2086         ASSERT_RTNL();
2087
2088         /*
2089          * Try to find the wiphy and netdev. Normally this
2090          * function shouldn't need the netdev, but this is
2091          * done for backward compatibility -- previously
2092          * setting the channel was done per wiphy, but now
2093          * it is per netdev. Previous userland like hostapd
2094          * also passed a netdev to set_wiphy, so that it is
2095          * possible to let that go to the right netdev!
2096          */
2097
2098         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2099                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2100
2101                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2102                 if (netdev && netdev->ieee80211_ptr)
2103                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2104                 else
2105                         netdev = NULL;
2106         }
2107
2108         if (!netdev) {
2109                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2110                                                   info->attrs);
2111                 if (IS_ERR(rdev))
2112                         return PTR_ERR(rdev);
2113                 wdev = NULL;
2114                 netdev = NULL;
2115                 result = 0;
2116         } else
2117                 wdev = netdev->ieee80211_ptr;
2118
2119         /*
2120          * end workaround code, by now the rdev is available
2121          * and locked, and wdev may or may not be NULL.
2122          */
2123
2124         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2125                 result = cfg80211_dev_rename(
2126                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2127
2128         if (result)
2129                 return result;
2130
2131         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2132                 struct ieee80211_txq_params txq_params;
2133                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2134
2135                 if (!rdev->ops->set_txq_params)
2136                         return -EOPNOTSUPP;
2137
2138                 if (!netdev)
2139                         return -EINVAL;
2140
2141                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2142                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2143                         return -EINVAL;
2144
2145                 if (!netif_running(netdev))
2146                         return -ENETDOWN;
2147
2148                 nla_for_each_nested(nl_txq_params,
2149                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2150                                     rem_txq_params) {
2151                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2152                                            nla_data(nl_txq_params),
2153                                            nla_len(nl_txq_params),
2154                                            txq_params_policy);
2155                         if (result)
2156                                 return result;
2157                         result = parse_txq_params(tb, &txq_params);
2158                         if (result)
2159                                 return result;
2160
2161                         result = rdev_set_txq_params(rdev, netdev,
2162                                                      &txq_params);
2163                         if (result)
2164                                 return result;
2165                 }
2166         }
2167
2168         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2169                 result = __nl80211_set_channel(
2170                         rdev,
2171                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2172                         info);
2173                 if (result)
2174                         return result;
2175         }
2176
2177         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2178                 struct wireless_dev *txp_wdev = wdev;
2179                 enum nl80211_tx_power_setting type;
2180                 int idx, mbm = 0;
2181
2182                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2183                         txp_wdev = NULL;
2184
2185                 if (!rdev->ops->set_tx_power)
2186                         return -EOPNOTSUPP;
2187
2188                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2189                 type = nla_get_u32(info->attrs[idx]);
2190
2191                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2192                     (type != NL80211_TX_POWER_AUTOMATIC))
2193                         return -EINVAL;
2194
2195                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2196                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2197                         mbm = nla_get_u32(info->attrs[idx]);
2198                 }
2199
2200                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2201                 if (result)
2202                         return result;
2203         }
2204
2205         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2206             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2207                 u32 tx_ant, rx_ant;
2208                 if ((!rdev->wiphy.available_antennas_tx &&
2209                      !rdev->wiphy.available_antennas_rx) ||
2210                     !rdev->ops->set_antenna)
2211                         return -EOPNOTSUPP;
2212
2213                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2214                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2215
2216                 /* reject antenna configurations which don't match the
2217                  * available antenna masks, except for the "all" mask */
2218                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2219                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2220                         return -EINVAL;
2221
2222                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2223                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2224
2225                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2226                 if (result)
2227                         return result;
2228         }
2229
2230         changed = 0;
2231
2232         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2233                 retry_short = nla_get_u8(
2234                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2235                 if (retry_short == 0)
2236                         return -EINVAL;
2237
2238                 changed |= WIPHY_PARAM_RETRY_SHORT;
2239         }
2240
2241         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2242                 retry_long = nla_get_u8(
2243                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2244                 if (retry_long == 0)
2245                         return -EINVAL;
2246
2247                 changed |= WIPHY_PARAM_RETRY_LONG;
2248         }
2249
2250         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2251                 frag_threshold = nla_get_u32(
2252                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2253                 if (frag_threshold < 256)
2254                         return -EINVAL;
2255
2256                 if (frag_threshold != (u32) -1) {
2257                         /*
2258                          * Fragments (apart from the last one) are required to
2259                          * have even length. Make the fragmentation code
2260                          * simpler by stripping LSB should someone try to use
2261                          * odd threshold value.
2262                          */
2263                         frag_threshold &= ~0x1;
2264                 }
2265                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2266         }
2267
2268         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2269                 rts_threshold = nla_get_u32(
2270                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2271                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2272         }
2273
2274         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2275                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2276                         return -EINVAL;
2277
2278                 coverage_class = nla_get_u8(
2279                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2280                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2281         }
2282
2283         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2284                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2285                         return -EOPNOTSUPP;
2286
2287                 changed |= WIPHY_PARAM_DYN_ACK;
2288         }
2289
2290         if (changed) {
2291                 u8 old_retry_short, old_retry_long;
2292                 u32 old_frag_threshold, old_rts_threshold;
2293                 u8 old_coverage_class;
2294
2295                 if (!rdev->ops->set_wiphy_params)
2296                         return -EOPNOTSUPP;
2297
2298                 old_retry_short = rdev->wiphy.retry_short;
2299                 old_retry_long = rdev->wiphy.retry_long;
2300                 old_frag_threshold = rdev->wiphy.frag_threshold;
2301                 old_rts_threshold = rdev->wiphy.rts_threshold;
2302                 old_coverage_class = rdev->wiphy.coverage_class;
2303
2304                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2305                         rdev->wiphy.retry_short = retry_short;
2306                 if (changed & WIPHY_PARAM_RETRY_LONG)
2307                         rdev->wiphy.retry_long = retry_long;
2308                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2309                         rdev->wiphy.frag_threshold = frag_threshold;
2310                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2311                         rdev->wiphy.rts_threshold = rts_threshold;
2312                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2313                         rdev->wiphy.coverage_class = coverage_class;
2314
2315                 result = rdev_set_wiphy_params(rdev, changed);
2316                 if (result) {
2317                         rdev->wiphy.retry_short = old_retry_short;
2318                         rdev->wiphy.retry_long = old_retry_long;
2319                         rdev->wiphy.frag_threshold = old_frag_threshold;
2320                         rdev->wiphy.rts_threshold = old_rts_threshold;
2321                         rdev->wiphy.coverage_class = old_coverage_class;
2322                 }
2323         }
2324         return 0;
2325 }
2326
2327 static inline u64 wdev_id(struct wireless_dev *wdev)
2328 {
2329         return (u64)wdev->identifier |
2330                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2331 }
2332
2333 static int nl80211_send_chandef(struct sk_buff *msg,
2334                                 const struct cfg80211_chan_def *chandef)
2335 {
2336         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2337                 return -EINVAL;
2338
2339         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2340                         chandef->chan->center_freq))
2341                 return -ENOBUFS;
2342         switch (chandef->width) {
2343         case NL80211_CHAN_WIDTH_20_NOHT:
2344         case NL80211_CHAN_WIDTH_20:
2345         case NL80211_CHAN_WIDTH_40:
2346                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2347                                 cfg80211_get_chandef_type(chandef)))
2348                         return -ENOBUFS;
2349                 break;
2350         default:
2351                 break;
2352         }
2353         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2354                 return -ENOBUFS;
2355         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2356                 return -ENOBUFS;
2357         if (chandef->center_freq2 &&
2358             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2359                 return -ENOBUFS;
2360         return 0;
2361 }
2362
2363 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2364                               struct cfg80211_registered_device *rdev,
2365                               struct wireless_dev *wdev, bool removal)
2366 {
2367         struct net_device *dev = wdev->netdev;
2368         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2369         void *hdr;
2370
2371         if (removal)
2372                 cmd = NL80211_CMD_DEL_INTERFACE;
2373
2374         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2375         if (!hdr)
2376                 return -1;
2377
2378         if (dev &&
2379             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2380              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2381                 goto nla_put_failure;
2382
2383         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2384             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2385             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2386             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2387             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2388                         rdev->devlist_generation ^
2389                         (cfg80211_rdev_list_generation << 2)))
2390                 goto nla_put_failure;
2391
2392         if (rdev->ops->get_channel) {
2393                 int ret;
2394                 struct cfg80211_chan_def chandef;
2395
2396                 ret = rdev_get_channel(rdev, wdev, &chandef);
2397                 if (ret == 0) {
2398                         if (nl80211_send_chandef(msg, &chandef))
2399                                 goto nla_put_failure;
2400                 }
2401         }
2402
2403         if (wdev->ssid_len) {
2404                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2405                         goto nla_put_failure;
2406         }
2407
2408         genlmsg_end(msg, hdr);
2409         return 0;
2410
2411  nla_put_failure:
2412         genlmsg_cancel(msg, hdr);
2413         return -EMSGSIZE;
2414 }
2415
2416 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2417 {
2418         int wp_idx = 0;
2419         int if_idx = 0;
2420         int wp_start = cb->args[0];
2421         int if_start = cb->args[1];
2422         struct cfg80211_registered_device *rdev;
2423         struct wireless_dev *wdev;
2424
2425         rtnl_lock();
2426         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2427                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2428                         continue;
2429                 if (wp_idx < wp_start) {
2430                         wp_idx++;
2431                         continue;
2432                 }
2433                 if_idx = 0;
2434
2435                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2436                         if (if_idx < if_start) {
2437                                 if_idx++;
2438                                 continue;
2439                         }
2440                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2441                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2442                                                rdev, wdev, false) < 0) {
2443                                 goto out;
2444                         }
2445                         if_idx++;
2446                 }
2447
2448                 wp_idx++;
2449         }
2450  out:
2451         rtnl_unlock();
2452
2453         cb->args[0] = wp_idx;
2454         cb->args[1] = if_idx;
2455
2456         return skb->len;
2457 }
2458
2459 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2460 {
2461         struct sk_buff *msg;
2462         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2463         struct wireless_dev *wdev = info->user_ptr[1];
2464
2465         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2466         if (!msg)
2467                 return -ENOMEM;
2468
2469         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2470                                rdev, wdev, false) < 0) {
2471                 nlmsg_free(msg);
2472                 return -ENOBUFS;
2473         }
2474
2475         return genlmsg_reply(msg, info);
2476 }
2477
2478 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2479         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2480         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2481         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2482         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2483         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2484         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2485 };
2486
2487 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2488 {
2489         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2490         int flag;
2491
2492         *mntrflags = 0;
2493
2494         if (!nla)
2495                 return -EINVAL;
2496
2497         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2498                              nla, mntr_flags_policy))
2499                 return -EINVAL;
2500
2501         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2502                 if (flags[flag])
2503                         *mntrflags |= (1<<flag);
2504
2505         return 0;
2506 }
2507
2508 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2509                                struct net_device *netdev, u8 use_4addr,
2510                                enum nl80211_iftype iftype)
2511 {
2512         if (!use_4addr) {
2513                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2514                         return -EBUSY;
2515                 return 0;
2516         }
2517
2518         switch (iftype) {
2519         case NL80211_IFTYPE_AP_VLAN:
2520                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2521                         return 0;
2522                 break;
2523         case NL80211_IFTYPE_STATION:
2524                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2525                         return 0;
2526                 break;
2527         default:
2528                 break;
2529         }
2530
2531         return -EOPNOTSUPP;
2532 }
2533
2534 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2535 {
2536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2537         struct vif_params params;
2538         int err;
2539         enum nl80211_iftype otype, ntype;
2540         struct net_device *dev = info->user_ptr[1];
2541         u32 _flags, *flags = NULL;
2542         bool change = false;
2543
2544         memset(&params, 0, sizeof(params));
2545
2546         otype = ntype = dev->ieee80211_ptr->iftype;
2547
2548         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2549                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2550                 if (otype != ntype)
2551                         change = true;
2552                 if (ntype > NL80211_IFTYPE_MAX)
2553                         return -EINVAL;
2554         }
2555
2556         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2557                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2558
2559                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2560                         return -EINVAL;
2561                 if (netif_running(dev))
2562                         return -EBUSY;
2563
2564                 wdev_lock(wdev);
2565                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2566                              IEEE80211_MAX_MESH_ID_LEN);
2567                 wdev->mesh_id_up_len =
2568                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2569                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2570                        wdev->mesh_id_up_len);
2571                 wdev_unlock(wdev);
2572         }
2573
2574         if (info->attrs[NL80211_ATTR_4ADDR]) {
2575                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2576                 change = true;
2577                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2578                 if (err)
2579                         return err;
2580         } else {
2581                 params.use_4addr = -1;
2582         }
2583
2584         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2585                 if (ntype != NL80211_IFTYPE_MONITOR)
2586                         return -EINVAL;
2587                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2588                                           &_flags);
2589                 if (err)
2590                         return err;
2591
2592                 flags = &_flags;
2593                 change = true;
2594         }
2595
2596         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2597             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2598                 return -EOPNOTSUPP;
2599
2600         if (change)
2601                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2602         else
2603                 err = 0;
2604
2605         if (!err && params.use_4addr != -1)
2606                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2607
2608         return err;
2609 }
2610
2611 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2612 {
2613         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2614         struct vif_params params;
2615         struct wireless_dev *wdev;
2616         struct sk_buff *msg, *event;
2617         int err;
2618         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2619         u32 flags;
2620
2621         /* to avoid failing a new interface creation due to pending removal */
2622         cfg80211_destroy_ifaces(rdev);
2623
2624         memset(&params, 0, sizeof(params));
2625
2626         if (!info->attrs[NL80211_ATTR_IFNAME])
2627                 return -EINVAL;
2628
2629         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2630                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2631                 if (type > NL80211_IFTYPE_MAX)
2632                         return -EINVAL;
2633         }
2634
2635         if (!rdev->ops->add_virtual_intf ||
2636             !(rdev->wiphy.interface_modes & (1 << type)))
2637                 return -EOPNOTSUPP;
2638
2639         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2640              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2641             info->attrs[NL80211_ATTR_MAC]) {
2642                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2643                            ETH_ALEN);
2644                 if (!is_valid_ether_addr(params.macaddr))
2645                         return -EADDRNOTAVAIL;
2646         }
2647
2648         if (info->attrs[NL80211_ATTR_4ADDR]) {
2649                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2650                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2651                 if (err)
2652                         return err;
2653         }
2654
2655         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2656         if (!msg)
2657                 return -ENOMEM;
2658
2659         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2660                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2661                                   &flags);
2662
2663         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2664             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2665                 return -EOPNOTSUPP;
2666
2667         wdev = rdev_add_virtual_intf(rdev,
2668                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2669                                 type, err ? NULL : &flags, &params);
2670         if (WARN_ON(!wdev)) {
2671                 nlmsg_free(msg);
2672                 return -EPROTO;
2673         } else if (IS_ERR(wdev)) {
2674                 nlmsg_free(msg);
2675                 return PTR_ERR(wdev);
2676         }
2677
2678         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2679                 wdev->owner_nlportid = info->snd_portid;
2680
2681         switch (type) {
2682         case NL80211_IFTYPE_MESH_POINT:
2683                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2684                         break;
2685                 wdev_lock(wdev);
2686                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2687                              IEEE80211_MAX_MESH_ID_LEN);
2688                 wdev->mesh_id_up_len =
2689                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2690                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2691                        wdev->mesh_id_up_len);
2692                 wdev_unlock(wdev);
2693                 break;
2694         case NL80211_IFTYPE_P2P_DEVICE:
2695                 /*
2696                  * P2P Device doesn't have a netdev, so doesn't go
2697                  * through the netdev notifier and must be added here
2698                  */
2699                 mutex_init(&wdev->mtx);
2700                 INIT_LIST_HEAD(&wdev->event_list);
2701                 spin_lock_init(&wdev->event_lock);
2702                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2703                 spin_lock_init(&wdev->mgmt_registrations_lock);
2704
2705                 wdev->identifier = ++rdev->wdev_id;
2706                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2707                 rdev->devlist_generation++;
2708                 break;
2709         default:
2710                 break;
2711         }
2712
2713         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2714                                rdev, wdev, false) < 0) {
2715                 nlmsg_free(msg);
2716                 return -ENOBUFS;
2717         }
2718
2719         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2720         if (event) {
2721                 if (nl80211_send_iface(event, 0, 0, 0,
2722                                        rdev, wdev, false) < 0) {
2723                         nlmsg_free(event);
2724                         goto out;
2725                 }
2726
2727                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2728                                         event, 0, NL80211_MCGRP_CONFIG,
2729                                         GFP_KERNEL);
2730         }
2731
2732 out:
2733         return genlmsg_reply(msg, info);
2734 }
2735
2736 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2737 {
2738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2739         struct wireless_dev *wdev = info->user_ptr[1];
2740         struct sk_buff *msg;
2741         int status;
2742
2743         if (!rdev->ops->del_virtual_intf)
2744                 return -EOPNOTSUPP;
2745
2746         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2747         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2748                 nlmsg_free(msg);
2749                 msg = NULL;
2750         }
2751
2752         /*
2753          * If we remove a wireless device without a netdev then clear
2754          * user_ptr[1] so that nl80211_post_doit won't dereference it
2755          * to check if it needs to do dev_put(). Otherwise it crashes
2756          * since the wdev has been freed, unlike with a netdev where
2757          * we need the dev_put() for the netdev to really be freed.
2758          */
2759         if (!wdev->netdev)
2760                 info->user_ptr[1] = NULL;
2761
2762         status = rdev_del_virtual_intf(rdev, wdev);
2763         if (status >= 0 && msg)
2764                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2765                                         msg, 0, NL80211_MCGRP_CONFIG,
2766                                         GFP_KERNEL);
2767         else
2768                 nlmsg_free(msg);
2769
2770         return status;
2771 }
2772
2773 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2774 {
2775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2776         struct net_device *dev = info->user_ptr[1];
2777         u16 noack_map;
2778
2779         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2780                 return -EINVAL;
2781
2782         if (!rdev->ops->set_noack_map)
2783                 return -EOPNOTSUPP;
2784
2785         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2786
2787         return rdev_set_noack_map(rdev, dev, noack_map);
2788 }
2789
2790 struct get_key_cookie {
2791         struct sk_buff *msg;
2792         int error;
2793         int idx;
2794 };
2795
2796 static void get_key_callback(void *c, struct key_params *params)
2797 {
2798         struct nlattr *key;
2799         struct get_key_cookie *cookie = c;
2800
2801         if ((params->key &&
2802              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2803                      params->key_len, params->key)) ||
2804             (params->seq &&
2805              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2806                      params->seq_len, params->seq)) ||
2807             (params->cipher &&
2808              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2809                          params->cipher)))
2810                 goto nla_put_failure;
2811
2812         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2813         if (!key)
2814                 goto nla_put_failure;
2815
2816         if ((params->key &&
2817              nla_put(cookie->msg, NL80211_KEY_DATA,
2818                      params->key_len, params->key)) ||
2819             (params->seq &&
2820              nla_put(cookie->msg, NL80211_KEY_SEQ,
2821                      params->seq_len, params->seq)) ||
2822             (params->cipher &&
2823              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2824                          params->cipher)))
2825                 goto nla_put_failure;
2826
2827         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2828                 goto nla_put_failure;
2829
2830         nla_nest_end(cookie->msg, key);
2831
2832         return;
2833  nla_put_failure:
2834         cookie->error = 1;
2835 }
2836
2837 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2838 {
2839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2840         int err;
2841         struct net_device *dev = info->user_ptr[1];
2842         u8 key_idx = 0;
2843         const u8 *mac_addr = NULL;
2844         bool pairwise;
2845         struct get_key_cookie cookie = {
2846                 .error = 0,
2847         };
2848         void *hdr;
2849         struct sk_buff *msg;
2850
2851         if (info->attrs[NL80211_ATTR_KEY_IDX])
2852                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2853
2854         if (key_idx > 5)
2855                 return -EINVAL;
2856
2857         if (info->attrs[NL80211_ATTR_MAC])
2858                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2859
2860         pairwise = !!mac_addr;
2861         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2862                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2863                 if (kt >= NUM_NL80211_KEYTYPES)
2864                         return -EINVAL;
2865                 if (kt != NL80211_KEYTYPE_GROUP &&
2866                     kt != NL80211_KEYTYPE_PAIRWISE)
2867                         return -EINVAL;
2868                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2869         }
2870
2871         if (!rdev->ops->get_key)
2872                 return -EOPNOTSUPP;
2873
2874         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2875                 return -ENOENT;
2876
2877         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2878         if (!msg)
2879                 return -ENOMEM;
2880
2881         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2882                              NL80211_CMD_NEW_KEY);
2883         if (!hdr)
2884                 goto nla_put_failure;
2885
2886         cookie.msg = msg;
2887         cookie.idx = key_idx;
2888
2889         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2890             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2891                 goto nla_put_failure;
2892         if (mac_addr &&
2893             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2894                 goto nla_put_failure;
2895
2896         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2897                            get_key_callback);
2898
2899         if (err)
2900                 goto free_msg;
2901
2902         if (cookie.error)
2903                 goto nla_put_failure;
2904
2905         genlmsg_end(msg, hdr);
2906         return genlmsg_reply(msg, info);
2907
2908  nla_put_failure:
2909         err = -ENOBUFS;
2910  free_msg:
2911         nlmsg_free(msg);
2912         return err;
2913 }
2914
2915 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2916 {
2917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2918         struct key_parse key;
2919         int err;
2920         struct net_device *dev = info->user_ptr[1];
2921
2922         err = nl80211_parse_key(info, &key);
2923         if (err)
2924                 return err;
2925
2926         if (key.idx < 0)
2927                 return -EINVAL;
2928
2929         /* only support setting default key */
2930         if (!key.def && !key.defmgmt)
2931                 return -EINVAL;
2932
2933         wdev_lock(dev->ieee80211_ptr);
2934
2935         if (key.def) {
2936                 if (!rdev->ops->set_default_key) {
2937                         err = -EOPNOTSUPP;
2938                         goto out;
2939                 }
2940
2941                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2942                 if (err)
2943                         goto out;
2944
2945                 err = rdev_set_default_key(rdev, dev, key.idx,
2946                                                  key.def_uni, key.def_multi);
2947
2948                 if (err)
2949                         goto out;
2950
2951 #ifdef CONFIG_CFG80211_WEXT
2952                 dev->ieee80211_ptr->wext.default_key = key.idx;
2953 #endif
2954         } else {
2955                 if (key.def_uni || !key.def_multi) {
2956                         err = -EINVAL;
2957                         goto out;
2958                 }
2959
2960                 if (!rdev->ops->set_default_mgmt_key) {
2961                         err = -EOPNOTSUPP;
2962                         goto out;
2963                 }
2964
2965                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2966                 if (err)
2967                         goto out;
2968
2969                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2970                 if (err)
2971                         goto out;
2972
2973 #ifdef CONFIG_CFG80211_WEXT
2974                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2975 #endif
2976         }
2977
2978  out:
2979         wdev_unlock(dev->ieee80211_ptr);
2980
2981         return err;
2982 }
2983
2984 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2985 {
2986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2987         int err;
2988         struct net_device *dev = info->user_ptr[1];
2989         struct key_parse key;
2990         const u8 *mac_addr = NULL;
2991
2992         err = nl80211_parse_key(info, &key);
2993         if (err)
2994                 return err;
2995
2996         if (!key.p.key)
2997                 return -EINVAL;
2998
2999         if (info->attrs[NL80211_ATTR_MAC])
3000                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3001
3002         if (key.type == -1) {
3003                 if (mac_addr)
3004                         key.type = NL80211_KEYTYPE_PAIRWISE;
3005                 else
3006                         key.type = NL80211_KEYTYPE_GROUP;
3007         }
3008
3009         /* for now */
3010         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3011             key.type != NL80211_KEYTYPE_GROUP)
3012                 return -EINVAL;
3013
3014         if (!rdev->ops->add_key)
3015                 return -EOPNOTSUPP;
3016
3017         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3018                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3019                                            mac_addr))
3020                 return -EINVAL;
3021
3022         wdev_lock(dev->ieee80211_ptr);
3023         err = nl80211_key_allowed(dev->ieee80211_ptr);
3024         if (!err)
3025                 err = rdev_add_key(rdev, dev, key.idx,
3026                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3027                                     mac_addr, &key.p);
3028         wdev_unlock(dev->ieee80211_ptr);
3029
3030         return err;
3031 }
3032
3033 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3034 {
3035         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3036         int err;
3037         struct net_device *dev = info->user_ptr[1];
3038         u8 *mac_addr = NULL;
3039         struct key_parse key;
3040
3041         err = nl80211_parse_key(info, &key);
3042         if (err)
3043                 return err;
3044
3045         if (info->attrs[NL80211_ATTR_MAC])
3046                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3047
3048         if (key.type == -1) {
3049                 if (mac_addr)
3050                         key.type = NL80211_KEYTYPE_PAIRWISE;
3051                 else
3052                         key.type = NL80211_KEYTYPE_GROUP;
3053         }
3054
3055         /* for now */
3056         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3057             key.type != NL80211_KEYTYPE_GROUP)
3058                 return -EINVAL;
3059
3060         if (!rdev->ops->del_key)
3061                 return -EOPNOTSUPP;
3062
3063         wdev_lock(dev->ieee80211_ptr);
3064         err = nl80211_key_allowed(dev->ieee80211_ptr);
3065
3066         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3067             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3068                 err = -ENOENT;
3069
3070         if (!err)
3071                 err = rdev_del_key(rdev, dev, key.idx,
3072                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3073                                    mac_addr);
3074
3075 #ifdef CONFIG_CFG80211_WEXT
3076         if (!err) {
3077                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3078                         dev->ieee80211_ptr->wext.default_key = -1;
3079                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3080                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3081         }
3082 #endif
3083         wdev_unlock(dev->ieee80211_ptr);
3084
3085         return err;
3086 }
3087
3088 /* This function returns an error or the number of nested attributes */
3089 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3090 {
3091         struct nlattr *attr;
3092         int n_entries = 0, tmp;
3093
3094         nla_for_each_nested(attr, nl_attr, tmp) {
3095                 if (nla_len(attr) != ETH_ALEN)
3096                         return -EINVAL;
3097
3098                 n_entries++;
3099         }
3100
3101         return n_entries;
3102 }
3103
3104 /*
3105  * This function parses ACL information and allocates memory for ACL data.
3106  * On successful return, the calling function is responsible to free the
3107  * ACL buffer returned by this function.
3108  */
3109 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3110                                                 struct genl_info *info)
3111 {
3112         enum nl80211_acl_policy acl_policy;
3113         struct nlattr *attr;
3114         struct cfg80211_acl_data *acl;
3115         int i = 0, n_entries, tmp;
3116
3117         if (!wiphy->max_acl_mac_addrs)
3118                 return ERR_PTR(-EOPNOTSUPP);
3119
3120         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3121                 return ERR_PTR(-EINVAL);
3122
3123         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3124         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3125             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3126                 return ERR_PTR(-EINVAL);
3127
3128         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3129                 return ERR_PTR(-EINVAL);
3130
3131         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3132         if (n_entries < 0)
3133                 return ERR_PTR(n_entries);
3134
3135         if (n_entries > wiphy->max_acl_mac_addrs)
3136                 return ERR_PTR(-ENOTSUPP);
3137
3138         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3139                       GFP_KERNEL);
3140         if (!acl)
3141                 return ERR_PTR(-ENOMEM);
3142
3143         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3144                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3145                 i++;
3146         }
3147
3148         acl->n_acl_entries = n_entries;
3149         acl->acl_policy = acl_policy;
3150
3151         return acl;
3152 }
3153
3154 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3155 {
3156         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3157         struct net_device *dev = info->user_ptr[1];
3158         struct cfg80211_acl_data *acl;
3159         int err;
3160
3161         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3162             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3163                 return -EOPNOTSUPP;
3164
3165         if (!dev->ieee80211_ptr->beacon_interval)
3166                 return -EINVAL;
3167
3168         acl = parse_acl_data(&rdev->wiphy, info);
3169         if (IS_ERR(acl))
3170                 return PTR_ERR(acl);
3171
3172         err = rdev_set_mac_acl(rdev, dev, acl);
3173
3174         kfree(acl);
3175
3176         return err;
3177 }
3178
3179 static int nl80211_parse_beacon(struct nlattr *attrs[],
3180                                 struct cfg80211_beacon_data *bcn)
3181 {
3182         bool haveinfo = false;
3183
3184         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3185             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3186             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3187             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3188                 return -EINVAL;
3189
3190         memset(bcn, 0, sizeof(*bcn));
3191
3192         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3193                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3194                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3195                 if (!bcn->head_len)
3196                         return -EINVAL;
3197                 haveinfo = true;
3198         }
3199
3200         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3201                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3202                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3203                 haveinfo = true;
3204         }
3205
3206         if (!haveinfo)
3207                 return -EINVAL;
3208
3209         if (attrs[NL80211_ATTR_IE]) {
3210                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3211                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3212         }
3213
3214         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3215                 bcn->proberesp_ies =
3216                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3217                 bcn->proberesp_ies_len =
3218                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3219         }
3220
3221         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3222                 bcn->assocresp_ies =
3223                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3224                 bcn->assocresp_ies_len =
3225                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3226         }
3227
3228         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3229                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3230                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3231         }
3232
3233         return 0;
3234 }
3235
3236 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3237                                    struct cfg80211_ap_settings *params)
3238 {
3239         struct wireless_dev *wdev;
3240         bool ret = false;
3241
3242         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3243                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3244                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3245                         continue;
3246
3247                 if (!wdev->preset_chandef.chan)
3248                         continue;
3249
3250                 params->chandef = wdev->preset_chandef;
3251                 ret = true;
3252                 break;
3253         }
3254
3255         return ret;
3256 }
3257
3258 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3259                                     enum nl80211_auth_type auth_type,
3260                                     enum nl80211_commands cmd)
3261 {
3262         if (auth_type > NL80211_AUTHTYPE_MAX)
3263                 return false;
3264
3265         switch (cmd) {
3266         case NL80211_CMD_AUTHENTICATE:
3267                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3268                     auth_type == NL80211_AUTHTYPE_SAE)
3269                         return false;
3270                 return true;
3271         case NL80211_CMD_CONNECT:
3272         case NL80211_CMD_START_AP:
3273                 /* SAE not supported yet */
3274                 if (auth_type == NL80211_AUTHTYPE_SAE)
3275                         return false;
3276                 return true;
3277         default:
3278                 return false;
3279         }
3280 }
3281
3282 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3283 {
3284         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3285         struct net_device *dev = info->user_ptr[1];
3286         struct wireless_dev *wdev = dev->ieee80211_ptr;
3287         struct cfg80211_ap_settings params;
3288         int err;
3289
3290         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3291             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3292                 return -EOPNOTSUPP;
3293
3294         if (!rdev->ops->start_ap)
3295                 return -EOPNOTSUPP;
3296
3297         if (wdev->beacon_interval)
3298                 return -EALREADY;
3299
3300         memset(&params, 0, sizeof(params));
3301
3302         /* these are required for START_AP */
3303         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3304             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3305             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3306                 return -EINVAL;
3307
3308         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3309         if (err)
3310                 return err;
3311
3312         params.beacon_interval =
3313                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3314         params.dtim_period =
3315                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3316
3317         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3318         if (err)
3319                 return err;
3320
3321         /*
3322          * In theory, some of these attributes should be required here
3323          * but since they were not used when the command was originally
3324          * added, keep them optional for old user space programs to let
3325          * them continue to work with drivers that do not need the
3326          * additional information -- drivers must check!
3327          */
3328         if (info->attrs[NL80211_ATTR_SSID]) {
3329                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3330                 params.ssid_len =
3331                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3332                 if (params.ssid_len == 0 ||
3333                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3334                         return -EINVAL;
3335         }
3336
3337         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3338                 params.hidden_ssid = nla_get_u32(
3339                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3340                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3341                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3342                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3343                         return -EINVAL;
3344         }
3345
3346         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3347
3348         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3349                 params.auth_type = nla_get_u32(
3350                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3351                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3352                                              NL80211_CMD_START_AP))
3353                         return -EINVAL;
3354         } else
3355                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3356
3357         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3358                                       NL80211_MAX_NR_CIPHER_SUITES);
3359         if (err)
3360                 return err;
3361
3362         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3363                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3364                         return -EOPNOTSUPP;
3365                 params.inactivity_timeout = nla_get_u16(
3366                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3367         }
3368
3369         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3370                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3371                         return -EINVAL;
3372                 params.p2p_ctwindow =
3373                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3374                 if (params.p2p_ctwindow > 127)
3375                         return -EINVAL;
3376                 if (params.p2p_ctwindow != 0 &&
3377                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3378                         return -EINVAL;
3379         }
3380
3381         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3382                 u8 tmp;
3383
3384                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3385                         return -EINVAL;
3386                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3387                 if (tmp > 1)
3388                         return -EINVAL;
3389                 params.p2p_opp_ps = tmp;
3390                 if (params.p2p_opp_ps != 0 &&
3391                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3392                         return -EINVAL;
3393         }
3394
3395         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3396                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3397                 if (err)
3398                         return err;
3399         } else if (wdev->preset_chandef.chan) {
3400                 params.chandef = wdev->preset_chandef;
3401         } else if (!nl80211_get_ap_channel(rdev, &params))
3402                 return -EINVAL;
3403
3404         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3405                                      wdev->iftype))
3406                 return -EINVAL;
3407
3408         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3409                 params.acl = parse_acl_data(&rdev->wiphy, info);
3410                 if (IS_ERR(params.acl))
3411                         return PTR_ERR(params.acl);
3412         }
3413
3414         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3415                 params.smps_mode =
3416                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3417                 switch (params.smps_mode) {
3418                 case NL80211_SMPS_OFF:
3419                         break;
3420                 case NL80211_SMPS_STATIC:
3421                         if (!(rdev->wiphy.features &
3422                               NL80211_FEATURE_STATIC_SMPS))
3423                                 return -EINVAL;
3424                         break;
3425                 case NL80211_SMPS_DYNAMIC:
3426                         if (!(rdev->wiphy.features &
3427                               NL80211_FEATURE_DYNAMIC_SMPS))
3428                                 return -EINVAL;
3429                         break;
3430                 default:
3431                         return -EINVAL;
3432                 }
3433         } else {
3434                 params.smps_mode = NL80211_SMPS_OFF;
3435         }
3436
3437         wdev_lock(wdev);
3438         err = rdev_start_ap(rdev, dev, &params);
3439         if (!err) {
3440                 wdev->preset_chandef = params.chandef;
3441                 wdev->beacon_interval = params.beacon_interval;
3442                 wdev->chandef = params.chandef;
3443                 wdev->ssid_len = params.ssid_len;
3444                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3445         }
3446         wdev_unlock(wdev);
3447
3448         kfree(params.acl);
3449
3450         return err;
3451 }
3452
3453 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3454 {
3455         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3456         struct net_device *dev = info->user_ptr[1];
3457         struct wireless_dev *wdev = dev->ieee80211_ptr;
3458         struct cfg80211_beacon_data params;
3459         int err;
3460
3461         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3462             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3463                 return -EOPNOTSUPP;
3464
3465         if (!rdev->ops->change_beacon)
3466                 return -EOPNOTSUPP;
3467
3468         if (!wdev->beacon_interval)
3469                 return -EINVAL;
3470
3471         err = nl80211_parse_beacon(info->attrs, &params);
3472         if (err)
3473                 return err;
3474
3475         wdev_lock(wdev);
3476         err = rdev_change_beacon(rdev, dev, &params);
3477         wdev_unlock(wdev);
3478
3479         return err;
3480 }
3481
3482 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3483 {
3484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3485         struct net_device *dev = info->user_ptr[1];
3486
3487         return cfg80211_stop_ap(rdev, dev, false);
3488 }
3489
3490 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3491         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3492         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3493         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3494         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3495         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3496         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3497 };
3498
3499 static int parse_station_flags(struct genl_info *info,
3500                                enum nl80211_iftype iftype,
3501                                struct station_parameters *params)
3502 {
3503         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3504         struct nlattr *nla;
3505         int flag;
3506
3507         /*
3508          * Try parsing the new attribute first so userspace
3509          * can specify both for older kernels.
3510          */
3511         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3512         if (nla) {
3513                 struct nl80211_sta_flag_update *sta_flags;
3514
3515                 sta_flags = nla_data(nla);
3516                 params->sta_flags_mask = sta_flags->mask;
3517                 params->sta_flags_set = sta_flags->set;
3518                 params->sta_flags_set &= params->sta_flags_mask;
3519                 if ((params->sta_flags_mask |
3520                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3521                         return -EINVAL;
3522                 return 0;
3523         }
3524
3525         /* if present, parse the old attribute */
3526
3527         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3528         if (!nla)
3529                 return 0;
3530
3531         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3532                              nla, sta_flags_policy))
3533                 return -EINVAL;
3534
3535         /*
3536          * Only allow certain flags for interface types so that
3537          * other attributes are silently ignored. Remember that
3538          * this is backward compatibility code with old userspace
3539          * and shouldn't be hit in other cases anyway.
3540          */
3541         switch (iftype) {
3542         case NL80211_IFTYPE_AP:
3543         case NL80211_IFTYPE_AP_VLAN:
3544         case NL80211_IFTYPE_P2P_GO:
3545                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3546                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3547                                          BIT(NL80211_STA_FLAG_WME) |
3548                                          BIT(NL80211_STA_FLAG_MFP);
3549                 break;
3550         case NL80211_IFTYPE_P2P_CLIENT:
3551         case NL80211_IFTYPE_STATION:
3552                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3553                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3554                 break;
3555         case NL80211_IFTYPE_MESH_POINT:
3556                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3557                                          BIT(NL80211_STA_FLAG_MFP) |
3558                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3559         default:
3560                 return -EINVAL;
3561         }
3562
3563         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3564                 if (flags[flag]) {
3565                         params->sta_flags_set |= (1<<flag);
3566
3567                         /* no longer support new API additions in old API */
3568                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3569                                 return -EINVAL;
3570                 }
3571         }
3572
3573         return 0;
3574 }
3575
3576 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3577                                  int attr)
3578 {
3579         struct nlattr *rate;
3580         u32 bitrate;
3581         u16 bitrate_compat;
3582         enum nl80211_attrs rate_flg;
3583
3584         rate = nla_nest_start(msg, attr);
3585         if (!rate)
3586                 return false;
3587
3588         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3589         bitrate = cfg80211_calculate_bitrate(info);
3590         /* report 16-bit bitrate only if we can */
3591         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3592         if (bitrate > 0 &&
3593             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3594                 return false;
3595         if (bitrate_compat > 0 &&
3596             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3597                 return false;
3598
3599         switch (info->bw) {
3600         case RATE_INFO_BW_5:
3601                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3602                 break;
3603         case RATE_INFO_BW_10:
3604                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3605                 break;
3606         default:
3607                 WARN_ON(1);
3608                 /* fall through */
3609         case RATE_INFO_BW_20:
3610                 rate_flg = 0;
3611                 break;
3612         case RATE_INFO_BW_40:
3613                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3614                 break;
3615         case RATE_INFO_BW_80:
3616                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3617                 break;
3618         case RATE_INFO_BW_160:
3619                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3620                 break;
3621         }
3622
3623         if (rate_flg && nla_put_flag(msg, rate_flg))
3624                 return false;
3625
3626         if (info->flags & RATE_INFO_FLAGS_MCS) {
3627                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3628                         return false;
3629                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3630                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3631                         return false;
3632         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3633                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3634                         return false;
3635                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3636                         return false;
3637                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3638                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3639                         return false;
3640         }
3641
3642         nla_nest_end(msg, rate);
3643         return true;
3644 }
3645
3646 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3647                                int id)
3648 {
3649         void *attr;
3650         int i = 0;
3651
3652         if (!mask)
3653                 return true;
3654
3655         attr = nla_nest_start(msg, id);
3656         if (!attr)
3657                 return false;
3658
3659         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3660                 if (!(mask & BIT(i)))
3661                         continue;
3662
3663                 if (nla_put_u8(msg, i, signal[i]))
3664                         return false;
3665         }
3666
3667         nla_nest_end(msg, attr);
3668
3669         return true;
3670 }
3671
3672 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3673                                 u32 seq, int flags,
3674                                 struct cfg80211_registered_device *rdev,
3675                                 struct net_device *dev,
3676                                 const u8 *mac_addr, struct station_info *sinfo)
3677 {
3678         void *hdr;
3679         struct nlattr *sinfoattr, *bss_param;
3680
3681         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3682         if (!hdr)
3683                 return -1;
3684
3685         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3686             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3687             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3688                 goto nla_put_failure;
3689
3690         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3691         if (!sinfoattr)
3692                 goto nla_put_failure;
3693
3694 #define PUT_SINFO(attr, memb, type) do {                                \
3695         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3696             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3697                              sinfo->memb))                              \
3698                 goto nla_put_failure;                                   \
3699         } while (0)
3700
3701         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3702         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3703
3704         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3705                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3706             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3707                         (u32)sinfo->rx_bytes))
3708                 goto nla_put_failure;
3709
3710         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3711                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3712             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3713                         (u32)sinfo->tx_bytes))
3714                 goto nla_put_failure;
3715
3716         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3717         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3718         PUT_SINFO(LLID, llid, u16);
3719         PUT_SINFO(PLID, plid, u16);
3720         PUT_SINFO(PLINK_STATE, plink_state, u8);
3721
3722         switch (rdev->wiphy.signal_type) {
3723         case CFG80211_SIGNAL_TYPE_MBM:
3724                 PUT_SINFO(SIGNAL, signal, u8);
3725                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3726                 break;
3727         default:
3728                 break;
3729         }
3730         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3731                 if (!nl80211_put_signal(msg, sinfo->chains,
3732                                         sinfo->chain_signal,
3733                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3734                         goto nla_put_failure;
3735         }
3736         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3737                 if (!nl80211_put_signal(msg, sinfo->chains,
3738                                         sinfo->chain_signal_avg,
3739                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3740                         goto nla_put_failure;
3741         }
3742         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3743                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3744                                           NL80211_STA_INFO_TX_BITRATE))
3745                         goto nla_put_failure;
3746         }
3747         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3748                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3749                                           NL80211_STA_INFO_RX_BITRATE))
3750                         goto nla_put_failure;
3751         }
3752
3753         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3754         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3755         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3756         PUT_SINFO(TX_FAILED, tx_failed, u32);
3757         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3758         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3759         PUT_SINFO(LOCAL_PM, local_pm, u32);
3760         PUT_SINFO(PEER_PM, peer_pm, u32);
3761         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3762
3763         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3764                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3765                 if (!bss_param)
3766                         goto nla_put_failure;
3767
3768                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3769                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3770                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3771                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3772                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3773                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3774                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3775                                sinfo->bss_param.dtim_period) ||
3776                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3777                                 sinfo->bss_param.beacon_interval))
3778                         goto nla_put_failure;
3779
3780                 nla_nest_end(msg, bss_param);
3781         }
3782         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3783             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3784                     sizeof(struct nl80211_sta_flag_update),
3785                     &sinfo->sta_flags))
3786                 goto nla_put_failure;
3787
3788         PUT_SINFO(T_OFFSET, t_offset, u64);
3789         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3790         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3791         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3792
3793 #undef PUT_SINFO
3794
3795         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3796                 struct nlattr *tidsattr;
3797                 int tid;
3798
3799                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3800                 if (!tidsattr)
3801                         goto nla_put_failure;
3802
3803                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3804                         struct cfg80211_tid_stats *tidstats;
3805                         struct nlattr *tidattr;
3806
3807                         tidstats = &sinfo->pertid[tid];
3808
3809                         if (!tidstats->filled)
3810                                 continue;
3811
3812                         tidattr = nla_nest_start(msg, tid + 1);
3813                         if (!tidattr)
3814                                 goto nla_put_failure;
3815
3816 #define PUT_TIDVAL(attr, memb, type) do {                               \
3817         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3818             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3819                              tidstats->memb))                           \
3820                 goto nla_put_failure;                                   \
3821         } while (0)
3822
3823                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3824                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3825                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3826                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3827
3828 #undef PUT_TIDVAL
3829                         nla_nest_end(msg, tidattr);
3830                 }
3831
3832                 nla_nest_end(msg, tidsattr);
3833         }
3834
3835         nla_nest_end(msg, sinfoattr);
3836
3837         if (sinfo->assoc_req_ies_len &&
3838             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3839                     sinfo->assoc_req_ies))
3840                 goto nla_put_failure;
3841
3842         genlmsg_end(msg, hdr);
3843         return 0;
3844
3845  nla_put_failure:
3846         genlmsg_cancel(msg, hdr);
3847         return -EMSGSIZE;
3848 }
3849
3850 static int nl80211_dump_station(struct sk_buff *skb,
3851                                 struct netlink_callback *cb)
3852 {
3853         struct station_info sinfo;
3854         struct cfg80211_registered_device *rdev;
3855         struct wireless_dev *wdev;
3856         u8 mac_addr[ETH_ALEN];
3857         int sta_idx = cb->args[2];
3858         int err;
3859
3860         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3861         if (err)
3862                 return err;
3863
3864         if (!wdev->netdev) {
3865                 err = -EINVAL;
3866                 goto out_err;
3867         }
3868
3869         if (!rdev->ops->dump_station) {
3870                 err = -EOPNOTSUPP;
3871                 goto out_err;
3872         }
3873
3874         while (1) {
3875                 memset(&sinfo, 0, sizeof(sinfo));
3876                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3877                                         mac_addr, &sinfo);
3878                 if (err == -ENOENT)
3879                         break;
3880                 if (err)
3881                         goto out_err;
3882
3883                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3884                                 NETLINK_CB(cb->skb).portid,
3885                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3886                                 rdev, wdev->netdev, mac_addr,
3887                                 &sinfo) < 0)
3888                         goto out;
3889
3890                 sta_idx++;
3891         }
3892
3893
3894  out:
3895         cb->args[2] = sta_idx;
3896         err = skb->len;
3897  out_err:
3898         nl80211_finish_wdev_dump(rdev);
3899
3900         return err;
3901 }
3902
3903 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3904 {
3905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3906         struct net_device *dev = info->user_ptr[1];
3907         struct station_info sinfo;
3908         struct sk_buff *msg;
3909         u8 *mac_addr = NULL;
3910         int err;
3911
3912         memset(&sinfo, 0, sizeof(sinfo));
3913
3914         if (!info->attrs[NL80211_ATTR_MAC])
3915                 return -EINVAL;
3916
3917         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3918
3919         if (!rdev->ops->get_station)
3920                 return -EOPNOTSUPP;
3921
3922         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3923         if (err)
3924                 return err;
3925
3926         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3927         if (!msg)
3928                 return -ENOMEM;
3929
3930         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3931                                  info->snd_portid, info->snd_seq, 0,
3932                                  rdev, dev, mac_addr, &sinfo) < 0) {
3933                 nlmsg_free(msg);
3934                 return -ENOBUFS;
3935         }
3936
3937         return genlmsg_reply(msg, info);
3938 }
3939
3940 int cfg80211_check_station_change(struct wiphy *wiphy,
3941                                   struct station_parameters *params,
3942                                   enum cfg80211_station_type statype)
3943 {
3944         if (params->listen_interval != -1)
3945                 return -EINVAL;
3946         if (params->aid &&
3947             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3948                 return -EINVAL;
3949
3950         /* When you run into this, adjust the code below for the new flag */
3951         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3952
3953         switch (statype) {
3954         case CFG80211_STA_MESH_PEER_KERNEL:
3955         case CFG80211_STA_MESH_PEER_USER:
3956                 /*
3957                  * No ignoring the TDLS flag here -- the userspace mesh
3958                  * code doesn't have the bug of including TDLS in the
3959                  * mask everywhere.
3960                  */
3961                 if (params->sta_flags_mask &
3962                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3963                                   BIT(NL80211_STA_FLAG_MFP) |
3964                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3965                         return -EINVAL;
3966                 break;
3967         case CFG80211_STA_TDLS_PEER_SETUP:
3968         case CFG80211_STA_TDLS_PEER_ACTIVE:
3969                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3970                         return -EINVAL;
3971                 /* ignore since it can't change */
3972                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3973                 break;
3974         default:
3975                 /* disallow mesh-specific things */
3976                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3977                         return -EINVAL;
3978                 if (params->local_pm)
3979                         return -EINVAL;
3980                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3981                         return -EINVAL;
3982         }
3983
3984         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3985             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3986                 /* TDLS can't be set, ... */
3987                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3988                         return -EINVAL;
3989                 /*
3990                  * ... but don't bother the driver with it. This works around
3991                  * a hostapd/wpa_supplicant issue -- it always includes the
3992                  * TLDS_PEER flag in the mask even for AP mode.
3993                  */
3994                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3995         }
3996
3997         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3998                 /* reject other things that can't change */
3999                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4000                         return -EINVAL;
4001                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4002                         return -EINVAL;
4003                 if (params->supported_rates)
4004                         return -EINVAL;
4005                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4006                         return -EINVAL;
4007         }
4008
4009         if (statype != CFG80211_STA_AP_CLIENT) {
4010                 if (params->vlan)
4011                         return -EINVAL;
4012         }
4013
4014         switch (statype) {
4015         case CFG80211_STA_AP_MLME_CLIENT:
4016                 /* Use this only for authorizing/unauthorizing a station */
4017                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4018                         return -EOPNOTSUPP;
4019                 break;
4020         case CFG80211_STA_AP_CLIENT:
4021                 /* accept only the listed bits */
4022                 if (params->sta_flags_mask &
4023                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4024                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4025                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4026                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4027                                   BIT(NL80211_STA_FLAG_WME) |
4028                                   BIT(NL80211_STA_FLAG_MFP)))
4029                         return -EINVAL;
4030
4031                 /* but authenticated/associated only if driver handles it */
4032                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4033                     params->sta_flags_mask &
4034                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4035                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4036                         return -EINVAL;
4037                 break;
4038         case CFG80211_STA_IBSS:
4039         case CFG80211_STA_AP_STA:
4040                 /* reject any changes other than AUTHORIZED */
4041                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4042                         return -EINVAL;
4043                 break;
4044         case CFG80211_STA_TDLS_PEER_SETUP:
4045                 /* reject any changes other than AUTHORIZED or WME */
4046                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4047                                                BIT(NL80211_STA_FLAG_WME)))
4048                         return -EINVAL;
4049                 /* force (at least) rates when authorizing */
4050                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4051                     !params->supported_rates)
4052                         return -EINVAL;
4053                 break;
4054         case CFG80211_STA_TDLS_PEER_ACTIVE:
4055                 /* reject any changes */
4056                 return -EINVAL;
4057         case CFG80211_STA_MESH_PEER_KERNEL:
4058                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4059                         return -EINVAL;
4060                 break;
4061         case CFG80211_STA_MESH_PEER_USER:
4062                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4063                         return -EINVAL;
4064                 break;
4065         }
4066
4067         return 0;
4068 }
4069 EXPORT_SYMBOL(cfg80211_check_station_change);
4070
4071 /*
4072  * Get vlan interface making sure it is running and on the right wiphy.
4073  */
4074 static struct net_device *get_vlan(struct genl_info *info,
4075                                    struct cfg80211_registered_device *rdev)
4076 {
4077         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4078         struct net_device *v;
4079         int ret;
4080
4081         if (!vlanattr)
4082                 return NULL;
4083
4084         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4085         if (!v)
4086                 return ERR_PTR(-ENODEV);
4087
4088         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4089                 ret = -EINVAL;
4090                 goto error;
4091         }
4092
4093         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4094             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4095             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4096                 ret = -EINVAL;
4097                 goto error;
4098         }
4099
4100         if (!netif_running(v)) {
4101                 ret = -ENETDOWN;
4102                 goto error;
4103         }
4104
4105         return v;
4106  error:
4107         dev_put(v);
4108         return ERR_PTR(ret);
4109 }
4110
4111 static const struct nla_policy
4112 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4113         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4114         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4115 };
4116
4117 static int nl80211_parse_sta_wme(struct genl_info *info,
4118                                  struct station_parameters *params)
4119 {
4120         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4121         struct nlattr *nla;
4122         int err;
4123
4124         /* parse WME attributes if present */
4125         if (!info->attrs[NL80211_ATTR_STA_WME])
4126                 return 0;
4127
4128         nla = info->attrs[NL80211_ATTR_STA_WME];
4129         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4130                                nl80211_sta_wme_policy);
4131         if (err)
4132                 return err;
4133
4134         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4135                 params->uapsd_queues = nla_get_u8(
4136                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4137         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4138                 return -EINVAL;
4139
4140         if (tb[NL80211_STA_WME_MAX_SP])
4141                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4142
4143         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4144                 return -EINVAL;
4145
4146         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4147
4148         return 0;
4149 }
4150
4151 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4152                                       struct station_parameters *params)
4153 {
4154         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4155                 params->supported_channels =
4156                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4157                 params->supported_channels_len =
4158                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4159                 /*
4160                  * Need to include at least one (first channel, number of
4161                  * channels) tuple for each subband, and must have proper
4162                  * tuples for the rest of the data as well.
4163                  */
4164                 if (params->supported_channels_len < 2)
4165                         return -EINVAL;
4166                 if (params->supported_channels_len % 2)
4167                         return -EINVAL;
4168         }
4169
4170         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4171                 params->supported_oper_classes =
4172                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4173                 params->supported_oper_classes_len =
4174                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4175                 /*
4176                  * The value of the Length field of the Supported Operating
4177                  * Classes element is between 2 and 253.
4178                  */
4179                 if (params->supported_oper_classes_len < 2 ||
4180                     params->supported_oper_classes_len > 253)
4181                         return -EINVAL;
4182         }
4183         return 0;
4184 }
4185
4186 static int nl80211_set_station_tdls(struct genl_info *info,
4187                                     struct station_parameters *params)
4188 {
4189         int err;
4190         /* Dummy STA entry gets updated once the peer capabilities are known */
4191         if (info->attrs[NL80211_ATTR_PEER_AID])
4192                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4193         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4194                 params->ht_capa =
4195                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4196         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4197                 params->vht_capa =
4198                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4199
4200         err = nl80211_parse_sta_channel_info(info, params);
4201         if (err)
4202                 return err;
4203
4204         return nl80211_parse_sta_wme(info, params);
4205 }
4206
4207 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4208 {
4209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4210         struct net_device *dev = info->user_ptr[1];
4211         struct station_parameters params;
4212         u8 *mac_addr;
4213         int err;
4214
4215         memset(&params, 0, sizeof(params));
4216
4217         params.listen_interval = -1;
4218
4219         if (!rdev->ops->change_station)
4220                 return -EOPNOTSUPP;
4221
4222         if (info->attrs[NL80211_ATTR_STA_AID])
4223                 return -EINVAL;
4224
4225         if (!info->attrs[NL80211_ATTR_MAC])
4226                 return -EINVAL;
4227
4228         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4229
4230         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4231                 params.supported_rates =
4232                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4233                 params.supported_rates_len =
4234                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4235         }
4236
4237         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4238                 params.capability =
4239                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4240                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4241         }
4242
4243         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4244                 params.ext_capab =
4245                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4246                 params.ext_capab_len =
4247                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4248         }
4249
4250         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4251                 return -EINVAL;
4252
4253         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4254                 return -EINVAL;
4255
4256         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4257                 params.plink_action =
4258                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4259                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4260                         return -EINVAL;
4261         }
4262
4263         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4264                 params.plink_state =
4265                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4266                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4267                         return -EINVAL;
4268                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4269         }
4270
4271         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4272                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4273                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4274
4275                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4276                     pm > NL80211_MESH_POWER_MAX)
4277                         return -EINVAL;
4278
4279                 params.local_pm = pm;
4280         }
4281
4282         /* Include parameters for TDLS peer (will check later) */
4283         err = nl80211_set_station_tdls(info, &params);
4284         if (err)
4285                 return err;
4286
4287         params.vlan = get_vlan(info, rdev);
4288         if (IS_ERR(params.vlan))
4289                 return PTR_ERR(params.vlan);
4290
4291         switch (dev->ieee80211_ptr->iftype) {
4292         case NL80211_IFTYPE_AP:
4293         case NL80211_IFTYPE_AP_VLAN:
4294         case NL80211_IFTYPE_P2P_GO:
4295         case NL80211_IFTYPE_P2P_CLIENT:
4296         case NL80211_IFTYPE_STATION:
4297         case NL80211_IFTYPE_ADHOC:
4298         case NL80211_IFTYPE_MESH_POINT:
4299                 break;
4300         default:
4301                 err = -EOPNOTSUPP;
4302                 goto out_put_vlan;
4303         }
4304
4305         /* driver will call cfg80211_check_station_change() */
4306         err = rdev_change_station(rdev, dev, mac_addr, &params);
4307
4308  out_put_vlan:
4309         if (params.vlan)
4310                 dev_put(params.vlan);
4311
4312         return err;
4313 }
4314
4315 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4316 {
4317         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4318         int err;
4319         struct net_device *dev = info->user_ptr[1];
4320         struct station_parameters params;
4321         u8 *mac_addr = NULL;
4322
4323         memset(&params, 0, sizeof(params));
4324
4325         if (!rdev->ops->add_station)
4326                 return -EOPNOTSUPP;
4327
4328         if (!info->attrs[NL80211_ATTR_MAC])
4329                 return -EINVAL;
4330
4331         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4332                 return -EINVAL;
4333
4334         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4335                 return -EINVAL;
4336
4337         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4338             !info->attrs[NL80211_ATTR_PEER_AID])
4339                 return -EINVAL;
4340
4341         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4342         params.supported_rates =
4343                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4344         params.supported_rates_len =
4345                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4346         params.listen_interval =
4347                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4348
4349         if (info->attrs[NL80211_ATTR_PEER_AID])
4350                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4351         else
4352                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4353         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4354                 return -EINVAL;
4355
4356         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4357                 params.capability =
4358                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4359                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4360         }
4361
4362         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4363                 params.ext_capab =
4364                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4365                 params.ext_capab_len =
4366                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4367         }
4368
4369         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4370                 params.ht_capa =
4371                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4372
4373         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4374                 params.vht_capa =
4375                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4376
4377         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4378                 params.opmode_notif_used = true;
4379                 params.opmode_notif =
4380                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4381         }
4382
4383         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4384                 params.plink_action =
4385                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4386                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4387                         return -EINVAL;
4388         }
4389
4390         err = nl80211_parse_sta_channel_info(info, &params);
4391         if (err)
4392                 return err;
4393
4394         err = nl80211_parse_sta_wme(info, &params);
4395         if (err)
4396                 return err;
4397
4398         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4399                 return -EINVAL;
4400
4401         /* When you run into this, adjust the code below for the new flag */
4402         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4403
4404         switch (dev->ieee80211_ptr->iftype) {
4405         case NL80211_IFTYPE_AP:
4406         case NL80211_IFTYPE_AP_VLAN:
4407         case NL80211_IFTYPE_P2P_GO:
4408                 /* ignore WME attributes if iface/sta is not capable */
4409                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4410                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4411                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4412
4413                 /* TDLS peers cannot be added */
4414                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4415                     info->attrs[NL80211_ATTR_PEER_AID])
4416                         return -EINVAL;
4417                 /* but don't bother the driver with it */
4418                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4419
4420                 /* allow authenticated/associated only if driver handles it */
4421                 if (!(rdev->wiphy.features &
4422                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4423                     params.sta_flags_mask &
4424                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4425                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4426                         return -EINVAL;
4427
4428                 /* must be last in here for error handling */
4429                 params.vlan = get_vlan(info, rdev);
4430                 if (IS_ERR(params.vlan))
4431                         return PTR_ERR(params.vlan);
4432                 break;
4433         case NL80211_IFTYPE_MESH_POINT:
4434                 /* ignore uAPSD data */
4435                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4436
4437                 /* associated is disallowed */
4438                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4439                         return -EINVAL;
4440                 /* TDLS peers cannot be added */
4441                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4442                     info->attrs[NL80211_ATTR_PEER_AID])
4443                         return -EINVAL;
4444                 break;
4445         case NL80211_IFTYPE_STATION:
4446         case NL80211_IFTYPE_P2P_CLIENT:
4447                 /* ignore uAPSD data */
4448                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4449
4450                 /* these are disallowed */
4451                 if (params.sta_flags_mask &
4452                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4453                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4454                         return -EINVAL;
4455                 /* Only TDLS peers can be added */
4456                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4457                         return -EINVAL;
4458                 /* Can only add if TDLS ... */
4459                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4460                         return -EOPNOTSUPP;
4461                 /* ... with external setup is supported */
4462                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4463                         return -EOPNOTSUPP;
4464                 /*
4465                  * Older wpa_supplicant versions always mark the TDLS peer
4466                  * as authorized, but it shouldn't yet be.
4467                  */
4468                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4469                 break;
4470         default:
4471                 return -EOPNOTSUPP;
4472         }
4473
4474         /* be aware of params.vlan when changing code here */
4475
4476         err = rdev_add_station(rdev, dev, mac_addr, &params);
4477
4478         if (params.vlan)
4479                 dev_put(params.vlan);
4480         return err;
4481 }
4482
4483 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4484 {
4485         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4486         struct net_device *dev = info->user_ptr[1];
4487         struct station_del_parameters params;
4488
4489         memset(&params, 0, sizeof(params));
4490
4491         if (info->attrs[NL80211_ATTR_MAC])
4492                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4493
4494         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4495             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4496             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4497             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4498                 return -EINVAL;
4499
4500         if (!rdev->ops->del_station)
4501                 return -EOPNOTSUPP;
4502
4503         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4504                 params.subtype =
4505                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4506                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4507                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4508                         return -EINVAL;
4509         } else {
4510                 /* Default to Deauthentication frame */
4511                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4512         }
4513
4514         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4515                 params.reason_code =
4516                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4517                 if (params.reason_code == 0)
4518                         return -EINVAL; /* 0 is reserved */
4519         } else {
4520                 /* Default to reason code 2 */
4521                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4522         }
4523
4524         return rdev_del_station(rdev, dev, &params);
4525 }
4526
4527 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4528                                 int flags, struct net_device *dev,
4529                                 u8 *dst, u8 *next_hop,
4530                                 struct mpath_info *pinfo)
4531 {
4532         void *hdr;
4533         struct nlattr *pinfoattr;
4534
4535         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4536         if (!hdr)
4537                 return -1;
4538
4539         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4540             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4541             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4542             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4543                 goto nla_put_failure;
4544
4545         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4546         if (!pinfoattr)
4547                 goto nla_put_failure;
4548         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4549             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4550                         pinfo->frame_qlen))
4551                 goto nla_put_failure;
4552         if (((pinfo->filled & MPATH_INFO_SN) &&
4553              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4554             ((pinfo->filled & MPATH_INFO_METRIC) &&
4555              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4556                          pinfo->metric)) ||
4557             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4558              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4559                          pinfo->exptime)) ||
4560             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4561              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4562                         pinfo->flags)) ||
4563             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4564              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4565                          pinfo->discovery_timeout)) ||
4566             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4567              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4568                         pinfo->discovery_retries)))
4569                 goto nla_put_failure;
4570
4571         nla_nest_end(msg, pinfoattr);
4572
4573         genlmsg_end(msg, hdr);
4574         return 0;
4575
4576  nla_put_failure:
4577         genlmsg_cancel(msg, hdr);
4578         return -EMSGSIZE;
4579 }
4580
4581 static int nl80211_dump_mpath(struct sk_buff *skb,
4582                               struct netlink_callback *cb)
4583 {
4584         struct mpath_info pinfo;
4585         struct cfg80211_registered_device *rdev;
4586         struct wireless_dev *wdev;
4587         u8 dst[ETH_ALEN];
4588         u8 next_hop[ETH_ALEN];
4589         int path_idx = cb->args[2];
4590         int err;
4591
4592         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4593         if (err)
4594                 return err;
4595
4596         if (!rdev->ops->dump_mpath) {
4597                 err = -EOPNOTSUPP;
4598                 goto out_err;
4599         }
4600
4601         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4602                 err = -EOPNOTSUPP;
4603                 goto out_err;
4604         }
4605
4606         while (1) {
4607                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4608                                       next_hop, &pinfo);
4609                 if (err == -ENOENT)
4610                         break;
4611                 if (err)
4612                         goto out_err;
4613
4614                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4615                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4616                                        wdev->netdev, dst, next_hop,
4617                                        &pinfo) < 0)
4618                         goto out;
4619
4620                 path_idx++;
4621         }
4622
4623
4624  out:
4625         cb->args[2] = path_idx;
4626         err = skb->len;
4627  out_err:
4628         nl80211_finish_wdev_dump(rdev);
4629         return err;
4630 }
4631
4632 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4633 {
4634         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4635         int err;
4636         struct net_device *dev = info->user_ptr[1];
4637         struct mpath_info pinfo;
4638         struct sk_buff *msg;
4639         u8 *dst = NULL;
4640         u8 next_hop[ETH_ALEN];
4641
4642         memset(&pinfo, 0, sizeof(pinfo));
4643
4644         if (!info->attrs[NL80211_ATTR_MAC])
4645                 return -EINVAL;
4646
4647         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4648
4649         if (!rdev->ops->get_mpath)
4650                 return -EOPNOTSUPP;
4651
4652         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4653                 return -EOPNOTSUPP;
4654
4655         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4656         if (err)
4657                 return err;
4658
4659         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4660         if (!msg)
4661                 return -ENOMEM;
4662
4663         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4664                                  dev, dst, next_hop, &pinfo) < 0) {
4665                 nlmsg_free(msg);
4666                 return -ENOBUFS;
4667         }
4668
4669         return genlmsg_reply(msg, info);
4670 }
4671
4672 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4673 {
4674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4675         struct net_device *dev = info->user_ptr[1];
4676         u8 *dst = NULL;
4677         u8 *next_hop = NULL;
4678
4679         if (!info->attrs[NL80211_ATTR_MAC])
4680                 return -EINVAL;
4681
4682         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4683                 return -EINVAL;
4684
4685         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4686         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4687
4688         if (!rdev->ops->change_mpath)
4689                 return -EOPNOTSUPP;
4690
4691         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4692                 return -EOPNOTSUPP;
4693
4694         return rdev_change_mpath(rdev, dev, dst, next_hop);
4695 }
4696
4697 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4698 {
4699         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4700         struct net_device *dev = info->user_ptr[1];
4701         u8 *dst = NULL;
4702         u8 *next_hop = NULL;
4703
4704         if (!info->attrs[NL80211_ATTR_MAC])
4705                 return -EINVAL;
4706
4707         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4708                 return -EINVAL;
4709
4710         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4711         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4712
4713         if (!rdev->ops->add_mpath)
4714                 return -EOPNOTSUPP;
4715
4716         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4717                 return -EOPNOTSUPP;
4718
4719         return rdev_add_mpath(rdev, dev, dst, next_hop);
4720 }
4721
4722 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4723 {
4724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4725         struct net_device *dev = info->user_ptr[1];
4726         u8 *dst = NULL;
4727
4728         if (info->attrs[NL80211_ATTR_MAC])
4729                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4730
4731         if (!rdev->ops->del_mpath)
4732                 return -EOPNOTSUPP;
4733
4734         return rdev_del_mpath(rdev, dev, dst);
4735 }
4736
4737 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4738 {
4739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4740         int err;
4741         struct net_device *dev = info->user_ptr[1];
4742         struct mpath_info pinfo;
4743         struct sk_buff *msg;
4744         u8 *dst = NULL;
4745         u8 mpp[ETH_ALEN];
4746
4747         memset(&pinfo, 0, sizeof(pinfo));
4748
4749         if (!info->attrs[NL80211_ATTR_MAC])
4750                 return -EINVAL;
4751
4752         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4753
4754         if (!rdev->ops->get_mpp)
4755                 return -EOPNOTSUPP;
4756
4757         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4758                 return -EOPNOTSUPP;
4759
4760         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4761         if (err)
4762                 return err;
4763
4764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4765         if (!msg)
4766                 return -ENOMEM;
4767
4768         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4769                                dev, dst, mpp, &pinfo) < 0) {
4770                 nlmsg_free(msg);
4771                 return -ENOBUFS;
4772         }
4773
4774         return genlmsg_reply(msg, info);
4775 }
4776
4777 static int nl80211_dump_mpp(struct sk_buff *skb,
4778                             struct netlink_callback *cb)
4779 {
4780         struct mpath_info pinfo;
4781         struct cfg80211_registered_device *rdev;
4782         struct wireless_dev *wdev;
4783         u8 dst[ETH_ALEN];
4784         u8 mpp[ETH_ALEN];
4785         int path_idx = cb->args[2];
4786         int err;
4787
4788         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4789         if (err)
4790                 return err;
4791
4792         if (!rdev->ops->dump_mpp) {
4793                 err = -EOPNOTSUPP;
4794                 goto out_err;
4795         }
4796
4797         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4798                 err = -EOPNOTSUPP;
4799                 goto out_err;
4800         }
4801
4802         while (1) {
4803                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4804                                     mpp, &pinfo);
4805                 if (err == -ENOENT)
4806                         break;
4807                 if (err)
4808                         goto out_err;
4809
4810                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4811                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4812                                        wdev->netdev, dst, mpp,
4813                                        &pinfo) < 0)
4814                         goto out;
4815
4816                 path_idx++;
4817         }
4818
4819  out:
4820         cb->args[2] = path_idx;
4821         err = skb->len;
4822  out_err:
4823         nl80211_finish_wdev_dump(rdev);
4824         return err;
4825 }
4826
4827 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4828 {
4829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4830         struct net_device *dev = info->user_ptr[1];
4831         struct wireless_dev *wdev = dev->ieee80211_ptr;
4832         struct bss_parameters params;
4833         int err;
4834
4835         memset(&params, 0, sizeof(params));
4836         /* default to not changing parameters */
4837         params.use_cts_prot = -1;
4838         params.use_short_preamble = -1;
4839         params.use_short_slot_time = -1;
4840         params.ap_isolate = -1;
4841         params.ht_opmode = -1;
4842         params.p2p_ctwindow = -1;
4843         params.p2p_opp_ps = -1;
4844
4845         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4846                 params.use_cts_prot =
4847                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4848         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4849                 params.use_short_preamble =
4850                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4851         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4852                 params.use_short_slot_time =
4853                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4854         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4855                 params.basic_rates =
4856                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4857                 params.basic_rates_len =
4858                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4859         }
4860         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4861                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4862         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4863                 params.ht_opmode =
4864                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4865
4866         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4867                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4868                         return -EINVAL;
4869                 params.p2p_ctwindow =
4870                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4871                 if (params.p2p_ctwindow < 0)
4872                         return -EINVAL;
4873                 if (params.p2p_ctwindow != 0 &&
4874                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4875                         return -EINVAL;
4876         }
4877
4878         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4879                 u8 tmp;
4880
4881                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4882                         return -EINVAL;
4883                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4884                 if (tmp > 1)
4885                         return -EINVAL;
4886                 params.p2p_opp_ps = tmp;
4887                 if (params.p2p_opp_ps &&
4888                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4889                         return -EINVAL;
4890         }
4891
4892         if (!rdev->ops->change_bss)
4893                 return -EOPNOTSUPP;
4894
4895         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4896             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4897                 return -EOPNOTSUPP;
4898
4899         wdev_lock(wdev);
4900         err = rdev_change_bss(rdev, dev, &params);
4901         wdev_unlock(wdev);
4902
4903         return err;
4904 }
4905
4906 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4907         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4908         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4909         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4910         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4911         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4912         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4913         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4914 };
4915
4916 static int parse_reg_rule(struct nlattr *tb[],
4917         struct ieee80211_reg_rule *reg_rule)
4918 {
4919         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4920         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4921
4922         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4923                 return -EINVAL;
4924         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4925                 return -EINVAL;
4926         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4927                 return -EINVAL;
4928         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4929                 return -EINVAL;
4930         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4931                 return -EINVAL;
4932
4933         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4934
4935         freq_range->start_freq_khz =
4936                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4937         freq_range->end_freq_khz =
4938                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4939         freq_range->max_bandwidth_khz =
4940                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4941
4942         power_rule->max_eirp =
4943                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4944
4945         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4946                 power_rule->max_antenna_gain =
4947                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4948
4949         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4950                 reg_rule->dfs_cac_ms =
4951                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4952
4953         return 0;
4954 }
4955
4956 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4957 {
4958         char *data = NULL;
4959         enum nl80211_user_reg_hint_type user_reg_hint_type;
4960
4961         /*
4962          * You should only get this when cfg80211 hasn't yet initialized
4963          * completely when built-in to the kernel right between the time
4964          * window between nl80211_init() and regulatory_init(), if that is
4965          * even possible.
4966          */
4967         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4968                 return -EINPROGRESS;
4969
4970         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4971                 user_reg_hint_type =
4972                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4973         else
4974                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4975
4976         switch (user_reg_hint_type) {
4977         case NL80211_USER_REG_HINT_USER:
4978         case NL80211_USER_REG_HINT_CELL_BASE:
4979                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4980                         return -EINVAL;
4981
4982                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4983                 return regulatory_hint_user(data, user_reg_hint_type);
4984         case NL80211_USER_REG_HINT_INDOOR:
4985                 return regulatory_hint_indoor_user();
4986         default:
4987                 return -EINVAL;
4988         }
4989 }
4990
4991 static int nl80211_get_mesh_config(struct sk_buff *skb,
4992                                    struct genl_info *info)
4993 {
4994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4995         struct net_device *dev = info->user_ptr[1];
4996         struct wireless_dev *wdev = dev->ieee80211_ptr;
4997         struct mesh_config cur_params;
4998         int err = 0;
4999         void *hdr;
5000         struct nlattr *pinfoattr;
5001         struct sk_buff *msg;
5002
5003         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5004                 return -EOPNOTSUPP;
5005
5006         if (!rdev->ops->get_mesh_config)
5007                 return -EOPNOTSUPP;
5008
5009         wdev_lock(wdev);
5010         /* If not connected, get default parameters */
5011         if (!wdev->mesh_id_len)
5012                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5013         else
5014                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5015         wdev_unlock(wdev);
5016
5017         if (err)
5018                 return err;
5019
5020         /* Draw up a netlink message to send back */
5021         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5022         if (!msg)
5023                 return -ENOMEM;
5024         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5025                              NL80211_CMD_GET_MESH_CONFIG);
5026         if (!hdr)
5027                 goto out;
5028         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5029         if (!pinfoattr)
5030                 goto nla_put_failure;
5031         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5032             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5033                         cur_params.dot11MeshRetryTimeout) ||
5034             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5035                         cur_params.dot11MeshConfirmTimeout) ||
5036             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5037                         cur_params.dot11MeshHoldingTimeout) ||
5038             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5039                         cur_params.dot11MeshMaxPeerLinks) ||
5040             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5041                        cur_params.dot11MeshMaxRetries) ||
5042             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5043                        cur_params.dot11MeshTTL) ||
5044             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5045                        cur_params.element_ttl) ||
5046             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5047                        cur_params.auto_open_plinks) ||
5048             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5049                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5050             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5051                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5052             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5053                         cur_params.path_refresh_time) ||
5054             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5055                         cur_params.min_discovery_timeout) ||
5056             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5057                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5058             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5059                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5060             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5061                         cur_params.dot11MeshHWMPperrMinInterval) ||
5062             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5063                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5064             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5065                        cur_params.dot11MeshHWMPRootMode) ||
5066             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5067                         cur_params.dot11MeshHWMPRannInterval) ||
5068             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5069                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5070             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5071                        cur_params.dot11MeshForwarding) ||
5072             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5073                         cur_params.rssi_threshold) ||
5074             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5075                         cur_params.ht_opmode) ||
5076             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5077                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5078             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5079                         cur_params.dot11MeshHWMProotInterval) ||
5080             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5081                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5082             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5083                         cur_params.power_mode) ||
5084             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5085                         cur_params.dot11MeshAwakeWindowDuration) ||
5086             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5087                         cur_params.plink_timeout))
5088                 goto nla_put_failure;
5089         nla_nest_end(msg, pinfoattr);
5090         genlmsg_end(msg, hdr);
5091         return genlmsg_reply(msg, info);
5092
5093  nla_put_failure:
5094         genlmsg_cancel(msg, hdr);
5095  out:
5096         nlmsg_free(msg);
5097         return -ENOBUFS;
5098 }
5099
5100 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5101         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5102         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5103         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5104         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5105         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5106         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5107         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5108         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5109         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5110         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5111         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5112         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5113         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5114         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5115         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5116         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5117         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5118         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5119         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5120         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5121         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5122         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5123         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5124         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5125         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5126         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5127         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5128         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5129 };
5130
5131 static const struct nla_policy
5132         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5133         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5134         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5135         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5136         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5137         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5138         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5139         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5140                                     .len = IEEE80211_MAX_DATA_LEN },
5141         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5142 };
5143
5144 static int nl80211_parse_mesh_config(struct genl_info *info,
5145                                      struct mesh_config *cfg,
5146                                      u32 *mask_out)
5147 {
5148         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5149         u32 mask = 0;
5150
5151 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5152 do {                                                                        \
5153         if (tb[attr]) {                                                     \
5154                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5155                         return -EINVAL;                                     \
5156                 cfg->param = fn(tb[attr]);                                  \
5157                 mask |= (1 << (attr - 1));                                  \
5158         }                                                                   \
5159 } while (0)
5160
5161
5162         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5163                 return -EINVAL;
5164         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5165                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5166                              nl80211_meshconf_params_policy))
5167                 return -EINVAL;
5168
5169         /* This makes sure that there aren't more than 32 mesh config
5170          * parameters (otherwise our bitfield scheme would not work.) */
5171         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5172
5173         /* Fill in the params struct */
5174         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5175                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5176                                   nla_get_u16);
5177         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5178                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5179                                   nla_get_u16);
5180         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5181                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5182                                   nla_get_u16);
5183         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5184                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5185                                   nla_get_u16);
5186         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5187                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5188                                   nla_get_u8);
5189         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5190                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5191         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5192                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5193                                   nla_get_u8);
5194         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5195                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5196                                   nla_get_u8);
5197         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5198                                   1, 255, mask,
5199                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5200                                   nla_get_u32);
5201         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5202                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5203                                   nla_get_u8);
5204         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5205                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5206                                   nla_get_u32);
5207         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5208                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5209                                   nla_get_u16);
5210         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5211                                   1, 65535, mask,
5212                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5213                                   nla_get_u32);
5214         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5215                                   1, 65535, mask,
5216                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5217                                   nla_get_u16);
5218         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5219                                   1, 65535, mask,
5220                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5221                                   nla_get_u16);
5222         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5223                                   dot11MeshHWMPnetDiameterTraversalTime,
5224                                   1, 65535, mask,
5225                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5226                                   nla_get_u16);
5227         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5228                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5229                                   nla_get_u8);
5230         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5231                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5232                                   nla_get_u16);
5233         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5234                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5235                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5236                                   nla_get_u8);
5237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5238                                   mask, NL80211_MESHCONF_FORWARDING,
5239                                   nla_get_u8);
5240         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5241                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5242                                   nla_get_s32);
5243         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5244                                   mask, NL80211_MESHCONF_HT_OPMODE,
5245                                   nla_get_u16);
5246         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5247                                   1, 65535, mask,
5248                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5249                                   nla_get_u32);
5250         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5251                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5252                                   nla_get_u16);
5253         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5254                                   dot11MeshHWMPconfirmationInterval,
5255                                   1, 65535, mask,
5256                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5257                                   nla_get_u16);
5258         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5259                                   NL80211_MESH_POWER_ACTIVE,
5260                                   NL80211_MESH_POWER_MAX,
5261                                   mask, NL80211_MESHCONF_POWER_MODE,
5262                                   nla_get_u32);
5263         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5264                                   0, 65535, mask,
5265                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5266         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5267                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5268                                   nla_get_u32);
5269         if (mask_out)
5270                 *mask_out = mask;
5271
5272         return 0;
5273
5274 #undef FILL_IN_MESH_PARAM_IF_SET
5275 }
5276
5277 static int nl80211_parse_mesh_setup(struct genl_info *info,
5278                                      struct mesh_setup *setup)
5279 {
5280         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5281         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5282
5283         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5284                 return -EINVAL;
5285         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5286                              info->attrs[NL80211_ATTR_MESH_SETUP],
5287                              nl80211_mesh_setup_params_policy))
5288                 return -EINVAL;
5289
5290         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5291                 setup->sync_method =
5292                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5293                  IEEE80211_SYNC_METHOD_VENDOR :
5294                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5295
5296         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5297                 setup->path_sel_proto =
5298                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5299                  IEEE80211_PATH_PROTOCOL_VENDOR :
5300                  IEEE80211_PATH_PROTOCOL_HWMP;
5301
5302         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5303                 setup->path_metric =
5304                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5305                  IEEE80211_PATH_METRIC_VENDOR :
5306                  IEEE80211_PATH_METRIC_AIRTIME;
5307
5308
5309         if (tb[NL80211_MESH_SETUP_IE]) {
5310                 struct nlattr *ieattr =
5311                         tb[NL80211_MESH_SETUP_IE];
5312                 if (!is_valid_ie_attr(ieattr))
5313                         return -EINVAL;
5314                 setup->ie = nla_data(ieattr);
5315                 setup->ie_len = nla_len(ieattr);
5316         }
5317         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5318             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5319                 return -EINVAL;
5320         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5321         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5322         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5323         if (setup->is_secure)
5324                 setup->user_mpm = true;
5325
5326         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5327                 if (!setup->user_mpm)
5328                         return -EINVAL;
5329                 setup->auth_id =
5330                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5331         }
5332
5333         return 0;
5334 }
5335
5336 static int nl80211_update_mesh_config(struct sk_buff *skb,
5337                                       struct genl_info *info)
5338 {
5339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5340         struct net_device *dev = info->user_ptr[1];
5341         struct wireless_dev *wdev = dev->ieee80211_ptr;
5342         struct mesh_config cfg;
5343         u32 mask;
5344         int err;
5345
5346         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5347                 return -EOPNOTSUPP;
5348
5349         if (!rdev->ops->update_mesh_config)
5350                 return -EOPNOTSUPP;
5351
5352         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5353         if (err)
5354                 return err;
5355
5356         wdev_lock(wdev);
5357         if (!wdev->mesh_id_len)
5358                 err = -ENOLINK;
5359
5360         if (!err)
5361                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5362
5363         wdev_unlock(wdev);
5364
5365         return err;
5366 }
5367
5368 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5369                               struct sk_buff *msg)
5370 {
5371         struct nlattr *nl_reg_rules;
5372         unsigned int i;
5373
5374         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5375             (regdom->dfs_region &&
5376              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5377                 goto nla_put_failure;
5378
5379         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5380         if (!nl_reg_rules)
5381                 goto nla_put_failure;
5382
5383         for (i = 0; i < regdom->n_reg_rules; i++) {
5384                 struct nlattr *nl_reg_rule;
5385                 const struct ieee80211_reg_rule *reg_rule;
5386                 const struct ieee80211_freq_range *freq_range;
5387                 const struct ieee80211_power_rule *power_rule;
5388                 unsigned int max_bandwidth_khz;
5389
5390                 reg_rule = &regdom->reg_rules[i];
5391                 freq_range = &reg_rule->freq_range;
5392                 power_rule = &reg_rule->power_rule;
5393
5394                 nl_reg_rule = nla_nest_start(msg, i);
5395                 if (!nl_reg_rule)
5396                         goto nla_put_failure;
5397
5398                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5399                 if (!max_bandwidth_khz)
5400                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5401                                                                   reg_rule);
5402
5403                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5404                                 reg_rule->flags) ||
5405                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5406                                 freq_range->start_freq_khz) ||
5407                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5408                                 freq_range->end_freq_khz) ||
5409                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5410                                 max_bandwidth_khz) ||
5411                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5412                                 power_rule->max_antenna_gain) ||
5413                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5414                                 power_rule->max_eirp) ||
5415                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5416                                 reg_rule->dfs_cac_ms))
5417                         goto nla_put_failure;
5418
5419                 nla_nest_end(msg, nl_reg_rule);
5420         }
5421
5422         nla_nest_end(msg, nl_reg_rules);
5423         return 0;
5424
5425 nla_put_failure:
5426         return -EMSGSIZE;
5427 }
5428
5429 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5430 {
5431         const struct ieee80211_regdomain *regdom = NULL;
5432         struct cfg80211_registered_device *rdev;
5433         struct wiphy *wiphy = NULL;
5434         struct sk_buff *msg;
5435         void *hdr;
5436
5437         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5438         if (!msg)
5439                 return -ENOBUFS;
5440
5441         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5442                              NL80211_CMD_GET_REG);
5443         if (!hdr)
5444                 goto put_failure;
5445
5446         if (info->attrs[NL80211_ATTR_WIPHY]) {
5447                 bool self_managed;
5448
5449                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5450                 if (IS_ERR(rdev)) {
5451                         nlmsg_free(msg);
5452                         return PTR_ERR(rdev);
5453                 }
5454
5455                 wiphy = &rdev->wiphy;
5456                 self_managed = wiphy->regulatory_flags &
5457                                REGULATORY_WIPHY_SELF_MANAGED;
5458                 regdom = get_wiphy_regdom(wiphy);
5459
5460                 /* a self-managed-reg device must have a private regdom */
5461                 if (WARN_ON(!regdom && self_managed)) {
5462                         nlmsg_free(msg);
5463                         return -EINVAL;
5464                 }
5465
5466                 if (regdom &&
5467                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5468                         goto nla_put_failure;
5469         }
5470
5471         if (!wiphy && reg_last_request_cell_base() &&
5472             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5473                         NL80211_USER_REG_HINT_CELL_BASE))
5474                 goto nla_put_failure;
5475
5476         rcu_read_lock();
5477
5478         if (!regdom)
5479                 regdom = rcu_dereference(cfg80211_regdomain);
5480
5481         if (nl80211_put_regdom(regdom, msg))
5482                 goto nla_put_failure_rcu;
5483
5484         rcu_read_unlock();
5485
5486         genlmsg_end(msg, hdr);
5487         return genlmsg_reply(msg, info);
5488
5489 nla_put_failure_rcu:
5490         rcu_read_unlock();
5491 nla_put_failure:
5492         genlmsg_cancel(msg, hdr);
5493 put_failure:
5494         nlmsg_free(msg);
5495         return -EMSGSIZE;
5496 }
5497
5498 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5499                                u32 seq, int flags, struct wiphy *wiphy,
5500                                const struct ieee80211_regdomain *regdom)
5501 {
5502         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5503                                    NL80211_CMD_GET_REG);
5504
5505         if (!hdr)
5506                 return -1;
5507
5508         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5509
5510         if (nl80211_put_regdom(regdom, msg))
5511                 goto nla_put_failure;
5512
5513         if (!wiphy && reg_last_request_cell_base() &&
5514             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5515                         NL80211_USER_REG_HINT_CELL_BASE))
5516                 goto nla_put_failure;
5517
5518         if (wiphy &&
5519             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5520                 goto nla_put_failure;
5521
5522         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5523             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5524                 goto nla_put_failure;
5525
5526         genlmsg_end(msg, hdr);
5527         return 0;
5528
5529 nla_put_failure:
5530         genlmsg_cancel(msg, hdr);
5531         return -EMSGSIZE;
5532 }
5533
5534 static int nl80211_get_reg_dump(struct sk_buff *skb,
5535                                 struct netlink_callback *cb)
5536 {
5537         const struct ieee80211_regdomain *regdom = NULL;
5538         struct cfg80211_registered_device *rdev;
5539         int err, reg_idx, start = cb->args[2];
5540
5541         rtnl_lock();
5542
5543         if (cfg80211_regdomain && start == 0) {
5544                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5545                                           NLM_F_MULTI, NULL,
5546                                           rtnl_dereference(cfg80211_regdomain));
5547                 if (err < 0)
5548                         goto out_err;
5549         }
5550
5551         /* the global regdom is idx 0 */
5552         reg_idx = 1;
5553         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5554                 regdom = get_wiphy_regdom(&rdev->wiphy);
5555                 if (!regdom)
5556                         continue;
5557
5558                 if (++reg_idx <= start)
5559                         continue;
5560
5561                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5562                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5563                 if (err < 0) {
5564                         reg_idx--;
5565                         break;
5566                 }
5567         }
5568
5569         cb->args[2] = reg_idx;
5570         err = skb->len;
5571 out_err:
5572         rtnl_unlock();
5573         return err;
5574 }
5575
5576 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5577 {
5578         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5579         struct nlattr *nl_reg_rule;
5580         char *alpha2;
5581         int rem_reg_rules, r;
5582         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5583         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5584         struct ieee80211_regdomain *rd;
5585
5586         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5587                 return -EINVAL;
5588
5589         if (!info->attrs[NL80211_ATTR_REG_RULES])
5590                 return -EINVAL;
5591
5592         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5593
5594         if (info->attrs[NL80211_ATTR_DFS_REGION])
5595                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5596
5597         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5598                             rem_reg_rules) {
5599                 num_rules++;
5600                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5601                         return -EINVAL;
5602         }
5603
5604         if (!reg_is_valid_request(alpha2))
5605                 return -EINVAL;
5606
5607         size_of_regd = sizeof(struct ieee80211_regdomain) +
5608                        num_rules * sizeof(struct ieee80211_reg_rule);
5609
5610         rd = kzalloc(size_of_regd, GFP_KERNEL);
5611         if (!rd)
5612                 return -ENOMEM;
5613
5614         rd->n_reg_rules = num_rules;
5615         rd->alpha2[0] = alpha2[0];
5616         rd->alpha2[1] = alpha2[1];
5617
5618         /*
5619          * Disable DFS master mode if the DFS region was
5620          * not supported or known on this kernel.
5621          */
5622         if (reg_supported_dfs_region(dfs_region))
5623                 rd->dfs_region = dfs_region;
5624
5625         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5626                             rem_reg_rules) {
5627                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5628                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5629                               reg_rule_policy);
5630                 if (r)
5631                         goto bad_reg;
5632                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5633                 if (r)
5634                         goto bad_reg;
5635
5636                 rule_idx++;
5637
5638                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5639                         r = -EINVAL;
5640                         goto bad_reg;
5641                 }
5642         }
5643
5644         r = set_regdom(rd);
5645         /* set_regdom took ownership */
5646         rd = NULL;
5647
5648  bad_reg:
5649         kfree(rd);
5650         return r;
5651 }
5652
5653 static int validate_scan_freqs(struct nlattr *freqs)
5654 {
5655         struct nlattr *attr1, *attr2;
5656         int n_channels = 0, tmp1, tmp2;
5657
5658         nla_for_each_nested(attr1, freqs, tmp1) {
5659                 n_channels++;
5660                 /*
5661                  * Some hardware has a limited channel list for
5662                  * scanning, and it is pretty much nonsensical
5663                  * to scan for a channel twice, so disallow that
5664                  * and don't require drivers to check that the
5665                  * channel list they get isn't longer than what
5666                  * they can scan, as long as they can scan all
5667                  * the channels they registered at once.
5668                  */
5669                 nla_for_each_nested(attr2, freqs, tmp2)
5670                         if (attr1 != attr2 &&
5671                             nla_get_u32(attr1) == nla_get_u32(attr2))
5672                                 return 0;
5673         }
5674
5675         return n_channels;
5676 }
5677
5678 static int nl80211_parse_random_mac(struct nlattr **attrs,
5679                                     u8 *mac_addr, u8 *mac_addr_mask)
5680 {
5681         int i;
5682
5683         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5684                 memset(mac_addr, 0, ETH_ALEN);
5685                 memset(mac_addr_mask, 0, ETH_ALEN);
5686                 mac_addr[0] = 0x2;
5687                 mac_addr_mask[0] = 0x3;
5688
5689                 return 0;
5690         }
5691
5692         /* need both or none */
5693         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5694                 return -EINVAL;
5695
5696         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5697         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5698
5699         /* don't allow or configure an mcast address */
5700         if (!is_multicast_ether_addr(mac_addr_mask) ||
5701             is_multicast_ether_addr(mac_addr))
5702                 return -EINVAL;
5703
5704         /*
5705          * allow users to pass a MAC address that has bits set outside
5706          * of the mask, but don't bother drivers with having to deal
5707          * with such bits
5708          */
5709         for (i = 0; i < ETH_ALEN; i++)
5710                 mac_addr[i] &= mac_addr_mask[i];
5711
5712         return 0;
5713 }
5714
5715 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5716 {
5717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5718         struct wireless_dev *wdev = info->user_ptr[1];
5719         struct cfg80211_scan_request *request;
5720         struct nlattr *attr;
5721         struct wiphy *wiphy;
5722         int err, tmp, n_ssids = 0, n_channels, i;
5723         size_t ie_len;
5724
5725         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5726                 return -EINVAL;
5727
5728         wiphy = &rdev->wiphy;
5729
5730         if (!rdev->ops->scan)
5731                 return -EOPNOTSUPP;
5732
5733         if (rdev->scan_req || rdev->scan_msg) {
5734                 err = -EBUSY;
5735                 goto unlock;
5736         }
5737
5738         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5739                 n_channels = validate_scan_freqs(
5740                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5741                 if (!n_channels) {
5742                         err = -EINVAL;
5743                         goto unlock;
5744                 }
5745         } else {
5746                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5747         }
5748
5749         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5750                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5751                         n_ssids++;
5752
5753         if (n_ssids > wiphy->max_scan_ssids) {
5754                 err = -EINVAL;
5755                 goto unlock;
5756         }
5757
5758         if (info->attrs[NL80211_ATTR_IE])
5759                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5760         else
5761                 ie_len = 0;
5762
5763         if (ie_len > wiphy->max_scan_ie_len) {
5764                 err = -EINVAL;
5765                 goto unlock;
5766         }
5767
5768         request = kzalloc(sizeof(*request)
5769                         + sizeof(*request->ssids) * n_ssids
5770                         + sizeof(*request->channels) * n_channels
5771                         + ie_len, GFP_KERNEL);
5772         if (!request) {
5773                 err = -ENOMEM;
5774                 goto unlock;
5775         }
5776
5777         if (n_ssids)
5778                 request->ssids = (void *)&request->channels[n_channels];
5779         request->n_ssids = n_ssids;
5780         if (ie_len) {
5781                 if (request->ssids)
5782                         request->ie = (void *)(request->ssids + n_ssids);
5783                 else
5784                         request->ie = (void *)(request->channels + n_channels);
5785         }
5786
5787         i = 0;
5788         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5789                 /* user specified, bail out if channel not found */
5790                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5791                         struct ieee80211_channel *chan;
5792
5793                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5794
5795                         if (!chan) {
5796                                 err = -EINVAL;
5797                                 goto out_free;
5798                         }
5799
5800                         /* ignore disabled channels */
5801                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5802                                 continue;
5803
5804                         request->channels[i] = chan;
5805                         i++;
5806                 }
5807         } else {
5808                 enum ieee80211_band band;
5809
5810                 /* all channels */
5811                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5812                         int j;
5813                         if (!wiphy->bands[band])
5814                                 continue;
5815                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5816                                 struct ieee80211_channel *chan;
5817
5818                                 chan = &wiphy->bands[band]->channels[j];
5819
5820                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5821                                         continue;
5822
5823                                 request->channels[i] = chan;
5824                                 i++;
5825                         }
5826                 }
5827         }
5828
5829         if (!i) {
5830                 err = -EINVAL;
5831                 goto out_free;
5832         }
5833
5834         request->n_channels = i;
5835
5836         i = 0;
5837         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5838                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5839                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5840                                 err = -EINVAL;
5841                                 goto out_free;
5842                         }
5843                         request->ssids[i].ssid_len = nla_len(attr);
5844                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5845                         i++;
5846                 }
5847         }
5848
5849         if (info->attrs[NL80211_ATTR_IE]) {
5850                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5851                 memcpy((void *)request->ie,
5852                        nla_data(info->attrs[NL80211_ATTR_IE]),
5853                        request->ie_len);
5854         }
5855
5856         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5857                 if (wiphy->bands[i])
5858                         request->rates[i] =
5859                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5860
5861         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5862                 nla_for_each_nested(attr,
5863                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5864                                     tmp) {
5865                         enum ieee80211_band band = nla_type(attr);
5866
5867                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5868                                 err = -EINVAL;
5869                                 goto out_free;
5870                         }
5871
5872                         if (!wiphy->bands[band])
5873                                 continue;
5874
5875                         err = ieee80211_get_ratemask(wiphy->bands[band],
5876                                                      nla_data(attr),
5877                                                      nla_len(attr),
5878                                                      &request->rates[band]);
5879                         if (err)
5880                                 goto out_free;
5881                 }
5882         }
5883
5884         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5885                 request->flags = nla_get_u32(
5886                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5887                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5888                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5889                         err = -EOPNOTSUPP;
5890                         goto out_free;
5891                 }
5892
5893                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5894                         if (!(wiphy->features &
5895                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5896                                 err = -EOPNOTSUPP;
5897                                 goto out_free;
5898                         }
5899
5900                         if (wdev->current_bss) {
5901                                 err = -EOPNOTSUPP;
5902                                 goto out_free;
5903                         }
5904
5905                         err = nl80211_parse_random_mac(info->attrs,
5906                                                        request->mac_addr,
5907                                                        request->mac_addr_mask);
5908                         if (err)
5909                                 goto out_free;
5910                 }
5911         }
5912
5913         request->no_cck =
5914                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5915
5916         request->wdev = wdev;
5917         request->wiphy = &rdev->wiphy;
5918         request->scan_start = jiffies;
5919
5920         rdev->scan_req = request;
5921         err = rdev_scan(rdev, request);
5922
5923         if (!err) {
5924                 nl80211_send_scan_start(rdev, wdev);
5925                 if (wdev->netdev)
5926                         dev_hold(wdev->netdev);
5927         } else {
5928  out_free:
5929                 rdev->scan_req = NULL;
5930                 kfree(request);
5931         }
5932
5933  unlock:
5934         return err;
5935 }
5936
5937 static struct cfg80211_sched_scan_request *
5938 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
5939                          struct nlattr **attrs)
5940 {
5941         struct cfg80211_sched_scan_request *request;
5942         struct nlattr *attr;
5943         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5944         u32 interval;
5945         enum ieee80211_band band;
5946         size_t ie_len;
5947         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5948         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5949
5950         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
5951                 return ERR_PTR(-EINVAL);
5952
5953         if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5954                 return ERR_PTR(-EINVAL);
5955
5956         interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5957         if (interval == 0)
5958                 return ERR_PTR(-EINVAL);
5959
5960         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5961                 n_channels = validate_scan_freqs(
5962                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5963                 if (!n_channels)
5964                         return ERR_PTR(-EINVAL);
5965         } else {
5966                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5967         }
5968
5969         if (attrs[NL80211_ATTR_SCAN_SSIDS])
5970                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5971                                     tmp)
5972                         n_ssids++;
5973
5974         if (n_ssids > wiphy->max_sched_scan_ssids)
5975                 return ERR_PTR(-EINVAL);
5976
5977         /*
5978          * First, count the number of 'real' matchsets. Due to an issue with
5979          * the old implementation, matchsets containing only the RSSI attribute
5980          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5981          * RSSI for all matchsets, rather than their own matchset for reporting
5982          * all APs with a strong RSSI. This is needed to be compatible with
5983          * older userspace that treated a matchset with only the RSSI as the
5984          * global RSSI for all other matchsets - if there are other matchsets.
5985          */
5986         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5987                 nla_for_each_nested(attr,
5988                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5989                                     tmp) {
5990                         struct nlattr *rssi;
5991
5992                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5993                                         nla_data(attr), nla_len(attr),
5994                                         nl80211_match_policy);
5995                         if (err)
5996                                 return ERR_PTR(err);
5997                         /* add other standalone attributes here */
5998                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5999                                 n_match_sets++;
6000                                 continue;
6001                         }
6002                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6003                         if (rssi)
6004                                 default_match_rssi = nla_get_s32(rssi);
6005                 }
6006         }
6007
6008         /* However, if there's no other matchset, add the RSSI one */
6009         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6010                 n_match_sets = 1;
6011
6012         if (n_match_sets > wiphy->max_match_sets)
6013                 return ERR_PTR(-EINVAL);
6014
6015         if (attrs[NL80211_ATTR_IE])
6016                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6017         else
6018                 ie_len = 0;
6019
6020         if (ie_len > wiphy->max_sched_scan_ie_len)
6021                 return ERR_PTR(-EINVAL);
6022
6023         request = kzalloc(sizeof(*request)
6024                         + sizeof(*request->ssids) * n_ssids
6025                         + sizeof(*request->match_sets) * n_match_sets
6026                         + sizeof(*request->channels) * n_channels
6027                         + ie_len, GFP_KERNEL);
6028         if (!request)
6029                 return ERR_PTR(-ENOMEM);
6030
6031         if (n_ssids)
6032                 request->ssids = (void *)&request->channels[n_channels];
6033         request->n_ssids = n_ssids;
6034         if (ie_len) {
6035                 if (request->ssids)
6036                         request->ie = (void *)(request->ssids + n_ssids);
6037                 else
6038                         request->ie = (void *)(request->channels + n_channels);
6039         }
6040
6041         if (n_match_sets) {
6042                 if (request->ie)
6043                         request->match_sets = (void *)(request->ie + ie_len);
6044                 else if (request->ssids)
6045                         request->match_sets =
6046                                 (void *)(request->ssids + n_ssids);
6047                 else
6048                         request->match_sets =
6049                                 (void *)(request->channels + n_channels);
6050         }
6051         request->n_match_sets = n_match_sets;
6052
6053         i = 0;
6054         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6055                 /* user specified, bail out if channel not found */
6056                 nla_for_each_nested(attr,
6057                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6058                                     tmp) {
6059                         struct ieee80211_channel *chan;
6060
6061                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6062
6063                         if (!chan) {
6064                                 err = -EINVAL;
6065                                 goto out_free;
6066                         }
6067
6068                         /* ignore disabled channels */
6069                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6070                                 continue;
6071
6072                         request->channels[i] = chan;
6073                         i++;
6074                 }
6075         } else {
6076                 /* all channels */
6077                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6078                         int j;
6079                         if (!wiphy->bands[band])
6080                                 continue;
6081                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6082                                 struct ieee80211_channel *chan;
6083
6084                                 chan = &wiphy->bands[band]->channels[j];
6085
6086                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6087                                         continue;
6088
6089                                 request->channels[i] = chan;
6090                                 i++;
6091                         }
6092                 }
6093         }
6094
6095         if (!i) {
6096                 err = -EINVAL;
6097                 goto out_free;
6098         }
6099
6100         request->n_channels = i;
6101
6102         i = 0;
6103         if (attrs[NL80211_ATTR_SCAN_SSIDS]) {
6104                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6105                                     tmp) {
6106                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6107                                 err = -EINVAL;
6108                                 goto out_free;
6109                         }
6110                         request->ssids[i].ssid_len = nla_len(attr);
6111                         memcpy(request->ssids[i].ssid, nla_data(attr),
6112                                nla_len(attr));
6113                         i++;
6114                 }
6115         }
6116
6117         i = 0;
6118         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6119                 nla_for_each_nested(attr,
6120                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6121                                     tmp) {
6122                         struct nlattr *ssid, *rssi;
6123
6124                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6125                                         nla_data(attr), nla_len(attr),
6126                                         nl80211_match_policy);
6127                         if (err)
6128                                 goto out_free;
6129                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6130                         if (ssid) {
6131                                 if (WARN_ON(i >= n_match_sets)) {
6132                                         /* this indicates a programming error,
6133                                          * the loop above should have verified
6134                                          * things properly
6135                                          */
6136                                         err = -EINVAL;
6137                                         goto out_free;
6138                                 }
6139
6140                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6141                                         err = -EINVAL;
6142                                         goto out_free;
6143                                 }
6144                                 memcpy(request->match_sets[i].ssid.ssid,
6145                                        nla_data(ssid), nla_len(ssid));
6146                                 request->match_sets[i].ssid.ssid_len =
6147                                         nla_len(ssid);
6148                                 /* special attribute - old implemenation w/a */
6149                                 request->match_sets[i].rssi_thold =
6150                                         default_match_rssi;
6151                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6152                                 if (rssi)
6153                                         request->match_sets[i].rssi_thold =
6154                                                 nla_get_s32(rssi);
6155                         }
6156                         i++;
6157                 }
6158
6159                 /* there was no other matchset, so the RSSI one is alone */
6160                 if (i == 0 && n_match_sets)
6161                         request->match_sets[0].rssi_thold = default_match_rssi;
6162
6163                 request->min_rssi_thold = INT_MAX;
6164                 for (i = 0; i < n_match_sets; i++)
6165                         request->min_rssi_thold =
6166                                 min(request->match_sets[i].rssi_thold,
6167                                     request->min_rssi_thold);
6168         } else {
6169                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6170         }
6171
6172         if (ie_len) {
6173                 request->ie_len = ie_len;
6174                 memcpy((void *)request->ie,
6175                        nla_data(attrs[NL80211_ATTR_IE]),
6176                        request->ie_len);
6177         }
6178
6179         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6180                 request->flags = nla_get_u32(
6181                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6182                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6183                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6184                         err = -EOPNOTSUPP;
6185                         goto out_free;
6186                 }
6187
6188                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6189                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6190
6191                         if (!wdev) /* must be net-detect */
6192                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6193
6194                         if (!(wiphy->features & flg)) {
6195                                 err = -EOPNOTSUPP;
6196                                 goto out_free;
6197                         }
6198
6199                         if (wdev && wdev->current_bss) {
6200                                 err = -EOPNOTSUPP;
6201                                 goto out_free;
6202                         }
6203
6204                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6205                                                        request->mac_addr_mask);
6206                         if (err)
6207                                 goto out_free;
6208                 }
6209         }
6210
6211         request->interval = interval;
6212         request->scan_start = jiffies;
6213
6214         return request;
6215
6216 out_free:
6217         kfree(request);
6218         return ERR_PTR(err);
6219 }
6220
6221 static int nl80211_start_sched_scan(struct sk_buff *skb,
6222                                     struct genl_info *info)
6223 {
6224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6225         struct net_device *dev = info->user_ptr[1];
6226         struct wireless_dev *wdev = dev->ieee80211_ptr;
6227         struct cfg80211_sched_scan_request *sched_scan_req;
6228         int err;
6229
6230         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6231             !rdev->ops->sched_scan_start)
6232                 return -EOPNOTSUPP;
6233
6234         if (rdev->sched_scan_req)
6235                 return -EINPROGRESS;
6236
6237         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6238                                                   info->attrs);
6239
6240         err = PTR_ERR_OR_ZERO(sched_scan_req);
6241         if (err)
6242                 goto out_err;
6243
6244         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6245         if (err)
6246                 goto out_free;
6247
6248         sched_scan_req->dev = dev;
6249         sched_scan_req->wiphy = &rdev->wiphy;
6250
6251         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6252                 sched_scan_req->owner_nlportid = info->snd_portid;
6253
6254         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6255
6256         nl80211_send_sched_scan(rdev, dev,
6257                                 NL80211_CMD_START_SCHED_SCAN);
6258         return 0;
6259
6260 out_free:
6261         kfree(sched_scan_req);
6262 out_err:
6263         return err;
6264 }
6265
6266 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6267                                    struct genl_info *info)
6268 {
6269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6270
6271         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6272             !rdev->ops->sched_scan_stop)
6273                 return -EOPNOTSUPP;
6274
6275         return __cfg80211_stop_sched_scan(rdev, false);
6276 }
6277
6278 static int nl80211_start_radar_detection(struct sk_buff *skb,
6279                                          struct genl_info *info)
6280 {
6281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6282         struct net_device *dev = info->user_ptr[1];
6283         struct wireless_dev *wdev = dev->ieee80211_ptr;
6284         struct cfg80211_chan_def chandef;
6285         enum nl80211_dfs_regions dfs_region;
6286         unsigned int cac_time_ms;
6287         int err;
6288
6289         dfs_region = reg_get_dfs_region(wdev->wiphy);
6290         if (dfs_region == NL80211_DFS_UNSET)
6291                 return -EINVAL;
6292
6293         err = nl80211_parse_chandef(rdev, info, &chandef);
6294         if (err)
6295                 return err;
6296
6297         if (netif_carrier_ok(dev))
6298                 return -EBUSY;
6299
6300         if (wdev->cac_started)
6301                 return -EBUSY;
6302
6303         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6304                                             wdev->iftype);
6305         if (err < 0)
6306                 return err;
6307
6308         if (err == 0)
6309                 return -EINVAL;
6310
6311         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6312                 return -EINVAL;
6313
6314         if (!rdev->ops->start_radar_detection)
6315                 return -EOPNOTSUPP;
6316
6317         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6318         if (WARN_ON(!cac_time_ms))
6319                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6320
6321         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6322                                                cac_time_ms);
6323         if (!err) {
6324                 wdev->chandef = chandef;
6325                 wdev->cac_started = true;
6326                 wdev->cac_start_time = jiffies;
6327                 wdev->cac_time_ms = cac_time_ms;
6328         }
6329         return err;
6330 }
6331
6332 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6333 {
6334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6335         struct net_device *dev = info->user_ptr[1];
6336         struct wireless_dev *wdev = dev->ieee80211_ptr;
6337         struct cfg80211_csa_settings params;
6338         /* csa_attrs is defined static to avoid waste of stack size - this
6339          * function is called under RTNL lock, so this should not be a problem.
6340          */
6341         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6342         int err;
6343         bool need_new_beacon = false;
6344         int len, i;
6345         u32 cs_count;
6346
6347         if (!rdev->ops->channel_switch ||
6348             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6349                 return -EOPNOTSUPP;
6350
6351         switch (dev->ieee80211_ptr->iftype) {
6352         case NL80211_IFTYPE_AP:
6353         case NL80211_IFTYPE_P2P_GO:
6354                 need_new_beacon = true;
6355
6356                 /* useless if AP is not running */
6357                 if (!wdev->beacon_interval)
6358                         return -ENOTCONN;
6359                 break;
6360         case NL80211_IFTYPE_ADHOC:
6361                 if (!wdev->ssid_len)
6362                         return -ENOTCONN;
6363                 break;
6364         case NL80211_IFTYPE_MESH_POINT:
6365                 if (!wdev->mesh_id_len)
6366                         return -ENOTCONN;
6367                 break;
6368         default:
6369                 return -EOPNOTSUPP;
6370         }
6371
6372         memset(&params, 0, sizeof(params));
6373
6374         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6375             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6376                 return -EINVAL;
6377
6378         /* only important for AP, IBSS and mesh create IEs internally */
6379         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6380                 return -EINVAL;
6381
6382         /* Even though the attribute is u32, the specification says
6383          * u8, so let's make sure we don't overflow.
6384          */
6385         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6386         if (cs_count > 255)
6387                 return -EINVAL;
6388
6389         params.count = cs_count;
6390
6391         if (!need_new_beacon)
6392                 goto skip_beacons;
6393
6394         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6395         if (err)
6396                 return err;
6397
6398         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6399                                info->attrs[NL80211_ATTR_CSA_IES],
6400                                nl80211_policy);
6401         if (err)
6402                 return err;
6403
6404         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6405         if (err)
6406                 return err;
6407
6408         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6409                 return -EINVAL;
6410
6411         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6412         if (!len || (len % sizeof(u16)))
6413                 return -EINVAL;
6414
6415         params.n_counter_offsets_beacon = len / sizeof(u16);
6416         if (rdev->wiphy.max_num_csa_counters &&
6417             (params.n_counter_offsets_beacon >
6418              rdev->wiphy.max_num_csa_counters))
6419                 return -EINVAL;
6420
6421         params.counter_offsets_beacon =
6422                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6423
6424         /* sanity checks - counters should fit and be the same */
6425         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6426                 u16 offset = params.counter_offsets_beacon[i];
6427
6428                 if (offset >= params.beacon_csa.tail_len)
6429                         return -EINVAL;
6430
6431                 if (params.beacon_csa.tail[offset] != params.count)
6432                         return -EINVAL;
6433         }
6434
6435         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6436                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6437                 if (!len || (len % sizeof(u16)))
6438                         return -EINVAL;
6439
6440                 params.n_counter_offsets_presp = len / sizeof(u16);
6441                 if (rdev->wiphy.max_num_csa_counters &&
6442                     (params.n_counter_offsets_beacon >
6443                      rdev->wiphy.max_num_csa_counters))
6444                         return -EINVAL;
6445
6446                 params.counter_offsets_presp =
6447                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6448
6449                 /* sanity checks - counters should fit and be the same */
6450                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6451                         u16 offset = params.counter_offsets_presp[i];
6452
6453                         if (offset >= params.beacon_csa.probe_resp_len)
6454                                 return -EINVAL;
6455
6456                         if (params.beacon_csa.probe_resp[offset] !=
6457                             params.count)
6458                                 return -EINVAL;
6459                 }
6460         }
6461
6462 skip_beacons:
6463         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6464         if (err)
6465                 return err;
6466
6467         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6468                                      wdev->iftype))
6469                 return -EINVAL;
6470
6471         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6472                                             &params.chandef,
6473                                             wdev->iftype);
6474         if (err < 0)
6475                 return err;
6476
6477         if (err > 0)
6478                 params.radar_required = true;
6479
6480         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6481                 params.block_tx = true;
6482
6483         wdev_lock(wdev);
6484         err = rdev_channel_switch(rdev, dev, &params);
6485         wdev_unlock(wdev);
6486
6487         return err;
6488 }
6489
6490 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6491                             u32 seq, int flags,
6492                             struct cfg80211_registered_device *rdev,
6493                             struct wireless_dev *wdev,
6494                             struct cfg80211_internal_bss *intbss)
6495 {
6496         struct cfg80211_bss *res = &intbss->pub;
6497         const struct cfg80211_bss_ies *ies;
6498         void *hdr;
6499         struct nlattr *bss;
6500
6501         ASSERT_WDEV_LOCK(wdev);
6502
6503         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6504                              NL80211_CMD_NEW_SCAN_RESULTS);
6505         if (!hdr)
6506                 return -1;
6507
6508         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6509
6510         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6511                 goto nla_put_failure;
6512         if (wdev->netdev &&
6513             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6514                 goto nla_put_failure;
6515         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6516                 goto nla_put_failure;
6517
6518         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6519         if (!bss)
6520                 goto nla_put_failure;
6521         if ((!is_zero_ether_addr(res->bssid) &&
6522              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6523                 goto nla_put_failure;
6524
6525         rcu_read_lock();
6526         /* indicate whether we have probe response data or not */
6527         if (rcu_access_pointer(res->proberesp_ies) &&
6528             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6529                 goto fail_unlock_rcu;
6530
6531         /* this pointer prefers to be pointed to probe response data
6532          * but is always valid
6533          */
6534         ies = rcu_dereference(res->ies);
6535         if (ies) {
6536                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6537                         goto fail_unlock_rcu;
6538                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6539                                         ies->len, ies->data))
6540                         goto fail_unlock_rcu;
6541         }
6542
6543         /* and this pointer is always (unless driver didn't know) beacon data */
6544         ies = rcu_dereference(res->beacon_ies);
6545         if (ies && ies->from_beacon) {
6546                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6547                         goto fail_unlock_rcu;
6548                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6549                                         ies->len, ies->data))
6550                         goto fail_unlock_rcu;
6551         }
6552         rcu_read_unlock();
6553
6554         if (res->beacon_interval &&
6555             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6556                 goto nla_put_failure;
6557         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6558             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6559             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6560             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6561                         jiffies_to_msecs(jiffies - intbss->ts)))
6562                 goto nla_put_failure;
6563
6564         switch (rdev->wiphy.signal_type) {
6565         case CFG80211_SIGNAL_TYPE_MBM:
6566                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6567                         goto nla_put_failure;
6568                 break;
6569         case CFG80211_SIGNAL_TYPE_UNSPEC:
6570                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6571                         goto nla_put_failure;
6572                 break;
6573         default:
6574                 break;
6575         }
6576
6577         switch (wdev->iftype) {
6578         case NL80211_IFTYPE_P2P_CLIENT:
6579         case NL80211_IFTYPE_STATION:
6580                 if (intbss == wdev->current_bss &&
6581                     nla_put_u32(msg, NL80211_BSS_STATUS,
6582                                 NL80211_BSS_STATUS_ASSOCIATED))
6583                         goto nla_put_failure;
6584                 break;
6585         case NL80211_IFTYPE_ADHOC:
6586                 if (intbss == wdev->current_bss &&
6587                     nla_put_u32(msg, NL80211_BSS_STATUS,
6588                                 NL80211_BSS_STATUS_IBSS_JOINED))
6589                         goto nla_put_failure;
6590                 break;
6591         default:
6592                 break;
6593         }
6594
6595         nla_nest_end(msg, bss);
6596
6597         genlmsg_end(msg, hdr);
6598         return 0;
6599
6600  fail_unlock_rcu:
6601         rcu_read_unlock();
6602  nla_put_failure:
6603         genlmsg_cancel(msg, hdr);
6604         return -EMSGSIZE;
6605 }
6606
6607 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6608 {
6609         struct cfg80211_registered_device *rdev;
6610         struct cfg80211_internal_bss *scan;
6611         struct wireless_dev *wdev;
6612         int start = cb->args[2], idx = 0;
6613         int err;
6614
6615         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6616         if (err)
6617                 return err;
6618
6619         wdev_lock(wdev);
6620         spin_lock_bh(&rdev->bss_lock);
6621         cfg80211_bss_expire(rdev);
6622
6623         cb->seq = rdev->bss_generation;
6624
6625         list_for_each_entry(scan, &rdev->bss_list, list) {
6626                 if (++idx <= start)
6627                         continue;
6628                 if (nl80211_send_bss(skb, cb,
6629                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6630                                 rdev, wdev, scan) < 0) {
6631                         idx--;
6632                         break;
6633                 }
6634         }
6635
6636         spin_unlock_bh(&rdev->bss_lock);
6637         wdev_unlock(wdev);
6638
6639         cb->args[2] = idx;
6640         nl80211_finish_wdev_dump(rdev);
6641
6642         return skb->len;
6643 }
6644
6645 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6646                                int flags, struct net_device *dev,
6647                                bool allow_radio_stats,
6648                                struct survey_info *survey)
6649 {
6650         void *hdr;
6651         struct nlattr *infoattr;
6652
6653         /* skip radio stats if userspace didn't request them */
6654         if (!survey->channel && !allow_radio_stats)
6655                 return 0;
6656
6657         hdr = nl80211hdr_put(msg, portid, seq, flags,
6658                              NL80211_CMD_NEW_SURVEY_RESULTS);
6659         if (!hdr)
6660                 return -ENOMEM;
6661
6662         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6663                 goto nla_put_failure;
6664
6665         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6666         if (!infoattr)
6667                 goto nla_put_failure;
6668
6669         if (survey->channel &&
6670             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6671                         survey->channel->center_freq))
6672                 goto nla_put_failure;
6673
6674         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6675             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6676                 goto nla_put_failure;
6677         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6678             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6679                 goto nla_put_failure;
6680         if ((survey->filled & SURVEY_INFO_TIME) &&
6681             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
6682                         survey->time))
6683                 goto nla_put_failure;
6684         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
6685             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
6686                         survey->time_busy))
6687                 goto nla_put_failure;
6688         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
6689             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
6690                         survey->time_ext_busy))
6691                 goto nla_put_failure;
6692         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
6693             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
6694                         survey->time_rx))
6695                 goto nla_put_failure;
6696         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
6697             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
6698                         survey->time_tx))
6699                 goto nla_put_failure;
6700         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
6701             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
6702                         survey->time_scan))
6703                 goto nla_put_failure;
6704
6705         nla_nest_end(msg, infoattr);
6706
6707         genlmsg_end(msg, hdr);
6708         return 0;
6709
6710  nla_put_failure:
6711         genlmsg_cancel(msg, hdr);
6712         return -EMSGSIZE;
6713 }
6714
6715 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
6716 {
6717         struct survey_info survey;
6718         struct cfg80211_registered_device *rdev;
6719         struct wireless_dev *wdev;
6720         int survey_idx = cb->args[2];
6721         int res;
6722         bool radio_stats;
6723
6724         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6725         if (res)
6726                 return res;
6727
6728         /* prepare_wdev_dump parsed the attributes */
6729         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
6730
6731         if (!wdev->netdev) {
6732                 res = -EINVAL;
6733                 goto out_err;
6734         }
6735
6736         if (!rdev->ops->dump_survey) {
6737                 res = -EOPNOTSUPP;
6738                 goto out_err;
6739         }
6740
6741         while (1) {
6742                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6743                 if (res == -ENOENT)
6744                         break;
6745                 if (res)
6746                         goto out_err;
6747
6748                 /* don't send disabled channels, but do send non-channel data */
6749                 if (survey.channel &&
6750                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6751                         survey_idx++;
6752                         continue;
6753                 }
6754
6755                 if (nl80211_send_survey(skb,
6756                                 NETLINK_CB(cb->skb).portid,
6757                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6758                                 wdev->netdev, radio_stats, &survey) < 0)
6759                         goto out;
6760                 survey_idx++;
6761         }
6762
6763  out:
6764         cb->args[2] = survey_idx;
6765         res = skb->len;
6766  out_err:
6767         nl80211_finish_wdev_dump(rdev);
6768         return res;
6769 }
6770
6771 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6772 {
6773         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6774                                   NL80211_WPA_VERSION_2));
6775 }
6776
6777 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6778 {
6779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6780         struct net_device *dev = info->user_ptr[1];
6781         struct ieee80211_channel *chan;
6782         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6783         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6784         enum nl80211_auth_type auth_type;
6785         struct key_parse key;
6786         bool local_state_change;
6787
6788         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6789                 return -EINVAL;
6790
6791         if (!info->attrs[NL80211_ATTR_MAC])
6792                 return -EINVAL;
6793
6794         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6795                 return -EINVAL;
6796
6797         if (!info->attrs[NL80211_ATTR_SSID])
6798                 return -EINVAL;
6799
6800         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6801                 return -EINVAL;
6802
6803         err = nl80211_parse_key(info, &key);
6804         if (err)
6805                 return err;
6806
6807         if (key.idx >= 0) {
6808                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6809                         return -EINVAL;
6810                 if (!key.p.key || !key.p.key_len)
6811                         return -EINVAL;
6812                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6813                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6814                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6815                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6816                         return -EINVAL;
6817                 if (key.idx > 4)
6818                         return -EINVAL;
6819         } else {
6820                 key.p.key_len = 0;
6821                 key.p.key = NULL;
6822         }
6823
6824         if (key.idx >= 0) {
6825                 int i;
6826                 bool ok = false;
6827                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6828                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6829                                 ok = true;
6830                                 break;
6831                         }
6832                 }
6833                 if (!ok)
6834                         return -EINVAL;
6835         }
6836
6837         if (!rdev->ops->auth)
6838                 return -EOPNOTSUPP;
6839
6840         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6841             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6842                 return -EOPNOTSUPP;
6843
6844         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6845         chan = nl80211_get_valid_chan(&rdev->wiphy,
6846                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6847         if (!chan)
6848                 return -EINVAL;
6849
6850         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6851         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6852
6853         if (info->attrs[NL80211_ATTR_IE]) {
6854                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6855                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6856         }
6857
6858         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6859         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6860                 return -EINVAL;
6861
6862         if (auth_type == NL80211_AUTHTYPE_SAE &&
6863             !info->attrs[NL80211_ATTR_SAE_DATA])
6864                 return -EINVAL;
6865
6866         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6867                 if (auth_type != NL80211_AUTHTYPE_SAE)
6868                         return -EINVAL;
6869                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6870                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6871                 /* need to include at least Auth Transaction and Status Code */
6872                 if (sae_data_len < 4)
6873                         return -EINVAL;
6874         }
6875
6876         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6877
6878         /*
6879          * Since we no longer track auth state, ignore
6880          * requests to only change local state.
6881          */
6882         if (local_state_change)
6883                 return 0;
6884
6885         wdev_lock(dev->ieee80211_ptr);
6886         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6887                                  ssid, ssid_len, ie, ie_len,
6888                                  key.p.key, key.p.key_len, key.idx,
6889                                  sae_data, sae_data_len);
6890         wdev_unlock(dev->ieee80211_ptr);
6891         return err;
6892 }
6893
6894 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6895                                    struct genl_info *info,
6896                                    struct cfg80211_crypto_settings *settings,
6897                                    int cipher_limit)
6898 {
6899         memset(settings, 0, sizeof(*settings));
6900
6901         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6902
6903         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6904                 u16 proto;
6905                 proto = nla_get_u16(
6906                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6907                 settings->control_port_ethertype = cpu_to_be16(proto);
6908                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6909                     proto != ETH_P_PAE)
6910                         return -EINVAL;
6911                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6912                         settings->control_port_no_encrypt = true;
6913         } else
6914                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6915
6916         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6917                 void *data;
6918                 int len, i;
6919
6920                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6921                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6922                 settings->n_ciphers_pairwise = len / sizeof(u32);
6923
6924                 if (len % sizeof(u32))
6925                         return -EINVAL;
6926
6927                 if (settings->n_ciphers_pairwise > cipher_limit)
6928                         return -EINVAL;
6929
6930                 memcpy(settings->ciphers_pairwise, data, len);
6931
6932                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6933                         if (!cfg80211_supported_cipher_suite(
6934                                         &rdev->wiphy,
6935                                         settings->ciphers_pairwise[i]))
6936                                 return -EINVAL;
6937         }
6938
6939         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6940                 settings->cipher_group =
6941                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6942                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6943                                                      settings->cipher_group))
6944                         return -EINVAL;
6945         }
6946
6947         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6948                 settings->wpa_versions =
6949                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6950                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6951                         return -EINVAL;
6952         }
6953
6954         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6955                 void *data;
6956                 int len;
6957
6958                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6959                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6960                 settings->n_akm_suites = len / sizeof(u32);
6961
6962                 if (len % sizeof(u32))
6963                         return -EINVAL;
6964
6965                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6966                         return -EINVAL;
6967
6968                 memcpy(settings->akm_suites, data, len);
6969         }
6970
6971         return 0;
6972 }
6973
6974 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6975 {
6976         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6977         struct net_device *dev = info->user_ptr[1];
6978         struct ieee80211_channel *chan;
6979         struct cfg80211_assoc_request req = {};
6980         const u8 *bssid, *ssid;
6981         int err, ssid_len = 0;
6982
6983         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6984                 return -EINVAL;
6985
6986         if (!info->attrs[NL80211_ATTR_MAC] ||
6987             !info->attrs[NL80211_ATTR_SSID] ||
6988             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6989                 return -EINVAL;
6990
6991         if (!rdev->ops->assoc)
6992                 return -EOPNOTSUPP;
6993
6994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6996                 return -EOPNOTSUPP;
6997
6998         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6999
7000         chan = nl80211_get_valid_chan(&rdev->wiphy,
7001                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7002         if (!chan)
7003                 return -EINVAL;
7004
7005         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7006         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7007
7008         if (info->attrs[NL80211_ATTR_IE]) {
7009                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7010                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7011         }
7012
7013         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7014                 enum nl80211_mfp mfp =
7015                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7016                 if (mfp == NL80211_MFP_REQUIRED)
7017                         req.use_mfp = true;
7018                 else if (mfp != NL80211_MFP_NO)
7019                         return -EINVAL;
7020         }
7021
7022         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7023                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7024
7025         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7026                 req.flags |= ASSOC_REQ_DISABLE_HT;
7027
7028         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7029                 memcpy(&req.ht_capa_mask,
7030                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7031                        sizeof(req.ht_capa_mask));
7032
7033         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7034                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7035                         return -EINVAL;
7036                 memcpy(&req.ht_capa,
7037                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7038                        sizeof(req.ht_capa));
7039         }
7040
7041         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7042                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7043
7044         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7045                 memcpy(&req.vht_capa_mask,
7046                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7047                        sizeof(req.vht_capa_mask));
7048
7049         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7050                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7051                         return -EINVAL;
7052                 memcpy(&req.vht_capa,
7053                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7054                        sizeof(req.vht_capa));
7055         }
7056
7057         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7058                 if (!(rdev->wiphy.features &
7059                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7060                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7061                         return -EINVAL;
7062                 req.flags |= ASSOC_REQ_USE_RRM;
7063         }
7064
7065         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7066         if (!err) {
7067                 wdev_lock(dev->ieee80211_ptr);
7068                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7069                                           ssid, ssid_len, &req);
7070                 wdev_unlock(dev->ieee80211_ptr);
7071         }
7072
7073         return err;
7074 }
7075
7076 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7077 {
7078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7079         struct net_device *dev = info->user_ptr[1];
7080         const u8 *ie = NULL, *bssid;
7081         int ie_len = 0, err;
7082         u16 reason_code;
7083         bool local_state_change;
7084
7085         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7086                 return -EINVAL;
7087
7088         if (!info->attrs[NL80211_ATTR_MAC])
7089                 return -EINVAL;
7090
7091         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7092                 return -EINVAL;
7093
7094         if (!rdev->ops->deauth)
7095                 return -EOPNOTSUPP;
7096
7097         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7098             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7099                 return -EOPNOTSUPP;
7100
7101         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7102
7103         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7104         if (reason_code == 0) {
7105                 /* Reason Code 0 is reserved */
7106                 return -EINVAL;
7107         }
7108
7109         if (info->attrs[NL80211_ATTR_IE]) {
7110                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7111                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7112         }
7113
7114         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7115
7116         wdev_lock(dev->ieee80211_ptr);
7117         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7118                                    local_state_change);
7119         wdev_unlock(dev->ieee80211_ptr);
7120         return err;
7121 }
7122
7123 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7124 {
7125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7126         struct net_device *dev = info->user_ptr[1];
7127         const u8 *ie = NULL, *bssid;
7128         int ie_len = 0, err;
7129         u16 reason_code;
7130         bool local_state_change;
7131
7132         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7133                 return -EINVAL;
7134
7135         if (!info->attrs[NL80211_ATTR_MAC])
7136                 return -EINVAL;
7137
7138         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7139                 return -EINVAL;
7140
7141         if (!rdev->ops->disassoc)
7142                 return -EOPNOTSUPP;
7143
7144         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7145             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7146                 return -EOPNOTSUPP;
7147
7148         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7149
7150         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7151         if (reason_code == 0) {
7152                 /* Reason Code 0 is reserved */
7153                 return -EINVAL;
7154         }
7155
7156         if (info->attrs[NL80211_ATTR_IE]) {
7157                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7158                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7159         }
7160
7161         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7162
7163         wdev_lock(dev->ieee80211_ptr);
7164         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7165                                      local_state_change);
7166         wdev_unlock(dev->ieee80211_ptr);
7167         return err;
7168 }
7169
7170 static bool
7171 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7172                          int mcast_rate[IEEE80211_NUM_BANDS],
7173                          int rateval)
7174 {
7175         struct wiphy *wiphy = &rdev->wiphy;
7176         bool found = false;
7177         int band, i;
7178
7179         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7180                 struct ieee80211_supported_band *sband;
7181
7182                 sband = wiphy->bands[band];
7183                 if (!sband)
7184                         continue;
7185
7186                 for (i = 0; i < sband->n_bitrates; i++) {
7187                         if (sband->bitrates[i].bitrate == rateval) {
7188                                 mcast_rate[band] = i + 1;
7189                                 found = true;
7190                                 break;
7191                         }
7192                 }
7193         }
7194
7195         return found;
7196 }
7197
7198 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7199 {
7200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7201         struct net_device *dev = info->user_ptr[1];
7202         struct cfg80211_ibss_params ibss;
7203         struct wiphy *wiphy;
7204         struct cfg80211_cached_keys *connkeys = NULL;
7205         int err;
7206
7207         memset(&ibss, 0, sizeof(ibss));
7208
7209         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7210                 return -EINVAL;
7211
7212         if (!info->attrs[NL80211_ATTR_SSID] ||
7213             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7214                 return -EINVAL;
7215
7216         ibss.beacon_interval = 100;
7217
7218         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7219                 ibss.beacon_interval =
7220                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7221                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7222                         return -EINVAL;
7223         }
7224
7225         if (!rdev->ops->join_ibss)
7226                 return -EOPNOTSUPP;
7227
7228         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7229                 return -EOPNOTSUPP;
7230
7231         wiphy = &rdev->wiphy;
7232
7233         if (info->attrs[NL80211_ATTR_MAC]) {
7234                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7235
7236                 if (!is_valid_ether_addr(ibss.bssid))
7237                         return -EINVAL;
7238         }
7239         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7240         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7241
7242         if (info->attrs[NL80211_ATTR_IE]) {
7243                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7244                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7245         }
7246
7247         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7248         if (err)
7249                 return err;
7250
7251         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7252                                      NL80211_IFTYPE_ADHOC))
7253                 return -EINVAL;
7254
7255         switch (ibss.chandef.width) {
7256         case NL80211_CHAN_WIDTH_5:
7257         case NL80211_CHAN_WIDTH_10:
7258         case NL80211_CHAN_WIDTH_20_NOHT:
7259                 break;
7260         case NL80211_CHAN_WIDTH_20:
7261         case NL80211_CHAN_WIDTH_40:
7262                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
7263                         break;
7264         default:
7265                 return -EINVAL;
7266         }
7267
7268         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7269         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7270
7271         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7272                 u8 *rates =
7273                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7274                 int n_rates =
7275                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7276                 struct ieee80211_supported_band *sband =
7277                         wiphy->bands[ibss.chandef.chan->band];
7278
7279                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7280                                              &ibss.basic_rates);
7281                 if (err)
7282                         return err;
7283         }
7284
7285         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7286                 memcpy(&ibss.ht_capa_mask,
7287                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7288                        sizeof(ibss.ht_capa_mask));
7289
7290         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7291                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7292                         return -EINVAL;
7293                 memcpy(&ibss.ht_capa,
7294                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7295                        sizeof(ibss.ht_capa));
7296         }
7297
7298         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7299             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7300                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7301                 return -EINVAL;
7302
7303         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7304                 bool no_ht = false;
7305
7306                 connkeys = nl80211_parse_connkeys(rdev,
7307                                           info->attrs[NL80211_ATTR_KEYS],
7308                                           &no_ht);
7309                 if (IS_ERR(connkeys))
7310                         return PTR_ERR(connkeys);
7311
7312                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7313                     no_ht) {
7314                         kfree(connkeys);
7315                         return -EINVAL;
7316                 }
7317         }
7318
7319         ibss.control_port =
7320                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7321
7322         ibss.userspace_handles_dfs =
7323                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7324
7325         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7326         if (err)
7327                 kzfree(connkeys);
7328         return err;
7329 }
7330
7331 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7332 {
7333         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7334         struct net_device *dev = info->user_ptr[1];
7335
7336         if (!rdev->ops->leave_ibss)
7337                 return -EOPNOTSUPP;
7338
7339         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7340                 return -EOPNOTSUPP;
7341
7342         return cfg80211_leave_ibss(rdev, dev, false);
7343 }
7344
7345 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7346 {
7347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7348         struct net_device *dev = info->user_ptr[1];
7349         int mcast_rate[IEEE80211_NUM_BANDS];
7350         u32 nla_rate;
7351         int err;
7352
7353         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7354             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7355                 return -EOPNOTSUPP;
7356
7357         if (!rdev->ops->set_mcast_rate)
7358                 return -EOPNOTSUPP;
7359
7360         memset(mcast_rate, 0, sizeof(mcast_rate));
7361
7362         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7363                 return -EINVAL;
7364
7365         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7366         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7367                 return -EINVAL;
7368
7369         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7370
7371         return err;
7372 }
7373
7374 static struct sk_buff *
7375 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7376                             int approxlen, u32 portid, u32 seq,
7377                             enum nl80211_commands cmd,
7378                             enum nl80211_attrs attr,
7379                             const struct nl80211_vendor_cmd_info *info,
7380                             gfp_t gfp)
7381 {
7382         struct sk_buff *skb;
7383         void *hdr;
7384         struct nlattr *data;
7385
7386         skb = nlmsg_new(approxlen + 100, gfp);
7387         if (!skb)
7388                 return NULL;
7389
7390         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7391         if (!hdr) {
7392                 kfree_skb(skb);
7393                 return NULL;
7394         }
7395
7396         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7397                 goto nla_put_failure;
7398
7399         if (info) {
7400                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7401                                 info->vendor_id))
7402                         goto nla_put_failure;
7403                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7404                                 info->subcmd))
7405                         goto nla_put_failure;
7406         }
7407
7408         data = nla_nest_start(skb, attr);
7409
7410         ((void **)skb->cb)[0] = rdev;
7411         ((void **)skb->cb)[1] = hdr;
7412         ((void **)skb->cb)[2] = data;
7413
7414         return skb;
7415
7416  nla_put_failure:
7417         kfree_skb(skb);
7418         return NULL;
7419 }
7420
7421 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7422                                            enum nl80211_commands cmd,
7423                                            enum nl80211_attrs attr,
7424                                            int vendor_event_idx,
7425                                            int approxlen, gfp_t gfp)
7426 {
7427         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7428         const struct nl80211_vendor_cmd_info *info;
7429
7430         switch (cmd) {
7431         case NL80211_CMD_TESTMODE:
7432                 if (WARN_ON(vendor_event_idx != -1))
7433                         return NULL;
7434                 info = NULL;
7435                 break;
7436         case NL80211_CMD_VENDOR:
7437                 if (WARN_ON(vendor_event_idx < 0 ||
7438                             vendor_event_idx >= wiphy->n_vendor_events))
7439                         return NULL;
7440                 info = &wiphy->vendor_events[vendor_event_idx];
7441                 break;
7442         default:
7443                 WARN_ON(1);
7444                 return NULL;
7445         }
7446
7447         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7448                                            cmd, attr, info, gfp);
7449 }
7450 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7451
7452 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7453 {
7454         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7455         void *hdr = ((void **)skb->cb)[1];
7456         struct nlattr *data = ((void **)skb->cb)[2];
7457         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7458
7459         /* clear CB data for netlink core to own from now on */
7460         memset(skb->cb, 0, sizeof(skb->cb));
7461
7462         nla_nest_end(skb, data);
7463         genlmsg_end(skb, hdr);
7464
7465         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7466                 mcgrp = NL80211_MCGRP_VENDOR;
7467
7468         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7469                                 mcgrp, gfp);
7470 }
7471 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7472
7473 #ifdef CONFIG_NL80211_TESTMODE
7474 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7475 {
7476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7477         struct wireless_dev *wdev =
7478                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7479         int err;
7480
7481         if (!rdev->ops->testmode_cmd)
7482                 return -EOPNOTSUPP;
7483
7484         if (IS_ERR(wdev)) {
7485                 err = PTR_ERR(wdev);
7486                 if (err != -EINVAL)
7487                         return err;
7488                 wdev = NULL;
7489         } else if (wdev->wiphy != &rdev->wiphy) {
7490                 return -EINVAL;
7491         }
7492
7493         if (!info->attrs[NL80211_ATTR_TESTDATA])
7494                 return -EINVAL;
7495
7496         rdev->cur_cmd_info = info;
7497         err = rdev_testmode_cmd(rdev, wdev,
7498                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7499                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7500         rdev->cur_cmd_info = NULL;
7501
7502         return err;
7503 }
7504
7505 static int nl80211_testmode_dump(struct sk_buff *skb,
7506                                  struct netlink_callback *cb)
7507 {
7508         struct cfg80211_registered_device *rdev;
7509         int err;
7510         long phy_idx;
7511         void *data = NULL;
7512         int data_len = 0;
7513
7514         rtnl_lock();
7515
7516         if (cb->args[0]) {
7517                 /*
7518                  * 0 is a valid index, but not valid for args[0],
7519                  * so we need to offset by 1.
7520                  */
7521                 phy_idx = cb->args[0] - 1;
7522         } else {
7523                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7524                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7525                                   nl80211_policy);
7526                 if (err)
7527                         goto out_err;
7528
7529                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7530                                                   nl80211_fam.attrbuf);
7531                 if (IS_ERR(rdev)) {
7532                         err = PTR_ERR(rdev);
7533                         goto out_err;
7534                 }
7535                 phy_idx = rdev->wiphy_idx;
7536                 rdev = NULL;
7537
7538                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7539                         cb->args[1] =
7540                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7541         }
7542
7543         if (cb->args[1]) {
7544                 data = nla_data((void *)cb->args[1]);
7545                 data_len = nla_len((void *)cb->args[1]);
7546         }
7547
7548         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7549         if (!rdev) {
7550                 err = -ENOENT;
7551                 goto out_err;
7552         }
7553
7554         if (!rdev->ops->testmode_dump) {
7555                 err = -EOPNOTSUPP;
7556                 goto out_err;
7557         }
7558
7559         while (1) {
7560                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7561                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7562                                            NL80211_CMD_TESTMODE);
7563                 struct nlattr *tmdata;
7564
7565                 if (!hdr)
7566                         break;
7567
7568                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7569                         genlmsg_cancel(skb, hdr);
7570                         break;
7571                 }
7572
7573                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7574                 if (!tmdata) {
7575                         genlmsg_cancel(skb, hdr);
7576                         break;
7577                 }
7578                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7579                 nla_nest_end(skb, tmdata);
7580
7581                 if (err == -ENOBUFS || err == -ENOENT) {
7582                         genlmsg_cancel(skb, hdr);
7583                         break;
7584                 } else if (err) {
7585                         genlmsg_cancel(skb, hdr);
7586                         goto out_err;
7587                 }
7588
7589                 genlmsg_end(skb, hdr);
7590         }
7591
7592         err = skb->len;
7593         /* see above */
7594         cb->args[0] = phy_idx + 1;
7595  out_err:
7596         rtnl_unlock();
7597         return err;
7598 }
7599 #endif
7600
7601 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7602 {
7603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7604         struct net_device *dev = info->user_ptr[1];
7605         struct cfg80211_connect_params connect;
7606         struct wiphy *wiphy;
7607         struct cfg80211_cached_keys *connkeys = NULL;
7608         int err;
7609
7610         memset(&connect, 0, sizeof(connect));
7611
7612         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7613                 return -EINVAL;
7614
7615         if (!info->attrs[NL80211_ATTR_SSID] ||
7616             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7617                 return -EINVAL;
7618
7619         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7620                 connect.auth_type =
7621                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7622                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7623                                              NL80211_CMD_CONNECT))
7624                         return -EINVAL;
7625         } else
7626                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7627
7628         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7629
7630         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7631                                       NL80211_MAX_NR_CIPHER_SUITES);
7632         if (err)
7633                 return err;
7634
7635         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7636             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7637                 return -EOPNOTSUPP;
7638
7639         wiphy = &rdev->wiphy;
7640
7641         connect.bg_scan_period = -1;
7642         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7643                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7644                 connect.bg_scan_period =
7645                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7646         }
7647
7648         if (info->attrs[NL80211_ATTR_MAC])
7649                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7650         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7651                 connect.bssid_hint =
7652                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7653         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7654         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7655
7656         if (info->attrs[NL80211_ATTR_IE]) {
7657                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7658                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7659         }
7660
7661         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7662                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7663                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7664                     connect.mfp != NL80211_MFP_NO)
7665                         return -EINVAL;
7666         } else {
7667                 connect.mfp = NL80211_MFP_NO;
7668         }
7669
7670         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7671                 connect.channel = nl80211_get_valid_chan(
7672                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7673                 if (!connect.channel)
7674                         return -EINVAL;
7675         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7676                 connect.channel_hint = nl80211_get_valid_chan(
7677                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7678                 if (!connect.channel_hint)
7679                         return -EINVAL;
7680         }
7681
7682         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7683                 connkeys = nl80211_parse_connkeys(rdev,
7684                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7685                 if (IS_ERR(connkeys))
7686                         return PTR_ERR(connkeys);
7687         }
7688
7689         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7690                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7691
7692         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7693                 memcpy(&connect.ht_capa_mask,
7694                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7695                        sizeof(connect.ht_capa_mask));
7696
7697         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7698                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7699                         kzfree(connkeys);
7700                         return -EINVAL;
7701                 }
7702                 memcpy(&connect.ht_capa,
7703                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7704                        sizeof(connect.ht_capa));
7705         }
7706
7707         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7708                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7709
7710         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7711                 memcpy(&connect.vht_capa_mask,
7712                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7713                        sizeof(connect.vht_capa_mask));
7714
7715         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7716                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7717                         kzfree(connkeys);
7718                         return -EINVAL;
7719                 }
7720                 memcpy(&connect.vht_capa,
7721                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7722                        sizeof(connect.vht_capa));
7723         }
7724
7725         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7726                 if (!(rdev->wiphy.features &
7727                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7728                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7729                         return -EINVAL;
7730                 connect.flags |= ASSOC_REQ_USE_RRM;
7731         }
7732
7733         wdev_lock(dev->ieee80211_ptr);
7734         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7735         wdev_unlock(dev->ieee80211_ptr);
7736         if (err)
7737                 kzfree(connkeys);
7738         return err;
7739 }
7740
7741 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7742 {
7743         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7744         struct net_device *dev = info->user_ptr[1];
7745         u16 reason;
7746         int ret;
7747
7748         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7749                 reason = WLAN_REASON_DEAUTH_LEAVING;
7750         else
7751                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7752
7753         if (reason == 0)
7754                 return -EINVAL;
7755
7756         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7757             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7758                 return -EOPNOTSUPP;
7759
7760         wdev_lock(dev->ieee80211_ptr);
7761         ret = cfg80211_disconnect(rdev, dev, reason, true);
7762         wdev_unlock(dev->ieee80211_ptr);
7763         return ret;
7764 }
7765
7766 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7767 {
7768         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7769         struct net *net;
7770         int err;
7771         u32 pid;
7772
7773         if (!info->attrs[NL80211_ATTR_PID])
7774                 return -EINVAL;
7775
7776         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7777
7778         net = get_net_ns_by_pid(pid);
7779         if (IS_ERR(net))
7780                 return PTR_ERR(net);
7781
7782         err = 0;
7783
7784         /* check if anything to do */
7785         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7786                 err = cfg80211_switch_netns(rdev, net);
7787
7788         put_net(net);
7789         return err;
7790 }
7791
7792 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7793 {
7794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7795         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7796                         struct cfg80211_pmksa *pmksa) = NULL;
7797         struct net_device *dev = info->user_ptr[1];
7798         struct cfg80211_pmksa pmksa;
7799
7800         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7801
7802         if (!info->attrs[NL80211_ATTR_MAC])
7803                 return -EINVAL;
7804
7805         if (!info->attrs[NL80211_ATTR_PMKID])
7806                 return -EINVAL;
7807
7808         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7809         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7810
7811         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7812             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7813                 return -EOPNOTSUPP;
7814
7815         switch (info->genlhdr->cmd) {
7816         case NL80211_CMD_SET_PMKSA:
7817                 rdev_ops = rdev->ops->set_pmksa;
7818                 break;
7819         case NL80211_CMD_DEL_PMKSA:
7820                 rdev_ops = rdev->ops->del_pmksa;
7821                 break;
7822         default:
7823                 WARN_ON(1);
7824                 break;
7825         }
7826
7827         if (!rdev_ops)
7828                 return -EOPNOTSUPP;
7829
7830         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7831 }
7832
7833 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7834 {
7835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7836         struct net_device *dev = info->user_ptr[1];
7837
7838         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7839             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7840                 return -EOPNOTSUPP;
7841
7842         if (!rdev->ops->flush_pmksa)
7843                 return -EOPNOTSUPP;
7844
7845         return rdev_flush_pmksa(rdev, dev);
7846 }
7847
7848 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7849 {
7850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7851         struct net_device *dev = info->user_ptr[1];
7852         u8 action_code, dialog_token;
7853         u32 peer_capability = 0;
7854         u16 status_code;
7855         u8 *peer;
7856         bool initiator;
7857
7858         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7859             !rdev->ops->tdls_mgmt)
7860                 return -EOPNOTSUPP;
7861
7862         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7863             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7864             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7865             !info->attrs[NL80211_ATTR_IE] ||
7866             !info->attrs[NL80211_ATTR_MAC])
7867                 return -EINVAL;
7868
7869         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7870         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7871         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7872         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7873         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7874         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7875                 peer_capability =
7876                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7877
7878         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7879                               dialog_token, status_code, peer_capability,
7880                               initiator,
7881                               nla_data(info->attrs[NL80211_ATTR_IE]),
7882                               nla_len(info->attrs[NL80211_ATTR_IE]));
7883 }
7884
7885 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7886 {
7887         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7888         struct net_device *dev = info->user_ptr[1];
7889         enum nl80211_tdls_operation operation;
7890         u8 *peer;
7891
7892         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7893             !rdev->ops->tdls_oper)
7894                 return -EOPNOTSUPP;
7895
7896         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7897             !info->attrs[NL80211_ATTR_MAC])
7898                 return -EINVAL;
7899
7900         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7901         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7902
7903         return rdev_tdls_oper(rdev, dev, peer, operation);
7904 }
7905
7906 static int nl80211_remain_on_channel(struct sk_buff *skb,
7907                                      struct genl_info *info)
7908 {
7909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7910         struct wireless_dev *wdev = info->user_ptr[1];
7911         struct cfg80211_chan_def chandef;
7912         struct sk_buff *msg;
7913         void *hdr;
7914         u64 cookie;
7915         u32 duration;
7916         int err;
7917
7918         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7919             !info->attrs[NL80211_ATTR_DURATION])
7920                 return -EINVAL;
7921
7922         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7923
7924         if (!rdev->ops->remain_on_channel ||
7925             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7926                 return -EOPNOTSUPP;
7927
7928         /*
7929          * We should be on that channel for at least a minimum amount of
7930          * time (10ms) but no longer than the driver supports.
7931          */
7932         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7933             duration > rdev->wiphy.max_remain_on_channel_duration)
7934                 return -EINVAL;
7935
7936         err = nl80211_parse_chandef(rdev, info, &chandef);
7937         if (err)
7938                 return err;
7939
7940         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7941         if (!msg)
7942                 return -ENOMEM;
7943
7944         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7945                              NL80211_CMD_REMAIN_ON_CHANNEL);
7946         if (!hdr) {
7947                 err = -ENOBUFS;
7948                 goto free_msg;
7949         }
7950
7951         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7952                                      duration, &cookie);
7953
7954         if (err)
7955                 goto free_msg;
7956
7957         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7958                 goto nla_put_failure;
7959
7960         genlmsg_end(msg, hdr);
7961
7962         return genlmsg_reply(msg, info);
7963
7964  nla_put_failure:
7965         err = -ENOBUFS;
7966  free_msg:
7967         nlmsg_free(msg);
7968         return err;
7969 }
7970
7971 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7972                                             struct genl_info *info)
7973 {
7974         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7975         struct wireless_dev *wdev = info->user_ptr[1];
7976         u64 cookie;
7977
7978         if (!info->attrs[NL80211_ATTR_COOKIE])
7979                 return -EINVAL;
7980
7981         if (!rdev->ops->cancel_remain_on_channel)
7982                 return -EOPNOTSUPP;
7983
7984         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7985
7986         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7987 }
7988
7989 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7990                            u8 *rates, u8 rates_len)
7991 {
7992         u8 i;
7993         u32 mask = 0;
7994
7995         for (i = 0; i < rates_len; i++) {
7996                 int rate = (rates[i] & 0x7f) * 5;
7997                 int ridx;
7998                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7999                         struct ieee80211_rate *srate =
8000                                 &sband->bitrates[ridx];
8001                         if (rate == srate->bitrate) {
8002                                 mask |= 1 << ridx;
8003                                 break;
8004                         }
8005                 }
8006                 if (ridx == sband->n_bitrates)
8007                         return 0; /* rate not found */
8008         }
8009
8010         return mask;
8011 }
8012
8013 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8014                                u8 *rates, u8 rates_len,
8015                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8016 {
8017         u8 i;
8018
8019         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8020
8021         for (i = 0; i < rates_len; i++) {
8022                 int ridx, rbit;
8023
8024                 ridx = rates[i] / 8;
8025                 rbit = BIT(rates[i] % 8);
8026
8027                 /* check validity */
8028                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8029                         return false;
8030
8031                 /* check availability */
8032                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8033                         mcs[ridx] |= rbit;
8034                 else
8035                         return false;
8036         }
8037
8038         return true;
8039 }
8040
8041 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8042 {
8043         u16 mcs_mask = 0;
8044
8045         switch (vht_mcs_map) {
8046         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8047                 break;
8048         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8049                 mcs_mask = 0x00FF;
8050                 break;
8051         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8052                 mcs_mask = 0x01FF;
8053                 break;
8054         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8055                 mcs_mask = 0x03FF;
8056                 break;
8057         default:
8058                 break;
8059         }
8060
8061         return mcs_mask;
8062 }
8063
8064 static void vht_build_mcs_mask(u16 vht_mcs_map,
8065                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8066 {
8067         u8 nss;
8068
8069         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8070                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8071                 vht_mcs_map >>= 2;
8072         }
8073 }
8074
8075 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8076                              struct nl80211_txrate_vht *txrate,
8077                              u16 mcs[NL80211_VHT_NSS_MAX])
8078 {
8079         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8080         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8081         u8 i;
8082
8083         if (!sband->vht_cap.vht_supported)
8084                 return false;
8085
8086         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8087
8088         /* Build vht_mcs_mask from VHT capabilities */
8089         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8090
8091         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8092                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8093                         mcs[i] = txrate->mcs[i];
8094                 else
8095                         return false;
8096         }
8097
8098         return true;
8099 }
8100
8101 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8102         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8103                                     .len = NL80211_MAX_SUPP_RATES },
8104         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8105                                 .len = NL80211_MAX_SUPP_HT_RATES },
8106         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8107         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8108 };
8109
8110 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8111                                        struct genl_info *info)
8112 {
8113         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8114         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8115         struct cfg80211_bitrate_mask mask;
8116         int rem, i;
8117         struct net_device *dev = info->user_ptr[1];
8118         struct nlattr *tx_rates;
8119         struct ieee80211_supported_band *sband;
8120         u16 vht_tx_mcs_map;
8121
8122         if (!rdev->ops->set_bitrate_mask)
8123                 return -EOPNOTSUPP;
8124
8125         memset(&mask, 0, sizeof(mask));
8126         /* Default to all rates enabled */
8127         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
8128                 sband = rdev->wiphy.bands[i];
8129
8130                 if (!sband)
8131                         continue;
8132
8133                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8134                 memcpy(mask.control[i].ht_mcs,
8135                        sband->ht_cap.mcs.rx_mask,
8136                        sizeof(mask.control[i].ht_mcs));
8137
8138                 if (!sband->vht_cap.vht_supported)
8139                         continue;
8140
8141                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8142                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8143         }
8144
8145         /* if no rates are given set it back to the defaults */
8146         if (!info->attrs[NL80211_ATTR_TX_RATES])
8147                 goto out;
8148
8149         /*
8150          * The nested attribute uses enum nl80211_band as the index. This maps
8151          * directly to the enum ieee80211_band values used in cfg80211.
8152          */
8153         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8154         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8155                 enum ieee80211_band band = nla_type(tx_rates);
8156                 int err;
8157
8158                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
8159                         return -EINVAL;
8160                 sband = rdev->wiphy.bands[band];
8161                 if (sband == NULL)
8162                         return -EINVAL;
8163                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8164                                 nla_len(tx_rates), nl80211_txattr_policy);
8165                 if (err)
8166                         return err;
8167                 if (tb[NL80211_TXRATE_LEGACY]) {
8168                         mask.control[band].legacy = rateset_to_mask(
8169                                 sband,
8170                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8171                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8172                         if ((mask.control[band].legacy == 0) &&
8173                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8174                                 return -EINVAL;
8175                 }
8176                 if (tb[NL80211_TXRATE_HT]) {
8177                         if (!ht_rateset_to_mask(
8178                                         sband,
8179                                         nla_data(tb[NL80211_TXRATE_HT]),
8180                                         nla_len(tb[NL80211_TXRATE_HT]),
8181                                         mask.control[band].ht_mcs))
8182                                 return -EINVAL;
8183                 }
8184                 if (tb[NL80211_TXRATE_VHT]) {
8185                         if (!vht_set_mcs_mask(
8186                                         sband,
8187                                         nla_data(tb[NL80211_TXRATE_VHT]),
8188                                         mask.control[band].vht_mcs))
8189                                 return -EINVAL;
8190                 }
8191                 if (tb[NL80211_TXRATE_GI]) {
8192                         mask.control[band].gi =
8193                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8194                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8195                                 return -EINVAL;
8196                 }
8197
8198                 if (mask.control[band].legacy == 0) {
8199                         /* don't allow empty legacy rates if HT or VHT
8200                          * are not even supported.
8201                          */
8202                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8203                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8204                                 return -EINVAL;
8205
8206                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8207                                 if (mask.control[band].ht_mcs[i])
8208                                         goto out;
8209
8210                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8211                                 if (mask.control[band].vht_mcs[i])
8212                                         goto out;
8213
8214                         /* legacy and mcs rates may not be both empty */
8215                         return -EINVAL;
8216                 }
8217         }
8218
8219 out:
8220         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8221 }
8222
8223 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8224 {
8225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8226         struct wireless_dev *wdev = info->user_ptr[1];
8227         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8228
8229         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8230                 return -EINVAL;
8231
8232         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8233                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8234
8235         switch (wdev->iftype) {
8236         case NL80211_IFTYPE_STATION:
8237         case NL80211_IFTYPE_ADHOC:
8238         case NL80211_IFTYPE_P2P_CLIENT:
8239         case NL80211_IFTYPE_AP:
8240         case NL80211_IFTYPE_AP_VLAN:
8241         case NL80211_IFTYPE_MESH_POINT:
8242         case NL80211_IFTYPE_P2P_GO:
8243         case NL80211_IFTYPE_P2P_DEVICE:
8244                 break;
8245         default:
8246                 return -EOPNOTSUPP;
8247         }
8248
8249         /* not much point in registering if we can't reply */
8250         if (!rdev->ops->mgmt_tx)
8251                 return -EOPNOTSUPP;
8252
8253         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8254                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8255                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8256 }
8257
8258 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8259 {
8260         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8261         struct wireless_dev *wdev = info->user_ptr[1];
8262         struct cfg80211_chan_def chandef;
8263         int err;
8264         void *hdr = NULL;
8265         u64 cookie;
8266         struct sk_buff *msg = NULL;
8267         struct cfg80211_mgmt_tx_params params = {
8268                 .dont_wait_for_ack =
8269                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8270         };
8271
8272         if (!info->attrs[NL80211_ATTR_FRAME])
8273                 return -EINVAL;
8274
8275         if (!rdev->ops->mgmt_tx)
8276                 return -EOPNOTSUPP;
8277
8278         switch (wdev->iftype) {
8279         case NL80211_IFTYPE_P2P_DEVICE:
8280                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8281                         return -EINVAL;
8282         case NL80211_IFTYPE_STATION:
8283         case NL80211_IFTYPE_ADHOC:
8284         case NL80211_IFTYPE_P2P_CLIENT:
8285         case NL80211_IFTYPE_AP:
8286         case NL80211_IFTYPE_AP_VLAN:
8287         case NL80211_IFTYPE_MESH_POINT:
8288         case NL80211_IFTYPE_P2P_GO:
8289                 break;
8290         default:
8291                 return -EOPNOTSUPP;
8292         }
8293
8294         if (info->attrs[NL80211_ATTR_DURATION]) {
8295                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8296                         return -EINVAL;
8297                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8298
8299                 /*
8300                  * We should wait on the channel for at least a minimum amount
8301                  * of time (10ms) but no longer than the driver supports.
8302                  */
8303                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8304                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8305                         return -EINVAL;
8306
8307         }
8308
8309         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8310
8311         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8312                 return -EINVAL;
8313
8314         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8315
8316         /* get the channel if any has been specified, otherwise pass NULL to
8317          * the driver. The latter will use the current one
8318          */
8319         chandef.chan = NULL;
8320         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8321                 err = nl80211_parse_chandef(rdev, info, &chandef);
8322                 if (err)
8323                         return err;
8324         }
8325
8326         if (!chandef.chan && params.offchan)
8327                 return -EINVAL;
8328
8329         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8330         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8331
8332         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8333                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8334                 int i;
8335
8336                 if (len % sizeof(u16))
8337                         return -EINVAL;
8338
8339                 params.n_csa_offsets = len / sizeof(u16);
8340                 params.csa_offsets =
8341                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8342
8343                 /* check that all the offsets fit the frame */
8344                 for (i = 0; i < params.n_csa_offsets; i++) {
8345                         if (params.csa_offsets[i] >= params.len)
8346                                 return -EINVAL;
8347                 }
8348         }
8349
8350         if (!params.dont_wait_for_ack) {
8351                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8352                 if (!msg)
8353                         return -ENOMEM;
8354
8355                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8356                                      NL80211_CMD_FRAME);
8357                 if (!hdr) {
8358                         err = -ENOBUFS;
8359                         goto free_msg;
8360                 }
8361         }
8362
8363         params.chan = chandef.chan;
8364         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8365         if (err)
8366                 goto free_msg;
8367
8368         if (msg) {
8369                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8370                         goto nla_put_failure;
8371
8372                 genlmsg_end(msg, hdr);
8373                 return genlmsg_reply(msg, info);
8374         }
8375
8376         return 0;
8377
8378  nla_put_failure:
8379         err = -ENOBUFS;
8380  free_msg:
8381         nlmsg_free(msg);
8382         return err;
8383 }
8384
8385 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8386 {
8387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8388         struct wireless_dev *wdev = info->user_ptr[1];
8389         u64 cookie;
8390
8391         if (!info->attrs[NL80211_ATTR_COOKIE])
8392                 return -EINVAL;
8393
8394         if (!rdev->ops->mgmt_tx_cancel_wait)
8395                 return -EOPNOTSUPP;
8396
8397         switch (wdev->iftype) {
8398         case NL80211_IFTYPE_STATION:
8399         case NL80211_IFTYPE_ADHOC:
8400         case NL80211_IFTYPE_P2P_CLIENT:
8401         case NL80211_IFTYPE_AP:
8402         case NL80211_IFTYPE_AP_VLAN:
8403         case NL80211_IFTYPE_P2P_GO:
8404         case NL80211_IFTYPE_P2P_DEVICE:
8405                 break;
8406         default:
8407                 return -EOPNOTSUPP;
8408         }
8409
8410         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8411
8412         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8413 }
8414
8415 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8416 {
8417         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8418         struct wireless_dev *wdev;
8419         struct net_device *dev = info->user_ptr[1];
8420         u8 ps_state;
8421         bool state;
8422         int err;
8423
8424         if (!info->attrs[NL80211_ATTR_PS_STATE])
8425                 return -EINVAL;
8426
8427         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8428
8429         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8430                 return -EINVAL;
8431
8432         wdev = dev->ieee80211_ptr;
8433
8434         if (!rdev->ops->set_power_mgmt)
8435                 return -EOPNOTSUPP;
8436
8437         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8438
8439         if (state == wdev->ps)
8440                 return 0;
8441
8442         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8443         if (!err)
8444                 wdev->ps = state;
8445         return err;
8446 }
8447
8448 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8449 {
8450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8451         enum nl80211_ps_state ps_state;
8452         struct wireless_dev *wdev;
8453         struct net_device *dev = info->user_ptr[1];
8454         struct sk_buff *msg;
8455         void *hdr;
8456         int err;
8457
8458         wdev = dev->ieee80211_ptr;
8459
8460         if (!rdev->ops->set_power_mgmt)
8461                 return -EOPNOTSUPP;
8462
8463         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8464         if (!msg)
8465                 return -ENOMEM;
8466
8467         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8468                              NL80211_CMD_GET_POWER_SAVE);
8469         if (!hdr) {
8470                 err = -ENOBUFS;
8471                 goto free_msg;
8472         }
8473
8474         if (wdev->ps)
8475                 ps_state = NL80211_PS_ENABLED;
8476         else
8477                 ps_state = NL80211_PS_DISABLED;
8478
8479         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8480                 goto nla_put_failure;
8481
8482         genlmsg_end(msg, hdr);
8483         return genlmsg_reply(msg, info);
8484
8485  nla_put_failure:
8486         err = -ENOBUFS;
8487  free_msg:
8488         nlmsg_free(msg);
8489         return err;
8490 }
8491
8492 static const struct nla_policy
8493 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8494         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8495         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8496         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8497         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8498         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8499         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8500 };
8501
8502 static int nl80211_set_cqm_txe(struct genl_info *info,
8503                                u32 rate, u32 pkts, u32 intvl)
8504 {
8505         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8506         struct net_device *dev = info->user_ptr[1];
8507         struct wireless_dev *wdev = dev->ieee80211_ptr;
8508
8509         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8510                 return -EINVAL;
8511
8512         if (!rdev->ops->set_cqm_txe_config)
8513                 return -EOPNOTSUPP;
8514
8515         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8516             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8517                 return -EOPNOTSUPP;
8518
8519         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8520 }
8521
8522 static int nl80211_set_cqm_rssi(struct genl_info *info,
8523                                 s32 threshold, u32 hysteresis)
8524 {
8525         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8526         struct net_device *dev = info->user_ptr[1];
8527         struct wireless_dev *wdev = dev->ieee80211_ptr;
8528
8529         if (threshold > 0)
8530                 return -EINVAL;
8531
8532         /* disabling - hysteresis should also be zero then */
8533         if (threshold == 0)
8534                 hysteresis = 0;
8535
8536         if (!rdev->ops->set_cqm_rssi_config)
8537                 return -EOPNOTSUPP;
8538
8539         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8540             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8541                 return -EOPNOTSUPP;
8542
8543         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8544 }
8545
8546 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8547 {
8548         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8549         struct nlattr *cqm;
8550         int err;
8551
8552         cqm = info->attrs[NL80211_ATTR_CQM];
8553         if (!cqm)
8554                 return -EINVAL;
8555
8556         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8557                                nl80211_attr_cqm_policy);
8558         if (err)
8559                 return err;
8560
8561         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8562             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8563                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8564                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8565
8566                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8567         }
8568
8569         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8570             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8571             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8572                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8573                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8574                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8575
8576                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8577         }
8578
8579         return -EINVAL;
8580 }
8581
8582 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8583 {
8584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8585         struct net_device *dev = info->user_ptr[1];
8586         struct ocb_setup setup = {};
8587         int err;
8588
8589         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8590         if (err)
8591                 return err;
8592
8593         return cfg80211_join_ocb(rdev, dev, &setup);
8594 }
8595
8596 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8597 {
8598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8599         struct net_device *dev = info->user_ptr[1];
8600
8601         return cfg80211_leave_ocb(rdev, dev);
8602 }
8603
8604 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8605 {
8606         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8607         struct net_device *dev = info->user_ptr[1];
8608         struct mesh_config cfg;
8609         struct mesh_setup setup;
8610         int err;
8611
8612         /* start with default */
8613         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8614         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8615
8616         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8617                 /* and parse parameters if given */
8618                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8619                 if (err)
8620                         return err;
8621         }
8622
8623         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8624             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8625                 return -EINVAL;
8626
8627         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8628         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8629
8630         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8631             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8632                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8633                         return -EINVAL;
8634
8635         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8636                 setup.beacon_interval =
8637                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8638                 if (setup.beacon_interval < 10 ||
8639                     setup.beacon_interval > 10000)
8640                         return -EINVAL;
8641         }
8642
8643         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8644                 setup.dtim_period =
8645                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8646                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8647                         return -EINVAL;
8648         }
8649
8650         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8651                 /* parse additional setup parameters if given */
8652                 err = nl80211_parse_mesh_setup(info, &setup);
8653                 if (err)
8654                         return err;
8655         }
8656
8657         if (setup.user_mpm)
8658                 cfg.auto_open_plinks = false;
8659
8660         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8661                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8662                 if (err)
8663                         return err;
8664         } else {
8665                 /* cfg80211_join_mesh() will sort it out */
8666                 setup.chandef.chan = NULL;
8667         }
8668
8669         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8670                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8671                 int n_rates =
8672                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8673                 struct ieee80211_supported_band *sband;
8674
8675                 if (!setup.chandef.chan)
8676                         return -EINVAL;
8677
8678                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8679
8680                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8681                                              &setup.basic_rates);
8682                 if (err)
8683                         return err;
8684         }
8685
8686         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8687 }
8688
8689 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8690 {
8691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8692         struct net_device *dev = info->user_ptr[1];
8693
8694         return cfg80211_leave_mesh(rdev, dev);
8695 }
8696
8697 #ifdef CONFIG_PM
8698 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8699                                         struct cfg80211_registered_device *rdev)
8700 {
8701         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8702         struct nlattr *nl_pats, *nl_pat;
8703         int i, pat_len;
8704
8705         if (!wowlan->n_patterns)
8706                 return 0;
8707
8708         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8709         if (!nl_pats)
8710                 return -ENOBUFS;
8711
8712         for (i = 0; i < wowlan->n_patterns; i++) {
8713                 nl_pat = nla_nest_start(msg, i + 1);
8714                 if (!nl_pat)
8715                         return -ENOBUFS;
8716                 pat_len = wowlan->patterns[i].pattern_len;
8717                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8718                             wowlan->patterns[i].mask) ||
8719                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8720                             wowlan->patterns[i].pattern) ||
8721                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8722                                 wowlan->patterns[i].pkt_offset))
8723                         return -ENOBUFS;
8724                 nla_nest_end(msg, nl_pat);
8725         }
8726         nla_nest_end(msg, nl_pats);
8727
8728         return 0;
8729 }
8730
8731 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8732                                    struct cfg80211_wowlan_tcp *tcp)
8733 {
8734         struct nlattr *nl_tcp;
8735
8736         if (!tcp)
8737                 return 0;
8738
8739         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8740         if (!nl_tcp)
8741                 return -ENOBUFS;
8742
8743         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8744             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8745             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8746             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8747             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8748             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8749                     tcp->payload_len, tcp->payload) ||
8750             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8751                         tcp->data_interval) ||
8752             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8753                     tcp->wake_len, tcp->wake_data) ||
8754             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8755                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8756                 return -ENOBUFS;
8757
8758         if (tcp->payload_seq.len &&
8759             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8760                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8761                 return -ENOBUFS;
8762
8763         if (tcp->payload_tok.len &&
8764             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8765                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8766                     &tcp->payload_tok))
8767                 return -ENOBUFS;
8768
8769         nla_nest_end(msg, nl_tcp);
8770
8771         return 0;
8772 }
8773
8774 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
8775                                   struct cfg80211_sched_scan_request *req)
8776 {
8777         struct nlattr *nd, *freqs, *matches, *match;
8778         int i;
8779
8780         if (!req)
8781                 return 0;
8782
8783         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
8784         if (!nd)
8785                 return -ENOBUFS;
8786
8787         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, req->interval))
8788                 return -ENOBUFS;
8789
8790         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8791         if (!freqs)
8792                 return -ENOBUFS;
8793
8794         for (i = 0; i < req->n_channels; i++)
8795                 nla_put_u32(msg, i, req->channels[i]->center_freq);
8796
8797         nla_nest_end(msg, freqs);
8798
8799         if (req->n_match_sets) {
8800                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
8801                 for (i = 0; i < req->n_match_sets; i++) {
8802                         match = nla_nest_start(msg, i);
8803                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
8804                                 req->match_sets[i].ssid.ssid_len,
8805                                 req->match_sets[i].ssid.ssid);
8806                         nla_nest_end(msg, match);
8807                 }
8808                 nla_nest_end(msg, matches);
8809         }
8810
8811         nla_nest_end(msg, nd);
8812
8813         return 0;
8814 }
8815
8816 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8817 {
8818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8819         struct sk_buff *msg;
8820         void *hdr;
8821         u32 size = NLMSG_DEFAULT_SIZE;
8822
8823         if (!rdev->wiphy.wowlan)
8824                 return -EOPNOTSUPP;
8825
8826         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8827                 /* adjust size to have room for all the data */
8828                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8829                         rdev->wiphy.wowlan_config->tcp->payload_len +
8830                         rdev->wiphy.wowlan_config->tcp->wake_len +
8831                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8832         }
8833
8834         msg = nlmsg_new(size, GFP_KERNEL);
8835         if (!msg)
8836                 return -ENOMEM;
8837
8838         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8839                              NL80211_CMD_GET_WOWLAN);
8840         if (!hdr)
8841                 goto nla_put_failure;
8842
8843         if (rdev->wiphy.wowlan_config) {
8844                 struct nlattr *nl_wowlan;
8845
8846                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8847                 if (!nl_wowlan)
8848                         goto nla_put_failure;
8849
8850                 if ((rdev->wiphy.wowlan_config->any &&
8851                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8852                     (rdev->wiphy.wowlan_config->disconnect &&
8853                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8854                     (rdev->wiphy.wowlan_config->magic_pkt &&
8855                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8856                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8857                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8858                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8859                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8860                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8861                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8862                     (rdev->wiphy.wowlan_config->rfkill_release &&
8863                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8864                         goto nla_put_failure;
8865
8866                 if (nl80211_send_wowlan_patterns(msg, rdev))
8867                         goto nla_put_failure;
8868
8869                 if (nl80211_send_wowlan_tcp(msg,
8870                                             rdev->wiphy.wowlan_config->tcp))
8871                         goto nla_put_failure;
8872
8873                 if (nl80211_send_wowlan_nd(
8874                             msg,
8875                             rdev->wiphy.wowlan_config->nd_config))
8876                         goto nla_put_failure;
8877
8878                 nla_nest_end(msg, nl_wowlan);
8879         }
8880
8881         genlmsg_end(msg, hdr);
8882         return genlmsg_reply(msg, info);
8883
8884 nla_put_failure:
8885         nlmsg_free(msg);
8886         return -ENOBUFS;
8887 }
8888
8889 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8890                                     struct nlattr *attr,
8891                                     struct cfg80211_wowlan *trig)
8892 {
8893         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8894         struct cfg80211_wowlan_tcp *cfg;
8895         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8896         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8897         u32 size;
8898         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8899         int err, port;
8900
8901         if (!rdev->wiphy.wowlan->tcp)
8902                 return -EINVAL;
8903
8904         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8905                         nla_data(attr), nla_len(attr),
8906                         nl80211_wowlan_tcp_policy);
8907         if (err)
8908                 return err;
8909
8910         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8911             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8912             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8913             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8914             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8915             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8916             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8917             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8918                 return -EINVAL;
8919
8920         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8921         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8922                 return -EINVAL;
8923
8924         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8925                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8926             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8927                 return -EINVAL;
8928
8929         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8930         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8931                 return -EINVAL;
8932
8933         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8934         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8935                 return -EINVAL;
8936
8937         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8938                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8939
8940                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8941                 tokens_size = tokln - sizeof(*tok);
8942
8943                 if (!tok->len || tokens_size % tok->len)
8944                         return -EINVAL;
8945                 if (!rdev->wiphy.wowlan->tcp->tok)
8946                         return -EINVAL;
8947                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8948                         return -EINVAL;
8949                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8950                         return -EINVAL;
8951                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8952                         return -EINVAL;
8953                 if (tok->offset + tok->len > data_size)
8954                         return -EINVAL;
8955         }
8956
8957         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8958                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8959                 if (!rdev->wiphy.wowlan->tcp->seq)
8960                         return -EINVAL;
8961                 if (seq->len == 0 || seq->len > 4)
8962                         return -EINVAL;
8963                 if (seq->len + seq->offset > data_size)
8964                         return -EINVAL;
8965         }
8966
8967         size = sizeof(*cfg);
8968         size += data_size;
8969         size += wake_size + wake_mask_size;
8970         size += tokens_size;
8971
8972         cfg = kzalloc(size, GFP_KERNEL);
8973         if (!cfg)
8974                 return -ENOMEM;
8975         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8976         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8977         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8978                ETH_ALEN);
8979         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8980                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8981         else
8982                 port = 0;
8983 #ifdef CONFIG_INET
8984         /* allocate a socket and port for it and use it */
8985         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8986                             IPPROTO_TCP, &cfg->sock, 1);
8987         if (err) {
8988                 kfree(cfg);
8989                 return err;
8990         }
8991         if (inet_csk_get_port(cfg->sock->sk, port)) {
8992                 sock_release(cfg->sock);
8993                 kfree(cfg);
8994                 return -EADDRINUSE;
8995         }
8996         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8997 #else
8998         if (!port) {
8999                 kfree(cfg);
9000                 return -EINVAL;
9001         }
9002         cfg->src_port = port;
9003 #endif
9004
9005         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9006         cfg->payload_len = data_size;
9007         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9008         memcpy((void *)cfg->payload,
9009                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9010                data_size);
9011         if (seq)
9012                 cfg->payload_seq = *seq;
9013         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9014         cfg->wake_len = wake_size;
9015         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9016         memcpy((void *)cfg->wake_data,
9017                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9018                wake_size);
9019         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9020                          data_size + wake_size;
9021         memcpy((void *)cfg->wake_mask,
9022                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9023                wake_mask_size);
9024         if (tok) {
9025                 cfg->tokens_size = tokens_size;
9026                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9027         }
9028
9029         trig->tcp = cfg;
9030
9031         return 0;
9032 }
9033
9034 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9035                                    const struct wiphy_wowlan_support *wowlan,
9036                                    struct nlattr *attr,
9037                                    struct cfg80211_wowlan *trig)
9038 {
9039         struct nlattr **tb;
9040         int err;
9041
9042         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9043         if (!tb)
9044                 return -ENOMEM;
9045
9046         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9047                 err = -EOPNOTSUPP;
9048                 goto out;
9049         }
9050
9051         err = nla_parse(tb, NL80211_ATTR_MAX,
9052                         nla_data(attr), nla_len(attr),
9053                         nl80211_policy);
9054         if (err)
9055                 goto out;
9056
9057         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9058         err = PTR_ERR_OR_ZERO(trig->nd_config);
9059         if (err)
9060                 trig->nd_config = NULL;
9061
9062 out:
9063         kfree(tb);
9064         return err;
9065 }
9066
9067 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9068 {
9069         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9070         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9071         struct cfg80211_wowlan new_triggers = {};
9072         struct cfg80211_wowlan *ntrig;
9073         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9074         int err, i;
9075         bool prev_enabled = rdev->wiphy.wowlan_config;
9076
9077         if (!wowlan)
9078                 return -EOPNOTSUPP;
9079
9080         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9081                 cfg80211_rdev_free_wowlan(rdev);
9082                 rdev->wiphy.wowlan_config = NULL;
9083                 goto set_wakeup;
9084         }
9085
9086         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9087                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9088                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9089                         nl80211_wowlan_policy);
9090         if (err)
9091                 return err;
9092
9093         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9094                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9095                         return -EINVAL;
9096                 new_triggers.any = true;
9097         }
9098
9099         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9100                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9101                         return -EINVAL;
9102                 new_triggers.disconnect = true;
9103         }
9104
9105         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9106                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9107                         return -EINVAL;
9108                 new_triggers.magic_pkt = true;
9109         }
9110
9111         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9112                 return -EINVAL;
9113
9114         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9115                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9116                         return -EINVAL;
9117                 new_triggers.gtk_rekey_failure = true;
9118         }
9119
9120         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9121                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9122                         return -EINVAL;
9123                 new_triggers.eap_identity_req = true;
9124         }
9125
9126         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9127                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9128                         return -EINVAL;
9129                 new_triggers.four_way_handshake = true;
9130         }
9131
9132         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9133                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9134                         return -EINVAL;
9135                 new_triggers.rfkill_release = true;
9136         }
9137
9138         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9139                 struct nlattr *pat;
9140                 int n_patterns = 0;
9141                 int rem, pat_len, mask_len, pkt_offset;
9142                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9143
9144                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9145                                     rem)
9146                         n_patterns++;
9147                 if (n_patterns > wowlan->n_patterns)
9148                         return -EINVAL;
9149
9150                 new_triggers.patterns = kcalloc(n_patterns,
9151                                                 sizeof(new_triggers.patterns[0]),
9152                                                 GFP_KERNEL);
9153                 if (!new_triggers.patterns)
9154                         return -ENOMEM;
9155
9156                 new_triggers.n_patterns = n_patterns;
9157                 i = 0;
9158
9159                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9160                                     rem) {
9161                         u8 *mask_pat;
9162
9163                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9164                                   nla_len(pat), NULL);
9165                         err = -EINVAL;
9166                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9167                             !pat_tb[NL80211_PKTPAT_PATTERN])
9168                                 goto error;
9169                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9170                         mask_len = DIV_ROUND_UP(pat_len, 8);
9171                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9172                                 goto error;
9173                         if (pat_len > wowlan->pattern_max_len ||
9174                             pat_len < wowlan->pattern_min_len)
9175                                 goto error;
9176
9177                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9178                                 pkt_offset = 0;
9179                         else
9180                                 pkt_offset = nla_get_u32(
9181                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9182                         if (pkt_offset > wowlan->max_pkt_offset)
9183                                 goto error;
9184                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9185
9186                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9187                         if (!mask_pat) {
9188                                 err = -ENOMEM;
9189                                 goto error;
9190                         }
9191                         new_triggers.patterns[i].mask = mask_pat;
9192                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9193                                mask_len);
9194                         mask_pat += mask_len;
9195                         new_triggers.patterns[i].pattern = mask_pat;
9196                         new_triggers.patterns[i].pattern_len = pat_len;
9197                         memcpy(mask_pat,
9198                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9199                                pat_len);
9200                         i++;
9201                 }
9202         }
9203
9204         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9205                 err = nl80211_parse_wowlan_tcp(
9206                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9207                         &new_triggers);
9208                 if (err)
9209                         goto error;
9210         }
9211
9212         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9213                 err = nl80211_parse_wowlan_nd(
9214                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9215                         &new_triggers);
9216                 if (err)
9217                         goto error;
9218         }
9219
9220         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9221         if (!ntrig) {
9222                 err = -ENOMEM;
9223                 goto error;
9224         }
9225         cfg80211_rdev_free_wowlan(rdev);
9226         rdev->wiphy.wowlan_config = ntrig;
9227
9228  set_wakeup:
9229         if (rdev->ops->set_wakeup &&
9230             prev_enabled != !!rdev->wiphy.wowlan_config)
9231                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9232
9233         return 0;
9234  error:
9235         for (i = 0; i < new_triggers.n_patterns; i++)
9236                 kfree(new_triggers.patterns[i].mask);
9237         kfree(new_triggers.patterns);
9238         if (new_triggers.tcp && new_triggers.tcp->sock)
9239                 sock_release(new_triggers.tcp->sock);
9240         kfree(new_triggers.tcp);
9241         return err;
9242 }
9243 #endif
9244
9245 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9246                                        struct cfg80211_registered_device *rdev)
9247 {
9248         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9249         int i, j, pat_len;
9250         struct cfg80211_coalesce_rules *rule;
9251
9252         if (!rdev->coalesce->n_rules)
9253                 return 0;
9254
9255         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9256         if (!nl_rules)
9257                 return -ENOBUFS;
9258
9259         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9260                 nl_rule = nla_nest_start(msg, i + 1);
9261                 if (!nl_rule)
9262                         return -ENOBUFS;
9263
9264                 rule = &rdev->coalesce->rules[i];
9265                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9266                                 rule->delay))
9267                         return -ENOBUFS;
9268
9269                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9270                                 rule->condition))
9271                         return -ENOBUFS;
9272
9273                 nl_pats = nla_nest_start(msg,
9274                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9275                 if (!nl_pats)
9276                         return -ENOBUFS;
9277
9278                 for (j = 0; j < rule->n_patterns; j++) {
9279                         nl_pat = nla_nest_start(msg, j + 1);
9280                         if (!nl_pat)
9281                                 return -ENOBUFS;
9282                         pat_len = rule->patterns[j].pattern_len;
9283                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9284                                     DIV_ROUND_UP(pat_len, 8),
9285                                     rule->patterns[j].mask) ||
9286                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9287                                     rule->patterns[j].pattern) ||
9288                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9289                                         rule->patterns[j].pkt_offset))
9290                                 return -ENOBUFS;
9291                         nla_nest_end(msg, nl_pat);
9292                 }
9293                 nla_nest_end(msg, nl_pats);
9294                 nla_nest_end(msg, nl_rule);
9295         }
9296         nla_nest_end(msg, nl_rules);
9297
9298         return 0;
9299 }
9300
9301 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9302 {
9303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9304         struct sk_buff *msg;
9305         void *hdr;
9306
9307         if (!rdev->wiphy.coalesce)
9308                 return -EOPNOTSUPP;
9309
9310         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9311         if (!msg)
9312                 return -ENOMEM;
9313
9314         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9315                              NL80211_CMD_GET_COALESCE);
9316         if (!hdr)
9317                 goto nla_put_failure;
9318
9319         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9320                 goto nla_put_failure;
9321
9322         genlmsg_end(msg, hdr);
9323         return genlmsg_reply(msg, info);
9324
9325 nla_put_failure:
9326         nlmsg_free(msg);
9327         return -ENOBUFS;
9328 }
9329
9330 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9331 {
9332         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9333         int i, j;
9334         struct cfg80211_coalesce_rules *rule;
9335
9336         if (!coalesce)
9337                 return;
9338
9339         for (i = 0; i < coalesce->n_rules; i++) {
9340                 rule = &coalesce->rules[i];
9341                 for (j = 0; j < rule->n_patterns; j++)
9342                         kfree(rule->patterns[j].mask);
9343                 kfree(rule->patterns);
9344         }
9345         kfree(coalesce->rules);
9346         kfree(coalesce);
9347         rdev->coalesce = NULL;
9348 }
9349
9350 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9351                                        struct nlattr *rule,
9352                                        struct cfg80211_coalesce_rules *new_rule)
9353 {
9354         int err, i;
9355         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9356         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9357         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9358         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9359
9360         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9361                         nla_len(rule), nl80211_coalesce_policy);
9362         if (err)
9363                 return err;
9364
9365         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9366                 new_rule->delay =
9367                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9368         if (new_rule->delay > coalesce->max_delay)
9369                 return -EINVAL;
9370
9371         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9372                 new_rule->condition =
9373                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9374         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9375             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9376                 return -EINVAL;
9377
9378         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9379                 return -EINVAL;
9380
9381         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9382                             rem)
9383                 n_patterns++;
9384         if (n_patterns > coalesce->n_patterns)
9385                 return -EINVAL;
9386
9387         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9388                                      GFP_KERNEL);
9389         if (!new_rule->patterns)
9390                 return -ENOMEM;
9391
9392         new_rule->n_patterns = n_patterns;
9393         i = 0;
9394
9395         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9396                             rem) {
9397                 u8 *mask_pat;
9398
9399                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9400                           nla_len(pat), NULL);
9401                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9402                     !pat_tb[NL80211_PKTPAT_PATTERN])
9403                         return -EINVAL;
9404                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9405                 mask_len = DIV_ROUND_UP(pat_len, 8);
9406                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9407                         return -EINVAL;
9408                 if (pat_len > coalesce->pattern_max_len ||
9409                     pat_len < coalesce->pattern_min_len)
9410                         return -EINVAL;
9411
9412                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9413                         pkt_offset = 0;
9414                 else
9415                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9416                 if (pkt_offset > coalesce->max_pkt_offset)
9417                         return -EINVAL;
9418                 new_rule->patterns[i].pkt_offset = pkt_offset;
9419
9420                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9421                 if (!mask_pat)
9422                         return -ENOMEM;
9423
9424                 new_rule->patterns[i].mask = mask_pat;
9425                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9426                        mask_len);
9427
9428                 mask_pat += mask_len;
9429                 new_rule->patterns[i].pattern = mask_pat;
9430                 new_rule->patterns[i].pattern_len = pat_len;
9431                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9432                        pat_len);
9433                 i++;
9434         }
9435
9436         return 0;
9437 }
9438
9439 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9440 {
9441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9442         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9443         struct cfg80211_coalesce new_coalesce = {};
9444         struct cfg80211_coalesce *n_coalesce;
9445         int err, rem_rule, n_rules = 0, i, j;
9446         struct nlattr *rule;
9447         struct cfg80211_coalesce_rules *tmp_rule;
9448
9449         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9450                 return -EOPNOTSUPP;
9451
9452         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9453                 cfg80211_rdev_free_coalesce(rdev);
9454                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9455                 return 0;
9456         }
9457
9458         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9459                             rem_rule)
9460                 n_rules++;
9461         if (n_rules > coalesce->n_rules)
9462                 return -EINVAL;
9463
9464         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9465                                      GFP_KERNEL);
9466         if (!new_coalesce.rules)
9467                 return -ENOMEM;
9468
9469         new_coalesce.n_rules = n_rules;
9470         i = 0;
9471
9472         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9473                             rem_rule) {
9474                 err = nl80211_parse_coalesce_rule(rdev, rule,
9475                                                   &new_coalesce.rules[i]);
9476                 if (err)
9477                         goto error;
9478
9479                 i++;
9480         }
9481
9482         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9483         if (err)
9484                 goto error;
9485
9486         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9487         if (!n_coalesce) {
9488                 err = -ENOMEM;
9489                 goto error;
9490         }
9491         cfg80211_rdev_free_coalesce(rdev);
9492         rdev->coalesce = n_coalesce;
9493
9494         return 0;
9495 error:
9496         for (i = 0; i < new_coalesce.n_rules; i++) {
9497                 tmp_rule = &new_coalesce.rules[i];
9498                 for (j = 0; j < tmp_rule->n_patterns; j++)
9499                         kfree(tmp_rule->patterns[j].mask);
9500                 kfree(tmp_rule->patterns);
9501         }
9502         kfree(new_coalesce.rules);
9503
9504         return err;
9505 }
9506
9507 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9508 {
9509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9510         struct net_device *dev = info->user_ptr[1];
9511         struct wireless_dev *wdev = dev->ieee80211_ptr;
9512         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9513         struct cfg80211_gtk_rekey_data rekey_data;
9514         int err;
9515
9516         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9517                 return -EINVAL;
9518
9519         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9520                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9521                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9522                         nl80211_rekey_policy);
9523         if (err)
9524                 return err;
9525
9526         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9527                 return -ERANGE;
9528         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9529                 return -ERANGE;
9530         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9531                 return -ERANGE;
9532
9533         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9534         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9535         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9536
9537         wdev_lock(wdev);
9538         if (!wdev->current_bss) {
9539                 err = -ENOTCONN;
9540                 goto out;
9541         }
9542
9543         if (!rdev->ops->set_rekey_data) {
9544                 err = -EOPNOTSUPP;
9545                 goto out;
9546         }
9547
9548         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9549  out:
9550         wdev_unlock(wdev);
9551         return err;
9552 }
9553
9554 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9555                                              struct genl_info *info)
9556 {
9557         struct net_device *dev = info->user_ptr[1];
9558         struct wireless_dev *wdev = dev->ieee80211_ptr;
9559
9560         if (wdev->iftype != NL80211_IFTYPE_AP &&
9561             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9562                 return -EINVAL;
9563
9564         if (wdev->ap_unexpected_nlportid)
9565                 return -EBUSY;
9566
9567         wdev->ap_unexpected_nlportid = info->snd_portid;
9568         return 0;
9569 }
9570
9571 static int nl80211_probe_client(struct sk_buff *skb,
9572                                 struct genl_info *info)
9573 {
9574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9575         struct net_device *dev = info->user_ptr[1];
9576         struct wireless_dev *wdev = dev->ieee80211_ptr;
9577         struct sk_buff *msg;
9578         void *hdr;
9579         const u8 *addr;
9580         u64 cookie;
9581         int err;
9582
9583         if (wdev->iftype != NL80211_IFTYPE_AP &&
9584             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9585                 return -EOPNOTSUPP;
9586
9587         if (!info->attrs[NL80211_ATTR_MAC])
9588                 return -EINVAL;
9589
9590         if (!rdev->ops->probe_client)
9591                 return -EOPNOTSUPP;
9592
9593         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9594         if (!msg)
9595                 return -ENOMEM;
9596
9597         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9598                              NL80211_CMD_PROBE_CLIENT);
9599         if (!hdr) {
9600                 err = -ENOBUFS;
9601                 goto free_msg;
9602         }
9603
9604         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9605
9606         err = rdev_probe_client(rdev, dev, addr, &cookie);
9607         if (err)
9608                 goto free_msg;
9609
9610         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9611                 goto nla_put_failure;
9612
9613         genlmsg_end(msg, hdr);
9614
9615         return genlmsg_reply(msg, info);
9616
9617  nla_put_failure:
9618         err = -ENOBUFS;
9619  free_msg:
9620         nlmsg_free(msg);
9621         return err;
9622 }
9623
9624 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9625 {
9626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9627         struct cfg80211_beacon_registration *reg, *nreg;
9628         int rv;
9629
9630         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9631                 return -EOPNOTSUPP;
9632
9633         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9634         if (!nreg)
9635                 return -ENOMEM;
9636
9637         /* First, check if already registered. */
9638         spin_lock_bh(&rdev->beacon_registrations_lock);
9639         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9640                 if (reg->nlportid == info->snd_portid) {
9641                         rv = -EALREADY;
9642                         goto out_err;
9643                 }
9644         }
9645         /* Add it to the list */
9646         nreg->nlportid = info->snd_portid;
9647         list_add(&nreg->list, &rdev->beacon_registrations);
9648
9649         spin_unlock_bh(&rdev->beacon_registrations_lock);
9650
9651         return 0;
9652 out_err:
9653         spin_unlock_bh(&rdev->beacon_registrations_lock);
9654         kfree(nreg);
9655         return rv;
9656 }
9657
9658 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9659 {
9660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9661         struct wireless_dev *wdev = info->user_ptr[1];
9662         int err;
9663
9664         if (!rdev->ops->start_p2p_device)
9665                 return -EOPNOTSUPP;
9666
9667         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9668                 return -EOPNOTSUPP;
9669
9670         if (wdev->p2p_started)
9671                 return 0;
9672
9673         if (rfkill_blocked(rdev->rfkill))
9674                 return -ERFKILL;
9675
9676         err = rdev_start_p2p_device(rdev, wdev);
9677         if (err)
9678                 return err;
9679
9680         wdev->p2p_started = true;
9681         rdev->opencount++;
9682
9683         return 0;
9684 }
9685
9686 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9687 {
9688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9689         struct wireless_dev *wdev = info->user_ptr[1];
9690
9691         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9692                 return -EOPNOTSUPP;
9693
9694         if (!rdev->ops->stop_p2p_device)
9695                 return -EOPNOTSUPP;
9696
9697         cfg80211_stop_p2p_device(rdev, wdev);
9698
9699         return 0;
9700 }
9701
9702 static int nl80211_get_protocol_features(struct sk_buff *skb,
9703                                          struct genl_info *info)
9704 {
9705         void *hdr;
9706         struct sk_buff *msg;
9707
9708         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9709         if (!msg)
9710                 return -ENOMEM;
9711
9712         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9713                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9714         if (!hdr)
9715                 goto nla_put_failure;
9716
9717         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9718                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9719                 goto nla_put_failure;
9720
9721         genlmsg_end(msg, hdr);
9722         return genlmsg_reply(msg, info);
9723
9724  nla_put_failure:
9725         kfree_skb(msg);
9726         return -ENOBUFS;
9727 }
9728
9729 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9730 {
9731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9732         struct cfg80211_update_ft_ies_params ft_params;
9733         struct net_device *dev = info->user_ptr[1];
9734
9735         if (!rdev->ops->update_ft_ies)
9736                 return -EOPNOTSUPP;
9737
9738         if (!info->attrs[NL80211_ATTR_MDID] ||
9739             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9740                 return -EINVAL;
9741
9742         memset(&ft_params, 0, sizeof(ft_params));
9743         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9744         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9745         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9746
9747         return rdev_update_ft_ies(rdev, dev, &ft_params);
9748 }
9749
9750 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9751                                        struct genl_info *info)
9752 {
9753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9754         struct wireless_dev *wdev = info->user_ptr[1];
9755         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9756         u16 duration;
9757         int ret;
9758
9759         if (!rdev->ops->crit_proto_start)
9760                 return -EOPNOTSUPP;
9761
9762         if (WARN_ON(!rdev->ops->crit_proto_stop))
9763                 return -EINVAL;
9764
9765         if (rdev->crit_proto_nlportid)
9766                 return -EBUSY;
9767
9768         /* determine protocol if provided */
9769         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9770                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9771
9772         if (proto >= NUM_NL80211_CRIT_PROTO)
9773                 return -EINVAL;
9774
9775         /* timeout must be provided */
9776         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9777                 return -EINVAL;
9778
9779         duration =
9780                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9781
9782         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9783                 return -ERANGE;
9784
9785         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9786         if (!ret)
9787                 rdev->crit_proto_nlportid = info->snd_portid;
9788
9789         return ret;
9790 }
9791
9792 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9793                                       struct genl_info *info)
9794 {
9795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9796         struct wireless_dev *wdev = info->user_ptr[1];
9797
9798         if (!rdev->ops->crit_proto_stop)
9799                 return -EOPNOTSUPP;
9800
9801         if (rdev->crit_proto_nlportid) {
9802                 rdev->crit_proto_nlportid = 0;
9803                 rdev_crit_proto_stop(rdev, wdev);
9804         }
9805         return 0;
9806 }
9807
9808 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9809 {
9810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9811         struct wireless_dev *wdev =
9812                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9813         int i, err;
9814         u32 vid, subcmd;
9815
9816         if (!rdev->wiphy.vendor_commands)
9817                 return -EOPNOTSUPP;
9818
9819         if (IS_ERR(wdev)) {
9820                 err = PTR_ERR(wdev);
9821                 if (err != -EINVAL)
9822                         return err;
9823                 wdev = NULL;
9824         } else if (wdev->wiphy != &rdev->wiphy) {
9825                 return -EINVAL;
9826         }
9827
9828         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9829             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9830                 return -EINVAL;
9831
9832         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9833         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9834         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9835                 const struct wiphy_vendor_command *vcmd;
9836                 void *data = NULL;
9837                 int len = 0;
9838
9839                 vcmd = &rdev->wiphy.vendor_commands[i];
9840
9841                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9842                         continue;
9843
9844                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9845                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9846                         if (!wdev)
9847                                 return -EINVAL;
9848                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9849                             !wdev->netdev)
9850                                 return -EINVAL;
9851
9852                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9853                                 if (wdev->netdev &&
9854                                     !netif_running(wdev->netdev))
9855                                         return -ENETDOWN;
9856                                 if (!wdev->netdev && !wdev->p2p_started)
9857                                         return -ENETDOWN;
9858                         }
9859                 } else {
9860                         wdev = NULL;
9861                 }
9862
9863                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9864                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9865                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9866                 }
9867
9868                 rdev->cur_cmd_info = info;
9869                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9870                                                           data, len);
9871                 rdev->cur_cmd_info = NULL;
9872                 return err;
9873         }
9874
9875         return -EOPNOTSUPP;
9876 }
9877
9878 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9879                                            enum nl80211_commands cmd,
9880                                            enum nl80211_attrs attr,
9881                                            int approxlen)
9882 {
9883         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9884
9885         if (WARN_ON(!rdev->cur_cmd_info))
9886                 return NULL;
9887
9888         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9889                                            rdev->cur_cmd_info->snd_portid,
9890                                            rdev->cur_cmd_info->snd_seq,
9891                                            cmd, attr, NULL, GFP_KERNEL);
9892 }
9893 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9894
9895 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9896 {
9897         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9898         void *hdr = ((void **)skb->cb)[1];
9899         struct nlattr *data = ((void **)skb->cb)[2];
9900
9901         /* clear CB data for netlink core to own from now on */
9902         memset(skb->cb, 0, sizeof(skb->cb));
9903
9904         if (WARN_ON(!rdev->cur_cmd_info)) {
9905                 kfree_skb(skb);
9906                 return -EINVAL;
9907         }
9908
9909         nla_nest_end(skb, data);
9910         genlmsg_end(skb, hdr);
9911         return genlmsg_reply(skb, rdev->cur_cmd_info);
9912 }
9913 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9914
9915
9916 static int nl80211_set_qos_map(struct sk_buff *skb,
9917                                struct genl_info *info)
9918 {
9919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9920         struct cfg80211_qos_map *qos_map = NULL;
9921         struct net_device *dev = info->user_ptr[1];
9922         u8 *pos, len, num_des, des_len, des;
9923         int ret;
9924
9925         if (!rdev->ops->set_qos_map)
9926                 return -EOPNOTSUPP;
9927
9928         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9929                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9930                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9931
9932                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9933                     len > IEEE80211_QOS_MAP_LEN_MAX)
9934                         return -EINVAL;
9935
9936                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9937                 if (!qos_map)
9938                         return -ENOMEM;
9939
9940                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9941                 if (num_des) {
9942                         des_len = num_des *
9943                                 sizeof(struct cfg80211_dscp_exception);
9944                         memcpy(qos_map->dscp_exception, pos, des_len);
9945                         qos_map->num_des = num_des;
9946                         for (des = 0; des < num_des; des++) {
9947                                 if (qos_map->dscp_exception[des].up > 7) {
9948                                         kfree(qos_map);
9949                                         return -EINVAL;
9950                                 }
9951                         }
9952                         pos += des_len;
9953                 }
9954                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9955         }
9956
9957         wdev_lock(dev->ieee80211_ptr);
9958         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9959         if (!ret)
9960                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9961         wdev_unlock(dev->ieee80211_ptr);
9962
9963         kfree(qos_map);
9964         return ret;
9965 }
9966
9967 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
9968 {
9969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9970         struct net_device *dev = info->user_ptr[1];
9971         struct wireless_dev *wdev = dev->ieee80211_ptr;
9972         const u8 *peer;
9973         u8 tsid, up;
9974         u16 admitted_time = 0;
9975         int err;
9976
9977         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
9978                 return -EOPNOTSUPP;
9979
9980         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
9981             !info->attrs[NL80211_ATTR_USER_PRIO])
9982                 return -EINVAL;
9983
9984         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9985         if (tsid >= IEEE80211_NUM_TIDS)
9986                 return -EINVAL;
9987
9988         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
9989         if (up >= IEEE80211_NUM_UPS)
9990                 return -EINVAL;
9991
9992         /* WMM uses TIDs 0-7 even for TSPEC */
9993         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
9994                 /* TODO: handle 802.11 TSPEC/admission control
9995                  * need more attributes for that (e.g. BA session requirement);
9996                  * change the WMM adminssion test above to allow both then
9997                  */
9998                 return -EINVAL;
9999         }
10000
10001         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10002
10003         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10004                 admitted_time =
10005                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10006                 if (!admitted_time)
10007                         return -EINVAL;
10008         }
10009
10010         wdev_lock(wdev);
10011         switch (wdev->iftype) {
10012         case NL80211_IFTYPE_STATION:
10013         case NL80211_IFTYPE_P2P_CLIENT:
10014                 if (wdev->current_bss)
10015                         break;
10016                 err = -ENOTCONN;
10017                 goto out;
10018         default:
10019                 err = -EOPNOTSUPP;
10020                 goto out;
10021         }
10022
10023         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10024
10025  out:
10026         wdev_unlock(wdev);
10027         return err;
10028 }
10029
10030 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10031 {
10032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10033         struct net_device *dev = info->user_ptr[1];
10034         struct wireless_dev *wdev = dev->ieee80211_ptr;
10035         const u8 *peer;
10036         u8 tsid;
10037         int err;
10038
10039         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10040                 return -EINVAL;
10041
10042         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10043         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10044
10045         wdev_lock(wdev);
10046         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10047         wdev_unlock(wdev);
10048
10049         return err;
10050 }
10051
10052 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10053                                        struct genl_info *info)
10054 {
10055         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10056         struct net_device *dev = info->user_ptr[1];
10057         struct wireless_dev *wdev = dev->ieee80211_ptr;
10058         struct cfg80211_chan_def chandef = {};
10059         const u8 *addr;
10060         u8 oper_class;
10061         int err;
10062
10063         if (!rdev->ops->tdls_channel_switch ||
10064             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10065                 return -EOPNOTSUPP;
10066
10067         switch (dev->ieee80211_ptr->iftype) {
10068         case NL80211_IFTYPE_STATION:
10069         case NL80211_IFTYPE_P2P_CLIENT:
10070                 break;
10071         default:
10072                 return -EOPNOTSUPP;
10073         }
10074
10075         if (!info->attrs[NL80211_ATTR_MAC] ||
10076             !info->attrs[NL80211_ATTR_OPER_CLASS])
10077                 return -EINVAL;
10078
10079         err = nl80211_parse_chandef(rdev, info, &chandef);
10080         if (err)
10081                 return err;
10082
10083         /*
10084          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10085          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10086          * specification is not defined for them.
10087          */
10088         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
10089             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10090             chandef.width != NL80211_CHAN_WIDTH_20)
10091                 return -EINVAL;
10092
10093         /* we will be active on the TDLS link */
10094         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
10095                 return -EINVAL;
10096
10097         /* don't allow switching to DFS channels */
10098         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10099                 return -EINVAL;
10100
10101         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10102         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10103
10104         wdev_lock(wdev);
10105         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10106         wdev_unlock(wdev);
10107
10108         return err;
10109 }
10110
10111 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10112                                               struct genl_info *info)
10113 {
10114         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10115         struct net_device *dev = info->user_ptr[1];
10116         struct wireless_dev *wdev = dev->ieee80211_ptr;
10117         const u8 *addr;
10118
10119         if (!rdev->ops->tdls_channel_switch ||
10120             !rdev->ops->tdls_cancel_channel_switch ||
10121             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10122                 return -EOPNOTSUPP;
10123
10124         switch (dev->ieee80211_ptr->iftype) {
10125         case NL80211_IFTYPE_STATION:
10126         case NL80211_IFTYPE_P2P_CLIENT:
10127                 break;
10128         default:
10129                 return -EOPNOTSUPP;
10130         }
10131
10132         if (!info->attrs[NL80211_ATTR_MAC])
10133                 return -EINVAL;
10134
10135         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10136
10137         wdev_lock(wdev);
10138         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10139         wdev_unlock(wdev);
10140
10141         return 0;
10142 }
10143
10144 #define NL80211_FLAG_NEED_WIPHY         0x01
10145 #define NL80211_FLAG_NEED_NETDEV        0x02
10146 #define NL80211_FLAG_NEED_RTNL          0x04
10147 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10148 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10149                                          NL80211_FLAG_CHECK_NETDEV_UP)
10150 #define NL80211_FLAG_NEED_WDEV          0x10
10151 /* If a netdev is associated, it must be UP, P2P must be started */
10152 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10153                                          NL80211_FLAG_CHECK_NETDEV_UP)
10154 #define NL80211_FLAG_CLEAR_SKB          0x20
10155
10156 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10157                             struct genl_info *info)
10158 {
10159         struct cfg80211_registered_device *rdev;
10160         struct wireless_dev *wdev;
10161         struct net_device *dev;
10162         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10163
10164         if (rtnl)
10165                 rtnl_lock();
10166
10167         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10168                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10169                 if (IS_ERR(rdev)) {
10170                         if (rtnl)
10171                                 rtnl_unlock();
10172                         return PTR_ERR(rdev);
10173                 }
10174                 info->user_ptr[0] = rdev;
10175         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10176                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10177                 ASSERT_RTNL();
10178
10179                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10180                                                   info->attrs);
10181                 if (IS_ERR(wdev)) {
10182                         if (rtnl)
10183                                 rtnl_unlock();
10184                         return PTR_ERR(wdev);
10185                 }
10186
10187                 dev = wdev->netdev;
10188                 rdev = wiphy_to_rdev(wdev->wiphy);
10189
10190                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10191                         if (!dev) {
10192                                 if (rtnl)
10193                                         rtnl_unlock();
10194                                 return -EINVAL;
10195                         }
10196
10197                         info->user_ptr[1] = dev;
10198                 } else {
10199                         info->user_ptr[1] = wdev;
10200                 }
10201
10202                 if (dev) {
10203                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10204                             !netif_running(dev)) {
10205                                 if (rtnl)
10206                                         rtnl_unlock();
10207                                 return -ENETDOWN;
10208                         }
10209
10210                         dev_hold(dev);
10211                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10212                         if (!wdev->p2p_started) {
10213                                 if (rtnl)
10214                                         rtnl_unlock();
10215                                 return -ENETDOWN;
10216                         }
10217                 }
10218
10219                 info->user_ptr[0] = rdev;
10220         }
10221
10222         return 0;
10223 }
10224
10225 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10226                               struct genl_info *info)
10227 {
10228         if (info->user_ptr[1]) {
10229                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10230                         struct wireless_dev *wdev = info->user_ptr[1];
10231
10232                         if (wdev->netdev)
10233                                 dev_put(wdev->netdev);
10234                 } else {
10235                         dev_put(info->user_ptr[1]);
10236                 }
10237         }
10238
10239         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10240                 rtnl_unlock();
10241
10242         /* If needed, clear the netlink message payload from the SKB
10243          * as it might contain key data that shouldn't stick around on
10244          * the heap after the SKB is freed. The netlink message header
10245          * is still needed for further processing, so leave it intact.
10246          */
10247         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10248                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10249
10250                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10251         }
10252 }
10253
10254 static const struct genl_ops nl80211_ops[] = {
10255         {
10256                 .cmd = NL80211_CMD_GET_WIPHY,
10257                 .doit = nl80211_get_wiphy,
10258                 .dumpit = nl80211_dump_wiphy,
10259                 .done = nl80211_dump_wiphy_done,
10260                 .policy = nl80211_policy,
10261                 /* can be retrieved by unprivileged users */
10262                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10263                                   NL80211_FLAG_NEED_RTNL,
10264         },
10265         {
10266                 .cmd = NL80211_CMD_SET_WIPHY,
10267                 .doit = nl80211_set_wiphy,
10268                 .policy = nl80211_policy,
10269                 .flags = GENL_ADMIN_PERM,
10270                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10271         },
10272         {
10273                 .cmd = NL80211_CMD_GET_INTERFACE,
10274                 .doit = nl80211_get_interface,
10275                 .dumpit = nl80211_dump_interface,
10276                 .policy = nl80211_policy,
10277                 /* can be retrieved by unprivileged users */
10278                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10279                                   NL80211_FLAG_NEED_RTNL,
10280         },
10281         {
10282                 .cmd = NL80211_CMD_SET_INTERFACE,
10283                 .doit = nl80211_set_interface,
10284                 .policy = nl80211_policy,
10285                 .flags = GENL_ADMIN_PERM,
10286                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10287                                   NL80211_FLAG_NEED_RTNL,
10288         },
10289         {
10290                 .cmd = NL80211_CMD_NEW_INTERFACE,
10291                 .doit = nl80211_new_interface,
10292                 .policy = nl80211_policy,
10293                 .flags = GENL_ADMIN_PERM,
10294                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10295                                   NL80211_FLAG_NEED_RTNL,
10296         },
10297         {
10298                 .cmd = NL80211_CMD_DEL_INTERFACE,
10299                 .doit = nl80211_del_interface,
10300                 .policy = nl80211_policy,
10301                 .flags = GENL_ADMIN_PERM,
10302                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10303                                   NL80211_FLAG_NEED_RTNL,
10304         },
10305         {
10306                 .cmd = NL80211_CMD_GET_KEY,
10307                 .doit = nl80211_get_key,
10308                 .policy = nl80211_policy,
10309                 .flags = GENL_ADMIN_PERM,
10310                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10311                                   NL80211_FLAG_NEED_RTNL,
10312         },
10313         {
10314                 .cmd = NL80211_CMD_SET_KEY,
10315                 .doit = nl80211_set_key,
10316                 .policy = nl80211_policy,
10317                 .flags = GENL_ADMIN_PERM,
10318                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10319                                   NL80211_FLAG_NEED_RTNL |
10320                                   NL80211_FLAG_CLEAR_SKB,
10321         },
10322         {
10323                 .cmd = NL80211_CMD_NEW_KEY,
10324                 .doit = nl80211_new_key,
10325                 .policy = nl80211_policy,
10326                 .flags = GENL_ADMIN_PERM,
10327                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10328                                   NL80211_FLAG_NEED_RTNL |
10329                                   NL80211_FLAG_CLEAR_SKB,
10330         },
10331         {
10332                 .cmd = NL80211_CMD_DEL_KEY,
10333                 .doit = nl80211_del_key,
10334                 .policy = nl80211_policy,
10335                 .flags = GENL_ADMIN_PERM,
10336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10337                                   NL80211_FLAG_NEED_RTNL,
10338         },
10339         {
10340                 .cmd = NL80211_CMD_SET_BEACON,
10341                 .policy = nl80211_policy,
10342                 .flags = GENL_ADMIN_PERM,
10343                 .doit = nl80211_set_beacon,
10344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10345                                   NL80211_FLAG_NEED_RTNL,
10346         },
10347         {
10348                 .cmd = NL80211_CMD_START_AP,
10349                 .policy = nl80211_policy,
10350                 .flags = GENL_ADMIN_PERM,
10351                 .doit = nl80211_start_ap,
10352                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10353                                   NL80211_FLAG_NEED_RTNL,
10354         },
10355         {
10356                 .cmd = NL80211_CMD_STOP_AP,
10357                 .policy = nl80211_policy,
10358                 .flags = GENL_ADMIN_PERM,
10359                 .doit = nl80211_stop_ap,
10360                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10361                                   NL80211_FLAG_NEED_RTNL,
10362         },
10363         {
10364                 .cmd = NL80211_CMD_GET_STATION,
10365                 .doit = nl80211_get_station,
10366                 .dumpit = nl80211_dump_station,
10367                 .policy = nl80211_policy,
10368                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10369                                   NL80211_FLAG_NEED_RTNL,
10370         },
10371         {
10372                 .cmd = NL80211_CMD_SET_STATION,
10373                 .doit = nl80211_set_station,
10374                 .policy = nl80211_policy,
10375                 .flags = GENL_ADMIN_PERM,
10376                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10377                                   NL80211_FLAG_NEED_RTNL,
10378         },
10379         {
10380                 .cmd = NL80211_CMD_NEW_STATION,
10381                 .doit = nl80211_new_station,
10382                 .policy = nl80211_policy,
10383                 .flags = GENL_ADMIN_PERM,
10384                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10385                                   NL80211_FLAG_NEED_RTNL,
10386         },
10387         {
10388                 .cmd = NL80211_CMD_DEL_STATION,
10389                 .doit = nl80211_del_station,
10390                 .policy = nl80211_policy,
10391                 .flags = GENL_ADMIN_PERM,
10392                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10393                                   NL80211_FLAG_NEED_RTNL,
10394         },
10395         {
10396                 .cmd = NL80211_CMD_GET_MPATH,
10397                 .doit = nl80211_get_mpath,
10398                 .dumpit = nl80211_dump_mpath,
10399                 .policy = nl80211_policy,
10400                 .flags = GENL_ADMIN_PERM,
10401                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10402                                   NL80211_FLAG_NEED_RTNL,
10403         },
10404         {
10405                 .cmd = NL80211_CMD_GET_MPP,
10406                 .doit = nl80211_get_mpp,
10407                 .dumpit = nl80211_dump_mpp,
10408                 .policy = nl80211_policy,
10409                 .flags = GENL_ADMIN_PERM,
10410                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10411                                   NL80211_FLAG_NEED_RTNL,
10412         },
10413         {
10414                 .cmd = NL80211_CMD_SET_MPATH,
10415                 .doit = nl80211_set_mpath,
10416                 .policy = nl80211_policy,
10417                 .flags = GENL_ADMIN_PERM,
10418                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10419                                   NL80211_FLAG_NEED_RTNL,
10420         },
10421         {
10422                 .cmd = NL80211_CMD_NEW_MPATH,
10423                 .doit = nl80211_new_mpath,
10424                 .policy = nl80211_policy,
10425                 .flags = GENL_ADMIN_PERM,
10426                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10427                                   NL80211_FLAG_NEED_RTNL,
10428         },
10429         {
10430                 .cmd = NL80211_CMD_DEL_MPATH,
10431                 .doit = nl80211_del_mpath,
10432                 .policy = nl80211_policy,
10433                 .flags = GENL_ADMIN_PERM,
10434                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10435                                   NL80211_FLAG_NEED_RTNL,
10436         },
10437         {
10438                 .cmd = NL80211_CMD_SET_BSS,
10439                 .doit = nl80211_set_bss,
10440                 .policy = nl80211_policy,
10441                 .flags = GENL_ADMIN_PERM,
10442                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10443                                   NL80211_FLAG_NEED_RTNL,
10444         },
10445         {
10446                 .cmd = NL80211_CMD_GET_REG,
10447                 .doit = nl80211_get_reg_do,
10448                 .dumpit = nl80211_get_reg_dump,
10449                 .policy = nl80211_policy,
10450                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10451                 /* can be retrieved by unprivileged users */
10452         },
10453         {
10454                 .cmd = NL80211_CMD_SET_REG,
10455                 .doit = nl80211_set_reg,
10456                 .policy = nl80211_policy,
10457                 .flags = GENL_ADMIN_PERM,
10458                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10459         },
10460         {
10461                 .cmd = NL80211_CMD_REQ_SET_REG,
10462                 .doit = nl80211_req_set_reg,
10463                 .policy = nl80211_policy,
10464                 .flags = GENL_ADMIN_PERM,
10465         },
10466         {
10467                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10468                 .doit = nl80211_get_mesh_config,
10469                 .policy = nl80211_policy,
10470                 /* can be retrieved by unprivileged users */
10471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10472                                   NL80211_FLAG_NEED_RTNL,
10473         },
10474         {
10475                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10476                 .doit = nl80211_update_mesh_config,
10477                 .policy = nl80211_policy,
10478                 .flags = GENL_ADMIN_PERM,
10479                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10480                                   NL80211_FLAG_NEED_RTNL,
10481         },
10482         {
10483                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10484                 .doit = nl80211_trigger_scan,
10485                 .policy = nl80211_policy,
10486                 .flags = GENL_ADMIN_PERM,
10487                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10488                                   NL80211_FLAG_NEED_RTNL,
10489         },
10490         {
10491                 .cmd = NL80211_CMD_GET_SCAN,
10492                 .policy = nl80211_policy,
10493                 .dumpit = nl80211_dump_scan,
10494         },
10495         {
10496                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10497                 .doit = nl80211_start_sched_scan,
10498                 .policy = nl80211_policy,
10499                 .flags = GENL_ADMIN_PERM,
10500                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10501                                   NL80211_FLAG_NEED_RTNL,
10502         },
10503         {
10504                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10505                 .doit = nl80211_stop_sched_scan,
10506                 .policy = nl80211_policy,
10507                 .flags = GENL_ADMIN_PERM,
10508                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10509                                   NL80211_FLAG_NEED_RTNL,
10510         },
10511         {
10512                 .cmd = NL80211_CMD_AUTHENTICATE,
10513                 .doit = nl80211_authenticate,
10514                 .policy = nl80211_policy,
10515                 .flags = GENL_ADMIN_PERM,
10516                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10517                                   NL80211_FLAG_NEED_RTNL |
10518                                   NL80211_FLAG_CLEAR_SKB,
10519         },
10520         {
10521                 .cmd = NL80211_CMD_ASSOCIATE,
10522                 .doit = nl80211_associate,
10523                 .policy = nl80211_policy,
10524                 .flags = GENL_ADMIN_PERM,
10525                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10526                                   NL80211_FLAG_NEED_RTNL,
10527         },
10528         {
10529                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10530                 .doit = nl80211_deauthenticate,
10531                 .policy = nl80211_policy,
10532                 .flags = GENL_ADMIN_PERM,
10533                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10534                                   NL80211_FLAG_NEED_RTNL,
10535         },
10536         {
10537                 .cmd = NL80211_CMD_DISASSOCIATE,
10538                 .doit = nl80211_disassociate,
10539                 .policy = nl80211_policy,
10540                 .flags = GENL_ADMIN_PERM,
10541                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10542                                   NL80211_FLAG_NEED_RTNL,
10543         },
10544         {
10545                 .cmd = NL80211_CMD_JOIN_IBSS,
10546                 .doit = nl80211_join_ibss,
10547                 .policy = nl80211_policy,
10548                 .flags = GENL_ADMIN_PERM,
10549                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10550                                   NL80211_FLAG_NEED_RTNL,
10551         },
10552         {
10553                 .cmd = NL80211_CMD_LEAVE_IBSS,
10554                 .doit = nl80211_leave_ibss,
10555                 .policy = nl80211_policy,
10556                 .flags = GENL_ADMIN_PERM,
10557                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10558                                   NL80211_FLAG_NEED_RTNL,
10559         },
10560 #ifdef CONFIG_NL80211_TESTMODE
10561         {
10562                 .cmd = NL80211_CMD_TESTMODE,
10563                 .doit = nl80211_testmode_do,
10564                 .dumpit = nl80211_testmode_dump,
10565                 .policy = nl80211_policy,
10566                 .flags = GENL_ADMIN_PERM,
10567                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10568                                   NL80211_FLAG_NEED_RTNL,
10569         },
10570 #endif
10571         {
10572                 .cmd = NL80211_CMD_CONNECT,
10573                 .doit = nl80211_connect,
10574                 .policy = nl80211_policy,
10575                 .flags = GENL_ADMIN_PERM,
10576                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10577                                   NL80211_FLAG_NEED_RTNL,
10578         },
10579         {
10580                 .cmd = NL80211_CMD_DISCONNECT,
10581                 .doit = nl80211_disconnect,
10582                 .policy = nl80211_policy,
10583                 .flags = GENL_ADMIN_PERM,
10584                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10585                                   NL80211_FLAG_NEED_RTNL,
10586         },
10587         {
10588                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10589                 .doit = nl80211_wiphy_netns,
10590                 .policy = nl80211_policy,
10591                 .flags = GENL_ADMIN_PERM,
10592                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10593                                   NL80211_FLAG_NEED_RTNL,
10594         },
10595         {
10596                 .cmd = NL80211_CMD_GET_SURVEY,
10597                 .policy = nl80211_policy,
10598                 .dumpit = nl80211_dump_survey,
10599         },
10600         {
10601                 .cmd = NL80211_CMD_SET_PMKSA,
10602                 .doit = nl80211_setdel_pmksa,
10603                 .policy = nl80211_policy,
10604                 .flags = GENL_ADMIN_PERM,
10605                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10606                                   NL80211_FLAG_NEED_RTNL,
10607         },
10608         {
10609                 .cmd = NL80211_CMD_DEL_PMKSA,
10610                 .doit = nl80211_setdel_pmksa,
10611                 .policy = nl80211_policy,
10612                 .flags = GENL_ADMIN_PERM,
10613                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10614                                   NL80211_FLAG_NEED_RTNL,
10615         },
10616         {
10617                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10618                 .doit = nl80211_flush_pmksa,
10619                 .policy = nl80211_policy,
10620                 .flags = GENL_ADMIN_PERM,
10621                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10622                                   NL80211_FLAG_NEED_RTNL,
10623         },
10624         {
10625                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10626                 .doit = nl80211_remain_on_channel,
10627                 .policy = nl80211_policy,
10628                 .flags = GENL_ADMIN_PERM,
10629                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10630                                   NL80211_FLAG_NEED_RTNL,
10631         },
10632         {
10633                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10634                 .doit = nl80211_cancel_remain_on_channel,
10635                 .policy = nl80211_policy,
10636                 .flags = GENL_ADMIN_PERM,
10637                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10638                                   NL80211_FLAG_NEED_RTNL,
10639         },
10640         {
10641                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10642                 .doit = nl80211_set_tx_bitrate_mask,
10643                 .policy = nl80211_policy,
10644                 .flags = GENL_ADMIN_PERM,
10645                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10646                                   NL80211_FLAG_NEED_RTNL,
10647         },
10648         {
10649                 .cmd = NL80211_CMD_REGISTER_FRAME,
10650                 .doit = nl80211_register_mgmt,
10651                 .policy = nl80211_policy,
10652                 .flags = GENL_ADMIN_PERM,
10653                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10654                                   NL80211_FLAG_NEED_RTNL,
10655         },
10656         {
10657                 .cmd = NL80211_CMD_FRAME,
10658                 .doit = nl80211_tx_mgmt,
10659                 .policy = nl80211_policy,
10660                 .flags = GENL_ADMIN_PERM,
10661                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10662                                   NL80211_FLAG_NEED_RTNL,
10663         },
10664         {
10665                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10666                 .doit = nl80211_tx_mgmt_cancel_wait,
10667                 .policy = nl80211_policy,
10668                 .flags = GENL_ADMIN_PERM,
10669                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10670                                   NL80211_FLAG_NEED_RTNL,
10671         },
10672         {
10673                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10674                 .doit = nl80211_set_power_save,
10675                 .policy = nl80211_policy,
10676                 .flags = GENL_ADMIN_PERM,
10677                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10678                                   NL80211_FLAG_NEED_RTNL,
10679         },
10680         {
10681                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10682                 .doit = nl80211_get_power_save,
10683                 .policy = nl80211_policy,
10684                 /* can be retrieved by unprivileged users */
10685                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10686                                   NL80211_FLAG_NEED_RTNL,
10687         },
10688         {
10689                 .cmd = NL80211_CMD_SET_CQM,
10690                 .doit = nl80211_set_cqm,
10691                 .policy = nl80211_policy,
10692                 .flags = GENL_ADMIN_PERM,
10693                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10694                                   NL80211_FLAG_NEED_RTNL,
10695         },
10696         {
10697                 .cmd = NL80211_CMD_SET_CHANNEL,
10698                 .doit = nl80211_set_channel,
10699                 .policy = nl80211_policy,
10700                 .flags = GENL_ADMIN_PERM,
10701                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10702                                   NL80211_FLAG_NEED_RTNL,
10703         },
10704         {
10705                 .cmd = NL80211_CMD_SET_WDS_PEER,
10706                 .doit = nl80211_set_wds_peer,
10707                 .policy = nl80211_policy,
10708                 .flags = GENL_ADMIN_PERM,
10709                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10710                                   NL80211_FLAG_NEED_RTNL,
10711         },
10712         {
10713                 .cmd = NL80211_CMD_JOIN_MESH,
10714                 .doit = nl80211_join_mesh,
10715                 .policy = nl80211_policy,
10716                 .flags = GENL_ADMIN_PERM,
10717                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10718                                   NL80211_FLAG_NEED_RTNL,
10719         },
10720         {
10721                 .cmd = NL80211_CMD_LEAVE_MESH,
10722                 .doit = nl80211_leave_mesh,
10723                 .policy = nl80211_policy,
10724                 .flags = GENL_ADMIN_PERM,
10725                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10726                                   NL80211_FLAG_NEED_RTNL,
10727         },
10728         {
10729                 .cmd = NL80211_CMD_JOIN_OCB,
10730                 .doit = nl80211_join_ocb,
10731                 .policy = nl80211_policy,
10732                 .flags = GENL_ADMIN_PERM,
10733                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10734                                   NL80211_FLAG_NEED_RTNL,
10735         },
10736         {
10737                 .cmd = NL80211_CMD_LEAVE_OCB,
10738                 .doit = nl80211_leave_ocb,
10739                 .policy = nl80211_policy,
10740                 .flags = GENL_ADMIN_PERM,
10741                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10742                                   NL80211_FLAG_NEED_RTNL,
10743         },
10744 #ifdef CONFIG_PM
10745         {
10746                 .cmd = NL80211_CMD_GET_WOWLAN,
10747                 .doit = nl80211_get_wowlan,
10748                 .policy = nl80211_policy,
10749                 /* can be retrieved by unprivileged users */
10750                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10751                                   NL80211_FLAG_NEED_RTNL,
10752         },
10753         {
10754                 .cmd = NL80211_CMD_SET_WOWLAN,
10755                 .doit = nl80211_set_wowlan,
10756                 .policy = nl80211_policy,
10757                 .flags = GENL_ADMIN_PERM,
10758                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10759                                   NL80211_FLAG_NEED_RTNL,
10760         },
10761 #endif
10762         {
10763                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10764                 .doit = nl80211_set_rekey_data,
10765                 .policy = nl80211_policy,
10766                 .flags = GENL_ADMIN_PERM,
10767                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10768                                   NL80211_FLAG_NEED_RTNL |
10769                                   NL80211_FLAG_CLEAR_SKB,
10770         },
10771         {
10772                 .cmd = NL80211_CMD_TDLS_MGMT,
10773                 .doit = nl80211_tdls_mgmt,
10774                 .policy = nl80211_policy,
10775                 .flags = GENL_ADMIN_PERM,
10776                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10777                                   NL80211_FLAG_NEED_RTNL,
10778         },
10779         {
10780                 .cmd = NL80211_CMD_TDLS_OPER,
10781                 .doit = nl80211_tdls_oper,
10782                 .policy = nl80211_policy,
10783                 .flags = GENL_ADMIN_PERM,
10784                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10785                                   NL80211_FLAG_NEED_RTNL,
10786         },
10787         {
10788                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10789                 .doit = nl80211_register_unexpected_frame,
10790                 .policy = nl80211_policy,
10791                 .flags = GENL_ADMIN_PERM,
10792                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10793                                   NL80211_FLAG_NEED_RTNL,
10794         },
10795         {
10796                 .cmd = NL80211_CMD_PROBE_CLIENT,
10797                 .doit = nl80211_probe_client,
10798                 .policy = nl80211_policy,
10799                 .flags = GENL_ADMIN_PERM,
10800                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10801                                   NL80211_FLAG_NEED_RTNL,
10802         },
10803         {
10804                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10805                 .doit = nl80211_register_beacons,
10806                 .policy = nl80211_policy,
10807                 .flags = GENL_ADMIN_PERM,
10808                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10809                                   NL80211_FLAG_NEED_RTNL,
10810         },
10811         {
10812                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10813                 .doit = nl80211_set_noack_map,
10814                 .policy = nl80211_policy,
10815                 .flags = GENL_ADMIN_PERM,
10816                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10817                                   NL80211_FLAG_NEED_RTNL,
10818         },
10819         {
10820                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10821                 .doit = nl80211_start_p2p_device,
10822                 .policy = nl80211_policy,
10823                 .flags = GENL_ADMIN_PERM,
10824                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10825                                   NL80211_FLAG_NEED_RTNL,
10826         },
10827         {
10828                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10829                 .doit = nl80211_stop_p2p_device,
10830                 .policy = nl80211_policy,
10831                 .flags = GENL_ADMIN_PERM,
10832                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10833                                   NL80211_FLAG_NEED_RTNL,
10834         },
10835         {
10836                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10837                 .doit = nl80211_set_mcast_rate,
10838                 .policy = nl80211_policy,
10839                 .flags = GENL_ADMIN_PERM,
10840                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10841                                   NL80211_FLAG_NEED_RTNL,
10842         },
10843         {
10844                 .cmd = NL80211_CMD_SET_MAC_ACL,
10845                 .doit = nl80211_set_mac_acl,
10846                 .policy = nl80211_policy,
10847                 .flags = GENL_ADMIN_PERM,
10848                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10849                                   NL80211_FLAG_NEED_RTNL,
10850         },
10851         {
10852                 .cmd = NL80211_CMD_RADAR_DETECT,
10853                 .doit = nl80211_start_radar_detection,
10854                 .policy = nl80211_policy,
10855                 .flags = GENL_ADMIN_PERM,
10856                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10857                                   NL80211_FLAG_NEED_RTNL,
10858         },
10859         {
10860                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10861                 .doit = nl80211_get_protocol_features,
10862                 .policy = nl80211_policy,
10863         },
10864         {
10865                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10866                 .doit = nl80211_update_ft_ies,
10867                 .policy = nl80211_policy,
10868                 .flags = GENL_ADMIN_PERM,
10869                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10870                                   NL80211_FLAG_NEED_RTNL,
10871         },
10872         {
10873                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10874                 .doit = nl80211_crit_protocol_start,
10875                 .policy = nl80211_policy,
10876                 .flags = GENL_ADMIN_PERM,
10877                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10878                                   NL80211_FLAG_NEED_RTNL,
10879         },
10880         {
10881                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10882                 .doit = nl80211_crit_protocol_stop,
10883                 .policy = nl80211_policy,
10884                 .flags = GENL_ADMIN_PERM,
10885                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10886                                   NL80211_FLAG_NEED_RTNL,
10887         },
10888         {
10889                 .cmd = NL80211_CMD_GET_COALESCE,
10890                 .doit = nl80211_get_coalesce,
10891                 .policy = nl80211_policy,
10892                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10893                                   NL80211_FLAG_NEED_RTNL,
10894         },
10895         {
10896                 .cmd = NL80211_CMD_SET_COALESCE,
10897                 .doit = nl80211_set_coalesce,
10898                 .policy = nl80211_policy,
10899                 .flags = GENL_ADMIN_PERM,
10900                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10901                                   NL80211_FLAG_NEED_RTNL,
10902         },
10903         {
10904                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10905                 .doit = nl80211_channel_switch,
10906                 .policy = nl80211_policy,
10907                 .flags = GENL_ADMIN_PERM,
10908                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10909                                   NL80211_FLAG_NEED_RTNL,
10910         },
10911         {
10912                 .cmd = NL80211_CMD_VENDOR,
10913                 .doit = nl80211_vendor_cmd,
10914                 .policy = nl80211_policy,
10915                 .flags = GENL_ADMIN_PERM,
10916                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10917                                   NL80211_FLAG_NEED_RTNL,
10918         },
10919         {
10920                 .cmd = NL80211_CMD_SET_QOS_MAP,
10921                 .doit = nl80211_set_qos_map,
10922                 .policy = nl80211_policy,
10923                 .flags = GENL_ADMIN_PERM,
10924                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10925                                   NL80211_FLAG_NEED_RTNL,
10926         },
10927         {
10928                 .cmd = NL80211_CMD_ADD_TX_TS,
10929                 .doit = nl80211_add_tx_ts,
10930                 .policy = nl80211_policy,
10931                 .flags = GENL_ADMIN_PERM,
10932                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10933                                   NL80211_FLAG_NEED_RTNL,
10934         },
10935         {
10936                 .cmd = NL80211_CMD_DEL_TX_TS,
10937                 .doit = nl80211_del_tx_ts,
10938                 .policy = nl80211_policy,
10939                 .flags = GENL_ADMIN_PERM,
10940                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10941                                   NL80211_FLAG_NEED_RTNL,
10942         },
10943         {
10944                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
10945                 .doit = nl80211_tdls_channel_switch,
10946                 .policy = nl80211_policy,
10947                 .flags = GENL_ADMIN_PERM,
10948                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10949                                   NL80211_FLAG_NEED_RTNL,
10950         },
10951         {
10952                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
10953                 .doit = nl80211_tdls_cancel_channel_switch,
10954                 .policy = nl80211_policy,
10955                 .flags = GENL_ADMIN_PERM,
10956                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10957                                   NL80211_FLAG_NEED_RTNL,
10958         },
10959 };
10960
10961 /* notification functions */
10962
10963 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10964                           enum nl80211_commands cmd)
10965 {
10966         struct sk_buff *msg;
10967         struct nl80211_dump_wiphy_state state = {};
10968
10969         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10970                 cmd != NL80211_CMD_DEL_WIPHY);
10971
10972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10973         if (!msg)
10974                 return;
10975
10976         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10977                 nlmsg_free(msg);
10978                 return;
10979         }
10980
10981         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10982                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10983 }
10984
10985 static int nl80211_add_scan_req(struct sk_buff *msg,
10986                                 struct cfg80211_registered_device *rdev)
10987 {
10988         struct cfg80211_scan_request *req = rdev->scan_req;
10989         struct nlattr *nest;
10990         int i;
10991
10992         if (WARN_ON(!req))
10993                 return 0;
10994
10995         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10996         if (!nest)
10997                 goto nla_put_failure;
10998         for (i = 0; i < req->n_ssids; i++) {
10999                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11000                         goto nla_put_failure;
11001         }
11002         nla_nest_end(msg, nest);
11003
11004         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11005         if (!nest)
11006                 goto nla_put_failure;
11007         for (i = 0; i < req->n_channels; i++) {
11008                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11009                         goto nla_put_failure;
11010         }
11011         nla_nest_end(msg, nest);
11012
11013         if (req->ie &&
11014             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11015                 goto nla_put_failure;
11016
11017         if (req->flags &&
11018             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11019                 goto nla_put_failure;
11020
11021         return 0;
11022  nla_put_failure:
11023         return -ENOBUFS;
11024 }
11025
11026 static int nl80211_send_scan_msg(struct sk_buff *msg,
11027                                  struct cfg80211_registered_device *rdev,
11028                                  struct wireless_dev *wdev,
11029                                  u32 portid, u32 seq, int flags,
11030                                  u32 cmd)
11031 {
11032         void *hdr;
11033
11034         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11035         if (!hdr)
11036                 return -1;
11037
11038         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11039             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11040                                          wdev->netdev->ifindex)) ||
11041             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11042                 goto nla_put_failure;
11043
11044         /* ignore errors and send incomplete event anyway */
11045         nl80211_add_scan_req(msg, rdev);
11046
11047         genlmsg_end(msg, hdr);
11048         return 0;
11049
11050  nla_put_failure:
11051         genlmsg_cancel(msg, hdr);
11052         return -EMSGSIZE;
11053 }
11054
11055 static int
11056 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11057                             struct cfg80211_registered_device *rdev,
11058                             struct net_device *netdev,
11059                             u32 portid, u32 seq, int flags, u32 cmd)
11060 {
11061         void *hdr;
11062
11063         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11064         if (!hdr)
11065                 return -1;
11066
11067         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11068             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11069                 goto nla_put_failure;
11070
11071         genlmsg_end(msg, hdr);
11072         return 0;
11073
11074  nla_put_failure:
11075         genlmsg_cancel(msg, hdr);
11076         return -EMSGSIZE;
11077 }
11078
11079 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11080                              struct wireless_dev *wdev)
11081 {
11082         struct sk_buff *msg;
11083
11084         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11085         if (!msg)
11086                 return;
11087
11088         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11089                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11090                 nlmsg_free(msg);
11091                 return;
11092         }
11093
11094         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11095                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11096 }
11097
11098 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11099                                        struct wireless_dev *wdev, bool aborted)
11100 {
11101         struct sk_buff *msg;
11102
11103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11104         if (!msg)
11105                 return NULL;
11106
11107         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11108                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11109                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11110                 nlmsg_free(msg);
11111                 return NULL;
11112         }
11113
11114         return msg;
11115 }
11116
11117 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11118                               struct sk_buff *msg)
11119 {
11120         if (!msg)
11121                 return;
11122
11123         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11124                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11125 }
11126
11127 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11128                                      struct net_device *netdev)
11129 {
11130         struct sk_buff *msg;
11131
11132         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11133         if (!msg)
11134                 return;
11135
11136         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11137                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11138                 nlmsg_free(msg);
11139                 return;
11140         }
11141
11142         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11143                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11144 }
11145
11146 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11147                              struct net_device *netdev, u32 cmd)
11148 {
11149         struct sk_buff *msg;
11150
11151         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11152         if (!msg)
11153                 return;
11154
11155         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11156                 nlmsg_free(msg);
11157                 return;
11158         }
11159
11160         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11161                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11162 }
11163
11164 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11165                                           struct regulatory_request *request)
11166 {
11167         /* Userspace can always count this one always being set */
11168         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11169                 goto nla_put_failure;
11170
11171         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11172                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11173                                NL80211_REGDOM_TYPE_WORLD))
11174                         goto nla_put_failure;
11175         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11176                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11177                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11178                         goto nla_put_failure;
11179         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11180                    request->intersect) {
11181                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11182                                NL80211_REGDOM_TYPE_INTERSECTION))
11183                         goto nla_put_failure;
11184         } else {
11185                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11186                                NL80211_REGDOM_TYPE_COUNTRY) ||
11187                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11188                                    request->alpha2))
11189                         goto nla_put_failure;
11190         }
11191
11192         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11193                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11194
11195                 if (wiphy &&
11196                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11197                         goto nla_put_failure;
11198
11199                 if (wiphy &&
11200                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11201                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11202                         goto nla_put_failure;
11203         }
11204
11205         return true;
11206
11207 nla_put_failure:
11208         return false;
11209 }
11210
11211 /*
11212  * This can happen on global regulatory changes or device specific settings
11213  * based on custom regulatory domains.
11214  */
11215 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11216                                      struct regulatory_request *request)
11217 {
11218         struct sk_buff *msg;
11219         void *hdr;
11220
11221         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11222         if (!msg)
11223                 return;
11224
11225         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11226         if (!hdr) {
11227                 nlmsg_free(msg);
11228                 return;
11229         }
11230
11231         if (nl80211_reg_change_event_fill(msg, request) == false)
11232                 goto nla_put_failure;
11233
11234         genlmsg_end(msg, hdr);
11235
11236         rcu_read_lock();
11237         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11238                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11239         rcu_read_unlock();
11240
11241         return;
11242
11243 nla_put_failure:
11244         genlmsg_cancel(msg, hdr);
11245         nlmsg_free(msg);
11246 }
11247
11248 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11249                                     struct net_device *netdev,
11250                                     const u8 *buf, size_t len,
11251                                     enum nl80211_commands cmd, gfp_t gfp,
11252                                     int uapsd_queues)
11253 {
11254         struct sk_buff *msg;
11255         void *hdr;
11256
11257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11258         if (!msg)
11259                 return;
11260
11261         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11262         if (!hdr) {
11263                 nlmsg_free(msg);
11264                 return;
11265         }
11266
11267         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11268             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11269             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11270                 goto nla_put_failure;
11271
11272         if (uapsd_queues >= 0) {
11273                 struct nlattr *nla_wmm =
11274                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11275                 if (!nla_wmm)
11276                         goto nla_put_failure;
11277
11278                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11279                                uapsd_queues))
11280                         goto nla_put_failure;
11281
11282                 nla_nest_end(msg, nla_wmm);
11283         }
11284
11285         genlmsg_end(msg, hdr);
11286
11287         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11288                                 NL80211_MCGRP_MLME, gfp);
11289         return;
11290
11291  nla_put_failure:
11292         genlmsg_cancel(msg, hdr);
11293         nlmsg_free(msg);
11294 }
11295
11296 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11297                           struct net_device *netdev, const u8 *buf,
11298                           size_t len, gfp_t gfp)
11299 {
11300         nl80211_send_mlme_event(rdev, netdev, buf, len,
11301                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11302 }
11303
11304 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11305                            struct net_device *netdev, const u8 *buf,
11306                            size_t len, gfp_t gfp, int uapsd_queues)
11307 {
11308         nl80211_send_mlme_event(rdev, netdev, buf, len,
11309                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11310 }
11311
11312 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11313                          struct net_device *netdev, const u8 *buf,
11314                          size_t len, gfp_t gfp)
11315 {
11316         nl80211_send_mlme_event(rdev, netdev, buf, len,
11317                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11318 }
11319
11320 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11321                            struct net_device *netdev, const u8 *buf,
11322                            size_t len, gfp_t gfp)
11323 {
11324         nl80211_send_mlme_event(rdev, netdev, buf, len,
11325                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11326 }
11327
11328 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11329                                   size_t len)
11330 {
11331         struct wireless_dev *wdev = dev->ieee80211_ptr;
11332         struct wiphy *wiphy = wdev->wiphy;
11333         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11334         const struct ieee80211_mgmt *mgmt = (void *)buf;
11335         u32 cmd;
11336
11337         if (WARN_ON(len < 2))
11338                 return;
11339
11340         if (ieee80211_is_deauth(mgmt->frame_control))
11341                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11342         else
11343                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11344
11345         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11346         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11347 }
11348 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11349
11350 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11351                                       struct net_device *netdev, int cmd,
11352                                       const u8 *addr, gfp_t gfp)
11353 {
11354         struct sk_buff *msg;
11355         void *hdr;
11356
11357         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11358         if (!msg)
11359                 return;
11360
11361         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11362         if (!hdr) {
11363                 nlmsg_free(msg);
11364                 return;
11365         }
11366
11367         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11368             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11369             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11370             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11371                 goto nla_put_failure;
11372
11373         genlmsg_end(msg, hdr);
11374
11375         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11376                                 NL80211_MCGRP_MLME, gfp);
11377         return;
11378
11379  nla_put_failure:
11380         genlmsg_cancel(msg, hdr);
11381         nlmsg_free(msg);
11382 }
11383
11384 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11385                                struct net_device *netdev, const u8 *addr,
11386                                gfp_t gfp)
11387 {
11388         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11389                                   addr, gfp);
11390 }
11391
11392 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11393                                 struct net_device *netdev, const u8 *addr,
11394                                 gfp_t gfp)
11395 {
11396         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11397                                   addr, gfp);
11398 }
11399
11400 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11401                                  struct net_device *netdev, const u8 *bssid,
11402                                  const u8 *req_ie, size_t req_ie_len,
11403                                  const u8 *resp_ie, size_t resp_ie_len,
11404                                  u16 status, gfp_t gfp)
11405 {
11406         struct sk_buff *msg;
11407         void *hdr;
11408
11409         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11410         if (!msg)
11411                 return;
11412
11413         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11414         if (!hdr) {
11415                 nlmsg_free(msg);
11416                 return;
11417         }
11418
11419         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11420             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11421             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11422             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11423             (req_ie &&
11424              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11425             (resp_ie &&
11426              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11427                 goto nla_put_failure;
11428
11429         genlmsg_end(msg, hdr);
11430
11431         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11432                                 NL80211_MCGRP_MLME, gfp);
11433         return;
11434
11435  nla_put_failure:
11436         genlmsg_cancel(msg, hdr);
11437         nlmsg_free(msg);
11438
11439 }
11440
11441 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11442                          struct net_device *netdev, const u8 *bssid,
11443                          const u8 *req_ie, size_t req_ie_len,
11444                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11445 {
11446         struct sk_buff *msg;
11447         void *hdr;
11448
11449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11450         if (!msg)
11451                 return;
11452
11453         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11454         if (!hdr) {
11455                 nlmsg_free(msg);
11456                 return;
11457         }
11458
11459         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11460             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11461             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11462             (req_ie &&
11463              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11464             (resp_ie &&
11465              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11466                 goto nla_put_failure;
11467
11468         genlmsg_end(msg, hdr);
11469
11470         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11471                                 NL80211_MCGRP_MLME, gfp);
11472         return;
11473
11474  nla_put_failure:
11475         genlmsg_cancel(msg, hdr);
11476         nlmsg_free(msg);
11477
11478 }
11479
11480 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11481                                struct net_device *netdev, u16 reason,
11482                                const u8 *ie, size_t ie_len, bool from_ap)
11483 {
11484         struct sk_buff *msg;
11485         void *hdr;
11486
11487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11488         if (!msg)
11489                 return;
11490
11491         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11492         if (!hdr) {
11493                 nlmsg_free(msg);
11494                 return;
11495         }
11496
11497         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11498             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11499             (from_ap && reason &&
11500              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
11501             (from_ap &&
11502              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
11503             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
11504                 goto nla_put_failure;
11505
11506         genlmsg_end(msg, hdr);
11507
11508         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11509                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11510         return;
11511
11512  nla_put_failure:
11513         genlmsg_cancel(msg, hdr);
11514         nlmsg_free(msg);
11515
11516 }
11517
11518 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
11519                              struct net_device *netdev, const u8 *bssid,
11520                              gfp_t gfp)
11521 {
11522         struct sk_buff *msg;
11523         void *hdr;
11524
11525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11526         if (!msg)
11527                 return;
11528
11529         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11530         if (!hdr) {
11531                 nlmsg_free(msg);
11532                 return;
11533         }
11534
11535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11536             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11537             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11538                 goto nla_put_failure;
11539
11540         genlmsg_end(msg, hdr);
11541
11542         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11543                                 NL80211_MCGRP_MLME, gfp);
11544         return;
11545
11546  nla_put_failure:
11547         genlmsg_cancel(msg, hdr);
11548         nlmsg_free(msg);
11549 }
11550
11551 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
11552                                         const u8* ie, u8 ie_len, gfp_t gfp)
11553 {
11554         struct wireless_dev *wdev = dev->ieee80211_ptr;
11555         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11556         struct sk_buff *msg;
11557         void *hdr;
11558
11559         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11560                 return;
11561
11562         trace_cfg80211_notify_new_peer_candidate(dev, addr);
11563
11564         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11565         if (!msg)
11566                 return;
11567
11568         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
11569         if (!hdr) {
11570                 nlmsg_free(msg);
11571                 return;
11572         }
11573
11574         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11575             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11576             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11577             (ie_len && ie &&
11578              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11579                 goto nla_put_failure;
11580
11581         genlmsg_end(msg, hdr);
11582
11583         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11584                                 NL80211_MCGRP_MLME, gfp);
11585         return;
11586
11587  nla_put_failure:
11588         genlmsg_cancel(msg, hdr);
11589         nlmsg_free(msg);
11590 }
11591 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11592
11593 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11594                                  struct net_device *netdev, const u8 *addr,
11595                                  enum nl80211_key_type key_type, int key_id,
11596                                  const u8 *tsc, gfp_t gfp)
11597 {
11598         struct sk_buff *msg;
11599         void *hdr;
11600
11601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11602         if (!msg)
11603                 return;
11604
11605         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11606         if (!hdr) {
11607                 nlmsg_free(msg);
11608                 return;
11609         }
11610
11611         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11612             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11613             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11614             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11615             (key_id != -1 &&
11616              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11617             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11618                 goto nla_put_failure;
11619
11620         genlmsg_end(msg, hdr);
11621
11622         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11623                                 NL80211_MCGRP_MLME, gfp);
11624         return;
11625
11626  nla_put_failure:
11627         genlmsg_cancel(msg, hdr);
11628         nlmsg_free(msg);
11629 }
11630
11631 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11632                                     struct ieee80211_channel *channel_before,
11633                                     struct ieee80211_channel *channel_after)
11634 {
11635         struct sk_buff *msg;
11636         void *hdr;
11637         struct nlattr *nl_freq;
11638
11639         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11640         if (!msg)
11641                 return;
11642
11643         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11644         if (!hdr) {
11645                 nlmsg_free(msg);
11646                 return;
11647         }
11648
11649         /*
11650          * Since we are applying the beacon hint to a wiphy we know its
11651          * wiphy_idx is valid
11652          */
11653         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11654                 goto nla_put_failure;
11655
11656         /* Before */
11657         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11658         if (!nl_freq)
11659                 goto nla_put_failure;
11660         if (nl80211_msg_put_channel(msg, channel_before, false))
11661                 goto nla_put_failure;
11662         nla_nest_end(msg, nl_freq);
11663
11664         /* After */
11665         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11666         if (!nl_freq)
11667                 goto nla_put_failure;
11668         if (nl80211_msg_put_channel(msg, channel_after, false))
11669                 goto nla_put_failure;
11670         nla_nest_end(msg, nl_freq);
11671
11672         genlmsg_end(msg, hdr);
11673
11674         rcu_read_lock();
11675         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11676                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11677         rcu_read_unlock();
11678
11679         return;
11680
11681 nla_put_failure:
11682         genlmsg_cancel(msg, hdr);
11683         nlmsg_free(msg);
11684 }
11685
11686 static void nl80211_send_remain_on_chan_event(
11687         int cmd, struct cfg80211_registered_device *rdev,
11688         struct wireless_dev *wdev, u64 cookie,
11689         struct ieee80211_channel *chan,
11690         unsigned int duration, gfp_t gfp)
11691 {
11692         struct sk_buff *msg;
11693         void *hdr;
11694
11695         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11696         if (!msg)
11697                 return;
11698
11699         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11700         if (!hdr) {
11701                 nlmsg_free(msg);
11702                 return;
11703         }
11704
11705         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11706             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11707                                          wdev->netdev->ifindex)) ||
11708             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11709             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11710             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11711                         NL80211_CHAN_NO_HT) ||
11712             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
11713                 goto nla_put_failure;
11714
11715         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
11716             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
11717                 goto nla_put_failure;
11718
11719         genlmsg_end(msg, hdr);
11720
11721         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11722                                 NL80211_MCGRP_MLME, gfp);
11723         return;
11724
11725  nla_put_failure:
11726         genlmsg_cancel(msg, hdr);
11727         nlmsg_free(msg);
11728 }
11729
11730 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
11731                                struct ieee80211_channel *chan,
11732                                unsigned int duration, gfp_t gfp)
11733 {
11734         struct wiphy *wiphy = wdev->wiphy;
11735         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11736
11737         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11738         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11739                                           rdev, wdev, cookie, chan,
11740                                           duration, gfp);
11741 }
11742 EXPORT_SYMBOL(cfg80211_ready_on_channel);
11743
11744 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
11745                                         struct ieee80211_channel *chan,
11746                                         gfp_t gfp)
11747 {
11748         struct wiphy *wiphy = wdev->wiphy;
11749         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11750
11751         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11752         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11753                                           rdev, wdev, cookie, chan, 0, gfp);
11754 }
11755 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11756
11757 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
11758                       struct station_info *sinfo, gfp_t gfp)
11759 {
11760         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11761         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11762         struct sk_buff *msg;
11763
11764         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
11765
11766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11767         if (!msg)
11768                 return;
11769
11770         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
11771                                  rdev, dev, mac_addr, sinfo) < 0) {
11772                 nlmsg_free(msg);
11773                 return;
11774         }
11775
11776         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11777                                 NL80211_MCGRP_MLME, gfp);
11778 }
11779 EXPORT_SYMBOL(cfg80211_new_sta);
11780
11781 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
11782                             struct station_info *sinfo, gfp_t gfp)
11783 {
11784         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11785         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11786         struct sk_buff *msg;
11787         struct station_info empty_sinfo = {};
11788
11789         if (!sinfo)
11790                 sinfo = &empty_sinfo;
11791
11792         trace_cfg80211_del_sta(dev, mac_addr);
11793
11794         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11795         if (!msg)
11796                 return;
11797
11798         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
11799                                  rdev, dev, mac_addr, sinfo) < 0) {
11800                 nlmsg_free(msg);
11801                 return;
11802         }
11803
11804         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11805                                 NL80211_MCGRP_MLME, gfp);
11806 }
11807 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
11808
11809 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11810                           enum nl80211_connect_failed_reason reason,
11811                           gfp_t gfp)
11812 {
11813         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11814         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11815         struct sk_buff *msg;
11816         void *hdr;
11817
11818         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11819         if (!msg)
11820                 return;
11821
11822         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11823         if (!hdr) {
11824                 nlmsg_free(msg);
11825                 return;
11826         }
11827
11828         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11829             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11830             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11831                 goto nla_put_failure;
11832
11833         genlmsg_end(msg, hdr);
11834
11835         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11836                                 NL80211_MCGRP_MLME, gfp);
11837         return;
11838
11839  nla_put_failure:
11840         genlmsg_cancel(msg, hdr);
11841         nlmsg_free(msg);
11842 }
11843 EXPORT_SYMBOL(cfg80211_conn_failed);
11844
11845 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11846                                        const u8 *addr, gfp_t gfp)
11847 {
11848         struct wireless_dev *wdev = dev->ieee80211_ptr;
11849         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11850         struct sk_buff *msg;
11851         void *hdr;
11852         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11853
11854         if (!nlportid)
11855                 return false;
11856
11857         msg = nlmsg_new(100, gfp);
11858         if (!msg)
11859                 return true;
11860
11861         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11862         if (!hdr) {
11863                 nlmsg_free(msg);
11864                 return true;
11865         }
11866
11867         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11868             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11869             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11870                 goto nla_put_failure;
11871
11872         genlmsg_end(msg, hdr);
11873         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11874         return true;
11875
11876  nla_put_failure:
11877         genlmsg_cancel(msg, hdr);
11878         nlmsg_free(msg);
11879         return true;
11880 }
11881
11882 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11883                                 const u8 *addr, gfp_t gfp)
11884 {
11885         struct wireless_dev *wdev = dev->ieee80211_ptr;
11886         bool ret;
11887
11888         trace_cfg80211_rx_spurious_frame(dev, addr);
11889
11890         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11891                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11892                 trace_cfg80211_return_bool(false);
11893                 return false;
11894         }
11895         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11896                                          addr, gfp);
11897         trace_cfg80211_return_bool(ret);
11898         return ret;
11899 }
11900 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11901
11902 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11903                                         const u8 *addr, gfp_t gfp)
11904 {
11905         struct wireless_dev *wdev = dev->ieee80211_ptr;
11906         bool ret;
11907
11908         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11909
11910         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11911                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11912                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11913                 trace_cfg80211_return_bool(false);
11914                 return false;
11915         }
11916         ret = __nl80211_unexpected_frame(dev,
11917                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11918                                          addr, gfp);
11919         trace_cfg80211_return_bool(ret);
11920         return ret;
11921 }
11922 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11923
11924 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11925                       struct wireless_dev *wdev, u32 nlportid,
11926                       int freq, int sig_dbm,
11927                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11928 {
11929         struct net_device *netdev = wdev->netdev;
11930         struct sk_buff *msg;
11931         void *hdr;
11932
11933         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11934         if (!msg)
11935                 return -ENOMEM;
11936
11937         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11938         if (!hdr) {
11939                 nlmsg_free(msg);
11940                 return -ENOMEM;
11941         }
11942
11943         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11944             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11945                                         netdev->ifindex)) ||
11946             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11947             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11948             (sig_dbm &&
11949              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11950             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11951             (flags &&
11952              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11953                 goto nla_put_failure;
11954
11955         genlmsg_end(msg, hdr);
11956
11957         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11958
11959  nla_put_failure:
11960         genlmsg_cancel(msg, hdr);
11961         nlmsg_free(msg);
11962         return -ENOBUFS;
11963 }
11964
11965 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11966                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11967 {
11968         struct wiphy *wiphy = wdev->wiphy;
11969         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11970         struct net_device *netdev = wdev->netdev;
11971         struct sk_buff *msg;
11972         void *hdr;
11973
11974         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11975
11976         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11977         if (!msg)
11978                 return;
11979
11980         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11981         if (!hdr) {
11982                 nlmsg_free(msg);
11983                 return;
11984         }
11985
11986         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11987             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11988                                    netdev->ifindex)) ||
11989             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11990             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11991             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11992             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11993                 goto nla_put_failure;
11994
11995         genlmsg_end(msg, hdr);
11996
11997         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11998                                 NL80211_MCGRP_MLME, gfp);
11999         return;
12000
12001  nla_put_failure:
12002         genlmsg_cancel(msg, hdr);
12003         nlmsg_free(msg);
12004 }
12005 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12006
12007 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12008                                             const char *mac, gfp_t gfp)
12009 {
12010         struct wireless_dev *wdev = dev->ieee80211_ptr;
12011         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12012         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12013         void **cb;
12014
12015         if (!msg)
12016                 return NULL;
12017
12018         cb = (void **)msg->cb;
12019
12020         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12021         if (!cb[0]) {
12022                 nlmsg_free(msg);
12023                 return NULL;
12024         }
12025
12026         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12027             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12028                 goto nla_put_failure;
12029
12030         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12031                 goto nla_put_failure;
12032
12033         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12034         if (!cb[1])
12035                 goto nla_put_failure;
12036
12037         cb[2] = rdev;
12038
12039         return msg;
12040  nla_put_failure:
12041         nlmsg_free(msg);
12042         return NULL;
12043 }
12044
12045 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12046 {
12047         void **cb = (void **)msg->cb;
12048         struct cfg80211_registered_device *rdev = cb[2];
12049
12050         nla_nest_end(msg, cb[1]);
12051         genlmsg_end(msg, cb[0]);
12052
12053         memset(msg->cb, 0, sizeof(msg->cb));
12054
12055         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12056                                 NL80211_MCGRP_MLME, gfp);
12057 }
12058
12059 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12060                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12061                               gfp_t gfp)
12062 {
12063         struct sk_buff *msg;
12064
12065         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12066
12067         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12068                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12069                 return;
12070
12071         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12072         if (!msg)
12073                 return;
12074
12075         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12076                         rssi_event))
12077                 goto nla_put_failure;
12078
12079         cfg80211_send_cqm(msg, gfp);
12080
12081         return;
12082
12083  nla_put_failure:
12084         nlmsg_free(msg);
12085 }
12086 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12087
12088 void cfg80211_cqm_txe_notify(struct net_device *dev,
12089                              const u8 *peer, u32 num_packets,
12090                              u32 rate, u32 intvl, gfp_t gfp)
12091 {
12092         struct sk_buff *msg;
12093
12094         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12095         if (!msg)
12096                 return;
12097
12098         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12099                 goto nla_put_failure;
12100
12101         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12102                 goto nla_put_failure;
12103
12104         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12105                 goto nla_put_failure;
12106
12107         cfg80211_send_cqm(msg, gfp);
12108         return;
12109
12110  nla_put_failure:
12111         nlmsg_free(msg);
12112 }
12113 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12114
12115 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12116                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12117 {
12118         struct sk_buff *msg;
12119
12120         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12121
12122         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12123         if (!msg)
12124                 return;
12125
12126         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12127                 goto nla_put_failure;
12128
12129         cfg80211_send_cqm(msg, gfp);
12130         return;
12131
12132  nla_put_failure:
12133         nlmsg_free(msg);
12134 }
12135 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12136
12137 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12138 {
12139         struct sk_buff *msg;
12140
12141         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12142         if (!msg)
12143                 return;
12144
12145         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12146                 goto nla_put_failure;
12147
12148         cfg80211_send_cqm(msg, gfp);
12149         return;
12150
12151  nla_put_failure:
12152         nlmsg_free(msg);
12153 }
12154 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12155
12156 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12157                                      struct net_device *netdev, const u8 *bssid,
12158                                      const u8 *replay_ctr, gfp_t gfp)
12159 {
12160         struct sk_buff *msg;
12161         struct nlattr *rekey_attr;
12162         void *hdr;
12163
12164         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12165         if (!msg)
12166                 return;
12167
12168         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12169         if (!hdr) {
12170                 nlmsg_free(msg);
12171                 return;
12172         }
12173
12174         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12175             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12176             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12177                 goto nla_put_failure;
12178
12179         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12180         if (!rekey_attr)
12181                 goto nla_put_failure;
12182
12183         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12184                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12185                 goto nla_put_failure;
12186
12187         nla_nest_end(msg, rekey_attr);
12188
12189         genlmsg_end(msg, hdr);
12190
12191         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12192                                 NL80211_MCGRP_MLME, gfp);
12193         return;
12194
12195  nla_put_failure:
12196         genlmsg_cancel(msg, hdr);
12197         nlmsg_free(msg);
12198 }
12199
12200 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12201                                const u8 *replay_ctr, gfp_t gfp)
12202 {
12203         struct wireless_dev *wdev = dev->ieee80211_ptr;
12204         struct wiphy *wiphy = wdev->wiphy;
12205         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12206
12207         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12208         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12209 }
12210 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12211
12212 static void
12213 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12214                                struct net_device *netdev, int index,
12215                                const u8 *bssid, bool preauth, gfp_t gfp)
12216 {
12217         struct sk_buff *msg;
12218         struct nlattr *attr;
12219         void *hdr;
12220
12221         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12222         if (!msg)
12223                 return;
12224
12225         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12226         if (!hdr) {
12227                 nlmsg_free(msg);
12228                 return;
12229         }
12230
12231         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12232             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12233                 goto nla_put_failure;
12234
12235         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12236         if (!attr)
12237                 goto nla_put_failure;
12238
12239         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12240             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12241             (preauth &&
12242              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12243                 goto nla_put_failure;
12244
12245         nla_nest_end(msg, attr);
12246
12247         genlmsg_end(msg, hdr);
12248
12249         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12250                                 NL80211_MCGRP_MLME, gfp);
12251         return;
12252
12253  nla_put_failure:
12254         genlmsg_cancel(msg, hdr);
12255         nlmsg_free(msg);
12256 }
12257
12258 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12259                                      const u8 *bssid, bool preauth, gfp_t gfp)
12260 {
12261         struct wireless_dev *wdev = dev->ieee80211_ptr;
12262         struct wiphy *wiphy = wdev->wiphy;
12263         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12264
12265         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12266         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12267 }
12268 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12269
12270 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12271                                      struct net_device *netdev,
12272                                      struct cfg80211_chan_def *chandef,
12273                                      gfp_t gfp,
12274                                      enum nl80211_commands notif,
12275                                      u8 count)
12276 {
12277         struct sk_buff *msg;
12278         void *hdr;
12279
12280         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12281         if (!msg)
12282                 return;
12283
12284         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12285         if (!hdr) {
12286                 nlmsg_free(msg);
12287                 return;
12288         }
12289
12290         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12291                 goto nla_put_failure;
12292
12293         if (nl80211_send_chandef(msg, chandef))
12294                 goto nla_put_failure;
12295
12296         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12297             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12298                         goto nla_put_failure;
12299
12300         genlmsg_end(msg, hdr);
12301
12302         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12303                                 NL80211_MCGRP_MLME, gfp);
12304         return;
12305
12306  nla_put_failure:
12307         genlmsg_cancel(msg, hdr);
12308         nlmsg_free(msg);
12309 }
12310
12311 void cfg80211_ch_switch_notify(struct net_device *dev,
12312                                struct cfg80211_chan_def *chandef)
12313 {
12314         struct wireless_dev *wdev = dev->ieee80211_ptr;
12315         struct wiphy *wiphy = wdev->wiphy;
12316         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12317
12318         ASSERT_WDEV_LOCK(wdev);
12319
12320         trace_cfg80211_ch_switch_notify(dev, chandef);
12321
12322         wdev->chandef = *chandef;
12323         wdev->preset_chandef = *chandef;
12324         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12325                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12326 }
12327 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
12328
12329 void cfg80211_ch_switch_started_notify(struct net_device *dev,
12330                                        struct cfg80211_chan_def *chandef,
12331                                        u8 count)
12332 {
12333         struct wireless_dev *wdev = dev->ieee80211_ptr;
12334         struct wiphy *wiphy = wdev->wiphy;
12335         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12336
12337         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12338
12339         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12340                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12341 }
12342 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12343
12344 void
12345 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12346                      const struct cfg80211_chan_def *chandef,
12347                      enum nl80211_radar_event event,
12348                      struct net_device *netdev, gfp_t gfp)
12349 {
12350         struct sk_buff *msg;
12351         void *hdr;
12352
12353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12354         if (!msg)
12355                 return;
12356
12357         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12358         if (!hdr) {
12359                 nlmsg_free(msg);
12360                 return;
12361         }
12362
12363         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12364                 goto nla_put_failure;
12365
12366         /* NOP and radar events don't need a netdev parameter */
12367         if (netdev) {
12368                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12369
12370                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12371                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12372                         goto nla_put_failure;
12373         }
12374
12375         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12376                 goto nla_put_failure;
12377
12378         if (nl80211_send_chandef(msg, chandef))
12379                 goto nla_put_failure;
12380
12381         genlmsg_end(msg, hdr);
12382
12383         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12384                                 NL80211_MCGRP_MLME, gfp);
12385         return;
12386
12387  nla_put_failure:
12388         genlmsg_cancel(msg, hdr);
12389         nlmsg_free(msg);
12390 }
12391
12392 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12393                            u64 cookie, bool acked, gfp_t gfp)
12394 {
12395         struct wireless_dev *wdev = dev->ieee80211_ptr;
12396         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12397         struct sk_buff *msg;
12398         void *hdr;
12399
12400         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12401
12402         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12403
12404         if (!msg)
12405                 return;
12406
12407         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12408         if (!hdr) {
12409                 nlmsg_free(msg);
12410                 return;
12411         }
12412
12413         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12414             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12415             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12416             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12417             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12418                 goto nla_put_failure;
12419
12420         genlmsg_end(msg, hdr);
12421
12422         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12423                                 NL80211_MCGRP_MLME, gfp);
12424         return;
12425
12426  nla_put_failure:
12427         genlmsg_cancel(msg, hdr);
12428         nlmsg_free(msg);
12429 }
12430 EXPORT_SYMBOL(cfg80211_probe_status);
12431
12432 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12433                                  const u8 *frame, size_t len,
12434                                  int freq, int sig_dbm)
12435 {
12436         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12437         struct sk_buff *msg;
12438         void *hdr;
12439         struct cfg80211_beacon_registration *reg;
12440
12441         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12442
12443         spin_lock_bh(&rdev->beacon_registrations_lock);
12444         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12445                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12446                 if (!msg) {
12447                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12448                         return;
12449                 }
12450
12451                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12452                 if (!hdr)
12453                         goto nla_put_failure;
12454
12455                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12456                     (freq &&
12457                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12458                     (sig_dbm &&
12459                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12460                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12461                         goto nla_put_failure;
12462
12463                 genlmsg_end(msg, hdr);
12464
12465                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12466         }
12467         spin_unlock_bh(&rdev->beacon_registrations_lock);
12468         return;
12469
12470  nla_put_failure:
12471         spin_unlock_bh(&rdev->beacon_registrations_lock);
12472         if (hdr)
12473                 genlmsg_cancel(msg, hdr);
12474         nlmsg_free(msg);
12475 }
12476 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12477
12478 #ifdef CONFIG_PM
12479 static int cfg80211_net_detect_results(struct sk_buff *msg,
12480                                        struct cfg80211_wowlan_wakeup *wakeup)
12481 {
12482         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12483         struct nlattr *nl_results, *nl_match, *nl_freqs;
12484         int i, j;
12485
12486         nl_results = nla_nest_start(
12487                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12488         if (!nl_results)
12489                 return -EMSGSIZE;
12490
12491         for (i = 0; i < nd->n_matches; i++) {
12492                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12493
12494                 nl_match = nla_nest_start(msg, i);
12495                 if (!nl_match)
12496                         break;
12497
12498                 /* The SSID attribute is optional in nl80211, but for
12499                  * simplicity reasons it's always present in the
12500                  * cfg80211 structure.  If a driver can't pass the
12501                  * SSID, that needs to be changed.  A zero length SSID
12502                  * is still a valid SSID (wildcard), so it cannot be
12503                  * used for this purpose.
12504                  */
12505                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
12506                             match->ssid.ssid)) {
12507                         nla_nest_cancel(msg, nl_match);
12508                         goto out;
12509                 }
12510
12511                 if (match->n_channels) {
12512                         nl_freqs = nla_nest_start(
12513                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
12514                         if (!nl_freqs) {
12515                                 nla_nest_cancel(msg, nl_match);
12516                                 goto out;
12517                         }
12518
12519                         for (j = 0; j < match->n_channels; j++) {
12520                                 if (nla_put_u32(msg,
12521                                                 NL80211_ATTR_WIPHY_FREQ,
12522                                                 match->channels[j])) {
12523                                         nla_nest_cancel(msg, nl_freqs);
12524                                         nla_nest_cancel(msg, nl_match);
12525                                         goto out;
12526                                 }
12527                         }
12528
12529                         nla_nest_end(msg, nl_freqs);
12530                 }
12531
12532                 nla_nest_end(msg, nl_match);
12533         }
12534
12535 out:
12536         nla_nest_end(msg, nl_results);
12537         return 0;
12538 }
12539
12540 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
12541                                    struct cfg80211_wowlan_wakeup *wakeup,
12542                                    gfp_t gfp)
12543 {
12544         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12545         struct sk_buff *msg;
12546         void *hdr;
12547         int size = 200;
12548
12549         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
12550
12551         if (wakeup)
12552                 size += wakeup->packet_present_len;
12553
12554         msg = nlmsg_new(size, gfp);
12555         if (!msg)
12556                 return;
12557
12558         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
12559         if (!hdr)
12560                 goto free_msg;
12561
12562         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12563             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12564                 goto free_msg;
12565
12566         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12567                                         wdev->netdev->ifindex))
12568                 goto free_msg;
12569
12570         if (wakeup) {
12571                 struct nlattr *reasons;
12572
12573                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12574                 if (!reasons)
12575                         goto free_msg;
12576
12577                 if (wakeup->disconnect &&
12578                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
12579                         goto free_msg;
12580                 if (wakeup->magic_pkt &&
12581                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
12582                         goto free_msg;
12583                 if (wakeup->gtk_rekey_failure &&
12584                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
12585                         goto free_msg;
12586                 if (wakeup->eap_identity_req &&
12587                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
12588                         goto free_msg;
12589                 if (wakeup->four_way_handshake &&
12590                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
12591                         goto free_msg;
12592                 if (wakeup->rfkill_release &&
12593                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
12594                         goto free_msg;
12595
12596                 if (wakeup->pattern_idx >= 0 &&
12597                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
12598                                 wakeup->pattern_idx))
12599                         goto free_msg;
12600
12601                 if (wakeup->tcp_match &&
12602                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
12603                         goto free_msg;
12604
12605                 if (wakeup->tcp_connlost &&
12606                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
12607                         goto free_msg;
12608
12609                 if (wakeup->tcp_nomoretokens &&
12610                     nla_put_flag(msg,
12611                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
12612                         goto free_msg;
12613
12614                 if (wakeup->packet) {
12615                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
12616                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
12617
12618                         if (!wakeup->packet_80211) {
12619                                 pkt_attr =
12620                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
12621                                 len_attr =
12622                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
12623                         }
12624
12625                         if (wakeup->packet_len &&
12626                             nla_put_u32(msg, len_attr, wakeup->packet_len))
12627                                 goto free_msg;
12628
12629                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
12630                                     wakeup->packet))
12631                                 goto free_msg;
12632                 }
12633
12634                 if (wakeup->net_detect &&
12635                     cfg80211_net_detect_results(msg, wakeup))
12636                                 goto free_msg;
12637
12638                 nla_nest_end(msg, reasons);
12639         }
12640
12641         genlmsg_end(msg, hdr);
12642
12643         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12644                                 NL80211_MCGRP_MLME, gfp);
12645         return;
12646
12647  free_msg:
12648         nlmsg_free(msg);
12649 }
12650 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12651 #endif
12652
12653 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12654                                 enum nl80211_tdls_operation oper,
12655                                 u16 reason_code, gfp_t gfp)
12656 {
12657         struct wireless_dev *wdev = dev->ieee80211_ptr;
12658         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12659         struct sk_buff *msg;
12660         void *hdr;
12661
12662         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12663                                          reason_code);
12664
12665         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12666         if (!msg)
12667                 return;
12668
12669         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12670         if (!hdr) {
12671                 nlmsg_free(msg);
12672                 return;
12673         }
12674
12675         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12676             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12677             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12678             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12679             (reason_code > 0 &&
12680              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12681                 goto nla_put_failure;
12682
12683         genlmsg_end(msg, hdr);
12684
12685         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12686                                 NL80211_MCGRP_MLME, gfp);
12687         return;
12688
12689  nla_put_failure:
12690         genlmsg_cancel(msg, hdr);
12691         nlmsg_free(msg);
12692 }
12693 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12694
12695 static int nl80211_netlink_notify(struct notifier_block * nb,
12696                                   unsigned long state,
12697                                   void *_notify)
12698 {
12699         struct netlink_notify *notify = _notify;
12700         struct cfg80211_registered_device *rdev;
12701         struct wireless_dev *wdev;
12702         struct cfg80211_beacon_registration *reg, *tmp;
12703
12704         if (state != NETLINK_URELEASE)
12705                 return NOTIFY_DONE;
12706
12707         rcu_read_lock();
12708
12709         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12710                 bool schedule_destroy_work = false;
12711                 bool schedule_scan_stop = false;
12712                 struct cfg80211_sched_scan_request *sched_scan_req =
12713                         rcu_dereference(rdev->sched_scan_req);
12714
12715                 if (sched_scan_req && notify->portid &&
12716                     sched_scan_req->owner_nlportid == notify->portid)
12717                         schedule_scan_stop = true;
12718
12719                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12720                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
12721
12722                         if (wdev->owner_nlportid == notify->portid)
12723                                 schedule_destroy_work = true;
12724                 }
12725
12726                 spin_lock_bh(&rdev->beacon_registrations_lock);
12727                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
12728                                          list) {
12729                         if (reg->nlportid == notify->portid) {
12730                                 list_del(&reg->list);
12731                                 kfree(reg);
12732                                 break;
12733                         }
12734                 }
12735                 spin_unlock_bh(&rdev->beacon_registrations_lock);
12736
12737                 if (schedule_destroy_work) {
12738                         struct cfg80211_iface_destroy *destroy;
12739
12740                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
12741                         if (destroy) {
12742                                 destroy->nlportid = notify->portid;
12743                                 spin_lock(&rdev->destroy_list_lock);
12744                                 list_add(&destroy->list, &rdev->destroy_list);
12745                                 spin_unlock(&rdev->destroy_list_lock);
12746                                 schedule_work(&rdev->destroy_work);
12747                         }
12748                 } else if (schedule_scan_stop) {
12749                         sched_scan_req->owner_nlportid = 0;
12750
12751                         if (rdev->ops->sched_scan_stop &&
12752                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
12753                                 schedule_work(&rdev->sched_scan_stop_wk);
12754                 }
12755         }
12756
12757         rcu_read_unlock();
12758
12759         return NOTIFY_OK;
12760 }
12761
12762 static struct notifier_block nl80211_netlink_notifier = {
12763         .notifier_call = nl80211_netlink_notify,
12764 };
12765
12766 void cfg80211_ft_event(struct net_device *netdev,
12767                        struct cfg80211_ft_event_params *ft_event)
12768 {
12769         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12770         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12771         struct sk_buff *msg;
12772         void *hdr;
12773
12774         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
12775
12776         if (!ft_event->target_ap)
12777                 return;
12778
12779         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12780         if (!msg)
12781                 return;
12782
12783         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12784         if (!hdr)
12785                 goto out;
12786
12787         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12788             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12789             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
12790                 goto out;
12791
12792         if (ft_event->ies &&
12793             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
12794                 goto out;
12795         if (ft_event->ric_ies &&
12796             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
12797                     ft_event->ric_ies))
12798                 goto out;
12799
12800         genlmsg_end(msg, hdr);
12801
12802         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12803                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12804         return;
12805  out:
12806         nlmsg_free(msg);
12807 }
12808 EXPORT_SYMBOL(cfg80211_ft_event);
12809
12810 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
12811 {
12812         struct cfg80211_registered_device *rdev;
12813         struct sk_buff *msg;
12814         void *hdr;
12815         u32 nlportid;
12816
12817         rdev = wiphy_to_rdev(wdev->wiphy);
12818         if (!rdev->crit_proto_nlportid)
12819                 return;
12820
12821         nlportid = rdev->crit_proto_nlportid;
12822         rdev->crit_proto_nlportid = 0;
12823
12824         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12825         if (!msg)
12826                 return;
12827
12828         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
12829         if (!hdr)
12830                 goto nla_put_failure;
12831
12832         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12833             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12834                 goto nla_put_failure;
12835
12836         genlmsg_end(msg, hdr);
12837
12838         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12839         return;
12840
12841  nla_put_failure:
12842         if (hdr)
12843                 genlmsg_cancel(msg, hdr);
12844         nlmsg_free(msg);
12845
12846 }
12847 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
12848
12849 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
12850 {
12851         struct wiphy *wiphy = wdev->wiphy;
12852         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12853         struct sk_buff *msg;
12854         void *hdr;
12855
12856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12857         if (!msg)
12858                 return;
12859
12860         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
12861         if (!hdr)
12862                 goto out;
12863
12864         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12865             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
12866             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12867                 goto out;
12868
12869         genlmsg_end(msg, hdr);
12870
12871         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
12872                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12873         return;
12874  out:
12875         nlmsg_free(msg);
12876 }
12877
12878 /* initialisation/exit functions */
12879
12880 int nl80211_init(void)
12881 {
12882         int err;
12883
12884         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
12885                                                    nl80211_mcgrps);
12886         if (err)
12887                 return err;
12888
12889         err = netlink_register_notifier(&nl80211_netlink_notifier);
12890         if (err)
12891                 goto err_out;
12892
12893         return 0;
12894  err_out:
12895         genl_unregister_family(&nl80211_fam);
12896         return err;
12897 }
12898
12899 void nl80211_exit(void)
12900 {
12901         netlink_unregister_notifier(&nl80211_netlink_notifier);
12902         genl_unregister_family(&nl80211_fam);
12903 }