net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/nospec.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 static int validate_beacon_head(const struct nlattr *attr)
 212 {
 213         const u8 *data = nla_data(attr);
 214         unsigned int len = nla_len(attr);
 215         const struct element *elem;
 216         const struct ieee80211_mgmt *mgmt = (void *)data;
 217         unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
 218                                          u.beacon.variable);
 219
 220         if (len < fixedlen)
 221                 goto err;
 222
 223         if (ieee80211_hdrlen(mgmt->frame_control) !=
 224             offsetof(struct ieee80211_mgmt, u.beacon))
 225                 goto err;
 226
 227         data += fixedlen;
 228         len -= fixedlen;
 229
 230         for_each_element(elem, data, len) {
 231                 /* nothing */
 232         }
 233
 234         if (for_each_element_completed(elem, data, len))
 235                 return 0;
 236
 237 err:
 238         return -EINVAL;
 239 }
 240
 241 /* policy for the attributes */
 242 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 243         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 244         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 245                                       .len = 20-1 },
 246         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 247
 248         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 249         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 250         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 251         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 252         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 253
 254         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 255         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 256         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 257         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 259
 260         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 261         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 262         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 263
 264         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 265         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 266
 267         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 268         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 269                                     .len = WLAN_MAX_KEY_LEN },
 270         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 271         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 272         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 273         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 274         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 275
 276         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 277         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 278         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 279                                        .len = IEEE80211_MAX_DATA_LEN },
 280         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 281                                        .len = IEEE80211_MAX_DATA_LEN },
 282         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 283         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 285         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 286                                                .len = NL80211_MAX_SUPP_RATES },
 287         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 288         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 289         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 290         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 291                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 292         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY,
 293                                           .len = ETH_ALEN },
 294
 295         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 296         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 297
 298         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 299         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 300         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 301         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 302                                            .len = NL80211_MAX_SUPP_RATES },
 303         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 304
 305         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 306         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 307
 308         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 309
 310         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 311         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 312                               .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 314         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 315
 316         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 317                                 .len = IEEE80211_MAX_SSID_LEN },
 318         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 319         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 323         [NL80211_ATTR_STA_FLAGS2] = {
 324                 .len = sizeof(struct nl80211_sta_flag_update),
 325         },
 326         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 329         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 330         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 331         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 332         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 333         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 334         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 335         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 336         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 337         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 339                                  .len = IEEE80211_MAX_DATA_LEN },
 340         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 341         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 342         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 343         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 345         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 346         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 347         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 348         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 349         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 350         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 351         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 353         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 354         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 355         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 356         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 357         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 358         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 359         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 360                                          .len = IEEE80211_MAX_DATA_LEN },
 361         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 362                                          .len = IEEE80211_MAX_DATA_LEN },
 363         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 365         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 367         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 368         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 369         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 370         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 371         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 372         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 373                                       .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 375         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 377                 .len = NL80211_HT_CAPABILITY_LEN
 378         },
 379         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 380         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 381         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 382         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 383         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 384         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 385         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 386         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 387         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 388         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 389         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 390         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 391         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 392         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 393         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 394         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 395         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 397                 .len = NL80211_VHT_CAPABILITY_LEN,
 398         },
 399         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 400         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 401                                   .len = IEEE80211_MAX_DATA_LEN },
 402         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 403         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 404         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 405         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 407         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 408         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 409         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 410         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 411         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 412         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 413         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 414         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 415         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 416                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 417         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 418         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 419         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 420         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 421         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 422 };
 423
 424 /* policy for the key attributes */
 425 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 426         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 427         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 428         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 429         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 430         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 431         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 432         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 433         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 434 };
 435
 436 /* policy for the key default flags */
 437 static const struct nla_policy
 438 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 439         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 440         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 441 };
 442
 443 /* policy for WoWLAN attributes */
 444 static const struct nla_policy
 445 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 446         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 447         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 448         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 449         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 450         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 451         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 452         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 453         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 454         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 455 };
 456
 457 static const struct nla_policy
 458 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 459         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 460         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 461         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 462         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 463         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 464         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 465         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 466                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 467         },
 468         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 469                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 470         },
 471         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 472         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 473         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 474 };
 475
 476 /* policy for coalesce rule attributes */
 477 static const struct nla_policy
 478 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 479         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 480         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 481         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 482 };
 483
 484 /* policy for GTK rekey offload attributes */
 485 static const struct nla_policy
 486 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 487         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 488         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 489         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 490 };
 491
 492 static const struct nla_policy
 493 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 494         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 495                                                  .len = IEEE80211_MAX_SSID_LEN },
 496         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 497 };
 498
 499 /* policy for packet pattern attributes */
 500 static const struct nla_policy
 501 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 502         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 503         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 504         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 505 };
 506
 507 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 508                                      struct netlink_callback *cb,
 509                                      struct cfg80211_registered_device **rdev,
 510                                      struct wireless_dev **wdev)
 511 {
 512         int err;
 513
 514         if (!cb->args[0]) {
 515                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 516                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 517                                   nl80211_policy);
 518                 if (err)
 519                         return err;
 520
 521                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 522                                                    nl80211_fam.attrbuf);
 523                 if (IS_ERR(*wdev))
 524                         return PTR_ERR(*wdev);
 525                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 526                 /* 0 is the first index - add 1 to parse only once */
 527                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 528                 cb->args[1] = (*wdev)->identifier;
 529         } else {
 530                 /* subtract the 1 again here */
 531                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 532                 struct wireless_dev *tmp;
 533
 534                 if (!wiphy)
 535                         return -ENODEV;
 536                 *rdev = wiphy_to_rdev(wiphy);
 537                 *wdev = NULL;
 538
 539                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 540                         if (tmp->identifier == cb->args[1]) {
 541                                 *wdev = tmp;
 542                                 break;
 543                         }
 544                 }
 545
 546                 if (!*wdev)
 547                         return -ENODEV;
 548         }
 549
 550         return 0;
 551 }
 552
 553 /* IE validation */
 554 static bool is_valid_ie_attr(const struct nlattr *attr)
 555 {
 556         const u8 *pos;
 557         int len;
 558
 559         if (!attr)
 560                 return true;
 561
 562         pos = nla_data(attr);
 563         len = nla_len(attr);
 564
 565         while (len) {
 566                 u8 elemlen;
 567
 568                 if (len < 2)
 569                         return false;
 570                 len -= 2;
 571
 572                 elemlen = pos[1];
 573                 if (elemlen > len)
 574                         return false;
 575
 576                 len -= elemlen;
 577                 pos += 2 + elemlen;
 578         }
 579
 580         return true;
 581 }
 582
 583 /* message building helper */
 584 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 585                                    int flags, u8 cmd)
 586 {
 587         /* since there is no private header just add the generic one */
 588         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 589 }
 590
 591 static int nl80211_msg_put_channel(struct sk_buff *msg,
 592                                    struct ieee80211_channel *chan,
 593                                    bool large)
 594 {
 595         /* Some channels must be completely excluded from the
 596          * list to protect old user-space tools from breaking
 597          */
 598         if (!large && chan->flags &
 599             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 600                 return 0;
 601
 602         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 603                         chan->center_freq))
 604                 goto nla_put_failure;
 605
 606         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 607             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 608                 goto nla_put_failure;
 609         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 610                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 611                         goto nla_put_failure;
 612                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 613                         goto nla_put_failure;
 614         }
 615         if (chan->flags & IEEE80211_CHAN_RADAR) {
 616                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 617                         goto nla_put_failure;
 618                 if (large) {
 619                         u32 time;
 620
 621                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 622
 623                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 624                                         chan->dfs_state))
 625                                 goto nla_put_failure;
 626                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 627                                         time))
 628                                 goto nla_put_failure;
 629                         if (nla_put_u32(msg,
 630                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 631                                         chan->dfs_cac_ms))
 632                                 goto nla_put_failure;
 633                 }
 634         }
 635
 636         if (large) {
 637                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 638                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 639                         goto nla_put_failure;
 640                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 641                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 642                         goto nla_put_failure;
 643                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 644                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 645                         goto nla_put_failure;
 646                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 651                         goto nla_put_failure;
 652                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 653                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 654                         goto nla_put_failure;
 655                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 656                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 657                         goto nla_put_failure;
 658                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 659                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 660                         goto nla_put_failure;
 661         }
 662
 663         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 664                         DBM_TO_MBM(chan->max_power)))
 665                 goto nla_put_failure;
 666
 667         return 0;
 668
 669  nla_put_failure:
 670         return -ENOBUFS;
 671 }
 672
 673 /* netlink command implementations */
 674
 675 struct key_parse {
 676         struct key_params p;
 677         int idx;
 678         int type;
 679         bool def, defmgmt;
 680         bool def_uni, def_multi;
 681 };
 682
 683 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 684 {
 685         struct nlattr *tb[NL80211_KEY_MAX + 1];
 686         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 687                                    nl80211_key_policy);
 688         if (err)
 689                 return err;
 690
 691         k->def = !!tb[NL80211_KEY_DEFAULT];
 692         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 693
 694         if (k->def) {
 695                 k->def_uni = true;
 696                 k->def_multi = true;
 697         }
 698         if (k->defmgmt)
 699                 k->def_multi = true;
 700
 701         if (tb[NL80211_KEY_IDX])
 702                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 703
 704         if (tb[NL80211_KEY_DATA]) {
 705                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 706                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 707         }
 708
 709         if (tb[NL80211_KEY_SEQ]) {
 710                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 711                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 712         }
 713
 714         if (tb[NL80211_KEY_CIPHER])
 715                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 716
 717         if (tb[NL80211_KEY_TYPE]) {
 718                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 719                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 720                         return -EINVAL;
 721         }
 722
 723         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 724                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 725                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 726                                        tb[NL80211_KEY_DEFAULT_TYPES],
 727                                        nl80211_key_default_policy);
 728                 if (err)
 729                         return err;
 730
 731                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 732                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 733         }
 734
 735         return 0;
 736 }
 737
 738 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 739 {
 740         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 741                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 742                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 743         }
 744
 745         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 746                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 747                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 748         }
 749
 750         if (info->attrs[NL80211_ATTR_KEY_IDX])
 751                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 752
 753         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 754                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 755
 756         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 757         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 758
 759         if (k->def) {
 760                 k->def_uni = true;
 761                 k->def_multi = true;
 762         }
 763         if (k->defmgmt)
 764                 k->def_multi = true;
 765
 766         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 767                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 768                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 769                         return -EINVAL;
 770         }
 771
 772         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 773                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 774                 int err = nla_parse_nested(
 775                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 776                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 777                                 nl80211_key_default_policy);
 778                 if (err)
 779                         return err;
 780
 781                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 782                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 783         }
 784
 785         return 0;
 786 }
 787
 788 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 789 {
 790         int err;
 791
 792         memset(k, 0, sizeof(*k));
 793         k->idx = -1;
 794         k->type = -1;
 795
 796         if (info->attrs[NL80211_ATTR_KEY])
 797                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 798         else
 799                 err = nl80211_parse_key_old(info, k);
 800
 801         if (err)
 802                 return err;
 803
 804         if (k->def && k->defmgmt)
 805                 return -EINVAL;
 806
 807         if (k->defmgmt) {
 808                 if (k->def_uni || !k->def_multi)
 809                         return -EINVAL;
 810         }
 811
 812         if (k->idx != -1) {
 813                 if (k->defmgmt) {
 814                         if (k->idx < 4 || k->idx > 5)
 815                                 return -EINVAL;
 816                 } else if (k->def) {
 817                         if (k->idx < 0 || k->idx > 3)
 818                                 return -EINVAL;
 819                 } else {
 820                         if (k->idx < 0 || k->idx > 5)
 821                                 return -EINVAL;
 822                 }
 823         }
 824
 825         return 0;
 826 }
 827
 828 static struct cfg80211_cached_keys *
 829 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 830                        struct nlattr *keys, bool *no_ht)
 831 {
 832         struct key_parse parse;
 833         struct nlattr *key;
 834         struct cfg80211_cached_keys *result;
 835         int rem, err, def = 0;
 836
 837         result = kzalloc(sizeof(*result), GFP_KERNEL);
 838         if (!result)
 839                 return ERR_PTR(-ENOMEM);
 840
 841         result->def = -1;
 842         result->defmgmt = -1;
 843
 844         nla_for_each_nested(key, keys, rem) {
 845                 memset(&parse, 0, sizeof(parse));
 846                 parse.idx = -1;
 847
 848                 err = nl80211_parse_key_new(key, &parse);
 849                 if (err)
 850                         goto error;
 851                 err = -EINVAL;
 852                 if (!parse.p.key)
 853                         goto error;
 854                 if (parse.idx < 0 || parse.idx > 4)
 855                         goto error;
 856                 if (parse.def) {
 857                         if (def)
 858                                 goto error;
 859                         def = 1;
 860                         result->def = parse.idx;
 861                         if (!parse.def_uni || !parse.def_multi)
 862                                 goto error;
 863                 } else if (parse.defmgmt)
 864                         goto error;
 865                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 866                                                      parse.idx, false, NULL);
 867                 if (err)
 868                         goto error;
 869                 result->params[parse.idx].cipher = parse.p.cipher;
 870                 result->params[parse.idx].key_len = parse.p.key_len;
 871                 result->params[parse.idx].key = result->data[parse.idx];
 872                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 873
 874                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 875                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 876                         if (no_ht)
 877                                 *no_ht = true;
 878                 }
 879         }
 880
 881         return result;
 882  error:
 883         kfree(result);
 884         return ERR_PTR(err);
 885 }
 886
 887 static int nl80211_key_allowed(struct wireless_dev *wdev)
 888 {
 889         ASSERT_WDEV_LOCK(wdev);
 890
 891         switch (wdev->iftype) {
 892         case NL80211_IFTYPE_AP:
 893         case NL80211_IFTYPE_AP_VLAN:
 894         case NL80211_IFTYPE_P2P_GO:
 895         case NL80211_IFTYPE_MESH_POINT:
 896                 break;
 897         case NL80211_IFTYPE_ADHOC:
 898         case NL80211_IFTYPE_STATION:
 899         case NL80211_IFTYPE_P2P_CLIENT:
 900                 if (!wdev->current_bss)
 901                         return -ENOLINK;
 902                 break;
 903         default:
 904                 return -EINVAL;
 905         }
 906
 907         return 0;
 908 }
 909
 910 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 911                                                         struct nlattr *tb)
 912 {
 913         struct ieee80211_channel *chan;
 914
 915         if (tb == NULL)
 916                 return NULL;
 917         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 918         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 919                 return NULL;
 920         return chan;
 921 }
 922
 923 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 924 {
 925         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 926         int i;
 927
 928         if (!nl_modes)
 929                 goto nla_put_failure;
 930
 931         i = 0;
 932         while (ifmodes) {
 933                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 934                         goto nla_put_failure;
 935                 ifmodes >>= 1;
 936                 i++;
 937         }
 938
 939         nla_nest_end(msg, nl_modes);
 940         return 0;
 941
 942 nla_put_failure:
 943         return -ENOBUFS;
 944 }
 945
 946 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 947                                           struct sk_buff *msg,
 948                                           bool large)
 949 {
 950         struct nlattr *nl_combis;
 951         int i, j;
 952
 953         nl_combis = nla_nest_start(msg,
 954                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 955         if (!nl_combis)
 956                 goto nla_put_failure;
 957
 958         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 959                 const struct ieee80211_iface_combination *c;
 960                 struct nlattr *nl_combi, *nl_limits;
 961
 962                 c = &wiphy->iface_combinations[i];
 963
 964                 nl_combi = nla_nest_start(msg, i + 1);
 965                 if (!nl_combi)
 966                         goto nla_put_failure;
 967
 968                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 969                 if (!nl_limits)
 970                         goto nla_put_failure;
 971
 972                 for (j = 0; j < c->n_limits; j++) {
 973                         struct nlattr *nl_limit;
 974
 975                         nl_limit = nla_nest_start(msg, j + 1);
 976                         if (!nl_limit)
 977                                 goto nla_put_failure;
 978                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 979                                         c->limits[j].max))
 980                                 goto nla_put_failure;
 981                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 982                                                 c->limits[j].types))
 983                                 goto nla_put_failure;
 984                         nla_nest_end(msg, nl_limit);
 985                 }
 986
 987                 nla_nest_end(msg, nl_limits);
 988
 989                 if (c->beacon_int_infra_match &&
 990                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 991                         goto nla_put_failure;
 992                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 993                                 c->num_different_channels) ||
 994                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 995                                 c->max_interfaces))
 996                         goto nla_put_failure;
 997                 if (large &&
 998                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 999                                 c->radar_detect_widths) ||
1000                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1001                                 c->radar_detect_regions)))
1002                         goto nla_put_failure;
1003
1004                 nla_nest_end(msg, nl_combi);
1005         }
1006
1007         nla_nest_end(msg, nl_combis);
1008
1009         return 0;
1010 nla_put_failure:
1011         return -ENOBUFS;
1012 }
1013
1014 #ifdef CONFIG_PM
1015 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1016                                         struct sk_buff *msg)
1017 {
1018         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1019         struct nlattr *nl_tcp;
1020
1021         if (!tcp)
1022                 return 0;
1023
1024         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1025         if (!nl_tcp)
1026                 return -ENOBUFS;
1027
1028         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1029                         tcp->data_payload_max))
1030                 return -ENOBUFS;
1031
1032         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1033                         tcp->data_payload_max))
1034                 return -ENOBUFS;
1035
1036         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1037                 return -ENOBUFS;
1038
1039         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1040                                 sizeof(*tcp->tok), tcp->tok))
1041                 return -ENOBUFS;
1042
1043         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1044                         tcp->data_interval_max))
1045                 return -ENOBUFS;
1046
1047         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1048                         tcp->wake_payload_max))
1049                 return -ENOBUFS;
1050
1051         nla_nest_end(msg, nl_tcp);
1052         return 0;
1053 }
1054
1055 static int nl80211_send_wowlan(struct sk_buff *msg,
1056                                struct cfg80211_registered_device *rdev,
1057                                bool large)
1058 {
1059         struct nlattr *nl_wowlan;
1060
1061         if (!rdev->wiphy.wowlan)
1062                 return 0;
1063
1064         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1065         if (!nl_wowlan)
1066                 return -ENOBUFS;
1067
1068         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1069              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1070             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1076             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1077              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1078             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1079              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1080             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1081              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1082             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1083              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1084                 return -ENOBUFS;
1085
1086         if (rdev->wiphy.wowlan->n_patterns) {
1087                 struct nl80211_pattern_support pat = {
1088                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1089                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1090                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1091                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1092                 };
1093
1094                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1095                             sizeof(pat), &pat))
1096                         return -ENOBUFS;
1097         }
1098
1099         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1100                 return -ENOBUFS;
1101
1102         nla_nest_end(msg, nl_wowlan);
1103
1104         return 0;
1105 }
1106 #endif
1107
1108 static int nl80211_send_coalesce(struct sk_buff *msg,
1109                                  struct cfg80211_registered_device *rdev)
1110 {
1111         struct nl80211_coalesce_rule_support rule;
1112
1113         if (!rdev->wiphy.coalesce)
1114                 return 0;
1115
1116         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1117         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1118         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1119         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1120         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1121         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1122
1123         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1124                 return -ENOBUFS;
1125
1126         return 0;
1127 }
1128
1129 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1130                                       struct ieee80211_supported_band *sband)
1131 {
1132         struct nlattr *nl_rates, *nl_rate;
1133         struct ieee80211_rate *rate;
1134         int i;
1135
1136         /* add HT info */
1137         if (sband->ht_cap.ht_supported &&
1138             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1139                      sizeof(sband->ht_cap.mcs),
1140                      &sband->ht_cap.mcs) ||
1141              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1142                          sband->ht_cap.cap) ||
1143              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1144                         sband->ht_cap.ampdu_factor) ||
1145              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1146                         sband->ht_cap.ampdu_density)))
1147                 return -ENOBUFS;
1148
1149         /* add VHT info */
1150         if (sband->vht_cap.vht_supported &&
1151             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1152                      sizeof(sband->vht_cap.vht_mcs),
1153                      &sband->vht_cap.vht_mcs) ||
1154              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1155                          sband->vht_cap.cap)))
1156                 return -ENOBUFS;
1157
1158         /* add bitrates */
1159         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1160         if (!nl_rates)
1161                 return -ENOBUFS;
1162
1163         for (i = 0; i < sband->n_bitrates; i++) {
1164                 nl_rate = nla_nest_start(msg, i);
1165                 if (!nl_rate)
1166                         return -ENOBUFS;
1167
1168                 rate = &sband->bitrates[i];
1169                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1170                                 rate->bitrate))
1171                         return -ENOBUFS;
1172                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1173                     nla_put_flag(msg,
1174                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1175                         return -ENOBUFS;
1176
1177                 nla_nest_end(msg, nl_rate);
1178         }
1179
1180         nla_nest_end(msg, nl_rates);
1181
1182         return 0;
1183 }
1184
1185 static int
1186 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1187                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1188 {
1189         u16 stypes;
1190         struct nlattr *nl_ftypes, *nl_ifs;
1191         enum nl80211_iftype ift;
1192         int i;
1193
1194         if (!mgmt_stypes)
1195                 return 0;
1196
1197         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1198         if (!nl_ifs)
1199                 return -ENOBUFS;
1200
1201         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1202                 nl_ftypes = nla_nest_start(msg, ift);
1203                 if (!nl_ftypes)
1204                         return -ENOBUFS;
1205                 i = 0;
1206                 stypes = mgmt_stypes[ift].tx;
1207                 while (stypes) {
1208                         if ((stypes & 1) &&
1209                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1210                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1211                                 return -ENOBUFS;
1212                         stypes >>= 1;
1213                         i++;
1214                 }
1215                 nla_nest_end(msg, nl_ftypes);
1216         }
1217
1218         nla_nest_end(msg, nl_ifs);
1219
1220         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1221         if (!nl_ifs)
1222                 return -ENOBUFS;
1223
1224         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1225                 nl_ftypes = nla_nest_start(msg, ift);
1226                 if (!nl_ftypes)
1227                         return -ENOBUFS;
1228                 i = 0;
1229                 stypes = mgmt_stypes[ift].rx;
1230                 while (stypes) {
1231                         if ((stypes & 1) &&
1232                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1233                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1234                                 return -ENOBUFS;
1235                         stypes >>= 1;
1236                         i++;
1237                 }
1238                 nla_nest_end(msg, nl_ftypes);
1239         }
1240         nla_nest_end(msg, nl_ifs);
1241
1242         return 0;
1243 }
1244
1245 struct nl80211_dump_wiphy_state {
1246         s64 filter_wiphy;
1247         long start;
1248         long split_start, band_start, chan_start;
1249         bool split;
1250 };
1251
1252 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1253                               enum nl80211_commands cmd,
1254                               struct sk_buff *msg, u32 portid, u32 seq,
1255                               int flags, struct nl80211_dump_wiphy_state *state)
1256 {
1257         void *hdr;
1258         struct nlattr *nl_bands, *nl_band;
1259         struct nlattr *nl_freqs, *nl_freq;
1260         struct nlattr *nl_cmds;
1261         enum ieee80211_band band;
1262         struct ieee80211_channel *chan;
1263         int i;
1264         const struct ieee80211_txrx_stypes *mgmt_stypes =
1265                                 rdev->wiphy.mgmt_stypes;
1266         u32 features;
1267
1268         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1269         if (!hdr)
1270                 return -ENOBUFS;
1271
1272         if (WARN_ON(!state))
1273                 return -EINVAL;
1274
1275         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1276             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1277                            wiphy_name(&rdev->wiphy)) ||
1278             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1279                         cfg80211_rdev_list_generation))
1280                 goto nla_put_failure;
1281
1282         if (cmd != NL80211_CMD_NEW_WIPHY)
1283                 goto finish;
1284
1285         switch (state->split_start) {
1286         case 0:
1287                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1288                                rdev->wiphy.retry_short) ||
1289                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1290                                rdev->wiphy.retry_long) ||
1291                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1292                                 rdev->wiphy.frag_threshold) ||
1293                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1294                                 rdev->wiphy.rts_threshold) ||
1295                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1296                                rdev->wiphy.coverage_class) ||
1297                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1298                                rdev->wiphy.max_scan_ssids) ||
1299                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1300                                rdev->wiphy.max_sched_scan_ssids) ||
1301                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1302                                 rdev->wiphy.max_scan_ie_len) ||
1303                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1304                                 rdev->wiphy.max_sched_scan_ie_len) ||
1305                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1306                                rdev->wiphy.max_match_sets))
1307                         goto nla_put_failure;
1308
1309                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1310                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1311                         goto nla_put_failure;
1312                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1313                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1314                         goto nla_put_failure;
1315                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1316                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1317                         goto nla_put_failure;
1318                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1319                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1320                         goto nla_put_failure;
1321                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1322                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1323                         goto nla_put_failure;
1324                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1325                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1326                         goto nla_put_failure;
1327                 state->split_start++;
1328                 if (state->split)
1329                         break;
1330         case 1:
1331                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1332                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1333                             rdev->wiphy.cipher_suites))
1334                         goto nla_put_failure;
1335
1336                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1337                                rdev->wiphy.max_num_pmkids))
1338                         goto nla_put_failure;
1339
1340                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1341                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1342                         goto nla_put_failure;
1343
1344                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1345                                 rdev->wiphy.available_antennas_tx) ||
1346                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1347                                 rdev->wiphy.available_antennas_rx))
1348                         goto nla_put_failure;
1349
1350                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1351                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1352                                 rdev->wiphy.probe_resp_offload))
1353                         goto nla_put_failure;
1354
1355                 if ((rdev->wiphy.available_antennas_tx ||
1356                      rdev->wiphy.available_antennas_rx) &&
1357                     rdev->ops->get_antenna) {
1358                         u32 tx_ant = 0, rx_ant = 0;
1359                         int res;
1360                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1361                         if (!res) {
1362                                 if (nla_put_u32(msg,
1363                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1364                                                 tx_ant) ||
1365                                     nla_put_u32(msg,
1366                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1367                                                 rx_ant))
1368                                         goto nla_put_failure;
1369                         }
1370                 }
1371
1372                 state->split_start++;
1373                 if (state->split)
1374                         break;
1375         case 2:
1376                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1377                                         rdev->wiphy.interface_modes))
1378                                 goto nla_put_failure;
1379                 state->split_start++;
1380                 if (state->split)
1381                         break;
1382         case 3:
1383                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1384                 if (!nl_bands)
1385                         goto nla_put_failure;
1386
1387                 for (band = state->band_start;
1388                      band < IEEE80211_NUM_BANDS; band++) {
1389                         struct ieee80211_supported_band *sband;
1390
1391                         sband = rdev->wiphy.bands[band];
1392
1393                         if (!sband)
1394                                 continue;
1395
1396                         nl_band = nla_nest_start(msg, band);
1397                         if (!nl_band)
1398                                 goto nla_put_failure;
1399
1400                         switch (state->chan_start) {
1401                         case 0:
1402                                 if (nl80211_send_band_rateinfo(msg, sband))
1403                                         goto nla_put_failure;
1404                                 state->chan_start++;
1405                                 if (state->split)
1406                                         break;
1407                         default:
1408                                 /* add frequencies */
1409                                 nl_freqs = nla_nest_start(
1410                                         msg, NL80211_BAND_ATTR_FREQS);
1411                                 if (!nl_freqs)
1412                                         goto nla_put_failure;
1413
1414                                 for (i = state->chan_start - 1;
1415                                      i < sband->n_channels;
1416                                      i++) {
1417                                         nl_freq = nla_nest_start(msg, i);
1418                                         if (!nl_freq)
1419                                                 goto nla_put_failure;
1420
1421                                         chan = &sband->channels[i];
1422
1423                                         if (nl80211_msg_put_channel(
1424                                                         msg, chan,
1425                                                         state->split))
1426                                                 goto nla_put_failure;
1427
1428                                         nla_nest_end(msg, nl_freq);
1429                                         if (state->split)
1430                                                 break;
1431                                 }
1432                                 if (i < sband->n_channels)
1433                                         state->chan_start = i + 2;
1434                                 else
1435                                         state->chan_start = 0;
1436                                 nla_nest_end(msg, nl_freqs);
1437                         }
1438
1439                         nla_nest_end(msg, nl_band);
1440
1441                         if (state->split) {
1442                                 /* start again here */
1443                                 if (state->chan_start)
1444                                         band--;
1445                                 break;
1446                         }
1447                 }
1448                 nla_nest_end(msg, nl_bands);
1449
1450                 if (band < IEEE80211_NUM_BANDS)
1451                         state->band_start = band + 1;
1452                 else
1453                         state->band_start = 0;
1454
1455                 /* if bands & channels are done, continue outside */
1456                 if (state->band_start == 0 && state->chan_start == 0)
1457                         state->split_start++;
1458                 if (state->split)
1459                         break;
1460         case 4:
1461                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1462                 if (!nl_cmds)
1463                         goto nla_put_failure;
1464
1465                 i = 0;
1466 #define CMD(op, n)                                                      \
1467                  do {                                                   \
1468                         if (rdev->ops->op) {                            \
1469                                 i++;                                    \
1470                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1471                                         goto nla_put_failure;           \
1472                         }                                               \
1473                 } while (0)
1474
1475                 CMD(add_virtual_intf, NEW_INTERFACE);
1476                 CMD(change_virtual_intf, SET_INTERFACE);
1477                 CMD(add_key, NEW_KEY);
1478                 CMD(start_ap, START_AP);
1479                 CMD(add_station, NEW_STATION);
1480                 CMD(add_mpath, NEW_MPATH);
1481                 CMD(update_mesh_config, SET_MESH_CONFIG);
1482                 CMD(change_bss, SET_BSS);
1483                 CMD(auth, AUTHENTICATE);
1484                 CMD(assoc, ASSOCIATE);
1485                 CMD(deauth, DEAUTHENTICATE);
1486                 CMD(disassoc, DISASSOCIATE);
1487                 CMD(join_ibss, JOIN_IBSS);
1488                 CMD(join_mesh, JOIN_MESH);
1489                 CMD(set_pmksa, SET_PMKSA);
1490                 CMD(del_pmksa, DEL_PMKSA);
1491                 CMD(flush_pmksa, FLUSH_PMKSA);
1492                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1493                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1494                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1495                 CMD(mgmt_tx, FRAME);
1496                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1497                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1498                         i++;
1499                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1500                                 goto nla_put_failure;
1501                 }
1502                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1503                     rdev->ops->join_mesh) {
1504                         i++;
1505                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1506                                 goto nla_put_failure;
1507                 }
1508                 CMD(set_wds_peer, SET_WDS_PEER);
1509                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1510                         CMD(tdls_mgmt, TDLS_MGMT);
1511                         CMD(tdls_oper, TDLS_OPER);
1512                 }
1513                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1514                         CMD(sched_scan_start, START_SCHED_SCAN);
1515                 CMD(probe_client, PROBE_CLIENT);
1516                 CMD(set_noack_map, SET_NOACK_MAP);
1517                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1518                         i++;
1519                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1520                                 goto nla_put_failure;
1521                 }
1522                 CMD(start_p2p_device, START_P2P_DEVICE);
1523                 CMD(set_mcast_rate, SET_MCAST_RATE);
1524 #ifdef CONFIG_NL80211_TESTMODE
1525                 CMD(testmode_cmd, TESTMODE);
1526 #endif
1527                 if (state->split) {
1528                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1529                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1530                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1531                                 CMD(channel_switch, CHANNEL_SWITCH);
1532                         CMD(set_qos_map, SET_QOS_MAP);
1533                 }
1534                 /* add into the if now */
1535 #undef CMD
1536
1537                 if (rdev->ops->connect || rdev->ops->auth) {
1538                         i++;
1539                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1540                                 goto nla_put_failure;
1541                 }
1542
1543                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1544                         i++;
1545                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1546                                 goto nla_put_failure;
1547                 }
1548
1549                 nla_nest_end(msg, nl_cmds);
1550                 state->split_start++;
1551                 if (state->split)
1552                         break;
1553         case 5:
1554                 if (rdev->ops->remain_on_channel &&
1555                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1556                     nla_put_u32(msg,
1557                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1558                                 rdev->wiphy.max_remain_on_channel_duration))
1559                         goto nla_put_failure;
1560
1561                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1562                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1563                         goto nla_put_failure;
1564
1565                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1566                         goto nla_put_failure;
1567                 state->split_start++;
1568                 if (state->split)
1569                         break;
1570         case 6:
1571 #ifdef CONFIG_PM
1572                 if (nl80211_send_wowlan(msg, rdev, state->split))
1573                         goto nla_put_failure;
1574                 state->split_start++;
1575                 if (state->split)
1576                         break;
1577 #else
1578                 state->split_start++;
1579 #endif
1580         case 7:
1581                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1582                                         rdev->wiphy.software_iftypes))
1583                         goto nla_put_failure;
1584
1585                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1586                                                    state->split))
1587                         goto nla_put_failure;
1588
1589                 state->split_start++;
1590                 if (state->split)
1591                         break;
1592         case 8:
1593                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1594                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1595                                 rdev->wiphy.ap_sme_capa))
1596                         goto nla_put_failure;
1597
1598                 features = rdev->wiphy.features;
1599                 /*
1600                  * We can only add the per-channel limit information if the
1601                  * dump is split, otherwise it makes it too big. Therefore
1602                  * only advertise it in that case.
1603                  */
1604                 if (state->split)
1605                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1606                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1607                         goto nla_put_failure;
1608
1609                 if (rdev->wiphy.ht_capa_mod_mask &&
1610                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1611                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1612                             rdev->wiphy.ht_capa_mod_mask))
1613                         goto nla_put_failure;
1614
1615                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1616                     rdev->wiphy.max_acl_mac_addrs &&
1617                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1618                                 rdev->wiphy.max_acl_mac_addrs))
1619                         goto nla_put_failure;
1620
1621                 /*
1622                  * Any information below this point is only available to
1623                  * applications that can deal with it being split. This
1624                  * helps ensure that newly added capabilities don't break
1625                  * older tools by overrunning their buffers.
1626                  *
1627                  * We still increment split_start so that in the split
1628                  * case we'll continue with more data in the next round,
1629                  * but break unconditionally so unsplit data stops here.
1630                  */
1631                 state->split_start++;
1632                 break;
1633         case 9:
1634                 if (rdev->wiphy.extended_capabilities &&
1635                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1636                              rdev->wiphy.extended_capabilities_len,
1637                              rdev->wiphy.extended_capabilities) ||
1638                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1639                              rdev->wiphy.extended_capabilities_len,
1640                              rdev->wiphy.extended_capabilities_mask)))
1641                         goto nla_put_failure;
1642
1643                 if (rdev->wiphy.vht_capa_mod_mask &&
1644                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1645                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1646                             rdev->wiphy.vht_capa_mod_mask))
1647                         goto nla_put_failure;
1648
1649                 state->split_start++;
1650                 break;
1651         case 10:
1652                 if (nl80211_send_coalesce(msg, rdev))
1653                         goto nla_put_failure;
1654
1655                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1656                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1657                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1658                         goto nla_put_failure;
1659
1660                 if (rdev->wiphy.max_ap_assoc_sta &&
1661                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1662                                 rdev->wiphy.max_ap_assoc_sta))
1663                         goto nla_put_failure;
1664
1665                 state->split_start++;
1666                 break;
1667         case 11:
1668                 if (rdev->wiphy.n_vendor_commands) {
1669                         const struct nl80211_vendor_cmd_info *info;
1670                         struct nlattr *nested;
1671
1672                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1673                         if (!nested)
1674                                 goto nla_put_failure;
1675
1676                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1677                                 info = &rdev->wiphy.vendor_commands[i].info;
1678                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1679                                         goto nla_put_failure;
1680                         }
1681                         nla_nest_end(msg, nested);
1682                 }
1683
1684                 if (rdev->wiphy.n_vendor_events) {
1685                         const struct nl80211_vendor_cmd_info *info;
1686                         struct nlattr *nested;
1687
1688                         nested = nla_nest_start(msg,
1689                                                 NL80211_ATTR_VENDOR_EVENTS);
1690                         if (!nested)
1691                                 goto nla_put_failure;
1692
1693                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1694                                 info = &rdev->wiphy.vendor_events[i];
1695                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1696                                         goto nla_put_failure;
1697                         }
1698                         nla_nest_end(msg, nested);
1699                 }
1700                 state->split_start++;
1701                 break;
1702         case 12:
1703                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1704                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1705                                rdev->wiphy.max_num_csa_counters))
1706                         goto nla_put_failure;
1707
1708                 /* done */
1709                 state->split_start = 0;
1710                 break;
1711         }
1712  finish:
1713         return genlmsg_end(msg, hdr);
1714
1715  nla_put_failure:
1716         genlmsg_cancel(msg, hdr);
1717         return -EMSGSIZE;
1718 }
1719
1720 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1721                                     struct netlink_callback *cb,
1722                                     struct nl80211_dump_wiphy_state *state)
1723 {
1724         struct nlattr **tb = nl80211_fam.attrbuf;
1725         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1726                               tb, nl80211_fam.maxattr, nl80211_policy);
1727         /* ignore parse errors for backward compatibility */
1728         if (ret)
1729                 return 0;
1730
1731         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1732         if (tb[NL80211_ATTR_WIPHY])
1733                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1734         if (tb[NL80211_ATTR_WDEV])
1735                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1736         if (tb[NL80211_ATTR_IFINDEX]) {
1737                 struct net_device *netdev;
1738                 struct cfg80211_registered_device *rdev;
1739                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1740
1741                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1742                 if (!netdev)
1743                         return -ENODEV;
1744                 if (netdev->ieee80211_ptr) {
1745                         rdev = wiphy_to_rdev(
1746                                 netdev->ieee80211_ptr->wiphy);
1747                         state->filter_wiphy = rdev->wiphy_idx;
1748                 }
1749         }
1750
1751         return 0;
1752 }
1753
1754 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1755 {
1756         int idx = 0, ret;
1757         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1758         struct cfg80211_registered_device *rdev;
1759
1760         rtnl_lock();
1761         if (!state) {
1762                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1763                 if (!state) {
1764                         rtnl_unlock();
1765                         return -ENOMEM;
1766                 }
1767                 state->filter_wiphy = -1;
1768                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1769                 if (ret) {
1770                         kfree(state);
1771                         rtnl_unlock();
1772                         return ret;
1773                 }
1774                 cb->args[0] = (long)state;
1775         }
1776
1777         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1778                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1779                         continue;
1780                 if (++idx <= state->start)
1781                         continue;
1782                 if (state->filter_wiphy != -1 &&
1783                     state->filter_wiphy != rdev->wiphy_idx)
1784                         continue;
1785                 /* attempt to fit multiple wiphy data chunks into the skb */
1786                 do {
1787                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1788                                                  skb,
1789                                                  NETLINK_CB(cb->skb).portid,
1790                                                  cb->nlh->nlmsg_seq,
1791                                                  NLM_F_MULTI, state);
1792                         if (ret < 0) {
1793                                 /*
1794                                  * If sending the wiphy data didn't fit (ENOBUFS
1795                                  * or EMSGSIZE returned), this SKB is still
1796                                  * empty (so it's not too big because another
1797                                  * wiphy dataset is already in the skb) and
1798                                  * we've not tried to adjust the dump allocation
1799                                  * yet ... then adjust the alloc size to be
1800                                  * bigger, and return 1 but with the empty skb.
1801                                  * This results in an empty message being RX'ed
1802                                  * in userspace, but that is ignored.
1803                                  *
1804                                  * We can then retry with the larger buffer.
1805                                  */
1806                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1807                                     !skb->len && !state->split &&
1808                                     cb->min_dump_alloc < 4096) {
1809                                         cb->min_dump_alloc = 4096;
1810                                         state->split_start = 0;
1811                                         rtnl_unlock();
1812                                         return 1;
1813                                 }
1814                                 idx--;
1815                                 break;
1816                         }
1817                 } while (state->split_start > 0);
1818                 break;
1819         }
1820         rtnl_unlock();
1821
1822         state->start = idx;
1823
1824         return skb->len;
1825 }
1826
1827 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1828 {
1829         kfree((void *)cb->args[0]);
1830         return 0;
1831 }
1832
1833 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1834 {
1835         struct sk_buff *msg;
1836         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1837         struct nl80211_dump_wiphy_state state = {};
1838
1839         msg = nlmsg_new(4096, GFP_KERNEL);
1840         if (!msg)
1841                 return -ENOMEM;
1842
1843         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1844                                info->snd_portid, info->snd_seq, 0,
1845                                &state) < 0) {
1846                 nlmsg_free(msg);
1847                 return -ENOBUFS;
1848         }
1849
1850         return genlmsg_reply(msg, info);
1851 }
1852
1853 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1854         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1855         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1856         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1857         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1858         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1859 };
1860
1861 static int parse_txq_params(struct nlattr *tb[],
1862                             struct ieee80211_txq_params *txq_params)
1863 {
1864         u8 ac;
1865
1866         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1867             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1868             !tb[NL80211_TXQ_ATTR_AIFS])
1869                 return -EINVAL;
1870
1871         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1872         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1873         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1874         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1875         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1876
1877         if (ac >= NL80211_NUM_ACS)
1878                 return -EINVAL;
1879         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
1880         return 0;
1881 }
1882
1883 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1884 {
1885         /*
1886          * You can only set the channel explicitly for WDS interfaces,
1887          * all others have their channel managed via their respective
1888          * "establish a connection" command (connect, join, ...)
1889          *
1890          * For AP/GO and mesh mode, the channel can be set with the
1891          * channel userspace API, but is only stored and passed to the
1892          * low-level driver when the AP starts or the mesh is joined.
1893          * This is for backward compatibility, userspace can also give
1894          * the channel in the start-ap or join-mesh commands instead.
1895          *
1896          * Monitors are special as they are normally slaved to
1897          * whatever else is going on, so they have their own special
1898          * operation to set the monitor channel if possible.
1899          */
1900         return !wdev ||
1901                 wdev->iftype == NL80211_IFTYPE_AP ||
1902                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1903                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1904                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1905 }
1906
1907 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1908                                  struct genl_info *info,
1909                                  struct cfg80211_chan_def *chandef)
1910 {
1911         u32 control_freq;
1912
1913         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1914                 return -EINVAL;
1915
1916         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1917
1918         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1919         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1920         chandef->center_freq1 = control_freq;
1921         chandef->center_freq2 = 0;
1922
1923         /* Primary channel not allowed */
1924         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1925                 return -EINVAL;
1926
1927         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1928                 enum nl80211_channel_type chantype;
1929
1930                 chantype = nla_get_u32(
1931                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1932
1933                 switch (chantype) {
1934                 case NL80211_CHAN_NO_HT:
1935                 case NL80211_CHAN_HT20:
1936                 case NL80211_CHAN_HT40PLUS:
1937                 case NL80211_CHAN_HT40MINUS:
1938                         cfg80211_chandef_create(chandef, chandef->chan,
1939                                                 chantype);
1940                         break;
1941                 default:
1942                         return -EINVAL;
1943                 }
1944         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1945                 chandef->width =
1946                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1947                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1948                         chandef->center_freq1 =
1949                                 nla_get_u32(
1950                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1951                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1952                         chandef->center_freq2 =
1953                                 nla_get_u32(
1954                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1955         }
1956
1957         if (!cfg80211_chandef_valid(chandef))
1958                 return -EINVAL;
1959
1960         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1961                                      IEEE80211_CHAN_DISABLED))
1962                 return -EINVAL;
1963
1964         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1965              chandef->width == NL80211_CHAN_WIDTH_10) &&
1966             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1967                 return -EINVAL;
1968
1969         return 0;
1970 }
1971
1972 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1973                                  struct net_device *dev,
1974                                  struct genl_info *info)
1975 {
1976         struct cfg80211_chan_def chandef;
1977         int result;
1978         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1979         struct wireless_dev *wdev = NULL;
1980
1981         if (dev)
1982                 wdev = dev->ieee80211_ptr;
1983         if (!nl80211_can_set_dev_channel(wdev))
1984                 return -EOPNOTSUPP;
1985         if (wdev)
1986                 iftype = wdev->iftype;
1987
1988         result = nl80211_parse_chandef(rdev, info, &chandef);
1989         if (result)
1990                 return result;
1991
1992         switch (iftype) {
1993         case NL80211_IFTYPE_AP:
1994         case NL80211_IFTYPE_P2P_GO:
1995                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1996                         result = -EINVAL;
1997                         break;
1998                 }
1999                 if (wdev->beacon_interval) {
2000                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2001                             !(rdev->wiphy.features &
2002                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2003                                 result = -EBUSY;
2004                                 break;
2005                         }
2006
2007                         /* Only allow dynamic channel width changes */
2008                         if (chandef.chan != wdev->preset_chandef.chan) {
2009                                 result = -EBUSY;
2010                                 break;
2011                         }
2012                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2013                         if (result)
2014                                 break;
2015                 }
2016                 wdev->preset_chandef = chandef;
2017                 result = 0;
2018                 break;
2019         case NL80211_IFTYPE_MESH_POINT:
2020                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2021                 break;
2022         case NL80211_IFTYPE_MONITOR:
2023                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2024                 break;
2025         default:
2026                 result = -EINVAL;
2027         }
2028
2029         return result;
2030 }
2031
2032 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2033 {
2034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2035         struct net_device *netdev = info->user_ptr[1];
2036
2037         return __nl80211_set_channel(rdev, netdev, info);
2038 }
2039
2040 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2041 {
2042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2043         struct net_device *dev = info->user_ptr[1];
2044         struct wireless_dev *wdev = dev->ieee80211_ptr;
2045         const u8 *bssid;
2046
2047         if (!info->attrs[NL80211_ATTR_MAC])
2048                 return -EINVAL;
2049
2050         if (netif_running(dev))
2051                 return -EBUSY;
2052
2053         if (!rdev->ops->set_wds_peer)
2054                 return -EOPNOTSUPP;
2055
2056         if (wdev->iftype != NL80211_IFTYPE_WDS)
2057                 return -EOPNOTSUPP;
2058
2059         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2060         return rdev_set_wds_peer(rdev, dev, bssid);
2061 }
2062
2063
2064 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2065 {
2066         struct cfg80211_registered_device *rdev;
2067         struct net_device *netdev = NULL;
2068         struct wireless_dev *wdev;
2069         int result = 0, rem_txq_params = 0;
2070         struct nlattr *nl_txq_params;
2071         u32 changed;
2072         u8 retry_short = 0, retry_long = 0;
2073         u32 frag_threshold = 0, rts_threshold = 0;
2074         u8 coverage_class = 0;
2075
2076         ASSERT_RTNL();
2077
2078         /*
2079          * Try to find the wiphy and netdev. Normally this
2080          * function shouldn't need the netdev, but this is
2081          * done for backward compatibility -- previously
2082          * setting the channel was done per wiphy, but now
2083          * it is per netdev. Previous userland like hostapd
2084          * also passed a netdev to set_wiphy, so that it is
2085          * possible to let that go to the right netdev!
2086          */
2087
2088         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2089                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2090
2091                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2092                 if (netdev && netdev->ieee80211_ptr)
2093                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2094                 else
2095                         netdev = NULL;
2096         }
2097
2098         if (!netdev) {
2099                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2100                                                   info->attrs);
2101                 if (IS_ERR(rdev))
2102                         return PTR_ERR(rdev);
2103                 wdev = NULL;
2104                 netdev = NULL;
2105                 result = 0;
2106         } else
2107                 wdev = netdev->ieee80211_ptr;
2108
2109         /*
2110          * end workaround code, by now the rdev is available
2111          * and locked, and wdev may or may not be NULL.
2112          */
2113
2114         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2115                 result = cfg80211_dev_rename(
2116                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2117
2118         if (result)
2119                 return result;
2120
2121         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2122                 struct ieee80211_txq_params txq_params;
2123                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2124
2125                 if (!rdev->ops->set_txq_params)
2126                         return -EOPNOTSUPP;
2127
2128                 if (!netdev)
2129                         return -EINVAL;
2130
2131                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2132                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2133                         return -EINVAL;
2134
2135                 if (!netif_running(netdev))
2136                         return -ENETDOWN;
2137
2138                 nla_for_each_nested(nl_txq_params,
2139                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2140                                     rem_txq_params) {
2141                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2142                                            nla_data(nl_txq_params),
2143                                            nla_len(nl_txq_params),
2144                                            txq_params_policy);
2145                         if (result)
2146                                 return result;
2147                         result = parse_txq_params(tb, &txq_params);
2148                         if (result)
2149                                 return result;
2150
2151                         result = rdev_set_txq_params(rdev, netdev,
2152                                                      &txq_params);
2153                         if (result)
2154                                 return result;
2155                 }
2156         }
2157
2158         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2159                 result = __nl80211_set_channel(
2160                         rdev,
2161                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2162                         info);
2163                 if (result)
2164                         return result;
2165         }
2166
2167         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2168                 struct wireless_dev *txp_wdev = wdev;
2169                 enum nl80211_tx_power_setting type;
2170                 int idx, mbm = 0;
2171
2172                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2173                         txp_wdev = NULL;
2174
2175                 if (!rdev->ops->set_tx_power)
2176                         return -EOPNOTSUPP;
2177
2178                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2179                 type = nla_get_u32(info->attrs[idx]);
2180
2181                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2182                     (type != NL80211_TX_POWER_AUTOMATIC))
2183                         return -EINVAL;
2184
2185                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2186                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2187                         mbm = nla_get_u32(info->attrs[idx]);
2188                 }
2189
2190                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2191                 if (result)
2192                         return result;
2193         }
2194
2195         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2196             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2197                 u32 tx_ant, rx_ant;
2198                 if ((!rdev->wiphy.available_antennas_tx &&
2199                      !rdev->wiphy.available_antennas_rx) ||
2200                     !rdev->ops->set_antenna)
2201                         return -EOPNOTSUPP;
2202
2203                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2204                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2205
2206                 /* reject antenna configurations which don't match the
2207                  * available antenna masks, except for the "all" mask */
2208                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2209                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2210                         return -EINVAL;
2211
2212                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2213                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2214
2215                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2216                 if (result)
2217                         return result;
2218         }
2219
2220         changed = 0;
2221
2222         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2223                 retry_short = nla_get_u8(
2224                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2225                 if (retry_short == 0)
2226                         return -EINVAL;
2227
2228                 changed |= WIPHY_PARAM_RETRY_SHORT;
2229         }
2230
2231         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2232                 retry_long = nla_get_u8(
2233                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2234                 if (retry_long == 0)
2235                         return -EINVAL;
2236
2237                 changed |= WIPHY_PARAM_RETRY_LONG;
2238         }
2239
2240         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2241                 frag_threshold = nla_get_u32(
2242                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2243                 if (frag_threshold < 256)
2244                         return -EINVAL;
2245
2246                 if (frag_threshold != (u32) -1) {
2247                         /*
2248                          * Fragments (apart from the last one) are required to
2249                          * have even length. Make the fragmentation code
2250                          * simpler by stripping LSB should someone try to use
2251                          * odd threshold value.
2252                          */
2253                         frag_threshold &= ~0x1;
2254                 }
2255                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2256         }
2257
2258         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2259                 rts_threshold = nla_get_u32(
2260                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2261                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2262         }
2263
2264         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2265                 coverage_class = nla_get_u8(
2266                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2267                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2268         }
2269
2270         if (changed) {
2271                 u8 old_retry_short, old_retry_long;
2272                 u32 old_frag_threshold, old_rts_threshold;
2273                 u8 old_coverage_class;
2274
2275                 if (!rdev->ops->set_wiphy_params)
2276                         return -EOPNOTSUPP;
2277
2278                 old_retry_short = rdev->wiphy.retry_short;
2279                 old_retry_long = rdev->wiphy.retry_long;
2280                 old_frag_threshold = rdev->wiphy.frag_threshold;
2281                 old_rts_threshold = rdev->wiphy.rts_threshold;
2282                 old_coverage_class = rdev->wiphy.coverage_class;
2283
2284                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2285                         rdev->wiphy.retry_short = retry_short;
2286                 if (changed & WIPHY_PARAM_RETRY_LONG)
2287                         rdev->wiphy.retry_long = retry_long;
2288                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2289                         rdev->wiphy.frag_threshold = frag_threshold;
2290                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2291                         rdev->wiphy.rts_threshold = rts_threshold;
2292                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2293                         rdev->wiphy.coverage_class = coverage_class;
2294
2295                 result = rdev_set_wiphy_params(rdev, changed);
2296                 if (result) {
2297                         rdev->wiphy.retry_short = old_retry_short;
2298                         rdev->wiphy.retry_long = old_retry_long;
2299                         rdev->wiphy.frag_threshold = old_frag_threshold;
2300                         rdev->wiphy.rts_threshold = old_rts_threshold;
2301                         rdev->wiphy.coverage_class = old_coverage_class;
2302                 }
2303         }
2304         return 0;
2305 }
2306
2307 static inline u64 wdev_id(struct wireless_dev *wdev)
2308 {
2309         return (u64)wdev->identifier |
2310                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2311 }
2312
2313 static int nl80211_send_chandef(struct sk_buff *msg,
2314                                 const struct cfg80211_chan_def *chandef)
2315 {
2316         WARN_ON(!cfg80211_chandef_valid(chandef));
2317
2318         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2319                         chandef->chan->center_freq))
2320                 return -ENOBUFS;
2321         switch (chandef->width) {
2322         case NL80211_CHAN_WIDTH_20_NOHT:
2323         case NL80211_CHAN_WIDTH_20:
2324         case NL80211_CHAN_WIDTH_40:
2325                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2326                                 cfg80211_get_chandef_type(chandef)))
2327                         return -ENOBUFS;
2328                 break;
2329         default:
2330                 break;
2331         }
2332         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2333                 return -ENOBUFS;
2334         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2335                 return -ENOBUFS;
2336         if (chandef->center_freq2 &&
2337             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2338                 return -ENOBUFS;
2339         return 0;
2340 }
2341
2342 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2343                               struct cfg80211_registered_device *rdev,
2344                               struct wireless_dev *wdev)
2345 {
2346         struct net_device *dev = wdev->netdev;
2347         void *hdr;
2348
2349         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2350         if (!hdr)
2351                 return -1;
2352
2353         if (dev &&
2354             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2355              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2356                 goto nla_put_failure;
2357
2358         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2359             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2360             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2361             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2362             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2363                         rdev->devlist_generation ^
2364                         (cfg80211_rdev_list_generation << 2)))
2365                 goto nla_put_failure;
2366
2367         if (rdev->ops->get_channel) {
2368                 int ret;
2369                 struct cfg80211_chan_def chandef;
2370
2371                 ret = rdev_get_channel(rdev, wdev, &chandef);
2372                 if (ret == 0) {
2373                         if (nl80211_send_chandef(msg, &chandef))
2374                                 goto nla_put_failure;
2375                 }
2376         }
2377
2378         wdev_lock(wdev);
2379         switch (wdev->iftype) {
2380         case NL80211_IFTYPE_AP:
2381                 if (wdev->ssid_len &&
2382                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2383                         goto nla_put_failure_locked;
2384                 break;
2385         case NL80211_IFTYPE_STATION:
2386         case NL80211_IFTYPE_P2P_CLIENT:
2387         case NL80211_IFTYPE_ADHOC: {
2388                 const u8 *ssid_ie;
2389                 if (!wdev->current_bss)
2390                         break;
2391                 rcu_read_lock();
2392                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2393                                                WLAN_EID_SSID);
2394                 if (ssid_ie &&
2395                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2396                         goto nla_put_failure_rcu_locked;
2397                 rcu_read_unlock();
2398                 break;
2399                 }
2400         default:
2401                 /* nothing */
2402                 break;
2403         }
2404         wdev_unlock(wdev);
2405
2406         return genlmsg_end(msg, hdr);
2407
2408  nla_put_failure_rcu_locked:
2409         rcu_read_unlock();
2410  nla_put_failure_locked:
2411         wdev_unlock(wdev);
2412  nla_put_failure:
2413         genlmsg_cancel(msg, hdr);
2414         return -EMSGSIZE;
2415 }
2416
2417 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2418 {
2419         int wp_idx = 0;
2420         int if_idx = 0;
2421         int wp_start = cb->args[0];
2422         int if_start = cb->args[1];
2423         struct cfg80211_registered_device *rdev;
2424         struct wireless_dev *wdev;
2425
2426         rtnl_lock();
2427         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2428                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2429                         continue;
2430                 if (wp_idx < wp_start) {
2431                         wp_idx++;
2432                         continue;
2433                 }
2434                 if_idx = 0;
2435
2436                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2437                         if (if_idx < if_start) {
2438                                 if_idx++;
2439                                 continue;
2440                         }
2441                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2442                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2443                                                rdev, wdev) < 0) {
2444                                 goto out;
2445                         }
2446                         if_idx++;
2447                 }
2448
2449                 wp_idx++;
2450         }
2451  out:
2452         rtnl_unlock();
2453
2454         cb->args[0] = wp_idx;
2455         cb->args[1] = if_idx;
2456
2457         return skb->len;
2458 }
2459
2460 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2461 {
2462         struct sk_buff *msg;
2463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2464         struct wireless_dev *wdev = info->user_ptr[1];
2465
2466         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2467         if (!msg)
2468                 return -ENOMEM;
2469
2470         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2471                                rdev, wdev) < 0) {
2472                 nlmsg_free(msg);
2473                 return -ENOBUFS;
2474         }
2475
2476         return genlmsg_reply(msg, info);
2477 }
2478
2479 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2480         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2481         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2482         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2483         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2484         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2485         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2486 };
2487
2488 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2489 {
2490         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2491         int flag;
2492
2493         *mntrflags = 0;
2494
2495         if (!nla)
2496                 return -EINVAL;
2497
2498         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2499                              nla, mntr_flags_policy))
2500                 return -EINVAL;
2501
2502         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2503                 if (flags[flag])
2504                         *mntrflags |= (1<<flag);
2505
2506         return 0;
2507 }
2508
2509 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2510                                struct net_device *netdev, u8 use_4addr,
2511                                enum nl80211_iftype iftype)
2512 {
2513         if (!use_4addr) {
2514                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2515                         return -EBUSY;
2516                 return 0;
2517         }
2518
2519         switch (iftype) {
2520         case NL80211_IFTYPE_AP_VLAN:
2521                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2522                         return 0;
2523                 break;
2524         case NL80211_IFTYPE_STATION:
2525                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2526                         return 0;
2527                 break;
2528         default:
2529                 break;
2530         }
2531
2532         return -EOPNOTSUPP;
2533 }
2534
2535 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2536 {
2537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2538         struct vif_params params;
2539         int err;
2540         enum nl80211_iftype otype, ntype;
2541         struct net_device *dev = info->user_ptr[1];
2542         u32 _flags, *flags = NULL;
2543         bool change = false;
2544
2545         memset(&params, 0, sizeof(params));
2546
2547         otype = ntype = dev->ieee80211_ptr->iftype;
2548
2549         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2550                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2551                 if (otype != ntype)
2552                         change = true;
2553                 if (ntype > NL80211_IFTYPE_MAX)
2554                         return -EINVAL;
2555         }
2556
2557         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2558                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2559
2560                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2561                         return -EINVAL;
2562                 if (netif_running(dev))
2563                         return -EBUSY;
2564
2565                 wdev_lock(wdev);
2566                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2567                              IEEE80211_MAX_MESH_ID_LEN);
2568                 wdev->mesh_id_up_len =
2569                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2570                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2571                        wdev->mesh_id_up_len);
2572                 wdev_unlock(wdev);
2573         }
2574
2575         if (info->attrs[NL80211_ATTR_4ADDR]) {
2576                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2577                 change = true;
2578                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2579                 if (err)
2580                         return err;
2581         } else {
2582                 params.use_4addr = -1;
2583         }
2584
2585         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2586                 if (ntype != NL80211_IFTYPE_MONITOR)
2587                         return -EINVAL;
2588                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2589                                           &_flags);
2590                 if (err)
2591                         return err;
2592
2593                 flags = &_flags;
2594                 change = true;
2595         }
2596
2597         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2598             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2599                 return -EOPNOTSUPP;
2600
2601         if (change)
2602                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2603         else
2604                 err = 0;
2605
2606         if (!err && params.use_4addr != -1)
2607                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2608
2609         return err;
2610 }
2611
2612 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2613 {
2614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2615         struct vif_params params;
2616         struct wireless_dev *wdev;
2617         struct sk_buff *msg;
2618         int err;
2619         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2620         u32 flags;
2621
2622         /* to avoid failing a new interface creation due to pending removal */
2623         cfg80211_destroy_ifaces(rdev);
2624
2625         memset(&params, 0, sizeof(params));
2626
2627         if (!info->attrs[NL80211_ATTR_IFNAME])
2628                 return -EINVAL;
2629
2630         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2631                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2632                 if (type > NL80211_IFTYPE_MAX)
2633                         return -EINVAL;
2634         }
2635
2636         if (!rdev->ops->add_virtual_intf ||
2637             !(rdev->wiphy.interface_modes & (1 << type)))
2638                 return -EOPNOTSUPP;
2639
2640         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2641                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2642                            ETH_ALEN);
2643                 if (!is_valid_ether_addr(params.macaddr))
2644                         return -EADDRNOTAVAIL;
2645         }
2646
2647         if (info->attrs[NL80211_ATTR_4ADDR]) {
2648                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2649                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2650                 if (err)
2651                         return err;
2652         }
2653
2654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2655         if (!msg)
2656                 return -ENOMEM;
2657
2658         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2659                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2660                                   &flags);
2661
2662         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2663             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2664                 return -EOPNOTSUPP;
2665
2666         wdev = rdev_add_virtual_intf(rdev,
2667                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2668                                 type, err ? NULL : &flags, &params);
2669         if (IS_ERR(wdev)) {
2670                 nlmsg_free(msg);
2671                 return PTR_ERR(wdev);
2672         }
2673
2674         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2675                 wdev->owner_nlportid = info->snd_portid;
2676
2677         switch (type) {
2678         case NL80211_IFTYPE_MESH_POINT:
2679                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2680                         break;
2681                 wdev_lock(wdev);
2682                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2683                              IEEE80211_MAX_MESH_ID_LEN);
2684                 wdev->mesh_id_up_len =
2685                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2686                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2687                        wdev->mesh_id_up_len);
2688                 wdev_unlock(wdev);
2689                 break;
2690         case NL80211_IFTYPE_P2P_DEVICE:
2691                 /*
2692                  * P2P Device doesn't have a netdev, so doesn't go
2693                  * through the netdev notifier and must be added here
2694                  */
2695                 mutex_init(&wdev->mtx);
2696                 INIT_LIST_HEAD(&wdev->event_list);
2697                 spin_lock_init(&wdev->event_lock);
2698                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2699                 spin_lock_init(&wdev->mgmt_registrations_lock);
2700
2701                 wdev->identifier = ++rdev->wdev_id;
2702                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2703                 rdev->devlist_generation++;
2704                 break;
2705         default:
2706                 break;
2707         }
2708
2709         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2710                                rdev, wdev) < 0) {
2711                 nlmsg_free(msg);
2712                 return -ENOBUFS;
2713         }
2714
2715         return genlmsg_reply(msg, info);
2716 }
2717
2718 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2719 {
2720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2721         struct wireless_dev *wdev = info->user_ptr[1];
2722
2723         if (!rdev->ops->del_virtual_intf)
2724                 return -EOPNOTSUPP;
2725
2726         /*
2727          * If we remove a wireless device without a netdev then clear
2728          * user_ptr[1] so that nl80211_post_doit won't dereference it
2729          * to check if it needs to do dev_put(). Otherwise it crashes
2730          * since the wdev has been freed, unlike with a netdev where
2731          * we need the dev_put() for the netdev to really be freed.
2732          */
2733         if (!wdev->netdev)
2734                 info->user_ptr[1] = NULL;
2735
2736         return rdev_del_virtual_intf(rdev, wdev);
2737 }
2738
2739 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2740 {
2741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2742         struct net_device *dev = info->user_ptr[1];
2743         u16 noack_map;
2744
2745         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2746                 return -EINVAL;
2747
2748         if (!rdev->ops->set_noack_map)
2749                 return -EOPNOTSUPP;
2750
2751         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2752
2753         return rdev_set_noack_map(rdev, dev, noack_map);
2754 }
2755
2756 struct get_key_cookie {
2757         struct sk_buff *msg;
2758         int error;
2759         int idx;
2760 };
2761
2762 static void get_key_callback(void *c, struct key_params *params)
2763 {
2764         struct nlattr *key;
2765         struct get_key_cookie *cookie = c;
2766
2767         if ((params->key &&
2768              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2769                      params->key_len, params->key)) ||
2770             (params->seq &&
2771              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2772                      params->seq_len, params->seq)) ||
2773             (params->cipher &&
2774              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2775                          params->cipher)))
2776                 goto nla_put_failure;
2777
2778         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2779         if (!key)
2780                 goto nla_put_failure;
2781
2782         if ((params->key &&
2783              nla_put(cookie->msg, NL80211_KEY_DATA,
2784                      params->key_len, params->key)) ||
2785             (params->seq &&
2786              nla_put(cookie->msg, NL80211_KEY_SEQ,
2787                      params->seq_len, params->seq)) ||
2788             (params->cipher &&
2789              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2790                          params->cipher)))
2791                 goto nla_put_failure;
2792
2793         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2794                 goto nla_put_failure;
2795
2796         nla_nest_end(cookie->msg, key);
2797
2798         return;
2799  nla_put_failure:
2800         cookie->error = 1;
2801 }
2802
2803 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2804 {
2805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2806         int err;
2807         struct net_device *dev = info->user_ptr[1];
2808         u8 key_idx = 0;
2809         const u8 *mac_addr = NULL;
2810         bool pairwise;
2811         struct get_key_cookie cookie = {
2812                 .error = 0,
2813         };
2814         void *hdr;
2815         struct sk_buff *msg;
2816
2817         if (info->attrs[NL80211_ATTR_KEY_IDX])
2818                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2819
2820         if (key_idx > 5)
2821                 return -EINVAL;
2822
2823         if (info->attrs[NL80211_ATTR_MAC])
2824                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2825
2826         pairwise = !!mac_addr;
2827         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2828                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2829                 if (kt >= NUM_NL80211_KEYTYPES)
2830                         return -EINVAL;
2831                 if (kt != NL80211_KEYTYPE_GROUP &&
2832                     kt != NL80211_KEYTYPE_PAIRWISE)
2833                         return -EINVAL;
2834                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2835         }
2836
2837         if (!rdev->ops->get_key)
2838                 return -EOPNOTSUPP;
2839
2840         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2841                 return -ENOENT;
2842
2843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2844         if (!msg)
2845                 return -ENOMEM;
2846
2847         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2848                              NL80211_CMD_NEW_KEY);
2849         if (!hdr)
2850                 goto nla_put_failure;
2851
2852         cookie.msg = msg;
2853         cookie.idx = key_idx;
2854
2855         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2856             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2857                 goto nla_put_failure;
2858         if (mac_addr &&
2859             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2860                 goto nla_put_failure;
2861
2862         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2863                            get_key_callback);
2864
2865         if (err)
2866                 goto free_msg;
2867
2868         if (cookie.error)
2869                 goto nla_put_failure;
2870
2871         genlmsg_end(msg, hdr);
2872         return genlmsg_reply(msg, info);
2873
2874  nla_put_failure:
2875         err = -ENOBUFS;
2876  free_msg:
2877         nlmsg_free(msg);
2878         return err;
2879 }
2880
2881 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2882 {
2883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2884         struct key_parse key;
2885         int err;
2886         struct net_device *dev = info->user_ptr[1];
2887
2888         err = nl80211_parse_key(info, &key);
2889         if (err)
2890                 return err;
2891
2892         if (key.idx < 0)
2893                 return -EINVAL;
2894
2895         /* only support setting default key */
2896         if (!key.def && !key.defmgmt)
2897                 return -EINVAL;
2898
2899         wdev_lock(dev->ieee80211_ptr);
2900
2901         if (key.def) {
2902                 if (!rdev->ops->set_default_key) {
2903                         err = -EOPNOTSUPP;
2904                         goto out;
2905                 }
2906
2907                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2908                 if (err)
2909                         goto out;
2910
2911                 err = rdev_set_default_key(rdev, dev, key.idx,
2912                                                  key.def_uni, key.def_multi);
2913
2914                 if (err)
2915                         goto out;
2916
2917 #ifdef CONFIG_CFG80211_WEXT
2918                 dev->ieee80211_ptr->wext.default_key = key.idx;
2919 #endif
2920         } else {
2921                 if (key.def_uni || !key.def_multi) {
2922                         err = -EINVAL;
2923                         goto out;
2924                 }
2925
2926                 if (!rdev->ops->set_default_mgmt_key) {
2927                         err = -EOPNOTSUPP;
2928                         goto out;
2929                 }
2930
2931                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2932                 if (err)
2933                         goto out;
2934
2935                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2936                 if (err)
2937                         goto out;
2938
2939 #ifdef CONFIG_CFG80211_WEXT
2940                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2941 #endif
2942         }
2943
2944  out:
2945         wdev_unlock(dev->ieee80211_ptr);
2946
2947         return err;
2948 }
2949
2950 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2951 {
2952         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2953         int err;
2954         struct net_device *dev = info->user_ptr[1];
2955         struct key_parse key;
2956         const u8 *mac_addr = NULL;
2957
2958         err = nl80211_parse_key(info, &key);
2959         if (err)
2960                 return err;
2961
2962         if (!key.p.key)
2963                 return -EINVAL;
2964
2965         if (info->attrs[NL80211_ATTR_MAC])
2966                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2967
2968         if (key.type == -1) {
2969                 if (mac_addr)
2970                         key.type = NL80211_KEYTYPE_PAIRWISE;
2971                 else
2972                         key.type = NL80211_KEYTYPE_GROUP;
2973         }
2974
2975         /* for now */
2976         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2977             key.type != NL80211_KEYTYPE_GROUP)
2978                 return -EINVAL;
2979
2980         if (!rdev->ops->add_key)
2981                 return -EOPNOTSUPP;
2982
2983         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2984                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2985                                            mac_addr))
2986                 return -EINVAL;
2987
2988         wdev_lock(dev->ieee80211_ptr);
2989         err = nl80211_key_allowed(dev->ieee80211_ptr);
2990         if (!err)
2991                 err = rdev_add_key(rdev, dev, key.idx,
2992                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2993                                     mac_addr, &key.p);
2994         wdev_unlock(dev->ieee80211_ptr);
2995
2996         return err;
2997 }
2998
2999 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3000 {
3001         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3002         int err;
3003         struct net_device *dev = info->user_ptr[1];
3004         u8 *mac_addr = NULL;
3005         struct key_parse key;
3006
3007         err = nl80211_parse_key(info, &key);
3008         if (err)
3009                 return err;
3010
3011         if (info->attrs[NL80211_ATTR_MAC])
3012                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3013
3014         if (key.type == -1) {
3015                 if (mac_addr)
3016                         key.type = NL80211_KEYTYPE_PAIRWISE;
3017                 else
3018                         key.type = NL80211_KEYTYPE_GROUP;
3019         }
3020
3021         /* for now */
3022         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3023             key.type != NL80211_KEYTYPE_GROUP)
3024                 return -EINVAL;
3025
3026         if (!rdev->ops->del_key)
3027                 return -EOPNOTSUPP;
3028
3029         wdev_lock(dev->ieee80211_ptr);
3030         err = nl80211_key_allowed(dev->ieee80211_ptr);
3031
3032         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3033             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3034                 err = -ENOENT;
3035
3036         if (!err)
3037                 err = rdev_del_key(rdev, dev, key.idx,
3038                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3039                                    mac_addr);
3040
3041 #ifdef CONFIG_CFG80211_WEXT
3042         if (!err) {
3043                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3044                         dev->ieee80211_ptr->wext.default_key = -1;
3045                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3046                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3047         }
3048 #endif
3049         wdev_unlock(dev->ieee80211_ptr);
3050
3051         return err;
3052 }
3053
3054 /* This function returns an error or the number of nested attributes */
3055 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3056 {
3057         struct nlattr *attr;
3058         int n_entries = 0, tmp;
3059
3060         nla_for_each_nested(attr, nl_attr, tmp) {
3061                 if (nla_len(attr) != ETH_ALEN)
3062                         return -EINVAL;
3063
3064                 n_entries++;
3065         }
3066
3067         return n_entries;
3068 }
3069
3070 /*
3071  * This function parses ACL information and allocates memory for ACL data.
3072  * On successful return, the calling function is responsible to free the
3073  * ACL buffer returned by this function.
3074  */
3075 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3076                                                 struct genl_info *info)
3077 {
3078         enum nl80211_acl_policy acl_policy;
3079         struct nlattr *attr;
3080         struct cfg80211_acl_data *acl;
3081         int i = 0, n_entries, tmp;
3082
3083         if (!wiphy->max_acl_mac_addrs)
3084                 return ERR_PTR(-EOPNOTSUPP);
3085
3086         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3087                 return ERR_PTR(-EINVAL);
3088
3089         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3090         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3091             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3092                 return ERR_PTR(-EINVAL);
3093
3094         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3095                 return ERR_PTR(-EINVAL);
3096
3097         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3098         if (n_entries < 0)
3099                 return ERR_PTR(n_entries);
3100
3101         if (n_entries > wiphy->max_acl_mac_addrs)
3102                 return ERR_PTR(-ENOTSUPP);
3103
3104         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3105                       GFP_KERNEL);
3106         if (!acl)
3107                 return ERR_PTR(-ENOMEM);
3108
3109         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3110                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3111                 i++;
3112         }
3113
3114         acl->n_acl_entries = n_entries;
3115         acl->acl_policy = acl_policy;
3116
3117         return acl;
3118 }
3119
3120 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3121 {
3122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3123         struct net_device *dev = info->user_ptr[1];
3124         struct cfg80211_acl_data *acl;
3125         int err;
3126
3127         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3128             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3129                 return -EOPNOTSUPP;
3130
3131         if (!dev->ieee80211_ptr->beacon_interval)
3132                 return -EINVAL;
3133
3134         acl = parse_acl_data(&rdev->wiphy, info);
3135         if (IS_ERR(acl))
3136                 return PTR_ERR(acl);
3137
3138         err = rdev_set_mac_acl(rdev, dev, acl);
3139
3140         kfree(acl);
3141
3142         return err;
3143 }
3144
3145 static int nl80211_parse_beacon(struct nlattr *attrs[],
3146                                 struct cfg80211_beacon_data *bcn)
3147 {
3148         bool haveinfo = false;
3149
3150         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3151             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3152             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3153             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3154                 return -EINVAL;
3155
3156         memset(bcn, 0, sizeof(*bcn));
3157
3158         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3159                 int ret = validate_beacon_head(attrs[NL80211_ATTR_BEACON_HEAD]);
3160
3161                 if (ret)
3162                         return ret;
3163
3164                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3165                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3166                 if (!bcn->head_len)
3167                         return -EINVAL;
3168                 haveinfo = true;
3169         }
3170
3171         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3172                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3173                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3174                 haveinfo = true;
3175         }
3176
3177         if (!haveinfo)
3178                 return -EINVAL;
3179
3180         if (attrs[NL80211_ATTR_IE]) {
3181                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3182                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3183         }
3184
3185         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3186                 bcn->proberesp_ies =
3187                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3188                 bcn->proberesp_ies_len =
3189                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3190         }
3191
3192         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3193                 bcn->assocresp_ies =
3194                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3195                 bcn->assocresp_ies_len =
3196                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3197         }
3198
3199         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3200                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3201                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3202         }
3203
3204         return 0;
3205 }
3206
3207 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3208                                    struct cfg80211_ap_settings *params)
3209 {
3210         struct wireless_dev *wdev;
3211         bool ret = false;
3212
3213         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3214                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3215                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3216                         continue;
3217
3218                 if (!wdev->preset_chandef.chan)
3219                         continue;
3220
3221                 params->chandef = wdev->preset_chandef;
3222                 ret = true;
3223                 break;
3224         }
3225
3226         return ret;
3227 }
3228
3229 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3230                                     enum nl80211_auth_type auth_type,
3231                                     enum nl80211_commands cmd)
3232 {
3233         if (auth_type > NL80211_AUTHTYPE_MAX)
3234                 return false;
3235
3236         switch (cmd) {
3237         case NL80211_CMD_AUTHENTICATE:
3238                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3239                     auth_type == NL80211_AUTHTYPE_SAE)
3240                         return false;
3241                 return true;
3242         case NL80211_CMD_CONNECT:
3243         case NL80211_CMD_START_AP:
3244                 /* SAE not supported yet */
3245                 if (auth_type == NL80211_AUTHTYPE_SAE)
3246                         return false;
3247                 return true;
3248         default:
3249                 return false;
3250         }
3251 }
3252
3253 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3254 {
3255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3256         struct net_device *dev = info->user_ptr[1];
3257         struct wireless_dev *wdev = dev->ieee80211_ptr;
3258         struct cfg80211_ap_settings params;
3259         int err;
3260
3261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3262             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3263                 return -EOPNOTSUPP;
3264
3265         if (!rdev->ops->start_ap)
3266                 return -EOPNOTSUPP;
3267
3268         if (wdev->beacon_interval)
3269                 return -EALREADY;
3270
3271         memset(&params, 0, sizeof(params));
3272
3273         /* these are required for START_AP */
3274         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3275             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3276             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3277                 return -EINVAL;
3278
3279         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3280         if (err)
3281                 return err;
3282
3283         params.beacon_interval =
3284                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3285         params.dtim_period =
3286                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3287
3288         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3289         if (err)
3290                 return err;
3291
3292         /*
3293          * In theory, some of these attributes should be required here
3294          * but since they were not used when the command was originally
3295          * added, keep them optional for old user space programs to let
3296          * them continue to work with drivers that do not need the
3297          * additional information -- drivers must check!
3298          */
3299         if (info->attrs[NL80211_ATTR_SSID]) {
3300                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3301                 params.ssid_len =
3302                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3303                 if (params.ssid_len == 0 ||
3304                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3305                         return -EINVAL;
3306         }
3307
3308         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3309                 params.hidden_ssid = nla_get_u32(
3310                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3311                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3312                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3313                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3314                         return -EINVAL;
3315         }
3316
3317         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3318
3319         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3320                 params.auth_type = nla_get_u32(
3321                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3322                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3323                                              NL80211_CMD_START_AP))
3324                         return -EINVAL;
3325         } else
3326                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3327
3328         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3329                                       NL80211_MAX_NR_CIPHER_SUITES);
3330         if (err)
3331                 return err;
3332
3333         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3334                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3335                         return -EOPNOTSUPP;
3336                 params.inactivity_timeout = nla_get_u16(
3337                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3338         }
3339
3340         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3341                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3342                         return -EINVAL;
3343                 params.p2p_ctwindow =
3344                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3345                 if (params.p2p_ctwindow > 127)
3346                         return -EINVAL;
3347                 if (params.p2p_ctwindow != 0 &&
3348                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3349                         return -EINVAL;
3350         }
3351
3352         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3353                 u8 tmp;
3354
3355                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3356                         return -EINVAL;
3357                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3358                 if (tmp > 1)
3359                         return -EINVAL;
3360                 params.p2p_opp_ps = tmp;
3361                 if (params.p2p_opp_ps != 0 &&
3362                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3363                         return -EINVAL;
3364         }
3365
3366         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3367                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3368                 if (err)
3369                         return err;
3370         } else if (wdev->preset_chandef.chan) {
3371                 params.chandef = wdev->preset_chandef;
3372         } else if (!nl80211_get_ap_channel(rdev, &params))
3373                 return -EINVAL;
3374
3375         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3376                                      wdev->iftype))
3377                 return -EINVAL;
3378
3379         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3380                 params.acl = parse_acl_data(&rdev->wiphy, info);
3381                 if (IS_ERR(params.acl))
3382                         return PTR_ERR(params.acl);
3383         }
3384
3385         wdev_lock(wdev);
3386         err = rdev_start_ap(rdev, dev, &params);
3387         if (!err) {
3388                 wdev->preset_chandef = params.chandef;
3389                 wdev->beacon_interval = params.beacon_interval;
3390                 wdev->chandef = params.chandef;
3391                 wdev->ssid_len = params.ssid_len;
3392                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3393         }
3394         wdev_unlock(wdev);
3395
3396         kfree(params.acl);
3397
3398         return err;
3399 }
3400
3401 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3402 {
3403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3404         struct net_device *dev = info->user_ptr[1];
3405         struct wireless_dev *wdev = dev->ieee80211_ptr;
3406         struct cfg80211_beacon_data params;
3407         int err;
3408
3409         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3410             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3411                 return -EOPNOTSUPP;
3412
3413         if (!rdev->ops->change_beacon)
3414                 return -EOPNOTSUPP;
3415
3416         if (!wdev->beacon_interval)
3417                 return -EINVAL;
3418
3419         err = nl80211_parse_beacon(info->attrs, &params);
3420         if (err)
3421                 return err;
3422
3423         wdev_lock(wdev);
3424         err = rdev_change_beacon(rdev, dev, &params);
3425         wdev_unlock(wdev);
3426
3427         return err;
3428 }
3429
3430 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3431 {
3432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3433         struct net_device *dev = info->user_ptr[1];
3434
3435         return cfg80211_stop_ap(rdev, dev, false);
3436 }
3437
3438 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3439         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3440         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3441         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3442         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3443         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3444         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3445 };
3446
3447 static int parse_station_flags(struct genl_info *info,
3448                                enum nl80211_iftype iftype,
3449                                struct station_parameters *params)
3450 {
3451         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3452         struct nlattr *nla;
3453         int flag;
3454
3455         /*
3456          * Try parsing the new attribute first so userspace
3457          * can specify both for older kernels.
3458          */
3459         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3460         if (nla) {
3461                 struct nl80211_sta_flag_update *sta_flags;
3462
3463                 sta_flags = nla_data(nla);
3464                 params->sta_flags_mask = sta_flags->mask;
3465                 params->sta_flags_set = sta_flags->set;
3466                 params->sta_flags_set &= params->sta_flags_mask;
3467                 if ((params->sta_flags_mask |
3468                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3469                         return -EINVAL;
3470                 return 0;
3471         }
3472
3473         /* if present, parse the old attribute */
3474
3475         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3476         if (!nla)
3477                 return 0;
3478
3479         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3480                              nla, sta_flags_policy))
3481                 return -EINVAL;
3482
3483         /*
3484          * Only allow certain flags for interface types so that
3485          * other attributes are silently ignored. Remember that
3486          * this is backward compatibility code with old userspace
3487          * and shouldn't be hit in other cases anyway.
3488          */
3489         switch (iftype) {
3490         case NL80211_IFTYPE_AP:
3491         case NL80211_IFTYPE_AP_VLAN:
3492         case NL80211_IFTYPE_P2P_GO:
3493                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3494                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3495                                          BIT(NL80211_STA_FLAG_WME) |
3496                                          BIT(NL80211_STA_FLAG_MFP);
3497                 break;
3498         case NL80211_IFTYPE_P2P_CLIENT:
3499         case NL80211_IFTYPE_STATION:
3500                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3501                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3502                 break;
3503         case NL80211_IFTYPE_MESH_POINT:
3504                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3505                                          BIT(NL80211_STA_FLAG_MFP) |
3506                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3507         default:
3508                 return -EINVAL;
3509         }
3510
3511         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3512                 if (flags[flag]) {
3513                         params->sta_flags_set |= (1<<flag);
3514
3515                         /* no longer support new API additions in old API */
3516                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3517                                 return -EINVAL;
3518                 }
3519         }
3520
3521         return 0;
3522 }
3523
3524 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3525                                  int attr)
3526 {
3527         struct nlattr *rate;
3528         u32 bitrate;
3529         u16 bitrate_compat;
3530
3531         rate = nla_nest_start(msg, attr);
3532         if (!rate)
3533                 return false;
3534
3535         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3536         bitrate = cfg80211_calculate_bitrate(info);
3537         /* report 16-bit bitrate only if we can */
3538         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3539         if (bitrate > 0 &&
3540             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3541                 return false;
3542         if (bitrate_compat > 0 &&
3543             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3544                 return false;
3545
3546         if (info->flags & RATE_INFO_FLAGS_MCS) {
3547                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3548                         return false;
3549                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3550                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3551                         return false;
3552                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3553                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3554                         return false;
3555         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3556                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3557                         return false;
3558                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3559                         return false;
3560                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3561                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3562                         return false;
3563                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3564                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3565                         return false;
3566                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3567                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3568                         return false;
3569                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3570                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3571                         return false;
3572                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3573                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3574                         return false;
3575         }
3576
3577         nla_nest_end(msg, rate);
3578         return true;
3579 }
3580
3581 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3582                                int id)
3583 {
3584         void *attr;
3585         int i = 0;
3586
3587         if (!mask)
3588                 return true;
3589
3590         attr = nla_nest_start(msg, id);
3591         if (!attr)
3592                 return false;
3593
3594         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3595                 if (!(mask & BIT(i)))
3596                         continue;
3597
3598                 if (nla_put_u8(msg, i, signal[i]))
3599                         return false;
3600         }
3601
3602         nla_nest_end(msg, attr);
3603
3604         return true;
3605 }
3606
3607 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3608                                 int flags,
3609                                 struct cfg80211_registered_device *rdev,
3610                                 struct net_device *dev,
3611                                 const u8 *mac_addr, struct station_info *sinfo)
3612 {
3613         void *hdr;
3614         struct nlattr *sinfoattr, *bss_param;
3615
3616         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3617         if (!hdr)
3618                 return -1;
3619
3620         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3621             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3622             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3623                 goto nla_put_failure;
3624
3625         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3626         if (!sinfoattr)
3627                 goto nla_put_failure;
3628         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3629             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3630                         sinfo->connected_time))
3631                 goto nla_put_failure;
3632         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3633             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3634                         sinfo->inactive_time))
3635                 goto nla_put_failure;
3636         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3637                               STATION_INFO_RX_BYTES64)) &&
3638             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3639                         (u32)sinfo->rx_bytes))
3640                 goto nla_put_failure;
3641         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3642                               STATION_INFO_TX_BYTES64)) &&
3643             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3644                         (u32)sinfo->tx_bytes))
3645                 goto nla_put_failure;
3646         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3647             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3648                         sinfo->rx_bytes))
3649                 goto nla_put_failure;
3650         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3651             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3652                         sinfo->tx_bytes))
3653                 goto nla_put_failure;
3654         if ((sinfo->filled & STATION_INFO_LLID) &&
3655             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3656                 goto nla_put_failure;
3657         if ((sinfo->filled & STATION_INFO_PLID) &&
3658             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3659                 goto nla_put_failure;
3660         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3661             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3662                        sinfo->plink_state))
3663                 goto nla_put_failure;
3664         switch (rdev->wiphy.signal_type) {
3665         case CFG80211_SIGNAL_TYPE_MBM:
3666                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3667                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3668                                sinfo->signal))
3669                         goto nla_put_failure;
3670                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3671                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3672                                sinfo->signal_avg))
3673                         goto nla_put_failure;
3674                 break;
3675         default:
3676                 break;
3677         }
3678         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3679                 if (!nl80211_put_signal(msg, sinfo->chains,
3680                                         sinfo->chain_signal,
3681                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3682                         goto nla_put_failure;
3683         }
3684         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3685                 if (!nl80211_put_signal(msg, sinfo->chains,
3686                                         sinfo->chain_signal_avg,
3687                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3688                         goto nla_put_failure;
3689         }
3690         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3691                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3692                                           NL80211_STA_INFO_TX_BITRATE))
3693                         goto nla_put_failure;
3694         }
3695         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3696                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3697                                           NL80211_STA_INFO_RX_BITRATE))
3698                         goto nla_put_failure;
3699         }
3700         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3701             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3702                         sinfo->rx_packets))
3703                 goto nla_put_failure;
3704         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3705             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3706                         sinfo->tx_packets))
3707                 goto nla_put_failure;
3708         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3709             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3710                         sinfo->tx_retries))
3711                 goto nla_put_failure;
3712         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3713             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3714                         sinfo->tx_failed))
3715                 goto nla_put_failure;
3716         if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
3717             nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
3718                         sinfo->expected_throughput))
3719                 goto nla_put_failure;
3720         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3721             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3722                         sinfo->beacon_loss_count))
3723                 goto nla_put_failure;
3724         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3725             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3726                         sinfo->local_pm))
3727                 goto nla_put_failure;
3728         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3729             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3730                         sinfo->peer_pm))
3731                 goto nla_put_failure;
3732         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3733             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3734                         sinfo->nonpeer_pm))
3735                 goto nla_put_failure;
3736         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3737                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3738                 if (!bss_param)
3739                         goto nla_put_failure;
3740
3741                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3742                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3743                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3744                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3745                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3746                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3747                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3748                                sinfo->bss_param.dtim_period) ||
3749                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3750                                 sinfo->bss_param.beacon_interval))
3751                         goto nla_put_failure;
3752
3753                 nla_nest_end(msg, bss_param);
3754         }
3755         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3756             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3757                     sizeof(struct nl80211_sta_flag_update),
3758                     &sinfo->sta_flags))
3759                 goto nla_put_failure;
3760         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3761                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3762                             sinfo->t_offset))
3763                 goto nla_put_failure;
3764         nla_nest_end(msg, sinfoattr);
3765
3766         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3767             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3768                     sinfo->assoc_req_ies))
3769                 goto nla_put_failure;
3770
3771         return genlmsg_end(msg, hdr);
3772
3773  nla_put_failure:
3774         genlmsg_cancel(msg, hdr);
3775         return -EMSGSIZE;
3776 }
3777
3778 static int nl80211_dump_station(struct sk_buff *skb,
3779                                 struct netlink_callback *cb)
3780 {
3781         struct station_info sinfo;
3782         struct cfg80211_registered_device *rdev;
3783         struct wireless_dev *wdev;
3784         u8 mac_addr[ETH_ALEN];
3785         int sta_idx = cb->args[2];
3786         int err;
3787
3788         rtnl_lock();
3789         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3790         if (err)
3791                 goto out_err;
3792
3793         if (!wdev->netdev) {
3794                 err = -EINVAL;
3795                 goto out_err;
3796         }
3797
3798         if (!rdev->ops->dump_station) {
3799                 err = -EOPNOTSUPP;
3800                 goto out_err;
3801         }
3802
3803         while (1) {
3804                 memset(&sinfo, 0, sizeof(sinfo));
3805                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3806                                         mac_addr, &sinfo);
3807                 if (err == -ENOENT)
3808                         break;
3809                 if (err)
3810                         goto out_err;
3811
3812                 if (nl80211_send_station(skb,
3813                                 NETLINK_CB(cb->skb).portid,
3814                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3815                                 rdev, wdev->netdev, mac_addr,
3816                                 &sinfo) < 0)
3817                         goto out;
3818
3819                 sta_idx++;
3820         }
3821
3822
3823  out:
3824         cb->args[2] = sta_idx;
3825         err = skb->len;
3826  out_err:
3827         rtnl_unlock();
3828
3829         return err;
3830 }
3831
3832 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3833 {
3834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3835         struct net_device *dev = info->user_ptr[1];
3836         struct station_info sinfo;
3837         struct sk_buff *msg;
3838         u8 *mac_addr = NULL;
3839         int err;
3840
3841         memset(&sinfo, 0, sizeof(sinfo));
3842
3843         if (!info->attrs[NL80211_ATTR_MAC])
3844                 return -EINVAL;
3845
3846         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3847
3848         if (!rdev->ops->get_station)
3849                 return -EOPNOTSUPP;
3850
3851         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3852         if (err)
3853                 return err;
3854
3855         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3856         if (!msg)
3857                 return -ENOMEM;
3858
3859         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3860                                  rdev, dev, mac_addr, &sinfo) < 0) {
3861                 nlmsg_free(msg);
3862                 return -ENOBUFS;
3863         }
3864
3865         return genlmsg_reply(msg, info);
3866 }
3867
3868 int cfg80211_check_station_change(struct wiphy *wiphy,
3869                                   struct station_parameters *params,
3870                                   enum cfg80211_station_type statype)
3871 {
3872         if (params->listen_interval != -1)
3873                 return -EINVAL;
3874         if (params->aid)
3875                 return -EINVAL;
3876
3877         /* When you run into this, adjust the code below for the new flag */
3878         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3879
3880         switch (statype) {
3881         case CFG80211_STA_MESH_PEER_KERNEL:
3882         case CFG80211_STA_MESH_PEER_USER:
3883                 /*
3884                  * No ignoring the TDLS flag here -- the userspace mesh
3885                  * code doesn't have the bug of including TDLS in the
3886                  * mask everywhere.
3887                  */
3888                 if (params->sta_flags_mask &
3889                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3890                                   BIT(NL80211_STA_FLAG_MFP) |
3891                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3892                         return -EINVAL;
3893                 break;
3894         case CFG80211_STA_TDLS_PEER_SETUP:
3895         case CFG80211_STA_TDLS_PEER_ACTIVE:
3896                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3897                         return -EINVAL;
3898                 /* ignore since it can't change */
3899                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3900                 break;
3901         default:
3902                 /* disallow mesh-specific things */
3903                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3904                         return -EINVAL;
3905                 if (params->local_pm)
3906                         return -EINVAL;
3907                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3908                         return -EINVAL;
3909         }
3910
3911         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3912             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3913                 /* TDLS can't be set, ... */
3914                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3915                         return -EINVAL;
3916                 /*
3917                  * ... but don't bother the driver with it. This works around
3918                  * a hostapd/wpa_supplicant issue -- it always includes the
3919                  * TLDS_PEER flag in the mask even for AP mode.
3920                  */
3921                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3922         }
3923
3924         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3925                 /* reject other things that can't change */
3926                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3927                         return -EINVAL;
3928                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3929                         return -EINVAL;
3930                 if (params->supported_rates)
3931                         return -EINVAL;
3932                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3933                         return -EINVAL;
3934         }
3935
3936         if (statype != CFG80211_STA_AP_CLIENT) {
3937                 if (params->vlan)
3938                         return -EINVAL;
3939         }
3940
3941         switch (statype) {
3942         case CFG80211_STA_AP_MLME_CLIENT:
3943                 /* Use this only for authorizing/unauthorizing a station */
3944                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3945                         return -EOPNOTSUPP;
3946                 break;
3947         case CFG80211_STA_AP_CLIENT:
3948                 /* accept only the listed bits */
3949                 if (params->sta_flags_mask &
3950                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3951                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3952                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3953                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3954                                   BIT(NL80211_STA_FLAG_WME) |
3955                                   BIT(NL80211_STA_FLAG_MFP)))
3956                         return -EINVAL;
3957
3958                 /* but authenticated/associated only if driver handles it */
3959                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3960                     params->sta_flags_mask &
3961                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3962                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3963                         return -EINVAL;
3964                 break;
3965         case CFG80211_STA_IBSS:
3966         case CFG80211_STA_AP_STA:
3967                 /* reject any changes other than AUTHORIZED */
3968                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3969                         return -EINVAL;
3970                 break;
3971         case CFG80211_STA_TDLS_PEER_SETUP:
3972                 /* reject any changes other than AUTHORIZED or WME */
3973                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3974                                                BIT(NL80211_STA_FLAG_WME)))
3975                         return -EINVAL;
3976                 /* force (at least) rates when authorizing */
3977                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3978                     !params->supported_rates)
3979                         return -EINVAL;
3980                 break;
3981         case CFG80211_STA_TDLS_PEER_ACTIVE:
3982                 /* reject any changes */
3983                 return -EINVAL;
3984         case CFG80211_STA_MESH_PEER_KERNEL:
3985                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3986                         return -EINVAL;
3987                 break;
3988         case CFG80211_STA_MESH_PEER_USER:
3989                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3990                         return -EINVAL;
3991                 break;
3992         }
3993
3994         return 0;
3995 }
3996 EXPORT_SYMBOL(cfg80211_check_station_change);
3997
3998 /*
3999  * Get vlan interface making sure it is running and on the right wiphy.
4000  */
4001 static struct net_device *get_vlan(struct genl_info *info,
4002                                    struct cfg80211_registered_device *rdev)
4003 {
4004         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4005         struct net_device *v;
4006         int ret;
4007
4008         if (!vlanattr)
4009                 return NULL;
4010
4011         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4012         if (!v)
4013                 return ERR_PTR(-ENODEV);
4014
4015         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4016                 ret = -EINVAL;
4017                 goto error;
4018         }
4019
4020         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4021             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4022             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4023                 ret = -EINVAL;
4024                 goto error;
4025         }
4026
4027         if (!netif_running(v)) {
4028                 ret = -ENETDOWN;
4029                 goto error;
4030         }
4031
4032         return v;
4033  error:
4034         dev_put(v);
4035         return ERR_PTR(ret);
4036 }
4037
4038 static const struct nla_policy
4039 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4040         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4041         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4042 };
4043
4044 static int nl80211_parse_sta_wme(struct genl_info *info,
4045                                  struct station_parameters *params)
4046 {
4047         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4048         struct nlattr *nla;
4049         int err;
4050
4051         /* parse WME attributes if present */
4052         if (!info->attrs[NL80211_ATTR_STA_WME])
4053                 return 0;
4054
4055         nla = info->attrs[NL80211_ATTR_STA_WME];
4056         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4057                                nl80211_sta_wme_policy);
4058         if (err)
4059                 return err;
4060
4061         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4062                 params->uapsd_queues = nla_get_u8(
4063                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4064         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4065                 return -EINVAL;
4066
4067         if (tb[NL80211_STA_WME_MAX_SP])
4068                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4069
4070         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4071                 return -EINVAL;
4072
4073         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4074
4075         return 0;
4076 }
4077
4078 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4079                                       struct station_parameters *params)
4080 {
4081         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4082                 params->supported_channels =
4083                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4084                 params->supported_channels_len =
4085                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4086                 /*
4087                  * Need to include at least one (first channel, number of
4088                  * channels) tuple for each subband, and must have proper
4089                  * tuples for the rest of the data as well.
4090                  */
4091                 if (params->supported_channels_len < 2)
4092                         return -EINVAL;
4093                 if (params->supported_channels_len % 2)
4094                         return -EINVAL;
4095         }
4096
4097         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4098                 params->supported_oper_classes =
4099                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4100                 params->supported_oper_classes_len =
4101                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4102                 /*
4103                  * The value of the Length field of the Supported Operating
4104                  * Classes element is between 2 and 253.
4105                  */
4106                 if (params->supported_oper_classes_len < 2 ||
4107                     params->supported_oper_classes_len > 253)
4108                         return -EINVAL;
4109         }
4110         return 0;
4111 }
4112
4113 static int nl80211_set_station_tdls(struct genl_info *info,
4114                                     struct station_parameters *params)
4115 {
4116         int err;
4117         /* Dummy STA entry gets updated once the peer capabilities are known */
4118         if (info->attrs[NL80211_ATTR_PEER_AID])
4119                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4120         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4121                 params->ht_capa =
4122                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4123         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4124                 params->vht_capa =
4125                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4126
4127         err = nl80211_parse_sta_channel_info(info, params);
4128         if (err)
4129                 return err;
4130
4131         return nl80211_parse_sta_wme(info, params);
4132 }
4133
4134 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4135 {
4136         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4137         struct net_device *dev = info->user_ptr[1];
4138         struct station_parameters params;
4139         u8 *mac_addr;
4140         int err;
4141
4142         memset(&params, 0, sizeof(params));
4143
4144         params.listen_interval = -1;
4145
4146         if (!rdev->ops->change_station)
4147                 return -EOPNOTSUPP;
4148
4149         if (info->attrs[NL80211_ATTR_STA_AID])
4150                 return -EINVAL;
4151
4152         if (!info->attrs[NL80211_ATTR_MAC])
4153                 return -EINVAL;
4154
4155         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4156
4157         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4158                 params.supported_rates =
4159                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4160                 params.supported_rates_len =
4161                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4162         }
4163
4164         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4165                 params.capability =
4166                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4167                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4168         }
4169
4170         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4171                 params.ext_capab =
4172                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4173                 params.ext_capab_len =
4174                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4175         }
4176
4177         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4178                 return -EINVAL;
4179
4180         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4181                 return -EINVAL;
4182
4183         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4184                 params.plink_action =
4185                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4186                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4187                         return -EINVAL;
4188         }
4189
4190         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4191                 params.plink_state =
4192                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4193                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4194                         return -EINVAL;
4195                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4196         }
4197
4198         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4199                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4200                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4201
4202                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4203                     pm > NL80211_MESH_POWER_MAX)
4204                         return -EINVAL;
4205
4206                 params.local_pm = pm;
4207         }
4208
4209         /* Include parameters for TDLS peer (will check later) */
4210         err = nl80211_set_station_tdls(info, &params);
4211         if (err)
4212                 return err;
4213
4214         params.vlan = get_vlan(info, rdev);
4215         if (IS_ERR(params.vlan))
4216                 return PTR_ERR(params.vlan);
4217
4218         switch (dev->ieee80211_ptr->iftype) {
4219         case NL80211_IFTYPE_AP:
4220         case NL80211_IFTYPE_AP_VLAN:
4221         case NL80211_IFTYPE_P2P_GO:
4222         case NL80211_IFTYPE_P2P_CLIENT:
4223         case NL80211_IFTYPE_STATION:
4224         case NL80211_IFTYPE_ADHOC:
4225         case NL80211_IFTYPE_MESH_POINT:
4226                 break;
4227         default:
4228                 err = -EOPNOTSUPP;
4229                 goto out_put_vlan;
4230         }
4231
4232         /* driver will call cfg80211_check_station_change() */
4233         err = rdev_change_station(rdev, dev, mac_addr, &params);
4234
4235  out_put_vlan:
4236         if (params.vlan)
4237                 dev_put(params.vlan);
4238
4239         return err;
4240 }
4241
4242 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4243 {
4244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4245         int err;
4246         struct net_device *dev = info->user_ptr[1];
4247         struct station_parameters params;
4248         u8 *mac_addr = NULL;
4249
4250         memset(&params, 0, sizeof(params));
4251
4252         if (!rdev->ops->add_station)
4253                 return -EOPNOTSUPP;
4254
4255         if (!info->attrs[NL80211_ATTR_MAC])
4256                 return -EINVAL;
4257
4258         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4259                 return -EINVAL;
4260
4261         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4262                 return -EINVAL;
4263
4264         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4265             !info->attrs[NL80211_ATTR_PEER_AID])
4266                 return -EINVAL;
4267
4268         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4269         params.supported_rates =
4270                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4271         params.supported_rates_len =
4272                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4273         params.listen_interval =
4274                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4275
4276         if (info->attrs[NL80211_ATTR_PEER_AID])
4277                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4278         else
4279                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4280         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4281                 return -EINVAL;
4282
4283         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4284                 params.capability =
4285                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4286                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4287         }
4288
4289         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4290                 params.ext_capab =
4291                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4292                 params.ext_capab_len =
4293                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4294         }
4295
4296         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4297                 params.ht_capa =
4298                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4299
4300         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4301                 params.vht_capa =
4302                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4303
4304         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4305                 params.opmode_notif_used = true;
4306                 params.opmode_notif =
4307                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4308         }
4309
4310         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4311                 params.plink_action =
4312                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4313                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4314                         return -EINVAL;
4315         }
4316
4317         err = nl80211_parse_sta_channel_info(info, &params);
4318         if (err)
4319                 return err;
4320
4321         err = nl80211_parse_sta_wme(info, &params);
4322         if (err)
4323                 return err;
4324
4325         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4326                 return -EINVAL;
4327
4328         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4329          * as userspace might just pass through the capabilities from the IEs
4330          * directly, rather than enforcing this restriction and returning an
4331          * error in this case.
4332          */
4333         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4334                 params.ht_capa = NULL;
4335                 params.vht_capa = NULL;
4336         }
4337
4338         /* When you run into this, adjust the code below for the new flag */
4339         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4340
4341         switch (dev->ieee80211_ptr->iftype) {
4342         case NL80211_IFTYPE_AP:
4343         case NL80211_IFTYPE_AP_VLAN:
4344         case NL80211_IFTYPE_P2P_GO:
4345                 /* ignore WME attributes if iface/sta is not capable */
4346                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4347                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4348                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4349
4350                 /* TDLS peers cannot be added */
4351                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4352                     info->attrs[NL80211_ATTR_PEER_AID])
4353                         return -EINVAL;
4354                 /* but don't bother the driver with it */
4355                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4356
4357                 /* allow authenticated/associated only if driver handles it */
4358                 if (!(rdev->wiphy.features &
4359                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4360                     params.sta_flags_mask &
4361                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4362                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4363                         return -EINVAL;
4364
4365                 /* must be last in here for error handling */
4366                 params.vlan = get_vlan(info, rdev);
4367                 if (IS_ERR(params.vlan))
4368                         return PTR_ERR(params.vlan);
4369                 break;
4370         case NL80211_IFTYPE_MESH_POINT:
4371                 /* ignore uAPSD data */
4372                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4373
4374                 /* associated is disallowed */
4375                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4376                         return -EINVAL;
4377                 /* TDLS peers cannot be added */
4378                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4379                     info->attrs[NL80211_ATTR_PEER_AID])
4380                         return -EINVAL;
4381                 break;
4382         case NL80211_IFTYPE_STATION:
4383         case NL80211_IFTYPE_P2P_CLIENT:
4384                 /* ignore uAPSD data */
4385                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4386
4387                 /* these are disallowed */
4388                 if (params.sta_flags_mask &
4389                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4390                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4391                         return -EINVAL;
4392                 /* Only TDLS peers can be added */
4393                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4394                         return -EINVAL;
4395                 /* Can only add if TDLS ... */
4396                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4397                         return -EOPNOTSUPP;
4398                 /* ... with external setup is supported */
4399                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4400                         return -EOPNOTSUPP;
4401                 /*
4402                  * Older wpa_supplicant versions always mark the TDLS peer
4403                  * as authorized, but it shouldn't yet be.
4404                  */
4405                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4406                 break;
4407         default:
4408                 return -EOPNOTSUPP;
4409         }
4410
4411         /* be aware of params.vlan when changing code here */
4412
4413         err = rdev_add_station(rdev, dev, mac_addr, &params);
4414
4415         if (params.vlan)
4416                 dev_put(params.vlan);
4417         return err;
4418 }
4419
4420 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4421 {
4422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4423         struct net_device *dev = info->user_ptr[1];
4424         u8 *mac_addr = NULL;
4425
4426         if (info->attrs[NL80211_ATTR_MAC])
4427                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4428
4429         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4430             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4431             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4432             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4433                 return -EINVAL;
4434
4435         if (!rdev->ops->del_station)
4436                 return -EOPNOTSUPP;
4437
4438         return rdev_del_station(rdev, dev, mac_addr);
4439 }
4440
4441 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4442                                 int flags, struct net_device *dev,
4443                                 u8 *dst, u8 *next_hop,
4444                                 struct mpath_info *pinfo)
4445 {
4446         void *hdr;
4447         struct nlattr *pinfoattr;
4448
4449         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4450         if (!hdr)
4451                 return -1;
4452
4453         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4454             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4455             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4456             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4457                 goto nla_put_failure;
4458
4459         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4460         if (!pinfoattr)
4461                 goto nla_put_failure;
4462         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4463             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4464                         pinfo->frame_qlen))
4465                 goto nla_put_failure;
4466         if (((pinfo->filled & MPATH_INFO_SN) &&
4467              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4468             ((pinfo->filled & MPATH_INFO_METRIC) &&
4469              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4470                          pinfo->metric)) ||
4471             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4472              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4473                          pinfo->exptime)) ||
4474             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4475              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4476                         pinfo->flags)) ||
4477             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4478              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4479                          pinfo->discovery_timeout)) ||
4480             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4481              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4482                         pinfo->discovery_retries)))
4483                 goto nla_put_failure;
4484
4485         nla_nest_end(msg, pinfoattr);
4486
4487         return genlmsg_end(msg, hdr);
4488
4489  nla_put_failure:
4490         genlmsg_cancel(msg, hdr);
4491         return -EMSGSIZE;
4492 }
4493
4494 static int nl80211_dump_mpath(struct sk_buff *skb,
4495                               struct netlink_callback *cb)
4496 {
4497         struct mpath_info pinfo;
4498         struct cfg80211_registered_device *rdev;
4499         struct wireless_dev *wdev;
4500         u8 dst[ETH_ALEN];
4501         u8 next_hop[ETH_ALEN];
4502         int path_idx = cb->args[2];
4503         int err;
4504
4505         rtnl_lock();
4506         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4507         if (err)
4508                 goto out_err;
4509
4510         if (!rdev->ops->dump_mpath) {
4511                 err = -EOPNOTSUPP;
4512                 goto out_err;
4513         }
4514
4515         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4516                 err = -EOPNOTSUPP;
4517                 goto out_err;
4518         }
4519
4520         while (1) {
4521                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4522                                       next_hop, &pinfo);
4523                 if (err == -ENOENT)
4524                         break;
4525                 if (err)
4526                         goto out_err;
4527
4528                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4529                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4530                                        wdev->netdev, dst, next_hop,
4531                                        &pinfo) < 0)
4532                         goto out;
4533
4534                 path_idx++;
4535         }
4536
4537
4538  out:
4539         cb->args[2] = path_idx;
4540         err = skb->len;
4541  out_err:
4542         rtnl_unlock();
4543         return err;
4544 }
4545
4546 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4547 {
4548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4549         int err;
4550         struct net_device *dev = info->user_ptr[1];
4551         struct mpath_info pinfo;
4552         struct sk_buff *msg;
4553         u8 *dst = NULL;
4554         u8 next_hop[ETH_ALEN];
4555
4556         memset(&pinfo, 0, sizeof(pinfo));
4557
4558         if (!info->attrs[NL80211_ATTR_MAC])
4559                 return -EINVAL;
4560
4561         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4562
4563         if (!rdev->ops->get_mpath)
4564                 return -EOPNOTSUPP;
4565
4566         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4567                 return -EOPNOTSUPP;
4568
4569         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4570         if (err)
4571                 return err;
4572
4573         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4574         if (!msg)
4575                 return -ENOMEM;
4576
4577         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4578                                  dev, dst, next_hop, &pinfo) < 0) {
4579                 nlmsg_free(msg);
4580                 return -ENOBUFS;
4581         }
4582
4583         return genlmsg_reply(msg, info);
4584 }
4585
4586 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4587 {
4588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4589         struct net_device *dev = info->user_ptr[1];
4590         u8 *dst = NULL;
4591         u8 *next_hop = NULL;
4592
4593         if (!info->attrs[NL80211_ATTR_MAC])
4594                 return -EINVAL;
4595
4596         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4597                 return -EINVAL;
4598
4599         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4600         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4601
4602         if (!rdev->ops->change_mpath)
4603                 return -EOPNOTSUPP;
4604
4605         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4606                 return -EOPNOTSUPP;
4607
4608         return rdev_change_mpath(rdev, dev, dst, next_hop);
4609 }
4610
4611 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4612 {
4613         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4614         struct net_device *dev = info->user_ptr[1];
4615         u8 *dst = NULL;
4616         u8 *next_hop = NULL;
4617
4618         if (!info->attrs[NL80211_ATTR_MAC])
4619                 return -EINVAL;
4620
4621         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4622                 return -EINVAL;
4623
4624         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4625         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4626
4627         if (!rdev->ops->add_mpath)
4628                 return -EOPNOTSUPP;
4629
4630         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4631                 return -EOPNOTSUPP;
4632
4633         return rdev_add_mpath(rdev, dev, dst, next_hop);
4634 }
4635
4636 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4637 {
4638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4639         struct net_device *dev = info->user_ptr[1];
4640         u8 *dst = NULL;
4641
4642         if (info->attrs[NL80211_ATTR_MAC])
4643                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4644
4645         if (!rdev->ops->del_mpath)
4646                 return -EOPNOTSUPP;
4647
4648         return rdev_del_mpath(rdev, dev, dst);
4649 }
4650
4651 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4652 {
4653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4654         struct net_device *dev = info->user_ptr[1];
4655         struct wireless_dev *wdev = dev->ieee80211_ptr;
4656         struct bss_parameters params;
4657         int err;
4658
4659         memset(&params, 0, sizeof(params));
4660         /* default to not changing parameters */
4661         params.use_cts_prot = -1;
4662         params.use_short_preamble = -1;
4663         params.use_short_slot_time = -1;
4664         params.ap_isolate = -1;
4665         params.ht_opmode = -1;
4666         params.p2p_ctwindow = -1;
4667         params.p2p_opp_ps = -1;
4668
4669         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4670                 params.use_cts_prot =
4671                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4672         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4673                 params.use_short_preamble =
4674                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4675         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4676                 params.use_short_slot_time =
4677                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4678         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4679                 params.basic_rates =
4680                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4681                 params.basic_rates_len =
4682                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4683         }
4684         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4685                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4686         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4687                 params.ht_opmode =
4688                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4689
4690         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4691                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4692                         return -EINVAL;
4693                 params.p2p_ctwindow =
4694                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4695                 if (params.p2p_ctwindow < 0)
4696                         return -EINVAL;
4697                 if (params.p2p_ctwindow != 0 &&
4698                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4699                         return -EINVAL;
4700         }
4701
4702         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4703                 u8 tmp;
4704
4705                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4706                         return -EINVAL;
4707                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4708                 if (tmp > 1)
4709                         return -EINVAL;
4710                 params.p2p_opp_ps = tmp;
4711                 if (params.p2p_opp_ps &&
4712                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4713                         return -EINVAL;
4714         }
4715
4716         if (!rdev->ops->change_bss)
4717                 return -EOPNOTSUPP;
4718
4719         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4720             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4721                 return -EOPNOTSUPP;
4722
4723         wdev_lock(wdev);
4724         err = rdev_change_bss(rdev, dev, &params);
4725         wdev_unlock(wdev);
4726
4727         return err;
4728 }
4729
4730 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4731         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4732         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4733         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4734         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4735         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4736         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4737         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4738 };
4739
4740 static int parse_reg_rule(struct nlattr *tb[],
4741         struct ieee80211_reg_rule *reg_rule)
4742 {
4743         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4744         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4745
4746         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4747                 return -EINVAL;
4748         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4749                 return -EINVAL;
4750         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4751                 return -EINVAL;
4752         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4753                 return -EINVAL;
4754         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4755                 return -EINVAL;
4756
4757         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4758
4759         freq_range->start_freq_khz =
4760                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4761         freq_range->end_freq_khz =
4762                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4763         freq_range->max_bandwidth_khz =
4764                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4765
4766         power_rule->max_eirp =
4767                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4768
4769         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4770                 power_rule->max_antenna_gain =
4771                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4772
4773         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4774                 reg_rule->dfs_cac_ms =
4775                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4776
4777         return 0;
4778 }
4779
4780 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4781 {
4782         char *data = NULL;
4783         enum nl80211_user_reg_hint_type user_reg_hint_type;
4784
4785         /*
4786          * You should only get this when cfg80211 hasn't yet initialized
4787          * completely when built-in to the kernel right between the time
4788          * window between nl80211_init() and regulatory_init(), if that is
4789          * even possible.
4790          */
4791         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4792                 return -EINPROGRESS;
4793
4794         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4795                 user_reg_hint_type =
4796                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4797         else
4798                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4799
4800         switch (user_reg_hint_type) {
4801         case NL80211_USER_REG_HINT_USER:
4802         case NL80211_USER_REG_HINT_CELL_BASE:
4803                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4804                         return -EINVAL;
4805
4806                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4807                 return regulatory_hint_user(data, user_reg_hint_type);
4808         case NL80211_USER_REG_HINT_INDOOR:
4809                 return regulatory_hint_indoor_user();
4810         default:
4811                 return -EINVAL;
4812         }
4813 }
4814
4815 static int nl80211_get_mesh_config(struct sk_buff *skb,
4816                                    struct genl_info *info)
4817 {
4818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4819         struct net_device *dev = info->user_ptr[1];
4820         struct wireless_dev *wdev = dev->ieee80211_ptr;
4821         struct mesh_config cur_params;
4822         int err = 0;
4823         void *hdr;
4824         struct nlattr *pinfoattr;
4825         struct sk_buff *msg;
4826
4827         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4828                 return -EOPNOTSUPP;
4829
4830         if (!rdev->ops->get_mesh_config)
4831                 return -EOPNOTSUPP;
4832
4833         wdev_lock(wdev);
4834         /* If not connected, get default parameters */
4835         if (!wdev->mesh_id_len)
4836                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4837         else
4838                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4839         wdev_unlock(wdev);
4840
4841         if (err)
4842                 return err;
4843
4844         /* Draw up a netlink message to send back */
4845         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4846         if (!msg)
4847                 return -ENOMEM;
4848         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4849                              NL80211_CMD_GET_MESH_CONFIG);
4850         if (!hdr)
4851                 goto out;
4852         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4853         if (!pinfoattr)
4854                 goto nla_put_failure;
4855         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4856             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4857                         cur_params.dot11MeshRetryTimeout) ||
4858             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4859                         cur_params.dot11MeshConfirmTimeout) ||
4860             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4861                         cur_params.dot11MeshHoldingTimeout) ||
4862             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4863                         cur_params.dot11MeshMaxPeerLinks) ||
4864             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4865                        cur_params.dot11MeshMaxRetries) ||
4866             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4867                        cur_params.dot11MeshTTL) ||
4868             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4869                        cur_params.element_ttl) ||
4870             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4871                        cur_params.auto_open_plinks) ||
4872             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4873                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4874             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4875                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4876             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4877                         cur_params.path_refresh_time) ||
4878             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4879                         cur_params.min_discovery_timeout) ||
4880             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4881                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4882             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4883                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4884             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4885                         cur_params.dot11MeshHWMPperrMinInterval) ||
4886             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4887                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4888             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4889                        cur_params.dot11MeshHWMPRootMode) ||
4890             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4891                         cur_params.dot11MeshHWMPRannInterval) ||
4892             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4893                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4894             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4895                        cur_params.dot11MeshForwarding) ||
4896             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4897                         cur_params.rssi_threshold) ||
4898             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4899                         cur_params.ht_opmode) ||
4900             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4901                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4902             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4903                         cur_params.dot11MeshHWMProotInterval) ||
4904             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4905                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4906             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4907                         cur_params.power_mode) ||
4908             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4909                         cur_params.dot11MeshAwakeWindowDuration) ||
4910             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4911                         cur_params.plink_timeout))
4912                 goto nla_put_failure;
4913         nla_nest_end(msg, pinfoattr);
4914         genlmsg_end(msg, hdr);
4915         return genlmsg_reply(msg, info);
4916
4917  nla_put_failure:
4918         genlmsg_cancel(msg, hdr);
4919  out:
4920         nlmsg_free(msg);
4921         return -ENOBUFS;
4922 }
4923
4924 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4925         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4926         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4927         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4928         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4929         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4930         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4931         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4932         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4933         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4934         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4935         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4936         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4937         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4938         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4939         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4940         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4941         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4942         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4943         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4944         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4945         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4946         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4947         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4948         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4949         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4950         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4951         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4952         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4953 };
4954
4955 static const struct nla_policy
4956         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4957         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4958         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4959         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4960         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4961         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4962         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4963         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4964                                     .len = IEEE80211_MAX_DATA_LEN },
4965         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4966 };
4967
4968 static int nl80211_parse_mesh_config(struct genl_info *info,
4969                                      struct mesh_config *cfg,
4970                                      u32 *mask_out)
4971 {
4972         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4973         u32 mask = 0;
4974
4975 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4976 do {                                                                        \
4977         if (tb[attr]) {                                                     \
4978                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4979                         return -EINVAL;                                     \
4980                 cfg->param = fn(tb[attr]);                                  \
4981                 mask |= (1 << (attr - 1));                                  \
4982         }                                                                   \
4983 } while (0)
4984
4985
4986         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4987                 return -EINVAL;
4988         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4989                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4990                              nl80211_meshconf_params_policy))
4991                 return -EINVAL;
4992
4993         /* This makes sure that there aren't more than 32 mesh config
4994          * parameters (otherwise our bitfield scheme would not work.) */
4995         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4996
4997         /* Fill in the params struct */
4998         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4999                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5000                                   nla_get_u16);
5001         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5002                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5003                                   nla_get_u16);
5004         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5005                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5006                                   nla_get_u16);
5007         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5008                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5009                                   nla_get_u16);
5010         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5011                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5012                                   nla_get_u8);
5013         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5014                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5015         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5016                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5017                                   nla_get_u8);
5018         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5019                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5020                                   nla_get_u8);
5021         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5022                                   1, 255, mask,
5023                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5024                                   nla_get_u32);
5025         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5026                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5027                                   nla_get_u8);
5028         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5029                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5030                                   nla_get_u32);
5031         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5032                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5033                                   nla_get_u16);
5034         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5035                                   1, 65535, mask,
5036                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5037                                   nla_get_u32);
5038         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5039                                   1, 65535, mask,
5040                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5041                                   nla_get_u16);
5042         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5043                                   1, 65535, mask,
5044                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5045                                   nla_get_u16);
5046         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5047                                   dot11MeshHWMPnetDiameterTraversalTime,
5048                                   1, 65535, mask,
5049                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5050                                   nla_get_u16);
5051         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5052                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5053                                   nla_get_u8);
5054         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5055                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5056                                   nla_get_u16);
5057         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5058                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5059                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5060                                   nla_get_u8);
5061         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5062                                   mask, NL80211_MESHCONF_FORWARDING,
5063                                   nla_get_u8);
5064         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5065                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5066                                   nla_get_s32);
5067         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5068                                   mask, NL80211_MESHCONF_HT_OPMODE,
5069                                   nla_get_u16);
5070         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5071                                   1, 65535, mask,
5072                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5073                                   nla_get_u32);
5074         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5075                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5076                                   nla_get_u16);
5077         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5078                                   dot11MeshHWMPconfirmationInterval,
5079                                   1, 65535, mask,
5080                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5081                                   nla_get_u16);
5082         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5083                                   NL80211_MESH_POWER_ACTIVE,
5084                                   NL80211_MESH_POWER_MAX,
5085                                   mask, NL80211_MESHCONF_POWER_MODE,
5086                                   nla_get_u32);
5087         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5088                                   0, 65535, mask,
5089                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5090         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5091                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5092                                   nla_get_u32);
5093         if (mask_out)
5094                 *mask_out = mask;
5095
5096         return 0;
5097
5098 #undef FILL_IN_MESH_PARAM_IF_SET
5099 }
5100
5101 static int nl80211_parse_mesh_setup(struct genl_info *info,
5102                                      struct mesh_setup *setup)
5103 {
5104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5105         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5106
5107         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5108                 return -EINVAL;
5109         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5110                              info->attrs[NL80211_ATTR_MESH_SETUP],
5111                              nl80211_mesh_setup_params_policy))
5112                 return -EINVAL;
5113
5114         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5115                 setup->sync_method =
5116                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5117                  IEEE80211_SYNC_METHOD_VENDOR :
5118                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5119
5120         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5121                 setup->path_sel_proto =
5122                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5123                  IEEE80211_PATH_PROTOCOL_VENDOR :
5124                  IEEE80211_PATH_PROTOCOL_HWMP;
5125
5126         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5127                 setup->path_metric =
5128                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5129                  IEEE80211_PATH_METRIC_VENDOR :
5130                  IEEE80211_PATH_METRIC_AIRTIME;
5131
5132
5133         if (tb[NL80211_MESH_SETUP_IE]) {
5134                 struct nlattr *ieattr =
5135                         tb[NL80211_MESH_SETUP_IE];
5136                 if (!is_valid_ie_attr(ieattr))
5137                         return -EINVAL;
5138                 setup->ie = nla_data(ieattr);
5139                 setup->ie_len = nla_len(ieattr);
5140         }
5141         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5142             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5143                 return -EINVAL;
5144         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5145         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5146         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5147         if (setup->is_secure)
5148                 setup->user_mpm = true;
5149
5150         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5151                 if (!setup->user_mpm)
5152                         return -EINVAL;
5153                 setup->auth_id =
5154                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5155         }
5156
5157         return 0;
5158 }
5159
5160 static int nl80211_update_mesh_config(struct sk_buff *skb,
5161                                       struct genl_info *info)
5162 {
5163         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5164         struct net_device *dev = info->user_ptr[1];
5165         struct wireless_dev *wdev = dev->ieee80211_ptr;
5166         struct mesh_config cfg;
5167         u32 mask;
5168         int err;
5169
5170         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5171                 return -EOPNOTSUPP;
5172
5173         if (!rdev->ops->update_mesh_config)
5174                 return -EOPNOTSUPP;
5175
5176         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5177         if (err)
5178                 return err;
5179
5180         wdev_lock(wdev);
5181         if (!wdev->mesh_id_len)
5182                 err = -ENOLINK;
5183
5184         if (!err)
5185                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5186
5187         wdev_unlock(wdev);
5188
5189         return err;
5190 }
5191
5192 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5193 {
5194         const struct ieee80211_regdomain *regdom;
5195         struct sk_buff *msg;
5196         void *hdr = NULL;
5197         struct nlattr *nl_reg_rules;
5198         unsigned int i;
5199
5200         if (!cfg80211_regdomain)
5201                 return -EINVAL;
5202
5203         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5204         if (!msg)
5205                 return -ENOBUFS;
5206
5207         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5208                              NL80211_CMD_GET_REG);
5209         if (!hdr)
5210                 goto put_failure;
5211
5212         if (reg_last_request_cell_base() &&
5213             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5214                         NL80211_USER_REG_HINT_CELL_BASE))
5215                 goto nla_put_failure;
5216
5217         rcu_read_lock();
5218         regdom = rcu_dereference(cfg80211_regdomain);
5219
5220         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5221             (regdom->dfs_region &&
5222              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5223                 goto nla_put_failure_rcu;
5224
5225         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5226         if (!nl_reg_rules)
5227                 goto nla_put_failure_rcu;
5228
5229         for (i = 0; i < regdom->n_reg_rules; i++) {
5230                 struct nlattr *nl_reg_rule;
5231                 const struct ieee80211_reg_rule *reg_rule;
5232                 const struct ieee80211_freq_range *freq_range;
5233                 const struct ieee80211_power_rule *power_rule;
5234                 unsigned int max_bandwidth_khz;
5235
5236                 reg_rule = &regdom->reg_rules[i];
5237                 freq_range = &reg_rule->freq_range;
5238                 power_rule = &reg_rule->power_rule;
5239
5240                 nl_reg_rule = nla_nest_start(msg, i);
5241                 if (!nl_reg_rule)
5242                         goto nla_put_failure_rcu;
5243
5244                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5245                 if (!max_bandwidth_khz)
5246                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5247                                                                   reg_rule);
5248
5249                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5250                                 reg_rule->flags) ||
5251                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5252                                 freq_range->start_freq_khz) ||
5253                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5254                                 freq_range->end_freq_khz) ||
5255                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5256                                 max_bandwidth_khz) ||
5257                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5258                                 power_rule->max_antenna_gain) ||
5259                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5260                                 power_rule->max_eirp) ||
5261                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5262                                 reg_rule->dfs_cac_ms))
5263                         goto nla_put_failure_rcu;
5264
5265                 nla_nest_end(msg, nl_reg_rule);
5266         }
5267         rcu_read_unlock();
5268
5269         nla_nest_end(msg, nl_reg_rules);
5270
5271         genlmsg_end(msg, hdr);
5272         return genlmsg_reply(msg, info);
5273
5274 nla_put_failure_rcu:
5275         rcu_read_unlock();
5276 nla_put_failure:
5277         genlmsg_cancel(msg, hdr);
5278 put_failure:
5279         nlmsg_free(msg);
5280         return -EMSGSIZE;
5281 }
5282
5283 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5284 {
5285         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5286         struct nlattr *nl_reg_rule;
5287         char *alpha2 = NULL;
5288         int rem_reg_rules = 0, r = 0;
5289         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5290         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5291         struct ieee80211_regdomain *rd = NULL;
5292
5293         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5294                 return -EINVAL;
5295
5296         if (!info->attrs[NL80211_ATTR_REG_RULES])
5297                 return -EINVAL;
5298
5299         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5300
5301         if (info->attrs[NL80211_ATTR_DFS_REGION])
5302                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5303
5304         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5305                             rem_reg_rules) {
5306                 num_rules++;
5307                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5308                         return -EINVAL;
5309         }
5310
5311         if (!reg_is_valid_request(alpha2))
5312                 return -EINVAL;
5313
5314         size_of_regd = sizeof(struct ieee80211_regdomain) +
5315                        num_rules * sizeof(struct ieee80211_reg_rule);
5316
5317         rd = kzalloc(size_of_regd, GFP_KERNEL);
5318         if (!rd)
5319                 return -ENOMEM;
5320
5321         rd->n_reg_rules = num_rules;
5322         rd->alpha2[0] = alpha2[0];
5323         rd->alpha2[1] = alpha2[1];
5324
5325         /*
5326          * Disable DFS master mode if the DFS region was
5327          * not supported or known on this kernel.
5328          */
5329         if (reg_supported_dfs_region(dfs_region))
5330                 rd->dfs_region = dfs_region;
5331
5332         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5333                             rem_reg_rules) {
5334                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5335                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5336                               reg_rule_policy);
5337                 if (r)
5338                         goto bad_reg;
5339                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5340                 if (r)
5341                         goto bad_reg;
5342
5343                 rule_idx++;
5344
5345                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5346                         r = -EINVAL;
5347                         goto bad_reg;
5348                 }
5349         }
5350
5351         r = set_regdom(rd);
5352         /* set_regdom took ownership */
5353         rd = NULL;
5354
5355  bad_reg:
5356         kfree(rd);
5357         return r;
5358 }
5359
5360 static int validate_scan_freqs(struct nlattr *freqs)
5361 {
5362         struct nlattr *attr1, *attr2;
5363         int n_channels = 0, tmp1, tmp2;
5364
5365         nla_for_each_nested(attr1, freqs, tmp1)
5366                 if (nla_len(attr1) != sizeof(u32))
5367                         return 0;
5368
5369         nla_for_each_nested(attr1, freqs, tmp1) {
5370                 n_channels++;
5371                 /*
5372                  * Some hardware has a limited channel list for
5373                  * scanning, and it is pretty much nonsensical
5374                  * to scan for a channel twice, so disallow that
5375                  * and don't require drivers to check that the
5376                  * channel list they get isn't longer than what
5377                  * they can scan, as long as they can scan all
5378                  * the channels they registered at once.
5379                  */
5380                 nla_for_each_nested(attr2, freqs, tmp2)
5381                         if (attr1 != attr2 &&
5382                             nla_get_u32(attr1) == nla_get_u32(attr2))
5383                                 return 0;
5384         }
5385
5386         return n_channels;
5387 }
5388
5389 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5390 {
5391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5392         struct wireless_dev *wdev = info->user_ptr[1];
5393         struct cfg80211_scan_request *request;
5394         struct nlattr *attr;
5395         struct wiphy *wiphy;
5396         int err, tmp, n_ssids = 0, n_channels, i;
5397         size_t ie_len;
5398
5399         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5400                 return -EINVAL;
5401
5402         wiphy = &rdev->wiphy;
5403
5404         if (!rdev->ops->scan)
5405                 return -EOPNOTSUPP;
5406
5407         if (rdev->scan_req || rdev->scan_msg) {
5408                 err = -EBUSY;
5409                 goto unlock;
5410         }
5411
5412         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5413                 n_channels = validate_scan_freqs(
5414                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5415                 if (!n_channels) {
5416                         err = -EINVAL;
5417                         goto unlock;
5418                 }
5419         } else {
5420                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5421         }
5422
5423         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5424                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5425                         n_ssids++;
5426
5427         if (n_ssids > wiphy->max_scan_ssids) {
5428                 err = -EINVAL;
5429                 goto unlock;
5430         }
5431
5432         if (info->attrs[NL80211_ATTR_IE])
5433                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5434         else
5435                 ie_len = 0;
5436
5437         if (ie_len > wiphy->max_scan_ie_len) {
5438                 err = -EINVAL;
5439                 goto unlock;
5440         }
5441
5442         request = kzalloc(sizeof(*request)
5443                         + sizeof(*request->ssids) * n_ssids
5444                         + sizeof(*request->channels) * n_channels
5445                         + ie_len, GFP_KERNEL);
5446         if (!request) {
5447                 err = -ENOMEM;
5448                 goto unlock;
5449         }
5450
5451         if (n_ssids)
5452                 request->ssids = (void *)&request->channels[n_channels];
5453         request->n_ssids = n_ssids;
5454         if (ie_len) {
5455                 if (request->ssids)
5456                         request->ie = (void *)(request->ssids + n_ssids);
5457                 else
5458                         request->ie = (void *)(request->channels + n_channels);
5459         }
5460
5461         i = 0;
5462         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5463                 /* user specified, bail out if channel not found */
5464                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5465                         struct ieee80211_channel *chan;
5466
5467                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5468
5469                         if (!chan) {
5470                                 err = -EINVAL;
5471                                 goto out_free;
5472                         }
5473
5474                         /* ignore disabled channels */
5475                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5476                                 continue;
5477
5478                         request->channels[i] = chan;
5479                         i++;
5480                 }
5481         } else {
5482                 enum ieee80211_band band;
5483
5484                 /* all channels */
5485                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5486                         int j;
5487                         if (!wiphy->bands[band])
5488                                 continue;
5489                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5490                                 struct ieee80211_channel *chan;
5491
5492                                 chan = &wiphy->bands[band]->channels[j];
5493
5494                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5495                                         continue;
5496
5497                                 request->channels[i] = chan;
5498                                 i++;
5499                         }
5500                 }
5501         }
5502
5503         if (!i) {
5504                 err = -EINVAL;
5505                 goto out_free;
5506         }
5507
5508         request->n_channels = i;
5509
5510         i = 0;
5511         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5512                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5513                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5514                                 err = -EINVAL;
5515                                 goto out_free;
5516                         }
5517                         request->ssids[i].ssid_len = nla_len(attr);
5518                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5519                         i++;
5520                 }
5521         }
5522
5523         if (info->attrs[NL80211_ATTR_IE]) {
5524                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5525                 memcpy((void *)request->ie,
5526                        nla_data(info->attrs[NL80211_ATTR_IE]),
5527                        request->ie_len);
5528         }
5529
5530         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5531                 if (wiphy->bands[i])
5532                         request->rates[i] =
5533                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5534
5535         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5536                 nla_for_each_nested(attr,
5537                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5538                                     tmp) {
5539                         enum ieee80211_band band = nla_type(attr);
5540
5541                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5542                                 err = -EINVAL;
5543                                 goto out_free;
5544                         }
5545
5546                         if (!wiphy->bands[band])
5547                                 continue;
5548
5549                         err = ieee80211_get_ratemask(wiphy->bands[band],
5550                                                      nla_data(attr),
5551                                                      nla_len(attr),
5552                                                      &request->rates[band]);
5553                         if (err)
5554                                 goto out_free;
5555                 }
5556         }
5557
5558         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5559                 request->flags = nla_get_u32(
5560                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5561                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5562                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5563                         err = -EOPNOTSUPP;
5564                         goto out_free;
5565                 }
5566         }
5567
5568         request->no_cck =
5569                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5570
5571         request->wdev = wdev;
5572         request->wiphy = &rdev->wiphy;
5573         request->scan_start = jiffies;
5574
5575         rdev->scan_req = request;
5576         err = rdev_scan(rdev, request);
5577
5578         if (!err) {
5579                 nl80211_send_scan_start(rdev, wdev);
5580                 if (wdev->netdev)
5581                         dev_hold(wdev->netdev);
5582         } else {
5583  out_free:
5584                 rdev->scan_req = NULL;
5585                 kfree(request);
5586         }
5587
5588  unlock:
5589         return err;
5590 }
5591
5592 static int nl80211_start_sched_scan(struct sk_buff *skb,
5593                                     struct genl_info *info)
5594 {
5595         struct cfg80211_sched_scan_request *request;
5596         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5597         struct net_device *dev = info->user_ptr[1];
5598         struct nlattr *attr;
5599         struct wiphy *wiphy;
5600         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5601         u32 interval;
5602         enum ieee80211_band band;
5603         size_t ie_len;
5604         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5605         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5606
5607         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5608             !rdev->ops->sched_scan_start)
5609                 return -EOPNOTSUPP;
5610
5611         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5612                 return -EINVAL;
5613
5614         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5615                 return -EINVAL;
5616
5617         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5618         if (interval == 0)
5619                 return -EINVAL;
5620
5621         wiphy = &rdev->wiphy;
5622
5623         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5624                 n_channels = validate_scan_freqs(
5625                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5626                 if (!n_channels)
5627                         return -EINVAL;
5628         } else {
5629                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5630         }
5631
5632         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5633                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5634                                     tmp)
5635                         n_ssids++;
5636
5637         if (n_ssids > wiphy->max_sched_scan_ssids)
5638                 return -EINVAL;
5639
5640         /*
5641          * First, count the number of 'real' matchsets. Due to an issue with
5642          * the old implementation, matchsets containing only the RSSI attribute
5643          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5644          * RSSI for all matchsets, rather than their own matchset for reporting
5645          * all APs with a strong RSSI. This is needed to be compatible with
5646          * older userspace that treated a matchset with only the RSSI as the
5647          * global RSSI for all other matchsets - if there are other matchsets.
5648          */
5649         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5650                 nla_for_each_nested(attr,
5651                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5652                                     tmp) {
5653                         struct nlattr *rssi;
5654
5655                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5656                                         nla_data(attr), nla_len(attr),
5657                                         nl80211_match_policy);
5658                         if (err)
5659                                 return err;
5660                         /* add other standalone attributes here */
5661                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5662                                 n_match_sets++;
5663                                 continue;
5664                         }
5665                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5666                         if (rssi)
5667                                 default_match_rssi = nla_get_s32(rssi);
5668                 }
5669         }
5670
5671         /* However, if there's no other matchset, add the RSSI one */
5672         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5673                 n_match_sets = 1;
5674
5675         if (n_match_sets > wiphy->max_match_sets)
5676                 return -EINVAL;
5677
5678         if (info->attrs[NL80211_ATTR_IE])
5679                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5680         else
5681                 ie_len = 0;
5682
5683         if (ie_len > wiphy->max_sched_scan_ie_len)
5684                 return -EINVAL;
5685
5686         if (rdev->sched_scan_req) {
5687                 err = -EINPROGRESS;
5688                 goto out;
5689         }
5690
5691         request = kzalloc(sizeof(*request)
5692                         + sizeof(*request->ssids) * n_ssids
5693                         + sizeof(*request->match_sets) * n_match_sets
5694                         + sizeof(*request->channels) * n_channels
5695                         + ie_len, GFP_KERNEL);
5696         if (!request) {
5697                 err = -ENOMEM;
5698                 goto out;
5699         }
5700
5701         if (n_ssids)
5702                 request->ssids = (void *)&request->channels[n_channels];
5703         request->n_ssids = n_ssids;
5704         if (ie_len) {
5705                 if (request->ssids)
5706                         request->ie = (void *)(request->ssids + n_ssids);
5707                 else
5708                         request->ie = (void *)(request->channels + n_channels);
5709         }
5710
5711         if (n_match_sets) {
5712                 if (request->ie)
5713                         request->match_sets = (void *)(request->ie + ie_len);
5714                 else if (request->ssids)
5715                         request->match_sets =
5716                                 (void *)(request->ssids + n_ssids);
5717                 else
5718                         request->match_sets =
5719                                 (void *)(request->channels + n_channels);
5720         }
5721         request->n_match_sets = n_match_sets;
5722
5723         i = 0;
5724         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5725                 /* user specified, bail out if channel not found */
5726                 nla_for_each_nested(attr,
5727                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5728                                     tmp) {
5729                         struct ieee80211_channel *chan;
5730
5731                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5732
5733                         if (!chan) {
5734                                 err = -EINVAL;
5735                                 goto out_free;
5736                         }
5737
5738                         /* ignore disabled channels */
5739                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5740                                 continue;
5741
5742                         request->channels[i] = chan;
5743                         i++;
5744                 }
5745         } else {
5746                 /* all channels */
5747                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5748                         int j;
5749                         if (!wiphy->bands[band])
5750                                 continue;
5751                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5752                                 struct ieee80211_channel *chan;
5753
5754                                 chan = &wiphy->bands[band]->channels[j];
5755
5756                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5757                                         continue;
5758
5759                                 request->channels[i] = chan;
5760                                 i++;
5761                         }
5762                 }
5763         }
5764
5765         if (!i) {
5766                 err = -EINVAL;
5767                 goto out_free;
5768         }
5769
5770         request->n_channels = i;
5771
5772         i = 0;
5773         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5774                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5775                                     tmp) {
5776                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5777                                 err = -EINVAL;
5778                                 goto out_free;
5779                         }
5780                         request->ssids[i].ssid_len = nla_len(attr);
5781                         memcpy(request->ssids[i].ssid, nla_data(attr),
5782                                nla_len(attr));
5783                         i++;
5784                 }
5785         }
5786
5787         i = 0;
5788         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5789                 nla_for_each_nested(attr,
5790                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5791                                     tmp) {
5792                         struct nlattr *ssid, *rssi;
5793
5794                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5795                                         nla_data(attr), nla_len(attr),
5796                                         nl80211_match_policy);
5797                         if (err)
5798                                 goto out_free;
5799                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5800                         if (ssid) {
5801                                 if (WARN_ON(i >= n_match_sets)) {
5802                                         /* this indicates a programming error,
5803                                          * the loop above should have verified
5804                                          * things properly
5805                                          */
5806                                         err = -EINVAL;
5807                                         goto out_free;
5808                                 }
5809
5810                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5811                                         err = -EINVAL;
5812                                         goto out_free;
5813                                 }
5814                                 memcpy(request->match_sets[i].ssid.ssid,
5815                                        nla_data(ssid), nla_len(ssid));
5816                                 request->match_sets[i].ssid.ssid_len =
5817                                         nla_len(ssid);
5818                                 /* special attribute - old implemenation w/a */
5819                                 request->match_sets[i].rssi_thold =
5820                                         default_match_rssi;
5821                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5822                                 if (rssi)
5823                                         request->match_sets[i].rssi_thold =
5824                                                 nla_get_s32(rssi);
5825                         }
5826                         i++;
5827                 }
5828
5829                 /* there was no other matchset, so the RSSI one is alone */
5830                 if (i == 0 && n_match_sets)
5831                         request->match_sets[0].rssi_thold = default_match_rssi;
5832
5833                 request->min_rssi_thold = INT_MAX;
5834                 for (i = 0; i < n_match_sets; i++)
5835                         request->min_rssi_thold =
5836                                 min(request->match_sets[i].rssi_thold,
5837                                     request->min_rssi_thold);
5838         } else {
5839                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5840         }
5841
5842         if (ie_len) {
5843                 request->ie_len = ie_len;
5844                 memcpy((void *)request->ie,
5845                        nla_data(info->attrs[NL80211_ATTR_IE]),
5846                        request->ie_len);
5847         }
5848
5849         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5850                 request->flags = nla_get_u32(
5851                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5852                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5853                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5854                         err = -EOPNOTSUPP;
5855                         goto out_free;
5856                 }
5857         }
5858
5859         request->dev = dev;
5860         request->wiphy = &rdev->wiphy;
5861         request->interval = interval;
5862         request->scan_start = jiffies;
5863
5864         err = rdev_sched_scan_start(rdev, dev, request);
5865         if (!err) {
5866                 rdev->sched_scan_req = request;
5867                 nl80211_send_sched_scan(rdev, dev,
5868                                         NL80211_CMD_START_SCHED_SCAN);
5869                 goto out;
5870         }
5871
5872 out_free:
5873         kfree(request);
5874 out:
5875         return err;
5876 }
5877
5878 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5879                                    struct genl_info *info)
5880 {
5881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5882
5883         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5884             !rdev->ops->sched_scan_stop)
5885                 return -EOPNOTSUPP;
5886
5887         return __cfg80211_stop_sched_scan(rdev, false);
5888 }
5889
5890 static int nl80211_start_radar_detection(struct sk_buff *skb,
5891                                          struct genl_info *info)
5892 {
5893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5894         struct net_device *dev = info->user_ptr[1];
5895         struct wireless_dev *wdev = dev->ieee80211_ptr;
5896         struct cfg80211_chan_def chandef;
5897         enum nl80211_dfs_regions dfs_region;
5898         unsigned int cac_time_ms;
5899         int err;
5900
5901         dfs_region = reg_get_dfs_region(wdev->wiphy);
5902         if (dfs_region == NL80211_DFS_UNSET)
5903                 return -EINVAL;
5904
5905         err = nl80211_parse_chandef(rdev, info, &chandef);
5906         if (err)
5907                 return err;
5908
5909         if (netif_carrier_ok(dev))
5910                 return -EBUSY;
5911
5912         if (wdev->cac_started)
5913                 return -EBUSY;
5914
5915         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
5916                                             wdev->iftype);
5917         if (err < 0)
5918                 return err;
5919
5920         if (err == 0)
5921                 return -EINVAL;
5922
5923         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5924                 return -EINVAL;
5925
5926         if (!rdev->ops->start_radar_detection)
5927                 return -EOPNOTSUPP;
5928
5929         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
5930         if (WARN_ON(!cac_time_ms))
5931                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
5932
5933         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
5934                                                cac_time_ms);
5935         if (!err) {
5936                 wdev->chandef = chandef;
5937                 wdev->cac_started = true;
5938                 wdev->cac_start_time = jiffies;
5939                 wdev->cac_time_ms = cac_time_ms;
5940         }
5941         return err;
5942 }
5943
5944 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5945 {
5946         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5947         struct net_device *dev = info->user_ptr[1];
5948         struct wireless_dev *wdev = dev->ieee80211_ptr;
5949         struct cfg80211_csa_settings params;
5950         /* csa_attrs is defined static to avoid waste of stack size - this
5951          * function is called under RTNL lock, so this should not be a problem.
5952          */
5953         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5954         u8 radar_detect_width = 0;
5955         int err;
5956         bool need_new_beacon = false;
5957         int len, i;
5958
5959         if (!rdev->ops->channel_switch ||
5960             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5961                 return -EOPNOTSUPP;
5962
5963         switch (dev->ieee80211_ptr->iftype) {
5964         case NL80211_IFTYPE_AP:
5965         case NL80211_IFTYPE_P2P_GO:
5966                 need_new_beacon = true;
5967
5968                 /* useless if AP is not running */
5969                 if (!wdev->beacon_interval)
5970                         return -ENOTCONN;
5971                 break;
5972         case NL80211_IFTYPE_ADHOC:
5973                 if (!wdev->ssid_len)
5974                         return -ENOTCONN;
5975                 break;
5976         case NL80211_IFTYPE_MESH_POINT:
5977                 if (!wdev->mesh_id_len)
5978                         return -ENOTCONN;
5979                 break;
5980         default:
5981                 return -EOPNOTSUPP;
5982         }
5983
5984         memset(&params, 0, sizeof(params));
5985
5986         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5987             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5988                 return -EINVAL;
5989
5990         /* only important for AP, IBSS and mesh create IEs internally */
5991         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5992                 return -EINVAL;
5993
5994         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5995
5996         if (!need_new_beacon)
5997                 goto skip_beacons;
5998
5999         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6000         if (err)
6001                 return err;
6002
6003         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6004                                info->attrs[NL80211_ATTR_CSA_IES],
6005                                nl80211_policy);
6006         if (err)
6007                 return err;
6008
6009         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6010         if (err)
6011                 return err;
6012
6013         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6014                 return -EINVAL;
6015
6016         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6017         if (!len || (len % sizeof(u16)))
6018                 return -EINVAL;
6019
6020         params.n_counter_offsets_beacon = len / sizeof(u16);
6021         if (rdev->wiphy.max_num_csa_counters &&
6022             (params.n_counter_offsets_beacon >
6023              rdev->wiphy.max_num_csa_counters))
6024                 return -EINVAL;
6025
6026         params.counter_offsets_beacon =
6027                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6028
6029         /* sanity checks - counters should fit and be the same */
6030         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6031                 u16 offset = params.counter_offsets_beacon[i];
6032
6033                 if (offset >= params.beacon_csa.tail_len)
6034                         return -EINVAL;
6035
6036                 if (params.beacon_csa.tail[offset] != params.count)
6037                         return -EINVAL;
6038         }
6039
6040         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6041                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6042                 if (!len || (len % sizeof(u16)))
6043                         return -EINVAL;
6044
6045                 params.n_counter_offsets_presp = len / sizeof(u16);
6046                 if (rdev->wiphy.max_num_csa_counters &&
6047                     (params.n_counter_offsets_presp >
6048                      rdev->wiphy.max_num_csa_counters))
6049                         return -EINVAL;
6050
6051                 params.counter_offsets_presp =
6052                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6053
6054                 /* sanity checks - counters should fit and be the same */
6055                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6056                         u16 offset = params.counter_offsets_presp[i];
6057
6058                         if (offset >= params.beacon_csa.probe_resp_len)
6059                                 return -EINVAL;
6060
6061                         if (params.beacon_csa.probe_resp[offset] !=
6062                             params.count)
6063                                 return -EINVAL;
6064                 }
6065         }
6066
6067 skip_beacons:
6068         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6069         if (err)
6070                 return err;
6071
6072         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6073                                      wdev->iftype))
6074                 return -EINVAL;
6075
6076         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6077                                             &params.chandef,
6078                                             wdev->iftype);
6079         if (err < 0)
6080                 return err;
6081
6082         if (err > 0) {
6083                 radar_detect_width = BIT(params.chandef.width);
6084                 params.radar_required = true;
6085         }
6086
6087         /* TODO: I left this here for now.  With channel switch, the
6088          * verification is a bit more complicated, because we only do
6089          * it later when the channel switch really happens.
6090          */
6091         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
6092                                            params.chandef.chan,
6093                                            CHAN_MODE_SHARED,
6094                                            radar_detect_width);
6095         if (err)
6096                 return err;
6097
6098         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6099                 params.block_tx = true;
6100
6101         wdev_lock(wdev);
6102         err = rdev_channel_switch(rdev, dev, &params);
6103         wdev_unlock(wdev);
6104
6105         return err;
6106 }
6107
6108 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6109                             u32 seq, int flags,
6110                             struct cfg80211_registered_device *rdev,
6111                             struct wireless_dev *wdev,
6112                             struct cfg80211_internal_bss *intbss)
6113 {
6114         struct cfg80211_bss *res = &intbss->pub;
6115         const struct cfg80211_bss_ies *ies;
6116         void *hdr;
6117         struct nlattr *bss;
6118         bool tsf = false;
6119
6120         ASSERT_WDEV_LOCK(wdev);
6121
6122         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6123                              NL80211_CMD_NEW_SCAN_RESULTS);
6124         if (!hdr)
6125                 return -1;
6126
6127         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6128
6129         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6130                 goto nla_put_failure;
6131         if (wdev->netdev &&
6132             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6133                 goto nla_put_failure;
6134         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6135                 goto nla_put_failure;
6136
6137         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6138         if (!bss)
6139                 goto nla_put_failure;
6140         if ((!is_zero_ether_addr(res->bssid) &&
6141              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6142                 goto nla_put_failure;
6143
6144         rcu_read_lock();
6145         ies = rcu_dereference(res->ies);
6146         if (ies) {
6147                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6148                         goto fail_unlock_rcu;
6149                 tsf = true;
6150                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6151                                         ies->len, ies->data))
6152                         goto fail_unlock_rcu;
6153         }
6154         ies = rcu_dereference(res->beacon_ies);
6155         if (ies) {
6156                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6157                         goto fail_unlock_rcu;
6158                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6159                                         ies->len, ies->data))
6160                         goto fail_unlock_rcu;
6161         }
6162         rcu_read_unlock();
6163
6164         if (res->beacon_interval &&
6165             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6166                 goto nla_put_failure;
6167         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6168             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6169             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6170             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6171                         jiffies_to_msecs(jiffies - intbss->ts)))
6172                 goto nla_put_failure;
6173
6174         switch (rdev->wiphy.signal_type) {
6175         case CFG80211_SIGNAL_TYPE_MBM:
6176                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6177                         goto nla_put_failure;
6178                 break;
6179         case CFG80211_SIGNAL_TYPE_UNSPEC:
6180                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6181                         goto nla_put_failure;
6182                 break;
6183         default:
6184                 break;
6185         }
6186
6187         switch (wdev->iftype) {
6188         case NL80211_IFTYPE_P2P_CLIENT:
6189         case NL80211_IFTYPE_STATION:
6190                 if (intbss == wdev->current_bss &&
6191                     nla_put_u32(msg, NL80211_BSS_STATUS,
6192                                 NL80211_BSS_STATUS_ASSOCIATED))
6193                         goto nla_put_failure;
6194                 break;
6195         case NL80211_IFTYPE_ADHOC:
6196                 if (intbss == wdev->current_bss &&
6197                     nla_put_u32(msg, NL80211_BSS_STATUS,
6198                                 NL80211_BSS_STATUS_IBSS_JOINED))
6199                         goto nla_put_failure;
6200                 break;
6201         default:
6202                 break;
6203         }
6204
6205         nla_nest_end(msg, bss);
6206
6207         return genlmsg_end(msg, hdr);
6208
6209  fail_unlock_rcu:
6210         rcu_read_unlock();
6211  nla_put_failure:
6212         genlmsg_cancel(msg, hdr);
6213         return -EMSGSIZE;
6214 }
6215
6216 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6217 {
6218         struct cfg80211_registered_device *rdev;
6219         struct cfg80211_internal_bss *scan;
6220         struct wireless_dev *wdev;
6221         int start = cb->args[2], idx = 0;
6222         int err;
6223
6224         rtnl_lock();
6225         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6226         if (err) {
6227                 rtnl_unlock();
6228                 return err;
6229         }
6230
6231         wdev_lock(wdev);
6232         spin_lock_bh(&rdev->bss_lock);
6233         cfg80211_bss_expire(rdev);
6234
6235         cb->seq = rdev->bss_generation;
6236
6237         list_for_each_entry(scan, &rdev->bss_list, list) {
6238                 if (++idx <= start)
6239                         continue;
6240                 if (nl80211_send_bss(skb, cb,
6241                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6242                                 rdev, wdev, scan) < 0) {
6243                         idx--;
6244                         break;
6245                 }
6246         }
6247
6248         spin_unlock_bh(&rdev->bss_lock);
6249         wdev_unlock(wdev);
6250
6251         cb->args[2] = idx;
6252         rtnl_unlock();
6253
6254         return skb->len;
6255 }
6256
6257 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6258                                 int flags, struct net_device *dev,
6259                                 struct survey_info *survey)
6260 {
6261         void *hdr;
6262         struct nlattr *infoattr;
6263
6264         hdr = nl80211hdr_put(msg, portid, seq, flags,
6265                              NL80211_CMD_NEW_SURVEY_RESULTS);
6266         if (!hdr)
6267                 return -ENOMEM;
6268
6269         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6270                 goto nla_put_failure;
6271
6272         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6273         if (!infoattr)
6274                 goto nla_put_failure;
6275
6276         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6277                         survey->channel->center_freq))
6278                 goto nla_put_failure;
6279
6280         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6281             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6282                 goto nla_put_failure;
6283         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6284             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6285                 goto nla_put_failure;
6286         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6287             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6288                         survey->channel_time))
6289                 goto nla_put_failure;
6290         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6291             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6292                         survey->channel_time_busy))
6293                 goto nla_put_failure;
6294         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6295             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6296                         survey->channel_time_ext_busy))
6297                 goto nla_put_failure;
6298         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6299             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6300                         survey->channel_time_rx))
6301                 goto nla_put_failure;
6302         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6303             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6304                         survey->channel_time_tx))
6305                 goto nla_put_failure;
6306
6307         nla_nest_end(msg, infoattr);
6308
6309         return genlmsg_end(msg, hdr);
6310
6311  nla_put_failure:
6312         genlmsg_cancel(msg, hdr);
6313         return -EMSGSIZE;
6314 }
6315
6316 static int nl80211_dump_survey(struct sk_buff *skb,
6317                         struct netlink_callback *cb)
6318 {
6319         struct survey_info survey;
6320         struct cfg80211_registered_device *rdev;
6321         struct wireless_dev *wdev;
6322         int survey_idx = cb->args[2];
6323         int res;
6324
6325         rtnl_lock();
6326         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6327         if (res)
6328                 goto out_err;
6329
6330         if (!wdev->netdev) {
6331                 res = -EINVAL;
6332                 goto out_err;
6333         }
6334
6335         if (!rdev->ops->dump_survey) {
6336                 res = -EOPNOTSUPP;
6337                 goto out_err;
6338         }
6339
6340         while (1) {
6341                 struct ieee80211_channel *chan;
6342
6343                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6344                 if (res == -ENOENT)
6345                         break;
6346                 if (res)
6347                         goto out_err;
6348
6349                 /* Survey without a channel doesn't make sense */
6350                 if (!survey.channel) {
6351                         res = -EINVAL;
6352                         goto out;
6353                 }
6354
6355                 chan = ieee80211_get_channel(&rdev->wiphy,
6356                                              survey.channel->center_freq);
6357                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6358                         survey_idx++;
6359                         continue;
6360                 }
6361
6362                 if (nl80211_send_survey(skb,
6363                                 NETLINK_CB(cb->skb).portid,
6364                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6365                                 wdev->netdev, &survey) < 0)
6366                         goto out;
6367                 survey_idx++;
6368         }
6369
6370  out:
6371         cb->args[2] = survey_idx;
6372         res = skb->len;
6373  out_err:
6374         rtnl_unlock();
6375         return res;
6376 }
6377
6378 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6379 {
6380         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6381                                   NL80211_WPA_VERSION_2));
6382 }
6383
6384 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6385 {
6386         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6387         struct net_device *dev = info->user_ptr[1];
6388         struct ieee80211_channel *chan;
6389         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6390         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6391         enum nl80211_auth_type auth_type;
6392         struct key_parse key;
6393         bool local_state_change;
6394
6395         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6396                 return -EINVAL;
6397
6398         if (!info->attrs[NL80211_ATTR_MAC])
6399                 return -EINVAL;
6400
6401         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6402                 return -EINVAL;
6403
6404         if (!info->attrs[NL80211_ATTR_SSID])
6405                 return -EINVAL;
6406
6407         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6408                 return -EINVAL;
6409
6410         err = nl80211_parse_key(info, &key);
6411         if (err)
6412                 return err;
6413
6414         if (key.idx >= 0) {
6415                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6416                         return -EINVAL;
6417                 if (!key.p.key || !key.p.key_len)
6418                         return -EINVAL;
6419                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6420                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6421                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6422                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6423                         return -EINVAL;
6424                 if (key.idx > 4)
6425                         return -EINVAL;
6426         } else {
6427                 key.p.key_len = 0;
6428                 key.p.key = NULL;
6429         }
6430
6431         if (key.idx >= 0) {
6432                 int i;
6433                 bool ok = false;
6434                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6435                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6436                                 ok = true;
6437                                 break;
6438                         }
6439                 }
6440                 if (!ok)
6441                         return -EINVAL;
6442         }
6443
6444         if (!rdev->ops->auth)
6445                 return -EOPNOTSUPP;
6446
6447         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6448             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6449                 return -EOPNOTSUPP;
6450
6451         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6452         chan = nl80211_get_valid_chan(&rdev->wiphy,
6453                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6454         if (!chan)
6455                 return -EINVAL;
6456
6457         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6458         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6459
6460         if (info->attrs[NL80211_ATTR_IE]) {
6461                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6462                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6463         }
6464
6465         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6466         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6467                 return -EINVAL;
6468
6469         if (auth_type == NL80211_AUTHTYPE_SAE &&
6470             !info->attrs[NL80211_ATTR_SAE_DATA])
6471                 return -EINVAL;
6472
6473         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6474                 if (auth_type != NL80211_AUTHTYPE_SAE)
6475                         return -EINVAL;
6476                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6477                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6478                 /* need to include at least Auth Transaction and Status Code */
6479                 if (sae_data_len < 4)
6480                         return -EINVAL;
6481         }
6482
6483         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6484
6485         /*
6486          * Since we no longer track auth state, ignore
6487          * requests to only change local state.
6488          */
6489         if (local_state_change)
6490                 return 0;
6491
6492         wdev_lock(dev->ieee80211_ptr);
6493         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6494                                  ssid, ssid_len, ie, ie_len,
6495                                  key.p.key, key.p.key_len, key.idx,
6496                                  sae_data, sae_data_len);
6497         wdev_unlock(dev->ieee80211_ptr);
6498         return err;
6499 }
6500
6501 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6502                                    struct genl_info *info,
6503                                    struct cfg80211_crypto_settings *settings,
6504                                    int cipher_limit)
6505 {
6506         memset(settings, 0, sizeof(*settings));
6507
6508         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6509
6510         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6511                 u16 proto;
6512                 proto = nla_get_u16(
6513                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6514                 settings->control_port_ethertype = cpu_to_be16(proto);
6515                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6516                     proto != ETH_P_PAE)
6517                         return -EINVAL;
6518                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6519                         settings->control_port_no_encrypt = true;
6520         } else
6521                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6522
6523         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6524                 void *data;
6525                 int len, i;
6526
6527                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6528                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6529                 settings->n_ciphers_pairwise = len / sizeof(u32);
6530
6531                 if (len % sizeof(u32))
6532                         return -EINVAL;
6533
6534                 if (settings->n_ciphers_pairwise > cipher_limit)
6535                         return -EINVAL;
6536
6537                 memcpy(settings->ciphers_pairwise, data, len);
6538
6539                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6540                         if (!cfg80211_supported_cipher_suite(
6541                                         &rdev->wiphy,
6542                                         settings->ciphers_pairwise[i]))
6543                                 return -EINVAL;
6544         }
6545
6546         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6547                 settings->cipher_group =
6548                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6549                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6550                                                      settings->cipher_group))
6551                         return -EINVAL;
6552         }
6553
6554         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6555                 settings->wpa_versions =
6556                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6557                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6558                         return -EINVAL;
6559         }
6560
6561         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6562                 void *data;
6563                 int len;
6564
6565                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6566                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6567                 settings->n_akm_suites = len / sizeof(u32);
6568
6569                 if (len % sizeof(u32))
6570                         return -EINVAL;
6571
6572                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6573                         return -EINVAL;
6574
6575                 memcpy(settings->akm_suites, data, len);
6576         }
6577
6578         return 0;
6579 }
6580
6581 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6582 {
6583         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6584         struct net_device *dev = info->user_ptr[1];
6585         struct ieee80211_channel *chan;
6586         struct cfg80211_assoc_request req = {};
6587         const u8 *bssid, *ssid;
6588         int err, ssid_len = 0;
6589
6590         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6591                 return -EINVAL;
6592
6593         if (!info->attrs[NL80211_ATTR_MAC] ||
6594             !info->attrs[NL80211_ATTR_SSID] ||
6595             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6596                 return -EINVAL;
6597
6598         if (!rdev->ops->assoc)
6599                 return -EOPNOTSUPP;
6600
6601         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6602             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6603                 return -EOPNOTSUPP;
6604
6605         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6606
6607         chan = nl80211_get_valid_chan(&rdev->wiphy,
6608                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6609         if (!chan)
6610                 return -EINVAL;
6611
6612         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6613         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6614
6615         if (info->attrs[NL80211_ATTR_IE]) {
6616                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6617                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6618         }
6619
6620         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6621                 enum nl80211_mfp mfp =
6622                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6623                 if (mfp == NL80211_MFP_REQUIRED)
6624                         req.use_mfp = true;
6625                 else if (mfp != NL80211_MFP_NO)
6626                         return -EINVAL;
6627         }
6628
6629         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6630                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6631
6632         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6633                 req.flags |= ASSOC_REQ_DISABLE_HT;
6634
6635         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6636                 memcpy(&req.ht_capa_mask,
6637                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6638                        sizeof(req.ht_capa_mask));
6639
6640         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6641                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6642                         return -EINVAL;
6643                 memcpy(&req.ht_capa,
6644                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6645                        sizeof(req.ht_capa));
6646         }
6647
6648         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6649                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6650
6651         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6652                 memcpy(&req.vht_capa_mask,
6653                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6654                        sizeof(req.vht_capa_mask));
6655
6656         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6657                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6658                         return -EINVAL;
6659                 memcpy(&req.vht_capa,
6660                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6661                        sizeof(req.vht_capa));
6662         }
6663
6664         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6665         if (!err) {
6666                 wdev_lock(dev->ieee80211_ptr);
6667                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6668                                           ssid, ssid_len, &req);
6669                 wdev_unlock(dev->ieee80211_ptr);
6670         }
6671
6672         return err;
6673 }
6674
6675 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6676 {
6677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6678         struct net_device *dev = info->user_ptr[1];
6679         const u8 *ie = NULL, *bssid;
6680         int ie_len = 0, err;
6681         u16 reason_code;
6682         bool local_state_change;
6683
6684         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6685                 return -EINVAL;
6686
6687         if (!info->attrs[NL80211_ATTR_MAC])
6688                 return -EINVAL;
6689
6690         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6691                 return -EINVAL;
6692
6693         if (!rdev->ops->deauth)
6694                 return -EOPNOTSUPP;
6695
6696         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6697             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6698                 return -EOPNOTSUPP;
6699
6700         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6701
6702         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6703         if (reason_code == 0) {
6704                 /* Reason Code 0 is reserved */
6705                 return -EINVAL;
6706         }
6707
6708         if (info->attrs[NL80211_ATTR_IE]) {
6709                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6710                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6711         }
6712
6713         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6714
6715         wdev_lock(dev->ieee80211_ptr);
6716         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6717                                    local_state_change);
6718         wdev_unlock(dev->ieee80211_ptr);
6719         return err;
6720 }
6721
6722 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6723 {
6724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6725         struct net_device *dev = info->user_ptr[1];
6726         const u8 *ie = NULL, *bssid;
6727         int ie_len = 0, err;
6728         u16 reason_code;
6729         bool local_state_change;
6730
6731         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6732                 return -EINVAL;
6733
6734         if (!info->attrs[NL80211_ATTR_MAC])
6735                 return -EINVAL;
6736
6737         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6738                 return -EINVAL;
6739
6740         if (!rdev->ops->disassoc)
6741                 return -EOPNOTSUPP;
6742
6743         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6744             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6745                 return -EOPNOTSUPP;
6746
6747         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6748
6749         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6750         if (reason_code == 0) {
6751                 /* Reason Code 0 is reserved */
6752                 return -EINVAL;
6753         }
6754
6755         if (info->attrs[NL80211_ATTR_IE]) {
6756                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6757                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6758         }
6759
6760         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6761
6762         wdev_lock(dev->ieee80211_ptr);
6763         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6764                                      local_state_change);
6765         wdev_unlock(dev->ieee80211_ptr);
6766         return err;
6767 }
6768
6769 static bool
6770 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6771                          int mcast_rate[IEEE80211_NUM_BANDS],
6772                          int rateval)
6773 {
6774         struct wiphy *wiphy = &rdev->wiphy;
6775         bool found = false;
6776         int band, i;
6777
6778         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6779                 struct ieee80211_supported_band *sband;
6780
6781                 sband = wiphy->bands[band];
6782                 if (!sband)
6783                         continue;
6784
6785                 for (i = 0; i < sband->n_bitrates; i++) {
6786                         if (sband->bitrates[i].bitrate == rateval) {
6787                                 mcast_rate[band] = i + 1;
6788                                 found = true;
6789                                 break;
6790                         }
6791                 }
6792         }
6793
6794         return found;
6795 }
6796
6797 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6798 {
6799         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6800         struct net_device *dev = info->user_ptr[1];
6801         struct cfg80211_ibss_params ibss;
6802         struct wiphy *wiphy;
6803         struct cfg80211_cached_keys *connkeys = NULL;
6804         int err;
6805
6806         memset(&ibss, 0, sizeof(ibss));
6807
6808         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6809                 return -EINVAL;
6810
6811         if (!info->attrs[NL80211_ATTR_SSID] ||
6812             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6813                 return -EINVAL;
6814
6815         ibss.beacon_interval = 100;
6816
6817         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6818                 ibss.beacon_interval =
6819                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6820                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6821                         return -EINVAL;
6822         }
6823
6824         if (!rdev->ops->join_ibss)
6825                 return -EOPNOTSUPP;
6826
6827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6828                 return -EOPNOTSUPP;
6829
6830         wiphy = &rdev->wiphy;
6831
6832         if (info->attrs[NL80211_ATTR_MAC]) {
6833                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6834
6835                 if (!is_valid_ether_addr(ibss.bssid))
6836                         return -EINVAL;
6837         }
6838         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6839         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6840
6841         if (info->attrs[NL80211_ATTR_IE]) {
6842                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6843                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6844         }
6845
6846         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6847         if (err)
6848                 return err;
6849
6850         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6851                                      NL80211_IFTYPE_ADHOC))
6852                 return -EINVAL;
6853
6854         switch (ibss.chandef.width) {
6855         case NL80211_CHAN_WIDTH_5:
6856         case NL80211_CHAN_WIDTH_10:
6857         case NL80211_CHAN_WIDTH_20_NOHT:
6858                 break;
6859         case NL80211_CHAN_WIDTH_20:
6860         case NL80211_CHAN_WIDTH_40:
6861                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6862                         break;
6863         default:
6864                 return -EINVAL;
6865         }
6866
6867         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6868         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6869
6870         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6871                 u8 *rates =
6872                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6873                 int n_rates =
6874                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6875                 struct ieee80211_supported_band *sband =
6876                         wiphy->bands[ibss.chandef.chan->band];
6877
6878                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6879                                              &ibss.basic_rates);
6880                 if (err)
6881                         return err;
6882         }
6883
6884         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6885                 memcpy(&ibss.ht_capa_mask,
6886                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6887                        sizeof(ibss.ht_capa_mask));
6888
6889         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6890                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6891                         return -EINVAL;
6892                 memcpy(&ibss.ht_capa,
6893                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6894                        sizeof(ibss.ht_capa));
6895         }
6896
6897         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6898             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6899                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6900                 return -EINVAL;
6901
6902         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6903                 bool no_ht = false;
6904
6905                 connkeys = nl80211_parse_connkeys(rdev,
6906                                           info->attrs[NL80211_ATTR_KEYS],
6907                                           &no_ht);
6908                 if (IS_ERR(connkeys))
6909                         return PTR_ERR(connkeys);
6910
6911                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6912                     no_ht) {
6913                         kfree(connkeys);
6914                         return -EINVAL;
6915                 }
6916         }
6917
6918         ibss.control_port =
6919                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6920
6921         ibss.userspace_handles_dfs =
6922                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6923
6924         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6925         if (err)
6926                 kfree(connkeys);
6927         return err;
6928 }
6929
6930 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6931 {
6932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6933         struct net_device *dev = info->user_ptr[1];
6934
6935         if (!rdev->ops->leave_ibss)
6936                 return -EOPNOTSUPP;
6937
6938         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6939                 return -EOPNOTSUPP;
6940
6941         return cfg80211_leave_ibss(rdev, dev, false);
6942 }
6943
6944 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6945 {
6946         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6947         struct net_device *dev = info->user_ptr[1];
6948         int mcast_rate[IEEE80211_NUM_BANDS];
6949         u32 nla_rate;
6950         int err;
6951
6952         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6953             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6954                 return -EOPNOTSUPP;
6955
6956         if (!rdev->ops->set_mcast_rate)
6957                 return -EOPNOTSUPP;
6958
6959         memset(mcast_rate, 0, sizeof(mcast_rate));
6960
6961         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6962                 return -EINVAL;
6963
6964         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6965         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6966                 return -EINVAL;
6967
6968         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6969
6970         return err;
6971 }
6972
6973 static struct sk_buff *
6974 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6975                             int approxlen, u32 portid, u32 seq,
6976                             enum nl80211_commands cmd,
6977                             enum nl80211_attrs attr,
6978                             const struct nl80211_vendor_cmd_info *info,
6979                             gfp_t gfp)
6980 {
6981         struct sk_buff *skb;
6982         void *hdr;
6983         struct nlattr *data;
6984
6985         skb = nlmsg_new(approxlen + 100, gfp);
6986         if (!skb)
6987                 return NULL;
6988
6989         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6990         if (!hdr) {
6991                 kfree_skb(skb);
6992                 return NULL;
6993         }
6994
6995         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6996                 goto nla_put_failure;
6997
6998         if (info) {
6999                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7000                                 info->vendor_id))
7001                         goto nla_put_failure;
7002                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7003                                 info->subcmd))
7004                         goto nla_put_failure;
7005         }
7006
7007         data = nla_nest_start(skb, attr);
7008
7009         ((void **)skb->cb)[0] = rdev;
7010         ((void **)skb->cb)[1] = hdr;
7011         ((void **)skb->cb)[2] = data;
7012
7013         return skb;
7014
7015  nla_put_failure:
7016         kfree_skb(skb);
7017         return NULL;
7018 }
7019
7020 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7021                                            enum nl80211_commands cmd,
7022                                            enum nl80211_attrs attr,
7023                                            int vendor_event_idx,
7024                                            int approxlen, gfp_t gfp)
7025 {
7026         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7027         const struct nl80211_vendor_cmd_info *info;
7028
7029         switch (cmd) {
7030         case NL80211_CMD_TESTMODE:
7031                 if (WARN_ON(vendor_event_idx != -1))
7032                         return NULL;
7033                 info = NULL;
7034                 break;
7035         case NL80211_CMD_VENDOR:
7036                 if (WARN_ON(vendor_event_idx < 0 ||
7037                             vendor_event_idx >= wiphy->n_vendor_events))
7038                         return NULL;
7039                 info = &wiphy->vendor_events[vendor_event_idx];
7040                 break;
7041         default:
7042                 WARN_ON(1);
7043                 return NULL;
7044         }
7045
7046         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7047                                            cmd, attr, info, gfp);
7048 }
7049 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7050
7051 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7052 {
7053         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7054         void *hdr = ((void **)skb->cb)[1];
7055         struct nlattr *data = ((void **)skb->cb)[2];
7056         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7057
7058         /* clear CB data for netlink core to own from now on */
7059         memset(skb->cb, 0, sizeof(skb->cb));
7060
7061         nla_nest_end(skb, data);
7062         genlmsg_end(skb, hdr);
7063
7064         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7065                 mcgrp = NL80211_MCGRP_VENDOR;
7066
7067         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7068                                 mcgrp, gfp);
7069 }
7070 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7071
7072 #ifdef CONFIG_NL80211_TESTMODE
7073 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7074 {
7075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7076         struct wireless_dev *wdev =
7077                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7078         int err;
7079
7080         if (!rdev->ops->testmode_cmd)
7081                 return -EOPNOTSUPP;
7082
7083         if (IS_ERR(wdev)) {
7084                 err = PTR_ERR(wdev);
7085                 if (err != -EINVAL)
7086                         return err;
7087                 wdev = NULL;
7088         } else if (wdev->wiphy != &rdev->wiphy) {
7089                 return -EINVAL;
7090         }
7091
7092         if (!info->attrs[NL80211_ATTR_TESTDATA])
7093                 return -EINVAL;
7094
7095         rdev->cur_cmd_info = info;
7096         err = rdev_testmode_cmd(rdev, wdev,
7097                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7098                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7099         rdev->cur_cmd_info = NULL;
7100
7101         return err;
7102 }
7103
7104 static int nl80211_testmode_dump(struct sk_buff *skb,
7105                                  struct netlink_callback *cb)
7106 {
7107         struct cfg80211_registered_device *rdev;
7108         int err;
7109         long phy_idx;
7110         void *data = NULL;
7111         int data_len = 0;
7112
7113         rtnl_lock();
7114
7115         if (cb->args[0]) {
7116                 /*
7117                  * 0 is a valid index, but not valid for args[0],
7118                  * so we need to offset by 1.
7119                  */
7120                 phy_idx = cb->args[0] - 1;
7121         } else {
7122                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7123                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7124                                   nl80211_policy);
7125                 if (err)
7126                         goto out_err;
7127
7128                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7129                                                   nl80211_fam.attrbuf);
7130                 if (IS_ERR(rdev)) {
7131                         err = PTR_ERR(rdev);
7132                         goto out_err;
7133                 }
7134                 phy_idx = rdev->wiphy_idx;
7135                 rdev = NULL;
7136
7137                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7138                         cb->args[1] =
7139                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7140         }
7141
7142         if (cb->args[1]) {
7143                 data = nla_data((void *)cb->args[1]);
7144                 data_len = nla_len((void *)cb->args[1]);
7145         }
7146
7147         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7148         if (!rdev) {
7149                 err = -ENOENT;
7150                 goto out_err;
7151         }
7152
7153         if (!rdev->ops->testmode_dump) {
7154                 err = -EOPNOTSUPP;
7155                 goto out_err;
7156         }
7157
7158         while (1) {
7159                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7160                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7161                                            NL80211_CMD_TESTMODE);
7162                 struct nlattr *tmdata;
7163
7164                 if (!hdr)
7165                         break;
7166
7167                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7168                         genlmsg_cancel(skb, hdr);
7169                         break;
7170                 }
7171
7172                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7173                 if (!tmdata) {
7174                         genlmsg_cancel(skb, hdr);
7175                         break;
7176                 }
7177                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7178                 nla_nest_end(skb, tmdata);
7179
7180                 if (err == -ENOBUFS || err == -ENOENT) {
7181                         genlmsg_cancel(skb, hdr);
7182                         break;
7183                 } else if (err) {
7184                         genlmsg_cancel(skb, hdr);
7185                         goto out_err;
7186                 }
7187
7188                 genlmsg_end(skb, hdr);
7189         }
7190
7191         err = skb->len;
7192         /* see above */
7193         cb->args[0] = phy_idx + 1;
7194  out_err:
7195         rtnl_unlock();
7196         return err;
7197 }
7198 #endif
7199
7200 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7201 {
7202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7203         struct net_device *dev = info->user_ptr[1];
7204         struct cfg80211_connect_params connect;
7205         struct wiphy *wiphy;
7206         struct cfg80211_cached_keys *connkeys = NULL;
7207         int err;
7208
7209         memset(&connect, 0, sizeof(connect));
7210
7211         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7212                 return -EINVAL;
7213
7214         if (!info->attrs[NL80211_ATTR_SSID] ||
7215             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7216                 return -EINVAL;
7217
7218         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7219                 connect.auth_type =
7220                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7221                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7222                                              NL80211_CMD_CONNECT))
7223                         return -EINVAL;
7224         } else
7225                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7226
7227         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7228
7229         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7230                                       NL80211_MAX_NR_CIPHER_SUITES);
7231         if (err)
7232                 return err;
7233
7234         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7235             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7236                 return -EOPNOTSUPP;
7237
7238         wiphy = &rdev->wiphy;
7239
7240         connect.bg_scan_period = -1;
7241         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7242                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7243                 connect.bg_scan_period =
7244                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7245         }
7246
7247         if (info->attrs[NL80211_ATTR_MAC])
7248                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7249         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7250                 connect.bssid_hint =
7251                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7252         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7253         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7254
7255         if (info->attrs[NL80211_ATTR_IE]) {
7256                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7257                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7258         }
7259
7260         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7261                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7262                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7263                     connect.mfp != NL80211_MFP_NO)
7264                         return -EINVAL;
7265         } else {
7266                 connect.mfp = NL80211_MFP_NO;
7267         }
7268
7269         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7270                 connect.channel = nl80211_get_valid_chan(
7271                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7272                 if (!connect.channel)
7273                         return -EINVAL;
7274         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7275                 connect.channel_hint = nl80211_get_valid_chan(
7276                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7277                 if (!connect.channel_hint)
7278                         return -EINVAL;
7279         }
7280
7281         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7282                 connkeys = nl80211_parse_connkeys(rdev,
7283                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7284                 if (IS_ERR(connkeys))
7285                         return PTR_ERR(connkeys);
7286         }
7287
7288         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7289                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7290
7291         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7292                 memcpy(&connect.ht_capa_mask,
7293                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7294                        sizeof(connect.ht_capa_mask));
7295
7296         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7297                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7298                         kfree(connkeys);
7299                         return -EINVAL;
7300                 }
7301                 memcpy(&connect.ht_capa,
7302                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7303                        sizeof(connect.ht_capa));
7304         }
7305
7306         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7307                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7308
7309         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7310                 memcpy(&connect.vht_capa_mask,
7311                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7312                        sizeof(connect.vht_capa_mask));
7313
7314         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7315                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7316                         kfree(connkeys);
7317                         return -EINVAL;
7318                 }
7319                 memcpy(&connect.vht_capa,
7320                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7321                        sizeof(connect.vht_capa));
7322         }
7323
7324         wdev_lock(dev->ieee80211_ptr);
7325         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7326         wdev_unlock(dev->ieee80211_ptr);
7327         if (err)
7328                 kfree(connkeys);
7329         return err;
7330 }
7331
7332 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7333 {
7334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7335         struct net_device *dev = info->user_ptr[1];
7336         u16 reason;
7337         int ret;
7338
7339         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7340                 reason = WLAN_REASON_DEAUTH_LEAVING;
7341         else
7342                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7343
7344         if (reason == 0)
7345                 return -EINVAL;
7346
7347         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7348             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7349                 return -EOPNOTSUPP;
7350
7351         wdev_lock(dev->ieee80211_ptr);
7352         ret = cfg80211_disconnect(rdev, dev, reason, true);
7353         wdev_unlock(dev->ieee80211_ptr);
7354         return ret;
7355 }
7356
7357 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7358 {
7359         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7360         struct net *net;
7361         int err;
7362         u32 pid;
7363
7364         if (!info->attrs[NL80211_ATTR_PID])
7365                 return -EINVAL;
7366
7367         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7368
7369         net = get_net_ns_by_pid(pid);
7370         if (IS_ERR(net))
7371                 return PTR_ERR(net);
7372
7373         err = 0;
7374
7375         /* check if anything to do */
7376         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7377                 err = cfg80211_switch_netns(rdev, net);
7378
7379         put_net(net);
7380         return err;
7381 }
7382
7383 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7384 {
7385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7386         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7387                         struct cfg80211_pmksa *pmksa) = NULL;
7388         struct net_device *dev = info->user_ptr[1];
7389         struct cfg80211_pmksa pmksa;
7390
7391         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7392
7393         if (!info->attrs[NL80211_ATTR_MAC])
7394                 return -EINVAL;
7395
7396         if (!info->attrs[NL80211_ATTR_PMKID])
7397                 return -EINVAL;
7398
7399         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7400         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7401
7402         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7403             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7404                 return -EOPNOTSUPP;
7405
7406         switch (info->genlhdr->cmd) {
7407         case NL80211_CMD_SET_PMKSA:
7408                 rdev_ops = rdev->ops->set_pmksa;
7409                 break;
7410         case NL80211_CMD_DEL_PMKSA:
7411                 rdev_ops = rdev->ops->del_pmksa;
7412                 break;
7413         default:
7414                 WARN_ON(1);
7415                 break;
7416         }
7417
7418         if (!rdev_ops)
7419                 return -EOPNOTSUPP;
7420
7421         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7422 }
7423
7424 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7425 {
7426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7427         struct net_device *dev = info->user_ptr[1];
7428
7429         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7430             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7431                 return -EOPNOTSUPP;
7432
7433         if (!rdev->ops->flush_pmksa)
7434                 return -EOPNOTSUPP;
7435
7436         return rdev_flush_pmksa(rdev, dev);
7437 }
7438
7439 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7440 {
7441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7442         struct net_device *dev = info->user_ptr[1];
7443         u8 action_code, dialog_token;
7444         u32 peer_capability = 0;
7445         u16 status_code;
7446         u8 *peer;
7447
7448         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7449             !rdev->ops->tdls_mgmt)
7450                 return -EOPNOTSUPP;
7451
7452         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7453             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7454             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7455             !info->attrs[NL80211_ATTR_IE] ||
7456             !info->attrs[NL80211_ATTR_MAC])
7457                 return -EINVAL;
7458
7459         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7460         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7461         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7462         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7463         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7464                 peer_capability =
7465                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7466
7467         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7468                               dialog_token, status_code, peer_capability,
7469                               nla_data(info->attrs[NL80211_ATTR_IE]),
7470                               nla_len(info->attrs[NL80211_ATTR_IE]));
7471 }
7472
7473 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7474 {
7475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7476         struct net_device *dev = info->user_ptr[1];
7477         enum nl80211_tdls_operation operation;
7478         u8 *peer;
7479
7480         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7481             !rdev->ops->tdls_oper)
7482                 return -EOPNOTSUPP;
7483
7484         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7485             !info->attrs[NL80211_ATTR_MAC])
7486                 return -EINVAL;
7487
7488         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7489         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7490
7491         return rdev_tdls_oper(rdev, dev, peer, operation);
7492 }
7493
7494 static int nl80211_remain_on_channel(struct sk_buff *skb,
7495                                      struct genl_info *info)
7496 {
7497         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7498         struct wireless_dev *wdev = info->user_ptr[1];
7499         struct cfg80211_chan_def chandef;
7500         struct sk_buff *msg;
7501         void *hdr;
7502         u64 cookie;
7503         u32 duration;
7504         int err;
7505
7506         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7507             !info->attrs[NL80211_ATTR_DURATION])
7508                 return -EINVAL;
7509
7510         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7511
7512         if (!rdev->ops->remain_on_channel ||
7513             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7514                 return -EOPNOTSUPP;
7515
7516         /*
7517          * We should be on that channel for at least a minimum amount of
7518          * time (10ms) but no longer than the driver supports.
7519          */
7520         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7521             duration > rdev->wiphy.max_remain_on_channel_duration)
7522                 return -EINVAL;
7523
7524         err = nl80211_parse_chandef(rdev, info, &chandef);
7525         if (err)
7526                 return err;
7527
7528         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7529         if (!msg)
7530                 return -ENOMEM;
7531
7532         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7533                              NL80211_CMD_REMAIN_ON_CHANNEL);
7534         if (!hdr) {
7535                 err = -ENOBUFS;
7536                 goto free_msg;
7537         }
7538
7539         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7540                                      duration, &cookie);
7541
7542         if (err)
7543                 goto free_msg;
7544
7545         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7546                 goto nla_put_failure;
7547
7548         genlmsg_end(msg, hdr);
7549
7550         return genlmsg_reply(msg, info);
7551
7552  nla_put_failure:
7553         err = -ENOBUFS;
7554  free_msg:
7555         nlmsg_free(msg);
7556         return err;
7557 }
7558
7559 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7560                                             struct genl_info *info)
7561 {
7562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7563         struct wireless_dev *wdev = info->user_ptr[1];
7564         u64 cookie;
7565
7566         if (!info->attrs[NL80211_ATTR_COOKIE])
7567                 return -EINVAL;
7568
7569         if (!rdev->ops->cancel_remain_on_channel)
7570                 return -EOPNOTSUPP;
7571
7572         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7573
7574         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7575 }
7576
7577 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7578                            u8 *rates, u8 rates_len)
7579 {
7580         u8 i;
7581         u32 mask = 0;
7582
7583         for (i = 0; i < rates_len; i++) {
7584                 int rate = (rates[i] & 0x7f) * 5;
7585                 int ridx;
7586                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7587                         struct ieee80211_rate *srate =
7588                                 &sband->bitrates[ridx];
7589                         if (rate == srate->bitrate) {
7590                                 mask |= 1 << ridx;
7591                                 break;
7592                         }
7593                 }
7594                 if (ridx == sband->n_bitrates)
7595                         return 0; /* rate not found */
7596         }
7597
7598         return mask;
7599 }
7600
7601 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7602                                u8 *rates, u8 rates_len,
7603                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7604 {
7605         u8 i;
7606
7607         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7608
7609         for (i = 0; i < rates_len; i++) {
7610                 int ridx, rbit;
7611
7612                 ridx = rates[i] / 8;
7613                 rbit = BIT(rates[i] % 8);
7614
7615                 /* check validity */
7616                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7617                         return false;
7618
7619                 /* check availability */
7620                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7621                         mcs[ridx] |= rbit;
7622                 else
7623                         return false;
7624         }
7625
7626         return true;
7627 }
7628
7629 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7630 {
7631         u16 mcs_mask = 0;
7632
7633         switch (vht_mcs_map) {
7634         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7635                 break;
7636         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7637                 mcs_mask = 0x00FF;
7638                 break;
7639         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7640                 mcs_mask = 0x01FF;
7641                 break;
7642         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7643                 mcs_mask = 0x03FF;
7644                 break;
7645         default:
7646                 break;
7647         }
7648
7649         return mcs_mask;
7650 }
7651
7652 static void vht_build_mcs_mask(u16 vht_mcs_map,
7653                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7654 {
7655         u8 nss;
7656
7657         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7658                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7659                 vht_mcs_map >>= 2;
7660         }
7661 }
7662
7663 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7664                              struct nl80211_txrate_vht *txrate,
7665                              u16 mcs[NL80211_VHT_NSS_MAX])
7666 {
7667         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7668         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7669         u8 i;
7670
7671         if (!sband->vht_cap.vht_supported)
7672                 return false;
7673
7674         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7675
7676         /* Build vht_mcs_mask from VHT capabilities */
7677         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7678
7679         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7680                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7681                         mcs[i] = txrate->mcs[i];
7682                 else
7683                         return false;
7684         }
7685
7686         return true;
7687 }
7688
7689 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7690         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7691                                     .len = NL80211_MAX_SUPP_RATES },
7692         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7693                                 .len = NL80211_MAX_SUPP_HT_RATES },
7694         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7695         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7696 };
7697
7698 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7699                                        struct genl_info *info)
7700 {
7701         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7703         struct cfg80211_bitrate_mask mask;
7704         int rem, i;
7705         struct net_device *dev = info->user_ptr[1];
7706         struct nlattr *tx_rates;
7707         struct ieee80211_supported_band *sband;
7708         u16 vht_tx_mcs_map;
7709
7710         if (!rdev->ops->set_bitrate_mask)
7711                 return -EOPNOTSUPP;
7712
7713         memset(&mask, 0, sizeof(mask));
7714         /* Default to all rates enabled */
7715         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7716                 sband = rdev->wiphy.bands[i];
7717
7718                 if (!sband)
7719                         continue;
7720
7721                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7722                 memcpy(mask.control[i].ht_mcs,
7723                        sband->ht_cap.mcs.rx_mask,
7724                        sizeof(mask.control[i].ht_mcs));
7725
7726                 if (!sband->vht_cap.vht_supported)
7727                         continue;
7728
7729                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7730                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7731         }
7732
7733         /* if no rates are given set it back to the defaults */
7734         if (!info->attrs[NL80211_ATTR_TX_RATES])
7735                 goto out;
7736
7737         /*
7738          * The nested attribute uses enum nl80211_band as the index. This maps
7739          * directly to the enum ieee80211_band values used in cfg80211.
7740          */
7741         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7742         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7743                 enum ieee80211_band band = nla_type(tx_rates);
7744                 int err;
7745
7746                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7747                         return -EINVAL;
7748                 sband = rdev->wiphy.bands[band];
7749                 if (sband == NULL)
7750                         return -EINVAL;
7751                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7752                                 nla_len(tx_rates), nl80211_txattr_policy);
7753                 if (err)
7754                         return err;
7755                 if (tb[NL80211_TXRATE_LEGACY]) {
7756                         mask.control[band].legacy = rateset_to_mask(
7757                                 sband,
7758                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7759                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7760                         if ((mask.control[band].legacy == 0) &&
7761                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7762                                 return -EINVAL;
7763                 }
7764                 if (tb[NL80211_TXRATE_HT]) {
7765                         if (!ht_rateset_to_mask(
7766                                         sband,
7767                                         nla_data(tb[NL80211_TXRATE_HT]),
7768                                         nla_len(tb[NL80211_TXRATE_HT]),
7769                                         mask.control[band].ht_mcs))
7770                                 return -EINVAL;
7771                 }
7772                 if (tb[NL80211_TXRATE_VHT]) {
7773                         if (!vht_set_mcs_mask(
7774                                         sband,
7775                                         nla_data(tb[NL80211_TXRATE_VHT]),
7776                                         mask.control[band].vht_mcs))
7777                                 return -EINVAL;
7778                 }
7779                 if (tb[NL80211_TXRATE_GI]) {
7780                         mask.control[band].gi =
7781                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7782                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7783                                 return -EINVAL;
7784                 }
7785
7786                 if (mask.control[band].legacy == 0) {
7787                         /* don't allow empty legacy rates if HT or VHT
7788                          * are not even supported.
7789                          */
7790                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7791                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7792                                 return -EINVAL;
7793
7794                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7795                                 if (mask.control[band].ht_mcs[i])
7796                                         goto out;
7797
7798                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7799                                 if (mask.control[band].vht_mcs[i])
7800                                         goto out;
7801
7802                         /* legacy and mcs rates may not be both empty */
7803                         return -EINVAL;
7804                 }
7805         }
7806
7807 out:
7808         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7809 }
7810
7811 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7812 {
7813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7814         struct wireless_dev *wdev = info->user_ptr[1];
7815         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7816
7817         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7818                 return -EINVAL;
7819
7820         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7821                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7822
7823         switch (wdev->iftype) {
7824         case NL80211_IFTYPE_STATION:
7825         case NL80211_IFTYPE_ADHOC:
7826         case NL80211_IFTYPE_P2P_CLIENT:
7827         case NL80211_IFTYPE_AP:
7828         case NL80211_IFTYPE_AP_VLAN:
7829         case NL80211_IFTYPE_MESH_POINT:
7830         case NL80211_IFTYPE_P2P_GO:
7831         case NL80211_IFTYPE_P2P_DEVICE:
7832                 break;
7833         default:
7834                 return -EOPNOTSUPP;
7835         }
7836
7837         /* not much point in registering if we can't reply */
7838         if (!rdev->ops->mgmt_tx)
7839                 return -EOPNOTSUPP;
7840
7841         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7842                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7843                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7844 }
7845
7846 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7847 {
7848         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7849         struct wireless_dev *wdev = info->user_ptr[1];
7850         struct cfg80211_chan_def chandef;
7851         int err;
7852         void *hdr = NULL;
7853         u64 cookie;
7854         struct sk_buff *msg = NULL;
7855         struct cfg80211_mgmt_tx_params params = {
7856                 .dont_wait_for_ack =
7857                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7858         };
7859
7860         if (!info->attrs[NL80211_ATTR_FRAME])
7861                 return -EINVAL;
7862
7863         if (!rdev->ops->mgmt_tx)
7864                 return -EOPNOTSUPP;
7865
7866         switch (wdev->iftype) {
7867         case NL80211_IFTYPE_P2P_DEVICE:
7868                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7869                         return -EINVAL;
7870         case NL80211_IFTYPE_STATION:
7871         case NL80211_IFTYPE_ADHOC:
7872         case NL80211_IFTYPE_P2P_CLIENT:
7873         case NL80211_IFTYPE_AP:
7874         case NL80211_IFTYPE_AP_VLAN:
7875         case NL80211_IFTYPE_MESH_POINT:
7876         case NL80211_IFTYPE_P2P_GO:
7877                 break;
7878         default:
7879                 return -EOPNOTSUPP;
7880         }
7881
7882         if (info->attrs[NL80211_ATTR_DURATION]) {
7883                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7884                         return -EINVAL;
7885                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7886
7887                 /*
7888                  * We should wait on the channel for at least a minimum amount
7889                  * of time (10ms) but no longer than the driver supports.
7890                  */
7891                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7892                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7893                         return -EINVAL;
7894
7895         }
7896
7897         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7898
7899         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7900                 return -EINVAL;
7901
7902         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7903
7904         /* get the channel if any has been specified, otherwise pass NULL to
7905          * the driver. The latter will use the current one
7906          */
7907         chandef.chan = NULL;
7908         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7909                 err = nl80211_parse_chandef(rdev, info, &chandef);
7910                 if (err)
7911                         return err;
7912         }
7913
7914         if (!chandef.chan && params.offchan)
7915                 return -EINVAL;
7916
7917         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7918         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7919
7920         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
7921                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7922                 int i;
7923
7924                 if (len % sizeof(u16))
7925                         return -EINVAL;
7926
7927                 params.n_csa_offsets = len / sizeof(u16);
7928                 params.csa_offsets =
7929                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7930
7931                 /* check that all the offsets fit the frame */
7932                 for (i = 0; i < params.n_csa_offsets; i++) {
7933                         if (params.csa_offsets[i] >= params.len)
7934                                 return -EINVAL;
7935                 }
7936         }
7937
7938         if (!params.dont_wait_for_ack) {
7939                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7940                 if (!msg)
7941                         return -ENOMEM;
7942
7943                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7944                                      NL80211_CMD_FRAME);
7945                 if (!hdr) {
7946                         err = -ENOBUFS;
7947                         goto free_msg;
7948                 }
7949         }
7950
7951         params.chan = chandef.chan;
7952         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7953         if (err)
7954                 goto free_msg;
7955
7956         if (msg) {
7957                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7958                         goto nla_put_failure;
7959
7960                 genlmsg_end(msg, hdr);
7961                 return genlmsg_reply(msg, info);
7962         }
7963
7964         return 0;
7965
7966  nla_put_failure:
7967         err = -ENOBUFS;
7968  free_msg:
7969         nlmsg_free(msg);
7970         return err;
7971 }
7972
7973 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7974 {
7975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7976         struct wireless_dev *wdev = info->user_ptr[1];
7977         u64 cookie;
7978
7979         if (!info->attrs[NL80211_ATTR_COOKIE])
7980                 return -EINVAL;
7981
7982         if (!rdev->ops->mgmt_tx_cancel_wait)
7983                 return -EOPNOTSUPP;
7984
7985         switch (wdev->iftype) {
7986         case NL80211_IFTYPE_STATION:
7987         case NL80211_IFTYPE_ADHOC:
7988         case NL80211_IFTYPE_P2P_CLIENT:
7989         case NL80211_IFTYPE_AP:
7990         case NL80211_IFTYPE_AP_VLAN:
7991         case NL80211_IFTYPE_P2P_GO:
7992         case NL80211_IFTYPE_P2P_DEVICE:
7993                 break;
7994         default:
7995                 return -EOPNOTSUPP;
7996         }
7997
7998         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7999
8000         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8001 }
8002
8003 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8004 {
8005         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8006         struct wireless_dev *wdev;
8007         struct net_device *dev = info->user_ptr[1];
8008         u8 ps_state;
8009         bool state;
8010         int err;
8011
8012         if (!info->attrs[NL80211_ATTR_PS_STATE])
8013                 return -EINVAL;
8014
8015         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8016
8017         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8018                 return -EINVAL;
8019
8020         wdev = dev->ieee80211_ptr;
8021
8022         if (!rdev->ops->set_power_mgmt)
8023                 return -EOPNOTSUPP;
8024
8025         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8026
8027         if (state == wdev->ps)
8028                 return 0;
8029
8030         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8031         if (!err)
8032                 wdev->ps = state;
8033         return err;
8034 }
8035
8036 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8037 {
8038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8039         enum nl80211_ps_state ps_state;
8040         struct wireless_dev *wdev;
8041         struct net_device *dev = info->user_ptr[1];
8042         struct sk_buff *msg;
8043         void *hdr;
8044         int err;
8045
8046         wdev = dev->ieee80211_ptr;
8047
8048         if (!rdev->ops->set_power_mgmt)
8049                 return -EOPNOTSUPP;
8050
8051         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8052         if (!msg)
8053                 return -ENOMEM;
8054
8055         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8056                              NL80211_CMD_GET_POWER_SAVE);
8057         if (!hdr) {
8058                 err = -ENOBUFS;
8059                 goto free_msg;
8060         }
8061
8062         if (wdev->ps)
8063                 ps_state = NL80211_PS_ENABLED;
8064         else
8065                 ps_state = NL80211_PS_DISABLED;
8066
8067         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8068                 goto nla_put_failure;
8069
8070         genlmsg_end(msg, hdr);
8071         return genlmsg_reply(msg, info);
8072
8073  nla_put_failure:
8074         err = -ENOBUFS;
8075  free_msg:
8076         nlmsg_free(msg);
8077         return err;
8078 }
8079
8080 static const struct nla_policy
8081 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8082         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8083         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8084         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8085         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8086         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8087         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8088 };
8089
8090 static int nl80211_set_cqm_txe(struct genl_info *info,
8091                                u32 rate, u32 pkts, u32 intvl)
8092 {
8093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8094         struct net_device *dev = info->user_ptr[1];
8095         struct wireless_dev *wdev = dev->ieee80211_ptr;
8096
8097         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8098                 return -EINVAL;
8099
8100         if (!rdev->ops->set_cqm_txe_config)
8101                 return -EOPNOTSUPP;
8102
8103         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8104             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8105                 return -EOPNOTSUPP;
8106
8107         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8108 }
8109
8110 static int nl80211_set_cqm_rssi(struct genl_info *info,
8111                                 s32 threshold, u32 hysteresis)
8112 {
8113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8114         struct net_device *dev = info->user_ptr[1];
8115         struct wireless_dev *wdev = dev->ieee80211_ptr;
8116
8117         if (threshold > 0)
8118                 return -EINVAL;
8119
8120         /* disabling - hysteresis should also be zero then */
8121         if (threshold == 0)
8122                 hysteresis = 0;
8123
8124         if (!rdev->ops->set_cqm_rssi_config)
8125                 return -EOPNOTSUPP;
8126
8127         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8128             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8129                 return -EOPNOTSUPP;
8130
8131         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8132 }
8133
8134 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8135 {
8136         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8137         struct nlattr *cqm;
8138         int err;
8139
8140         cqm = info->attrs[NL80211_ATTR_CQM];
8141         if (!cqm)
8142                 return -EINVAL;
8143
8144         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8145                                nl80211_attr_cqm_policy);
8146         if (err)
8147                 return err;
8148
8149         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8150             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8151                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8152                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8153
8154                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8155         }
8156
8157         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8158             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8159             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8160                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8161                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8162                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8163
8164                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8165         }
8166
8167         return -EINVAL;
8168 }
8169
8170 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8171 {
8172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8173         struct net_device *dev = info->user_ptr[1];
8174         struct mesh_config cfg;
8175         struct mesh_setup setup;
8176         int err;
8177
8178         /* start with default */
8179         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8180         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8181
8182         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8183                 /* and parse parameters if given */
8184                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8185                 if (err)
8186                         return err;
8187         }
8188
8189         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8190             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8191                 return -EINVAL;
8192
8193         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8194         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8195
8196         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8197             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8198                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8199                         return -EINVAL;
8200
8201         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8202                 setup.beacon_interval =
8203                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8204                 if (setup.beacon_interval < 10 ||
8205                     setup.beacon_interval > 10000)
8206                         return -EINVAL;
8207         }
8208
8209         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8210                 setup.dtim_period =
8211                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8212                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8213                         return -EINVAL;
8214         }
8215
8216         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8217                 /* parse additional setup parameters if given */
8218                 err = nl80211_parse_mesh_setup(info, &setup);
8219                 if (err)
8220                         return err;
8221         }
8222
8223         if (setup.user_mpm)
8224                 cfg.auto_open_plinks = false;
8225
8226         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8227                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8228                 if (err)
8229                         return err;
8230         } else {
8231                 /* cfg80211_join_mesh() will sort it out */
8232                 setup.chandef.chan = NULL;
8233         }
8234
8235         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8236                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8237                 int n_rates =
8238                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8239                 struct ieee80211_supported_band *sband;
8240
8241                 if (!setup.chandef.chan)
8242                         return -EINVAL;
8243
8244                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8245
8246                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8247                                              &setup.basic_rates);
8248                 if (err)
8249                         return err;
8250         }
8251
8252         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8253 }
8254
8255 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8256 {
8257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8258         struct net_device *dev = info->user_ptr[1];
8259
8260         return cfg80211_leave_mesh(rdev, dev);
8261 }
8262
8263 #ifdef CONFIG_PM
8264 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8265                                         struct cfg80211_registered_device *rdev)
8266 {
8267         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8268         struct nlattr *nl_pats, *nl_pat;
8269         int i, pat_len;
8270
8271         if (!wowlan->n_patterns)
8272                 return 0;
8273
8274         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8275         if (!nl_pats)
8276                 return -ENOBUFS;
8277
8278         for (i = 0; i < wowlan->n_patterns; i++) {
8279                 nl_pat = nla_nest_start(msg, i + 1);
8280                 if (!nl_pat)
8281                         return -ENOBUFS;
8282                 pat_len = wowlan->patterns[i].pattern_len;
8283                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8284                             wowlan->patterns[i].mask) ||
8285                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8286                             wowlan->patterns[i].pattern) ||
8287                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8288                                 wowlan->patterns[i].pkt_offset))
8289                         return -ENOBUFS;
8290                 nla_nest_end(msg, nl_pat);
8291         }
8292         nla_nest_end(msg, nl_pats);
8293
8294         return 0;
8295 }
8296
8297 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8298                                    struct cfg80211_wowlan_tcp *tcp)
8299 {
8300         struct nlattr *nl_tcp;
8301
8302         if (!tcp)
8303                 return 0;
8304
8305         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8306         if (!nl_tcp)
8307                 return -ENOBUFS;
8308
8309         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8310             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8311             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8312             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8313             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8314             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8315                     tcp->payload_len, tcp->payload) ||
8316             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8317                         tcp->data_interval) ||
8318             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8319                     tcp->wake_len, tcp->wake_data) ||
8320             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8321                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8322                 return -ENOBUFS;
8323
8324         if (tcp->payload_seq.len &&
8325             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8326                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8327                 return -ENOBUFS;
8328
8329         if (tcp->payload_tok.len &&
8330             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8331                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8332                     &tcp->payload_tok))
8333                 return -ENOBUFS;
8334
8335         nla_nest_end(msg, nl_tcp);
8336
8337         return 0;
8338 }
8339
8340 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8341 {
8342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8343         struct sk_buff *msg;
8344         void *hdr;
8345         u32 size = NLMSG_DEFAULT_SIZE;
8346
8347         if (!rdev->wiphy.wowlan)
8348                 return -EOPNOTSUPP;
8349
8350         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8351                 /* adjust size to have room for all the data */
8352                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8353                         rdev->wiphy.wowlan_config->tcp->payload_len +
8354                         rdev->wiphy.wowlan_config->tcp->wake_len +
8355                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8356         }
8357
8358         msg = nlmsg_new(size, GFP_KERNEL);
8359         if (!msg)
8360                 return -ENOMEM;
8361
8362         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8363                              NL80211_CMD_GET_WOWLAN);
8364         if (!hdr)
8365                 goto nla_put_failure;
8366
8367         if (rdev->wiphy.wowlan_config) {
8368                 struct nlattr *nl_wowlan;
8369
8370                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8371                 if (!nl_wowlan)
8372                         goto nla_put_failure;
8373
8374                 if ((rdev->wiphy.wowlan_config->any &&
8375                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8376                     (rdev->wiphy.wowlan_config->disconnect &&
8377                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8378                     (rdev->wiphy.wowlan_config->magic_pkt &&
8379                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8380                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8381                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8382                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8383                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8384                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8385                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8386                     (rdev->wiphy.wowlan_config->rfkill_release &&
8387                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8388                         goto nla_put_failure;
8389
8390                 if (nl80211_send_wowlan_patterns(msg, rdev))
8391                         goto nla_put_failure;
8392
8393                 if (nl80211_send_wowlan_tcp(msg,
8394                                             rdev->wiphy.wowlan_config->tcp))
8395                         goto nla_put_failure;
8396
8397                 nla_nest_end(msg, nl_wowlan);
8398         }
8399
8400         genlmsg_end(msg, hdr);
8401         return genlmsg_reply(msg, info);
8402
8403 nla_put_failure:
8404         nlmsg_free(msg);
8405         return -ENOBUFS;
8406 }
8407
8408 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8409                                     struct nlattr *attr,
8410                                     struct cfg80211_wowlan *trig)
8411 {
8412         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8413         struct cfg80211_wowlan_tcp *cfg;
8414         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8415         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8416         u32 size;
8417         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8418         int err, port;
8419
8420         if (!rdev->wiphy.wowlan->tcp)
8421                 return -EINVAL;
8422
8423         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8424                         nla_data(attr), nla_len(attr),
8425                         nl80211_wowlan_tcp_policy);
8426         if (err)
8427                 return err;
8428
8429         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8430             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8431             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8432             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8433             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8434             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8435             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8436             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8437                 return -EINVAL;
8438
8439         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8440         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8441                 return -EINVAL;
8442
8443         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8444                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8445             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8446                 return -EINVAL;
8447
8448         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8449         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8450                 return -EINVAL;
8451
8452         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8453         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8454                 return -EINVAL;
8455
8456         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8457                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8458
8459                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8460                 tokens_size = tokln - sizeof(*tok);
8461
8462                 if (!tok->len || tokens_size % tok->len)
8463                         return -EINVAL;
8464                 if (!rdev->wiphy.wowlan->tcp->tok)
8465                         return -EINVAL;
8466                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8467                         return -EINVAL;
8468                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8469                         return -EINVAL;
8470                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8471                         return -EINVAL;
8472                 if (tok->offset + tok->len > data_size)
8473                         return -EINVAL;
8474         }
8475
8476         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8477                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8478                 if (!rdev->wiphy.wowlan->tcp->seq)
8479                         return -EINVAL;
8480                 if (seq->len == 0 || seq->len > 4)
8481                         return -EINVAL;
8482                 if (seq->len + seq->offset > data_size)
8483                         return -EINVAL;
8484         }
8485
8486         size = sizeof(*cfg);
8487         size += data_size;
8488         size += wake_size + wake_mask_size;
8489         size += tokens_size;
8490
8491         cfg = kzalloc(size, GFP_KERNEL);
8492         if (!cfg)
8493                 return -ENOMEM;
8494         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8495         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8496         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8497                ETH_ALEN);
8498         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8499                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8500         else
8501                 port = 0;
8502 #ifdef CONFIG_INET
8503         /* allocate a socket and port for it and use it */
8504         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8505                             IPPROTO_TCP, &cfg->sock, 1);
8506         if (err) {
8507                 kfree(cfg);
8508                 return err;
8509         }
8510         if (inet_csk_get_port(cfg->sock->sk, port)) {
8511                 sock_release(cfg->sock);
8512                 kfree(cfg);
8513                 return -EADDRINUSE;
8514         }
8515         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8516 #else
8517         if (!port) {
8518                 kfree(cfg);
8519                 return -EINVAL;
8520         }
8521         cfg->src_port = port;
8522 #endif
8523
8524         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8525         cfg->payload_len = data_size;
8526         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8527         memcpy((void *)cfg->payload,
8528                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8529                data_size);
8530         if (seq)
8531                 cfg->payload_seq = *seq;
8532         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8533         cfg->wake_len = wake_size;
8534         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8535         memcpy((void *)cfg->wake_data,
8536                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8537                wake_size);
8538         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8539                          data_size + wake_size;
8540         memcpy((void *)cfg->wake_mask,
8541                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8542                wake_mask_size);
8543         if (tok) {
8544                 cfg->tokens_size = tokens_size;
8545                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8546         }
8547
8548         trig->tcp = cfg;
8549
8550         return 0;
8551 }
8552
8553 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8554 {
8555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8556         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8557         struct cfg80211_wowlan new_triggers = {};
8558         struct cfg80211_wowlan *ntrig;
8559         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8560         int err, i;
8561         bool prev_enabled = rdev->wiphy.wowlan_config;
8562
8563         if (!wowlan)
8564                 return -EOPNOTSUPP;
8565
8566         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8567                 cfg80211_rdev_free_wowlan(rdev);
8568                 rdev->wiphy.wowlan_config = NULL;
8569                 goto set_wakeup;
8570         }
8571
8572         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8573                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8574                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8575                         nl80211_wowlan_policy);
8576         if (err)
8577                 return err;
8578
8579         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8580                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8581                         return -EINVAL;
8582                 new_triggers.any = true;
8583         }
8584
8585         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8586                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8587                         return -EINVAL;
8588                 new_triggers.disconnect = true;
8589         }
8590
8591         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8592                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8593                         return -EINVAL;
8594                 new_triggers.magic_pkt = true;
8595         }
8596
8597         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8598                 return -EINVAL;
8599
8600         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8601                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8602                         return -EINVAL;
8603                 new_triggers.gtk_rekey_failure = true;
8604         }
8605
8606         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8607                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8608                         return -EINVAL;
8609                 new_triggers.eap_identity_req = true;
8610         }
8611
8612         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8613                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8614                         return -EINVAL;
8615                 new_triggers.four_way_handshake = true;
8616         }
8617
8618         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8619                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8620                         return -EINVAL;
8621                 new_triggers.rfkill_release = true;
8622         }
8623
8624         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8625                 struct nlattr *pat;
8626                 int n_patterns = 0;
8627                 int rem, pat_len, mask_len, pkt_offset;
8628                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8629
8630                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8631                                     rem)
8632                         n_patterns++;
8633                 if (n_patterns > wowlan->n_patterns)
8634                         return -EINVAL;
8635
8636                 new_triggers.patterns = kcalloc(n_patterns,
8637                                                 sizeof(new_triggers.patterns[0]),
8638                                                 GFP_KERNEL);
8639                 if (!new_triggers.patterns)
8640                         return -ENOMEM;
8641
8642                 new_triggers.n_patterns = n_patterns;
8643                 i = 0;
8644
8645                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8646                                     rem) {
8647                         u8 *mask_pat;
8648
8649                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8650                                   nla_len(pat), nl80211_packet_pattern_policy);
8651                         err = -EINVAL;
8652                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8653                             !pat_tb[NL80211_PKTPAT_PATTERN])
8654                                 goto error;
8655                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8656                         mask_len = DIV_ROUND_UP(pat_len, 8);
8657                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8658                                 goto error;
8659                         if (pat_len > wowlan->pattern_max_len ||
8660                             pat_len < wowlan->pattern_min_len)
8661                                 goto error;
8662
8663                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8664                                 pkt_offset = 0;
8665                         else
8666                                 pkt_offset = nla_get_u32(
8667                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8668                         if (pkt_offset > wowlan->max_pkt_offset)
8669                                 goto error;
8670                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8671
8672                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8673                         if (!mask_pat) {
8674                                 err = -ENOMEM;
8675                                 goto error;
8676                         }
8677                         new_triggers.patterns[i].mask = mask_pat;
8678                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8679                                mask_len);
8680                         mask_pat += mask_len;
8681                         new_triggers.patterns[i].pattern = mask_pat;
8682                         new_triggers.patterns[i].pattern_len = pat_len;
8683                         memcpy(mask_pat,
8684                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8685                                pat_len);
8686                         i++;
8687                 }
8688         }
8689
8690         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8691                 err = nl80211_parse_wowlan_tcp(
8692                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8693                         &new_triggers);
8694                 if (err)
8695                         goto error;
8696         }
8697
8698         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8699         if (!ntrig) {
8700                 err = -ENOMEM;
8701                 goto error;
8702         }
8703         cfg80211_rdev_free_wowlan(rdev);
8704         rdev->wiphy.wowlan_config = ntrig;
8705
8706  set_wakeup:
8707         if (rdev->ops->set_wakeup &&
8708             prev_enabled != !!rdev->wiphy.wowlan_config)
8709                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8710
8711         return 0;
8712  error:
8713         for (i = 0; i < new_triggers.n_patterns; i++)
8714                 kfree(new_triggers.patterns[i].mask);
8715         kfree(new_triggers.patterns);
8716         if (new_triggers.tcp && new_triggers.tcp->sock)
8717                 sock_release(new_triggers.tcp->sock);
8718         kfree(new_triggers.tcp);
8719         return err;
8720 }
8721 #endif
8722
8723 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8724                                        struct cfg80211_registered_device *rdev)
8725 {
8726         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8727         int i, j, pat_len;
8728         struct cfg80211_coalesce_rules *rule;
8729
8730         if (!rdev->coalesce->n_rules)
8731                 return 0;
8732
8733         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8734         if (!nl_rules)
8735                 return -ENOBUFS;
8736
8737         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8738                 nl_rule = nla_nest_start(msg, i + 1);
8739                 if (!nl_rule)
8740                         return -ENOBUFS;
8741
8742                 rule = &rdev->coalesce->rules[i];
8743                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8744                                 rule->delay))
8745                         return -ENOBUFS;
8746
8747                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8748                                 rule->condition))
8749                         return -ENOBUFS;
8750
8751                 nl_pats = nla_nest_start(msg,
8752                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8753                 if (!nl_pats)
8754                         return -ENOBUFS;
8755
8756                 for (j = 0; j < rule->n_patterns; j++) {
8757                         nl_pat = nla_nest_start(msg, j + 1);
8758                         if (!nl_pat)
8759                                 return -ENOBUFS;
8760                         pat_len = rule->patterns[j].pattern_len;
8761                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8762                                     DIV_ROUND_UP(pat_len, 8),
8763                                     rule->patterns[j].mask) ||
8764                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8765                                     rule->patterns[j].pattern) ||
8766                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8767                                         rule->patterns[j].pkt_offset))
8768                                 return -ENOBUFS;
8769                         nla_nest_end(msg, nl_pat);
8770                 }
8771                 nla_nest_end(msg, nl_pats);
8772                 nla_nest_end(msg, nl_rule);
8773         }
8774         nla_nest_end(msg, nl_rules);
8775
8776         return 0;
8777 }
8778
8779 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8780 {
8781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8782         struct sk_buff *msg;
8783         void *hdr;
8784
8785         if (!rdev->wiphy.coalesce)
8786                 return -EOPNOTSUPP;
8787
8788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8789         if (!msg)
8790                 return -ENOMEM;
8791
8792         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8793                              NL80211_CMD_GET_COALESCE);
8794         if (!hdr)
8795                 goto nla_put_failure;
8796
8797         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8798                 goto nla_put_failure;
8799
8800         genlmsg_end(msg, hdr);
8801         return genlmsg_reply(msg, info);
8802
8803 nla_put_failure:
8804         nlmsg_free(msg);
8805         return -ENOBUFS;
8806 }
8807
8808 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8809 {
8810         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8811         int i, j;
8812         struct cfg80211_coalesce_rules *rule;
8813
8814         if (!coalesce)
8815                 return;
8816
8817         for (i = 0; i < coalesce->n_rules; i++) {
8818                 rule = &coalesce->rules[i];
8819                 for (j = 0; j < rule->n_patterns; j++)
8820                         kfree(rule->patterns[j].mask);
8821                 kfree(rule->patterns);
8822         }
8823         kfree(coalesce->rules);
8824         kfree(coalesce);
8825         rdev->coalesce = NULL;
8826 }
8827
8828 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8829                                        struct nlattr *rule,
8830                                        struct cfg80211_coalesce_rules *new_rule)
8831 {
8832         int err, i;
8833         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8834         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8835         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8836         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8837
8838         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8839                         nla_len(rule), nl80211_coalesce_policy);
8840         if (err)
8841                 return err;
8842
8843         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8844                 new_rule->delay =
8845                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8846         if (new_rule->delay > coalesce->max_delay)
8847                 return -EINVAL;
8848
8849         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8850                 new_rule->condition =
8851                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8852         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8853             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8854                 return -EINVAL;
8855
8856         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8857                 return -EINVAL;
8858
8859         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8860                             rem)
8861                 n_patterns++;
8862         if (n_patterns > coalesce->n_patterns)
8863                 return -EINVAL;
8864
8865         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8866                                      GFP_KERNEL);
8867         if (!new_rule->patterns)
8868                 return -ENOMEM;
8869
8870         new_rule->n_patterns = n_patterns;
8871         i = 0;
8872
8873         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8874                             rem) {
8875                 u8 *mask_pat;
8876
8877                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8878                           nla_len(pat), nl80211_packet_pattern_policy);
8879                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8880                     !pat_tb[NL80211_PKTPAT_PATTERN])
8881                         return -EINVAL;
8882                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8883                 mask_len = DIV_ROUND_UP(pat_len, 8);
8884                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8885                         return -EINVAL;
8886                 if (pat_len > coalesce->pattern_max_len ||
8887                     pat_len < coalesce->pattern_min_len)
8888                         return -EINVAL;
8889
8890                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8891                         pkt_offset = 0;
8892                 else
8893                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8894                 if (pkt_offset > coalesce->max_pkt_offset)
8895                         return -EINVAL;
8896                 new_rule->patterns[i].pkt_offset = pkt_offset;
8897
8898                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8899                 if (!mask_pat)
8900                         return -ENOMEM;
8901
8902                 new_rule->patterns[i].mask = mask_pat;
8903                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8904                        mask_len);
8905
8906                 mask_pat += mask_len;
8907                 new_rule->patterns[i].pattern = mask_pat;
8908                 new_rule->patterns[i].pattern_len = pat_len;
8909                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8910                        pat_len);
8911                 i++;
8912         }
8913
8914         return 0;
8915 }
8916
8917 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8918 {
8919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8920         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8921         struct cfg80211_coalesce new_coalesce = {};
8922         struct cfg80211_coalesce *n_coalesce;
8923         int err, rem_rule, n_rules = 0, i, j;
8924         struct nlattr *rule;
8925         struct cfg80211_coalesce_rules *tmp_rule;
8926
8927         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8928                 return -EOPNOTSUPP;
8929
8930         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8931                 cfg80211_rdev_free_coalesce(rdev);
8932                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8933                 return 0;
8934         }
8935
8936         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8937                             rem_rule)
8938                 n_rules++;
8939         if (n_rules > coalesce->n_rules)
8940                 return -EINVAL;
8941
8942         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8943                                      GFP_KERNEL);
8944         if (!new_coalesce.rules)
8945                 return -ENOMEM;
8946
8947         new_coalesce.n_rules = n_rules;
8948         i = 0;
8949
8950         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8951                             rem_rule) {
8952                 err = nl80211_parse_coalesce_rule(rdev, rule,
8953                                                   &new_coalesce.rules[i]);
8954                 if (err)
8955                         goto error;
8956
8957                 i++;
8958         }
8959
8960         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8961         if (err)
8962                 goto error;
8963
8964         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8965         if (!n_coalesce) {
8966                 err = -ENOMEM;
8967                 goto error;
8968         }
8969         cfg80211_rdev_free_coalesce(rdev);
8970         rdev->coalesce = n_coalesce;
8971
8972         return 0;
8973 error:
8974         for (i = 0; i < new_coalesce.n_rules; i++) {
8975                 tmp_rule = &new_coalesce.rules[i];
8976                 for (j = 0; j < tmp_rule->n_patterns; j++)
8977                         kfree(tmp_rule->patterns[j].mask);
8978                 kfree(tmp_rule->patterns);
8979         }
8980         kfree(new_coalesce.rules);
8981
8982         return err;
8983 }
8984
8985 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8986 {
8987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8988         struct net_device *dev = info->user_ptr[1];
8989         struct wireless_dev *wdev = dev->ieee80211_ptr;
8990         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8991         struct cfg80211_gtk_rekey_data rekey_data;
8992         int err;
8993
8994         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8995                 return -EINVAL;
8996
8997         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8998                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8999                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9000                         nl80211_rekey_policy);
9001         if (err)
9002                 return err;
9003
9004         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
9005             !tb[NL80211_REKEY_DATA_KCK])
9006                 return -EINVAL;
9007         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9008                 return -ERANGE;
9009         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9010                 return -ERANGE;
9011         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9012                 return -ERANGE;
9013
9014         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
9015                NL80211_KEK_LEN);
9016         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
9017                NL80211_KCK_LEN);
9018         memcpy(rekey_data.replay_ctr,
9019                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
9020                NL80211_REPLAY_CTR_LEN);
9021
9022         wdev_lock(wdev);
9023         if (!wdev->current_bss) {
9024                 err = -ENOTCONN;
9025                 goto out;
9026         }
9027
9028         if (!rdev->ops->set_rekey_data) {
9029                 err = -EOPNOTSUPP;
9030                 goto out;
9031         }
9032
9033         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9034  out:
9035         wdev_unlock(wdev);
9036         return err;
9037 }
9038
9039 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9040                                              struct genl_info *info)
9041 {
9042         struct net_device *dev = info->user_ptr[1];
9043         struct wireless_dev *wdev = dev->ieee80211_ptr;
9044
9045         if (wdev->iftype != NL80211_IFTYPE_AP &&
9046             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9047                 return -EINVAL;
9048
9049         if (wdev->ap_unexpected_nlportid)
9050                 return -EBUSY;
9051
9052         wdev->ap_unexpected_nlportid = info->snd_portid;
9053         return 0;
9054 }
9055
9056 static int nl80211_probe_client(struct sk_buff *skb,
9057                                 struct genl_info *info)
9058 {
9059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9060         struct net_device *dev = info->user_ptr[1];
9061         struct wireless_dev *wdev = dev->ieee80211_ptr;
9062         struct sk_buff *msg;
9063         void *hdr;
9064         const u8 *addr;
9065         u64 cookie;
9066         int err;
9067
9068         if (wdev->iftype != NL80211_IFTYPE_AP &&
9069             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9070                 return -EOPNOTSUPP;
9071
9072         if (!info->attrs[NL80211_ATTR_MAC])
9073                 return -EINVAL;
9074
9075         if (!rdev->ops->probe_client)
9076                 return -EOPNOTSUPP;
9077
9078         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9079         if (!msg)
9080                 return -ENOMEM;
9081
9082         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9083                              NL80211_CMD_PROBE_CLIENT);
9084         if (!hdr) {
9085                 err = -ENOBUFS;
9086                 goto free_msg;
9087         }
9088
9089         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9090
9091         err = rdev_probe_client(rdev, dev, addr, &cookie);
9092         if (err)
9093                 goto free_msg;
9094
9095         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9096                 goto nla_put_failure;
9097
9098         genlmsg_end(msg, hdr);
9099
9100         return genlmsg_reply(msg, info);
9101
9102  nla_put_failure:
9103         err = -ENOBUFS;
9104  free_msg:
9105         nlmsg_free(msg);
9106         return err;
9107 }
9108
9109 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9110 {
9111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9112         struct cfg80211_beacon_registration *reg, *nreg;
9113         int rv;
9114
9115         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9116                 return -EOPNOTSUPP;
9117
9118         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9119         if (!nreg)
9120                 return -ENOMEM;
9121
9122         /* First, check if already registered. */
9123         spin_lock_bh(&rdev->beacon_registrations_lock);
9124         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9125                 if (reg->nlportid == info->snd_portid) {
9126                         rv = -EALREADY;
9127                         goto out_err;
9128                 }
9129         }
9130         /* Add it to the list */
9131         nreg->nlportid = info->snd_portid;
9132         list_add(&nreg->list, &rdev->beacon_registrations);
9133
9134         spin_unlock_bh(&rdev->beacon_registrations_lock);
9135
9136         return 0;
9137 out_err:
9138         spin_unlock_bh(&rdev->beacon_registrations_lock);
9139         kfree(nreg);
9140         return rv;
9141 }
9142
9143 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9144 {
9145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9146         struct wireless_dev *wdev = info->user_ptr[1];
9147         int err;
9148
9149         if (!rdev->ops->start_p2p_device)
9150                 return -EOPNOTSUPP;
9151
9152         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9153                 return -EOPNOTSUPP;
9154
9155         if (wdev->p2p_started)
9156                 return 0;
9157
9158         if (rfkill_blocked(rdev->rfkill))
9159                 return -ERFKILL;
9160
9161         err = rdev_start_p2p_device(rdev, wdev);
9162         if (err)
9163                 return err;
9164
9165         wdev->p2p_started = true;
9166         rdev->opencount++;
9167
9168         return 0;
9169 }
9170
9171 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9172 {
9173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9174         struct wireless_dev *wdev = info->user_ptr[1];
9175
9176         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9177                 return -EOPNOTSUPP;
9178
9179         if (!rdev->ops->stop_p2p_device)
9180                 return -EOPNOTSUPP;
9181
9182         cfg80211_stop_p2p_device(rdev, wdev);
9183
9184         return 0;
9185 }
9186
9187 static int nl80211_get_protocol_features(struct sk_buff *skb,
9188                                          struct genl_info *info)
9189 {
9190         void *hdr;
9191         struct sk_buff *msg;
9192
9193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9194         if (!msg)
9195                 return -ENOMEM;
9196
9197         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9198                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9199         if (!hdr)
9200                 goto nla_put_failure;
9201
9202         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9203                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9204                 goto nla_put_failure;
9205
9206         genlmsg_end(msg, hdr);
9207         return genlmsg_reply(msg, info);
9208
9209  nla_put_failure:
9210         kfree_skb(msg);
9211         return -ENOBUFS;
9212 }
9213
9214 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9215 {
9216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9217         struct cfg80211_update_ft_ies_params ft_params;
9218         struct net_device *dev = info->user_ptr[1];
9219
9220         if (!rdev->ops->update_ft_ies)
9221                 return -EOPNOTSUPP;
9222
9223         if (!info->attrs[NL80211_ATTR_MDID] ||
9224             !info->attrs[NL80211_ATTR_IE] ||
9225             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9226                 return -EINVAL;
9227
9228         memset(&ft_params, 0, sizeof(ft_params));
9229         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9230         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9231         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9232
9233         return rdev_update_ft_ies(rdev, dev, &ft_params);
9234 }
9235
9236 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9237                                        struct genl_info *info)
9238 {
9239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9240         struct wireless_dev *wdev = info->user_ptr[1];
9241         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9242         u16 duration;
9243         int ret;
9244
9245         if (!rdev->ops->crit_proto_start)
9246                 return -EOPNOTSUPP;
9247
9248         if (WARN_ON(!rdev->ops->crit_proto_stop))
9249                 return -EINVAL;
9250
9251         if (rdev->crit_proto_nlportid)
9252                 return -EBUSY;
9253
9254         /* determine protocol if provided */
9255         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9256                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9257
9258         if (proto >= NUM_NL80211_CRIT_PROTO)
9259                 return -EINVAL;
9260
9261         /* timeout must be provided */
9262         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9263                 return -EINVAL;
9264
9265         duration =
9266                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9267
9268         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9269                 return -ERANGE;
9270
9271         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9272         if (!ret)
9273                 rdev->crit_proto_nlportid = info->snd_portid;
9274
9275         return ret;
9276 }
9277
9278 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9279                                       struct genl_info *info)
9280 {
9281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9282         struct wireless_dev *wdev = info->user_ptr[1];
9283
9284         if (!rdev->ops->crit_proto_stop)
9285                 return -EOPNOTSUPP;
9286
9287         if (rdev->crit_proto_nlportid) {
9288                 rdev->crit_proto_nlportid = 0;
9289                 rdev_crit_proto_stop(rdev, wdev);
9290         }
9291         return 0;
9292 }
9293
9294 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9295 {
9296         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9297         struct wireless_dev *wdev =
9298                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9299         int i, err;
9300         u32 vid, subcmd;
9301
9302         if (!rdev->wiphy.vendor_commands)
9303                 return -EOPNOTSUPP;
9304
9305         if (IS_ERR(wdev)) {
9306                 err = PTR_ERR(wdev);
9307                 if (err != -EINVAL)
9308                         return err;
9309                 wdev = NULL;
9310         } else if (wdev->wiphy != &rdev->wiphy) {
9311                 return -EINVAL;
9312         }
9313
9314         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9315             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9316                 return -EINVAL;
9317
9318         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9319         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9320         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9321                 const struct wiphy_vendor_command *vcmd;
9322                 void *data = NULL;
9323                 int len = 0;
9324
9325                 vcmd = &rdev->wiphy.vendor_commands[i];
9326
9327                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9328                         continue;
9329
9330                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9331                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9332                         if (!wdev)
9333                                 return -EINVAL;
9334                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9335                             !wdev->netdev)
9336                                 return -EINVAL;
9337
9338                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9339                                 if (wdev->netdev &&
9340                                     !netif_running(wdev->netdev))
9341                                         return -ENETDOWN;
9342                                 if (!wdev->netdev && !wdev->p2p_started)
9343                                         return -ENETDOWN;
9344                         }
9345                 } else {
9346                         wdev = NULL;
9347                 }
9348
9349                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9350                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9351                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9352                 }
9353
9354                 rdev->cur_cmd_info = info;
9355                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9356                                                           data, len);
9357                 rdev->cur_cmd_info = NULL;
9358                 return err;
9359         }
9360
9361         return -EOPNOTSUPP;
9362 }
9363
9364 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9365                                            enum nl80211_commands cmd,
9366                                            enum nl80211_attrs attr,
9367                                            int approxlen)
9368 {
9369         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9370
9371         if (WARN_ON(!rdev->cur_cmd_info))
9372                 return NULL;
9373
9374         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9375                                            rdev->cur_cmd_info->snd_portid,
9376                                            rdev->cur_cmd_info->snd_seq,
9377                                            cmd, attr, NULL, GFP_KERNEL);
9378 }
9379 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9380
9381 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9382 {
9383         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9384         void *hdr = ((void **)skb->cb)[1];
9385         struct nlattr *data = ((void **)skb->cb)[2];
9386
9387         /* clear CB data for netlink core to own from now on */
9388         memset(skb->cb, 0, sizeof(skb->cb));
9389
9390         if (WARN_ON(!rdev->cur_cmd_info)) {
9391                 kfree_skb(skb);
9392                 return -EINVAL;
9393         }
9394
9395         nla_nest_end(skb, data);
9396         genlmsg_end(skb, hdr);
9397         return genlmsg_reply(skb, rdev->cur_cmd_info);
9398 }
9399 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9400
9401
9402 static int nl80211_set_qos_map(struct sk_buff *skb,
9403                                struct genl_info *info)
9404 {
9405         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9406         struct cfg80211_qos_map *qos_map = NULL;
9407         struct net_device *dev = info->user_ptr[1];
9408         u8 *pos, len, num_des, des_len, des;
9409         int ret;
9410
9411         if (!rdev->ops->set_qos_map)
9412                 return -EOPNOTSUPP;
9413
9414         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9415                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9416                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9417
9418                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9419                     len > IEEE80211_QOS_MAP_LEN_MAX)
9420                         return -EINVAL;
9421
9422                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9423                 if (!qos_map)
9424                         return -ENOMEM;
9425
9426                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9427                 if (num_des) {
9428                         des_len = num_des *
9429                                 sizeof(struct cfg80211_dscp_exception);
9430                         memcpy(qos_map->dscp_exception, pos, des_len);
9431                         qos_map->num_des = num_des;
9432                         for (des = 0; des < num_des; des++) {
9433                                 if (qos_map->dscp_exception[des].up > 7) {
9434                                         kfree(qos_map);
9435                                         return -EINVAL;
9436                                 }
9437                         }
9438                         pos += des_len;
9439                 }
9440                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9441         }
9442
9443         wdev_lock(dev->ieee80211_ptr);
9444         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9445         if (!ret)
9446                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9447         wdev_unlock(dev->ieee80211_ptr);
9448
9449         kfree(qos_map);
9450         return ret;
9451 }
9452
9453 #define NL80211_FLAG_NEED_WIPHY         0x01
9454 #define NL80211_FLAG_NEED_NETDEV        0x02
9455 #define NL80211_FLAG_NEED_RTNL          0x04
9456 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9457 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9458                                          NL80211_FLAG_CHECK_NETDEV_UP)
9459 #define NL80211_FLAG_NEED_WDEV          0x10
9460 /* If a netdev is associated, it must be UP, P2P must be started */
9461 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9462                                          NL80211_FLAG_CHECK_NETDEV_UP)
9463
9464 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9465                             struct genl_info *info)
9466 {
9467         struct cfg80211_registered_device *rdev;
9468         struct wireless_dev *wdev;
9469         struct net_device *dev;
9470         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9471
9472         if (rtnl)
9473                 rtnl_lock();
9474
9475         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9476                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9477                 if (IS_ERR(rdev)) {
9478                         if (rtnl)
9479                                 rtnl_unlock();
9480                         return PTR_ERR(rdev);
9481                 }
9482                 info->user_ptr[0] = rdev;
9483         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9484                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9485                 ASSERT_RTNL();
9486
9487                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9488                                                   info->attrs);
9489                 if (IS_ERR(wdev)) {
9490                         if (rtnl)
9491                                 rtnl_unlock();
9492                         return PTR_ERR(wdev);
9493                 }
9494
9495                 dev = wdev->netdev;
9496                 rdev = wiphy_to_rdev(wdev->wiphy);
9497
9498                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9499                         if (!dev) {
9500                                 if (rtnl)
9501                                         rtnl_unlock();
9502                                 return -EINVAL;
9503                         }
9504
9505                         info->user_ptr[1] = dev;
9506                 } else {
9507                         info->user_ptr[1] = wdev;
9508                 }
9509
9510                 if (dev) {
9511                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9512                             !netif_running(dev)) {
9513                                 if (rtnl)
9514                                         rtnl_unlock();
9515                                 return -ENETDOWN;
9516                         }
9517
9518                         dev_hold(dev);
9519                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9520                         if (!wdev->p2p_started) {
9521                                 if (rtnl)
9522                                         rtnl_unlock();
9523                                 return -ENETDOWN;
9524                         }
9525                 }
9526
9527                 info->user_ptr[0] = rdev;
9528         }
9529
9530         return 0;
9531 }
9532
9533 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9534                               struct genl_info *info)
9535 {
9536         if (info->user_ptr[1]) {
9537                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9538                         struct wireless_dev *wdev = info->user_ptr[1];
9539
9540                         if (wdev->netdev)
9541                                 dev_put(wdev->netdev);
9542                 } else {
9543                         dev_put(info->user_ptr[1]);
9544                 }
9545         }
9546         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9547                 rtnl_unlock();
9548 }
9549
9550 static const struct genl_ops nl80211_ops[] = {
9551         {
9552                 .cmd = NL80211_CMD_GET_WIPHY,
9553                 .doit = nl80211_get_wiphy,
9554                 .dumpit = nl80211_dump_wiphy,
9555                 .done = nl80211_dump_wiphy_done,
9556                 .policy = nl80211_policy,
9557                 /* can be retrieved by unprivileged users */
9558                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9559                                   NL80211_FLAG_NEED_RTNL,
9560         },
9561         {
9562                 .cmd = NL80211_CMD_SET_WIPHY,
9563                 .doit = nl80211_set_wiphy,
9564                 .policy = nl80211_policy,
9565                 .flags = GENL_ADMIN_PERM,
9566                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9567         },
9568         {
9569                 .cmd = NL80211_CMD_GET_INTERFACE,
9570                 .doit = nl80211_get_interface,
9571                 .dumpit = nl80211_dump_interface,
9572                 .policy = nl80211_policy,
9573                 /* can be retrieved by unprivileged users */
9574                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9575                                   NL80211_FLAG_NEED_RTNL,
9576         },
9577         {
9578                 .cmd = NL80211_CMD_SET_INTERFACE,
9579                 .doit = nl80211_set_interface,
9580                 .policy = nl80211_policy,
9581                 .flags = GENL_ADMIN_PERM,
9582                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9583                                   NL80211_FLAG_NEED_RTNL,
9584         },
9585         {
9586                 .cmd = NL80211_CMD_NEW_INTERFACE,
9587                 .doit = nl80211_new_interface,
9588                 .policy = nl80211_policy,
9589                 .flags = GENL_ADMIN_PERM,
9590                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9591                                   NL80211_FLAG_NEED_RTNL,
9592         },
9593         {
9594                 .cmd = NL80211_CMD_DEL_INTERFACE,
9595                 .doit = nl80211_del_interface,
9596                 .policy = nl80211_policy,
9597                 .flags = GENL_ADMIN_PERM,
9598                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9599                                   NL80211_FLAG_NEED_RTNL,
9600         },
9601         {
9602                 .cmd = NL80211_CMD_GET_KEY,
9603                 .doit = nl80211_get_key,
9604                 .policy = nl80211_policy,
9605                 .flags = GENL_ADMIN_PERM,
9606                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9607                                   NL80211_FLAG_NEED_RTNL,
9608         },
9609         {
9610                 .cmd = NL80211_CMD_SET_KEY,
9611                 .doit = nl80211_set_key,
9612                 .policy = nl80211_policy,
9613                 .flags = GENL_ADMIN_PERM,
9614                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9615                                   NL80211_FLAG_NEED_RTNL,
9616         },
9617         {
9618                 .cmd = NL80211_CMD_NEW_KEY,
9619                 .doit = nl80211_new_key,
9620                 .policy = nl80211_policy,
9621                 .flags = GENL_ADMIN_PERM,
9622                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9623                                   NL80211_FLAG_NEED_RTNL,
9624         },
9625         {
9626                 .cmd = NL80211_CMD_DEL_KEY,
9627                 .doit = nl80211_del_key,
9628                 .policy = nl80211_policy,
9629                 .flags = GENL_ADMIN_PERM,
9630                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9631                                   NL80211_FLAG_NEED_RTNL,
9632         },
9633         {
9634                 .cmd = NL80211_CMD_SET_BEACON,
9635                 .policy = nl80211_policy,
9636                 .flags = GENL_ADMIN_PERM,
9637                 .doit = nl80211_set_beacon,
9638                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9639                                   NL80211_FLAG_NEED_RTNL,
9640         },
9641         {
9642                 .cmd = NL80211_CMD_START_AP,
9643                 .policy = nl80211_policy,
9644                 .flags = GENL_ADMIN_PERM,
9645                 .doit = nl80211_start_ap,
9646                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9647                                   NL80211_FLAG_NEED_RTNL,
9648         },
9649         {
9650                 .cmd = NL80211_CMD_STOP_AP,
9651                 .policy = nl80211_policy,
9652                 .flags = GENL_ADMIN_PERM,
9653                 .doit = nl80211_stop_ap,
9654                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9655                                   NL80211_FLAG_NEED_RTNL,
9656         },
9657         {
9658                 .cmd = NL80211_CMD_GET_STATION,
9659                 .doit = nl80211_get_station,
9660                 .dumpit = nl80211_dump_station,
9661                 .policy = nl80211_policy,
9662                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9663                                   NL80211_FLAG_NEED_RTNL,
9664         },
9665         {
9666                 .cmd = NL80211_CMD_SET_STATION,
9667                 .doit = nl80211_set_station,
9668                 .policy = nl80211_policy,
9669                 .flags = GENL_ADMIN_PERM,
9670                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9671                                   NL80211_FLAG_NEED_RTNL,
9672         },
9673         {
9674                 .cmd = NL80211_CMD_NEW_STATION,
9675                 .doit = nl80211_new_station,
9676                 .policy = nl80211_policy,
9677                 .flags = GENL_ADMIN_PERM,
9678                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9679                                   NL80211_FLAG_NEED_RTNL,
9680         },
9681         {
9682                 .cmd = NL80211_CMD_DEL_STATION,
9683                 .doit = nl80211_del_station,
9684                 .policy = nl80211_policy,
9685                 .flags = GENL_ADMIN_PERM,
9686                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9687                                   NL80211_FLAG_NEED_RTNL,
9688         },
9689         {
9690                 .cmd = NL80211_CMD_GET_MPATH,
9691                 .doit = nl80211_get_mpath,
9692                 .dumpit = nl80211_dump_mpath,
9693                 .policy = nl80211_policy,
9694                 .flags = GENL_ADMIN_PERM,
9695                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9696                                   NL80211_FLAG_NEED_RTNL,
9697         },
9698         {
9699                 .cmd = NL80211_CMD_SET_MPATH,
9700                 .doit = nl80211_set_mpath,
9701                 .policy = nl80211_policy,
9702                 .flags = GENL_ADMIN_PERM,
9703                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9704                                   NL80211_FLAG_NEED_RTNL,
9705         },
9706         {
9707                 .cmd = NL80211_CMD_NEW_MPATH,
9708                 .doit = nl80211_new_mpath,
9709                 .policy = nl80211_policy,
9710                 .flags = GENL_ADMIN_PERM,
9711                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9712                                   NL80211_FLAG_NEED_RTNL,
9713         },
9714         {
9715                 .cmd = NL80211_CMD_DEL_MPATH,
9716                 .doit = nl80211_del_mpath,
9717                 .policy = nl80211_policy,
9718                 .flags = GENL_ADMIN_PERM,
9719                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9720                                   NL80211_FLAG_NEED_RTNL,
9721         },
9722         {
9723                 .cmd = NL80211_CMD_SET_BSS,
9724                 .doit = nl80211_set_bss,
9725                 .policy = nl80211_policy,
9726                 .flags = GENL_ADMIN_PERM,
9727                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9728                                   NL80211_FLAG_NEED_RTNL,
9729         },
9730         {
9731                 .cmd = NL80211_CMD_GET_REG,
9732                 .doit = nl80211_get_reg,
9733                 .policy = nl80211_policy,
9734                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9735                 /* can be retrieved by unprivileged users */
9736         },
9737         {
9738                 .cmd = NL80211_CMD_SET_REG,
9739                 .doit = nl80211_set_reg,
9740                 .policy = nl80211_policy,
9741                 .flags = GENL_ADMIN_PERM,
9742                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9743         },
9744         {
9745                 .cmd = NL80211_CMD_REQ_SET_REG,
9746                 .doit = nl80211_req_set_reg,
9747                 .policy = nl80211_policy,
9748                 .flags = GENL_ADMIN_PERM,
9749         },
9750         {
9751                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9752                 .doit = nl80211_get_mesh_config,
9753                 .policy = nl80211_policy,
9754                 /* can be retrieved by unprivileged users */
9755                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9756                                   NL80211_FLAG_NEED_RTNL,
9757         },
9758         {
9759                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9760                 .doit = nl80211_update_mesh_config,
9761                 .policy = nl80211_policy,
9762                 .flags = GENL_ADMIN_PERM,
9763                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9764                                   NL80211_FLAG_NEED_RTNL,
9765         },
9766         {
9767                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9768                 .doit = nl80211_trigger_scan,
9769                 .policy = nl80211_policy,
9770                 .flags = GENL_ADMIN_PERM,
9771                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9772                                   NL80211_FLAG_NEED_RTNL,
9773         },
9774         {
9775                 .cmd = NL80211_CMD_GET_SCAN,
9776                 .policy = nl80211_policy,
9777                 .dumpit = nl80211_dump_scan,
9778         },
9779         {
9780                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9781                 .doit = nl80211_start_sched_scan,
9782                 .policy = nl80211_policy,
9783                 .flags = GENL_ADMIN_PERM,
9784                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9785                                   NL80211_FLAG_NEED_RTNL,
9786         },
9787         {
9788                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9789                 .doit = nl80211_stop_sched_scan,
9790                 .policy = nl80211_policy,
9791                 .flags = GENL_ADMIN_PERM,
9792                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9793                                   NL80211_FLAG_NEED_RTNL,
9794         },
9795         {
9796                 .cmd = NL80211_CMD_AUTHENTICATE,
9797                 .doit = nl80211_authenticate,
9798                 .policy = nl80211_policy,
9799                 .flags = GENL_ADMIN_PERM,
9800                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9801                                   NL80211_FLAG_NEED_RTNL,
9802         },
9803         {
9804                 .cmd = NL80211_CMD_ASSOCIATE,
9805                 .doit = nl80211_associate,
9806                 .policy = nl80211_policy,
9807                 .flags = GENL_ADMIN_PERM,
9808                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9809                                   NL80211_FLAG_NEED_RTNL,
9810         },
9811         {
9812                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9813                 .doit = nl80211_deauthenticate,
9814                 .policy = nl80211_policy,
9815                 .flags = GENL_ADMIN_PERM,
9816                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9817                                   NL80211_FLAG_NEED_RTNL,
9818         },
9819         {
9820                 .cmd = NL80211_CMD_DISASSOCIATE,
9821                 .doit = nl80211_disassociate,
9822                 .policy = nl80211_policy,
9823                 .flags = GENL_ADMIN_PERM,
9824                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9825                                   NL80211_FLAG_NEED_RTNL,
9826         },
9827         {
9828                 .cmd = NL80211_CMD_JOIN_IBSS,
9829                 .doit = nl80211_join_ibss,
9830                 .policy = nl80211_policy,
9831                 .flags = GENL_ADMIN_PERM,
9832                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9833                                   NL80211_FLAG_NEED_RTNL,
9834         },
9835         {
9836                 .cmd = NL80211_CMD_LEAVE_IBSS,
9837                 .doit = nl80211_leave_ibss,
9838                 .policy = nl80211_policy,
9839                 .flags = GENL_ADMIN_PERM,
9840                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9841                                   NL80211_FLAG_NEED_RTNL,
9842         },
9843 #ifdef CONFIG_NL80211_TESTMODE
9844         {
9845                 .cmd = NL80211_CMD_TESTMODE,
9846                 .doit = nl80211_testmode_do,
9847                 .dumpit = nl80211_testmode_dump,
9848                 .policy = nl80211_policy,
9849                 .flags = GENL_ADMIN_PERM,
9850                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9851                                   NL80211_FLAG_NEED_RTNL,
9852         },
9853 #endif
9854         {
9855                 .cmd = NL80211_CMD_CONNECT,
9856                 .doit = nl80211_connect,
9857                 .policy = nl80211_policy,
9858                 .flags = GENL_ADMIN_PERM,
9859                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9860                                   NL80211_FLAG_NEED_RTNL,
9861         },
9862         {
9863                 .cmd = NL80211_CMD_DISCONNECT,
9864                 .doit = nl80211_disconnect,
9865                 .policy = nl80211_policy,
9866                 .flags = GENL_ADMIN_PERM,
9867                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9868                                   NL80211_FLAG_NEED_RTNL,
9869         },
9870         {
9871                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9872                 .doit = nl80211_wiphy_netns,
9873                 .policy = nl80211_policy,
9874                 .flags = GENL_ADMIN_PERM,
9875                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9876                                   NL80211_FLAG_NEED_RTNL,
9877         },
9878         {
9879                 .cmd = NL80211_CMD_GET_SURVEY,
9880                 .policy = nl80211_policy,
9881                 .dumpit = nl80211_dump_survey,
9882         },
9883         {
9884                 .cmd = NL80211_CMD_SET_PMKSA,
9885                 .doit = nl80211_setdel_pmksa,
9886                 .policy = nl80211_policy,
9887                 .flags = GENL_ADMIN_PERM,
9888                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9889                                   NL80211_FLAG_NEED_RTNL,
9890         },
9891         {
9892                 .cmd = NL80211_CMD_DEL_PMKSA,
9893                 .doit = nl80211_setdel_pmksa,
9894                 .policy = nl80211_policy,
9895                 .flags = GENL_ADMIN_PERM,
9896                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9897                                   NL80211_FLAG_NEED_RTNL,
9898         },
9899         {
9900                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9901                 .doit = nl80211_flush_pmksa,
9902                 .policy = nl80211_policy,
9903                 .flags = GENL_ADMIN_PERM,
9904                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9905                                   NL80211_FLAG_NEED_RTNL,
9906         },
9907         {
9908                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9909                 .doit = nl80211_remain_on_channel,
9910                 .policy = nl80211_policy,
9911                 .flags = GENL_ADMIN_PERM,
9912                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9913                                   NL80211_FLAG_NEED_RTNL,
9914         },
9915         {
9916                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9917                 .doit = nl80211_cancel_remain_on_channel,
9918                 .policy = nl80211_policy,
9919                 .flags = GENL_ADMIN_PERM,
9920                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9921                                   NL80211_FLAG_NEED_RTNL,
9922         },
9923         {
9924                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9925                 .doit = nl80211_set_tx_bitrate_mask,
9926                 .policy = nl80211_policy,
9927                 .flags = GENL_ADMIN_PERM,
9928                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9929                                   NL80211_FLAG_NEED_RTNL,
9930         },
9931         {
9932                 .cmd = NL80211_CMD_REGISTER_FRAME,
9933                 .doit = nl80211_register_mgmt,
9934                 .policy = nl80211_policy,
9935                 .flags = GENL_ADMIN_PERM,
9936                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9937                                   NL80211_FLAG_NEED_RTNL,
9938         },
9939         {
9940                 .cmd = NL80211_CMD_FRAME,
9941                 .doit = nl80211_tx_mgmt,
9942                 .policy = nl80211_policy,
9943                 .flags = GENL_ADMIN_PERM,
9944                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9945                                   NL80211_FLAG_NEED_RTNL,
9946         },
9947         {
9948                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9949                 .doit = nl80211_tx_mgmt_cancel_wait,
9950                 .policy = nl80211_policy,
9951                 .flags = GENL_ADMIN_PERM,
9952                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9953                                   NL80211_FLAG_NEED_RTNL,
9954         },
9955         {
9956                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9957                 .doit = nl80211_set_power_save,
9958                 .policy = nl80211_policy,
9959                 .flags = GENL_ADMIN_PERM,
9960                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9961                                   NL80211_FLAG_NEED_RTNL,
9962         },
9963         {
9964                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9965                 .doit = nl80211_get_power_save,
9966                 .policy = nl80211_policy,
9967                 /* can be retrieved by unprivileged users */
9968                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9969                                   NL80211_FLAG_NEED_RTNL,
9970         },
9971         {
9972                 .cmd = NL80211_CMD_SET_CQM,
9973                 .doit = nl80211_set_cqm,
9974                 .policy = nl80211_policy,
9975                 .flags = GENL_ADMIN_PERM,
9976                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9977                                   NL80211_FLAG_NEED_RTNL,
9978         },
9979         {
9980                 .cmd = NL80211_CMD_SET_CHANNEL,
9981                 .doit = nl80211_set_channel,
9982                 .policy = nl80211_policy,
9983                 .flags = GENL_ADMIN_PERM,
9984                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9985                                   NL80211_FLAG_NEED_RTNL,
9986         },
9987         {
9988                 .cmd = NL80211_CMD_SET_WDS_PEER,
9989                 .doit = nl80211_set_wds_peer,
9990                 .policy = nl80211_policy,
9991                 .flags = GENL_ADMIN_PERM,
9992                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9993                                   NL80211_FLAG_NEED_RTNL,
9994         },
9995         {
9996                 .cmd = NL80211_CMD_JOIN_MESH,
9997                 .doit = nl80211_join_mesh,
9998                 .policy = nl80211_policy,
9999                 .flags = GENL_ADMIN_PERM,
10000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10001                                   NL80211_FLAG_NEED_RTNL,
10002         },
10003         {
10004                 .cmd = NL80211_CMD_LEAVE_MESH,
10005                 .doit = nl80211_leave_mesh,
10006                 .policy = nl80211_policy,
10007                 .flags = GENL_ADMIN_PERM,
10008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10009                                   NL80211_FLAG_NEED_RTNL,
10010         },
10011 #ifdef CONFIG_PM
10012         {
10013                 .cmd = NL80211_CMD_GET_WOWLAN,
10014                 .doit = nl80211_get_wowlan,
10015                 .policy = nl80211_policy,
10016                 /* can be retrieved by unprivileged users */
10017                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10018                                   NL80211_FLAG_NEED_RTNL,
10019         },
10020         {
10021                 .cmd = NL80211_CMD_SET_WOWLAN,
10022                 .doit = nl80211_set_wowlan,
10023                 .policy = nl80211_policy,
10024                 .flags = GENL_ADMIN_PERM,
10025                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10026                                   NL80211_FLAG_NEED_RTNL,
10027         },
10028 #endif
10029         {
10030                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10031                 .doit = nl80211_set_rekey_data,
10032                 .policy = nl80211_policy,
10033                 .flags = GENL_ADMIN_PERM,
10034                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10035                                   NL80211_FLAG_NEED_RTNL,
10036         },
10037         {
10038                 .cmd = NL80211_CMD_TDLS_MGMT,
10039                 .doit = nl80211_tdls_mgmt,
10040                 .policy = nl80211_policy,
10041                 .flags = GENL_ADMIN_PERM,
10042                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10043                                   NL80211_FLAG_NEED_RTNL,
10044         },
10045         {
10046                 .cmd = NL80211_CMD_TDLS_OPER,
10047                 .doit = nl80211_tdls_oper,
10048                 .policy = nl80211_policy,
10049                 .flags = GENL_ADMIN_PERM,
10050                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10051                                   NL80211_FLAG_NEED_RTNL,
10052         },
10053         {
10054                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10055                 .doit = nl80211_register_unexpected_frame,
10056                 .policy = nl80211_policy,
10057                 .flags = GENL_ADMIN_PERM,
10058                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10059                                   NL80211_FLAG_NEED_RTNL,
10060         },
10061         {
10062                 .cmd = NL80211_CMD_PROBE_CLIENT,
10063                 .doit = nl80211_probe_client,
10064                 .policy = nl80211_policy,
10065                 .flags = GENL_ADMIN_PERM,
10066                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10067                                   NL80211_FLAG_NEED_RTNL,
10068         },
10069         {
10070                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10071                 .doit = nl80211_register_beacons,
10072                 .policy = nl80211_policy,
10073                 .flags = GENL_ADMIN_PERM,
10074                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10075                                   NL80211_FLAG_NEED_RTNL,
10076         },
10077         {
10078                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10079                 .doit = nl80211_set_noack_map,
10080                 .policy = nl80211_policy,
10081                 .flags = GENL_ADMIN_PERM,
10082                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10083                                   NL80211_FLAG_NEED_RTNL,
10084         },
10085         {
10086                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10087                 .doit = nl80211_start_p2p_device,
10088                 .policy = nl80211_policy,
10089                 .flags = GENL_ADMIN_PERM,
10090                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10091                                   NL80211_FLAG_NEED_RTNL,
10092         },
10093         {
10094                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10095                 .doit = nl80211_stop_p2p_device,
10096                 .policy = nl80211_policy,
10097                 .flags = GENL_ADMIN_PERM,
10098                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10099                                   NL80211_FLAG_NEED_RTNL,
10100         },
10101         {
10102                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10103                 .doit = nl80211_set_mcast_rate,
10104                 .policy = nl80211_policy,
10105                 .flags = GENL_ADMIN_PERM,
10106                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10107                                   NL80211_FLAG_NEED_RTNL,
10108         },
10109         {
10110                 .cmd = NL80211_CMD_SET_MAC_ACL,
10111                 .doit = nl80211_set_mac_acl,
10112                 .policy = nl80211_policy,
10113                 .flags = GENL_ADMIN_PERM,
10114                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10115                                   NL80211_FLAG_NEED_RTNL,
10116         },
10117         {
10118                 .cmd = NL80211_CMD_RADAR_DETECT,
10119                 .doit = nl80211_start_radar_detection,
10120                 .policy = nl80211_policy,
10121                 .flags = GENL_ADMIN_PERM,
10122                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10123                                   NL80211_FLAG_NEED_RTNL,
10124         },
10125         {
10126                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10127                 .doit = nl80211_get_protocol_features,
10128                 .policy = nl80211_policy,
10129         },
10130         {
10131                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10132                 .doit = nl80211_update_ft_ies,
10133                 .policy = nl80211_policy,
10134                 .flags = GENL_ADMIN_PERM,
10135                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10136                                   NL80211_FLAG_NEED_RTNL,
10137         },
10138         {
10139                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10140                 .doit = nl80211_crit_protocol_start,
10141                 .policy = nl80211_policy,
10142                 .flags = GENL_ADMIN_PERM,
10143                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10144                                   NL80211_FLAG_NEED_RTNL,
10145         },
10146         {
10147                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10148                 .doit = nl80211_crit_protocol_stop,
10149                 .policy = nl80211_policy,
10150                 .flags = GENL_ADMIN_PERM,
10151                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10152                                   NL80211_FLAG_NEED_RTNL,
10153         },
10154         {
10155                 .cmd = NL80211_CMD_GET_COALESCE,
10156                 .doit = nl80211_get_coalesce,
10157                 .policy = nl80211_policy,
10158                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10159                                   NL80211_FLAG_NEED_RTNL,
10160         },
10161         {
10162                 .cmd = NL80211_CMD_SET_COALESCE,
10163                 .doit = nl80211_set_coalesce,
10164                 .policy = nl80211_policy,
10165                 .flags = GENL_ADMIN_PERM,
10166                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10167                                   NL80211_FLAG_NEED_RTNL,
10168         },
10169         {
10170                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10171                 .doit = nl80211_channel_switch,
10172                 .policy = nl80211_policy,
10173                 .flags = GENL_ADMIN_PERM,
10174                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10175                                   NL80211_FLAG_NEED_RTNL,
10176         },
10177         {
10178                 .cmd = NL80211_CMD_VENDOR,
10179                 .doit = nl80211_vendor_cmd,
10180                 .policy = nl80211_policy,
10181                 .flags = GENL_ADMIN_PERM,
10182                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10183                                   NL80211_FLAG_NEED_RTNL,
10184         },
10185         {
10186                 .cmd = NL80211_CMD_SET_QOS_MAP,
10187                 .doit = nl80211_set_qos_map,
10188                 .policy = nl80211_policy,
10189                 .flags = GENL_ADMIN_PERM,
10190                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10191                                   NL80211_FLAG_NEED_RTNL,
10192         },
10193 };
10194
10195 /* notification functions */
10196
10197 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10198                           enum nl80211_commands cmd)
10199 {
10200         struct sk_buff *msg;
10201         struct nl80211_dump_wiphy_state state = {};
10202
10203         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10204                 cmd != NL80211_CMD_DEL_WIPHY);
10205
10206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10207         if (!msg)
10208                 return;
10209
10210         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10211                 nlmsg_free(msg);
10212                 return;
10213         }
10214
10215         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10216                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10217 }
10218
10219 static int nl80211_add_scan_req(struct sk_buff *msg,
10220                                 struct cfg80211_registered_device *rdev)
10221 {
10222         struct cfg80211_scan_request *req = rdev->scan_req;
10223         struct nlattr *nest;
10224         int i;
10225
10226         if (WARN_ON(!req))
10227                 return 0;
10228
10229         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10230         if (!nest)
10231                 goto nla_put_failure;
10232         for (i = 0; i < req->n_ssids; i++) {
10233                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10234                         goto nla_put_failure;
10235         }
10236         nla_nest_end(msg, nest);
10237
10238         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10239         if (!nest)
10240                 goto nla_put_failure;
10241         for (i = 0; i < req->n_channels; i++) {
10242                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10243                         goto nla_put_failure;
10244         }
10245         nla_nest_end(msg, nest);
10246
10247         if (req->ie &&
10248             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10249                 goto nla_put_failure;
10250
10251         if (req->flags &&
10252             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10253                 goto nla_put_failure;
10254
10255         return 0;
10256  nla_put_failure:
10257         return -ENOBUFS;
10258 }
10259
10260 static int nl80211_send_scan_msg(struct sk_buff *msg,
10261                                  struct cfg80211_registered_device *rdev,
10262                                  struct wireless_dev *wdev,
10263                                  u32 portid, u32 seq, int flags,
10264                                  u32 cmd)
10265 {
10266         void *hdr;
10267
10268         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10269         if (!hdr)
10270                 return -1;
10271
10272         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10273             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10274                                          wdev->netdev->ifindex)) ||
10275             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10276                 goto nla_put_failure;
10277
10278         /* ignore errors and send incomplete event anyway */
10279         nl80211_add_scan_req(msg, rdev);
10280
10281         return genlmsg_end(msg, hdr);
10282
10283  nla_put_failure:
10284         genlmsg_cancel(msg, hdr);
10285         return -EMSGSIZE;
10286 }
10287
10288 static int
10289 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10290                             struct cfg80211_registered_device *rdev,
10291                             struct net_device *netdev,
10292                             u32 portid, u32 seq, int flags, u32 cmd)
10293 {
10294         void *hdr;
10295
10296         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10297         if (!hdr)
10298                 return -1;
10299
10300         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10301             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10302                 goto nla_put_failure;
10303
10304         return genlmsg_end(msg, hdr);
10305
10306  nla_put_failure:
10307         genlmsg_cancel(msg, hdr);
10308         return -EMSGSIZE;
10309 }
10310
10311 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10312                              struct wireless_dev *wdev)
10313 {
10314         struct sk_buff *msg;
10315
10316         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10317         if (!msg)
10318                 return;
10319
10320         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10321                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10322                 nlmsg_free(msg);
10323                 return;
10324         }
10325
10326         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10327                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10328 }
10329
10330 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10331                                        struct wireless_dev *wdev, bool aborted)
10332 {
10333         struct sk_buff *msg;
10334
10335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10336         if (!msg)
10337                 return NULL;
10338
10339         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10340                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10341                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10342                 nlmsg_free(msg);
10343                 return NULL;
10344         }
10345
10346         return msg;
10347 }
10348
10349 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10350                               struct sk_buff *msg)
10351 {
10352         if (!msg)
10353                 return;
10354
10355         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10356                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10357 }
10358
10359 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10360                                      struct net_device *netdev)
10361 {
10362         struct sk_buff *msg;
10363
10364         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10365         if (!msg)
10366                 return;
10367
10368         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10369                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10370                 nlmsg_free(msg);
10371                 return;
10372         }
10373
10374         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10375                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10376 }
10377
10378 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10379                              struct net_device *netdev, u32 cmd)
10380 {
10381         struct sk_buff *msg;
10382
10383         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10384         if (!msg)
10385                 return;
10386
10387         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10388                 nlmsg_free(msg);
10389                 return;
10390         }
10391
10392         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10393                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10394 }
10395
10396 /*
10397  * This can happen on global regulatory changes or device specific settings
10398  * based on custom world regulatory domains.
10399  */
10400 void nl80211_send_reg_change_event(struct regulatory_request *request)
10401 {
10402         struct sk_buff *msg;
10403         void *hdr;
10404
10405         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10406         if (!msg)
10407                 return;
10408
10409         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10410         if (!hdr) {
10411                 nlmsg_free(msg);
10412                 return;
10413         }
10414
10415         /* Userspace can always count this one always being set */
10416         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10417                 goto nla_put_failure;
10418
10419         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10420                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10421                                NL80211_REGDOM_TYPE_WORLD))
10422                         goto nla_put_failure;
10423         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10424                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10425                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10426                         goto nla_put_failure;
10427         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10428                    request->intersect) {
10429                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10430                                NL80211_REGDOM_TYPE_INTERSECTION))
10431                         goto nla_put_failure;
10432         } else {
10433                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10434                                NL80211_REGDOM_TYPE_COUNTRY) ||
10435                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10436                                    request->alpha2))
10437                         goto nla_put_failure;
10438         }
10439
10440         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10441             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10442                 goto nla_put_failure;
10443
10444         genlmsg_end(msg, hdr);
10445
10446         rcu_read_lock();
10447         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10448                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10449         rcu_read_unlock();
10450
10451         return;
10452
10453 nla_put_failure:
10454         genlmsg_cancel(msg, hdr);
10455         nlmsg_free(msg);
10456 }
10457
10458 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10459                                     struct net_device *netdev,
10460                                     const u8 *buf, size_t len,
10461                                     enum nl80211_commands cmd, gfp_t gfp)
10462 {
10463         struct sk_buff *msg;
10464         void *hdr;
10465
10466         msg = nlmsg_new(100 + len, gfp);
10467         if (!msg)
10468                 return;
10469
10470         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10471         if (!hdr) {
10472                 nlmsg_free(msg);
10473                 return;
10474         }
10475
10476         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10477             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10478             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10479                 goto nla_put_failure;
10480
10481         genlmsg_end(msg, hdr);
10482
10483         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10484                                 NL80211_MCGRP_MLME, gfp);
10485         return;
10486
10487  nla_put_failure:
10488         genlmsg_cancel(msg, hdr);
10489         nlmsg_free(msg);
10490 }
10491
10492 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10493                           struct net_device *netdev, const u8 *buf,
10494                           size_t len, gfp_t gfp)
10495 {
10496         nl80211_send_mlme_event(rdev, netdev, buf, len,
10497                                 NL80211_CMD_AUTHENTICATE, gfp);
10498 }
10499
10500 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10501                            struct net_device *netdev, const u8 *buf,
10502                            size_t len, gfp_t gfp)
10503 {
10504         nl80211_send_mlme_event(rdev, netdev, buf, len,
10505                                 NL80211_CMD_ASSOCIATE, gfp);
10506 }
10507
10508 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10509                          struct net_device *netdev, const u8 *buf,
10510                          size_t len, gfp_t gfp)
10511 {
10512         nl80211_send_mlme_event(rdev, netdev, buf, len,
10513                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10514 }
10515
10516 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10517                            struct net_device *netdev, const u8 *buf,
10518                            size_t len, gfp_t gfp)
10519 {
10520         nl80211_send_mlme_event(rdev, netdev, buf, len,
10521                                 NL80211_CMD_DISASSOCIATE, gfp);
10522 }
10523
10524 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10525                                   size_t len)
10526 {
10527         struct wireless_dev *wdev = dev->ieee80211_ptr;
10528         struct wiphy *wiphy = wdev->wiphy;
10529         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10530         const struct ieee80211_mgmt *mgmt = (void *)buf;
10531         u32 cmd;
10532
10533         if (WARN_ON(len < 2))
10534                 return;
10535
10536         if (ieee80211_is_deauth(mgmt->frame_control))
10537                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10538         else
10539                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10540
10541         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10542         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10543 }
10544 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10545
10546 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10547                                       struct net_device *netdev, int cmd,
10548                                       const u8 *addr, gfp_t gfp)
10549 {
10550         struct sk_buff *msg;
10551         void *hdr;
10552
10553         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10554         if (!msg)
10555                 return;
10556
10557         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10558         if (!hdr) {
10559                 nlmsg_free(msg);
10560                 return;
10561         }
10562
10563         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10564             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10565             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10566             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10567                 goto nla_put_failure;
10568
10569         genlmsg_end(msg, hdr);
10570
10571         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10572                                 NL80211_MCGRP_MLME, gfp);
10573         return;
10574
10575  nla_put_failure:
10576         genlmsg_cancel(msg, hdr);
10577         nlmsg_free(msg);
10578 }
10579
10580 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10581                                struct net_device *netdev, const u8 *addr,
10582                                gfp_t gfp)
10583 {
10584         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10585                                   addr, gfp);
10586 }
10587
10588 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10589                                 struct net_device *netdev, const u8 *addr,
10590                                 gfp_t gfp)
10591 {
10592         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10593                                   addr, gfp);
10594 }
10595
10596 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10597                                  struct net_device *netdev, const u8 *bssid,
10598                                  const u8 *req_ie, size_t req_ie_len,
10599                                  const u8 *resp_ie, size_t resp_ie_len,
10600                                  u16 status, gfp_t gfp)
10601 {
10602         struct sk_buff *msg;
10603         void *hdr;
10604
10605         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
10606         if (!msg)
10607                 return;
10608
10609         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10610         if (!hdr) {
10611                 nlmsg_free(msg);
10612                 return;
10613         }
10614
10615         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10616             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10617             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10618             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10619             (req_ie &&
10620              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10621             (resp_ie &&
10622              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10623                 goto nla_put_failure;
10624
10625         genlmsg_end(msg, hdr);
10626
10627         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10628                                 NL80211_MCGRP_MLME, gfp);
10629         return;
10630
10631  nla_put_failure:
10632         genlmsg_cancel(msg, hdr);
10633         nlmsg_free(msg);
10634
10635 }
10636
10637 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10638                          struct net_device *netdev, const u8 *bssid,
10639                          const u8 *req_ie, size_t req_ie_len,
10640                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10641 {
10642         struct sk_buff *msg;
10643         void *hdr;
10644
10645         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
10646         if (!msg)
10647                 return;
10648
10649         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10650         if (!hdr) {
10651                 nlmsg_free(msg);
10652                 return;
10653         }
10654
10655         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10656             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10657             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10658             (req_ie &&
10659              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10660             (resp_ie &&
10661              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10662                 goto nla_put_failure;
10663
10664         genlmsg_end(msg, hdr);
10665
10666         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10667                                 NL80211_MCGRP_MLME, gfp);
10668         return;
10669
10670  nla_put_failure:
10671         genlmsg_cancel(msg, hdr);
10672         nlmsg_free(msg);
10673
10674 }
10675
10676 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10677                                struct net_device *netdev, u16 reason,
10678                                const u8 *ie, size_t ie_len, bool from_ap)
10679 {
10680         struct sk_buff *msg;
10681         void *hdr;
10682
10683         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
10684         if (!msg)
10685                 return;
10686
10687         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10688         if (!hdr) {
10689                 nlmsg_free(msg);
10690                 return;
10691         }
10692
10693         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10694             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10695             (from_ap && reason &&
10696              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10697             (from_ap &&
10698              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10699             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10700                 goto nla_put_failure;
10701
10702         genlmsg_end(msg, hdr);
10703
10704         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10705                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10706         return;
10707
10708  nla_put_failure:
10709         genlmsg_cancel(msg, hdr);
10710         nlmsg_free(msg);
10711
10712 }
10713
10714 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10715                              struct net_device *netdev, const u8 *bssid,
10716                              gfp_t gfp)
10717 {
10718         struct sk_buff *msg;
10719         void *hdr;
10720
10721         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10722         if (!msg)
10723                 return;
10724
10725         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10726         if (!hdr) {
10727                 nlmsg_free(msg);
10728                 return;
10729         }
10730
10731         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10732             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10733             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10734                 goto nla_put_failure;
10735
10736         genlmsg_end(msg, hdr);
10737
10738         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10739                                 NL80211_MCGRP_MLME, gfp);
10740         return;
10741
10742  nla_put_failure:
10743         genlmsg_cancel(msg, hdr);
10744         nlmsg_free(msg);
10745 }
10746
10747 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10748                                         const u8* ie, u8 ie_len, gfp_t gfp)
10749 {
10750         struct wireless_dev *wdev = dev->ieee80211_ptr;
10751         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10752         struct sk_buff *msg;
10753         void *hdr;
10754
10755         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10756                 return;
10757
10758         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10759
10760         msg = nlmsg_new(100 + ie_len, gfp);
10761         if (!msg)
10762                 return;
10763
10764         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10765         if (!hdr) {
10766                 nlmsg_free(msg);
10767                 return;
10768         }
10769
10770         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10771             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10772             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10773             (ie_len && ie &&
10774              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10775                 goto nla_put_failure;
10776
10777         genlmsg_end(msg, hdr);
10778
10779         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10780                                 NL80211_MCGRP_MLME, gfp);
10781         return;
10782
10783  nla_put_failure:
10784         genlmsg_cancel(msg, hdr);
10785         nlmsg_free(msg);
10786 }
10787 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10788
10789 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10790                                  struct net_device *netdev, const u8 *addr,
10791                                  enum nl80211_key_type key_type, int key_id,
10792                                  const u8 *tsc, gfp_t gfp)
10793 {
10794         struct sk_buff *msg;
10795         void *hdr;
10796
10797         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10798         if (!msg)
10799                 return;
10800
10801         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10802         if (!hdr) {
10803                 nlmsg_free(msg);
10804                 return;
10805         }
10806
10807         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10808             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10809             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10810             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10811             (key_id != -1 &&
10812              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10813             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10814                 goto nla_put_failure;
10815
10816         genlmsg_end(msg, hdr);
10817
10818         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10819                                 NL80211_MCGRP_MLME, gfp);
10820         return;
10821
10822  nla_put_failure:
10823         genlmsg_cancel(msg, hdr);
10824         nlmsg_free(msg);
10825 }
10826
10827 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10828                                     struct ieee80211_channel *channel_before,
10829                                     struct ieee80211_channel *channel_after)
10830 {
10831         struct sk_buff *msg;
10832         void *hdr;
10833         struct nlattr *nl_freq;
10834
10835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10836         if (!msg)
10837                 return;
10838
10839         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10840         if (!hdr) {
10841                 nlmsg_free(msg);
10842                 return;
10843         }
10844
10845         /*
10846          * Since we are applying the beacon hint to a wiphy we know its
10847          * wiphy_idx is valid
10848          */
10849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10850                 goto nla_put_failure;
10851
10852         /* Before */
10853         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10854         if (!nl_freq)
10855                 goto nla_put_failure;
10856         if (nl80211_msg_put_channel(msg, channel_before, false))
10857                 goto nla_put_failure;
10858         nla_nest_end(msg, nl_freq);
10859
10860         /* After */
10861         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10862         if (!nl_freq)
10863                 goto nla_put_failure;
10864         if (nl80211_msg_put_channel(msg, channel_after, false))
10865                 goto nla_put_failure;
10866         nla_nest_end(msg, nl_freq);
10867
10868         genlmsg_end(msg, hdr);
10869
10870         rcu_read_lock();
10871         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10872                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10873         rcu_read_unlock();
10874
10875         return;
10876
10877 nla_put_failure:
10878         genlmsg_cancel(msg, hdr);
10879         nlmsg_free(msg);
10880 }
10881
10882 static void nl80211_send_remain_on_chan_event(
10883         int cmd, struct cfg80211_registered_device *rdev,
10884         struct wireless_dev *wdev, u64 cookie,
10885         struct ieee80211_channel *chan,
10886         unsigned int duration, gfp_t gfp)
10887 {
10888         struct sk_buff *msg;
10889         void *hdr;
10890
10891         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10892         if (!msg)
10893                 return;
10894
10895         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10896         if (!hdr) {
10897                 nlmsg_free(msg);
10898                 return;
10899         }
10900
10901         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10902             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10903                                          wdev->netdev->ifindex)) ||
10904             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10905             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10906             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10907                         NL80211_CHAN_NO_HT) ||
10908             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10909                 goto nla_put_failure;
10910
10911         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10912             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10913                 goto nla_put_failure;
10914
10915         genlmsg_end(msg, hdr);
10916
10917         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10918                                 NL80211_MCGRP_MLME, gfp);
10919         return;
10920
10921  nla_put_failure:
10922         genlmsg_cancel(msg, hdr);
10923         nlmsg_free(msg);
10924 }
10925
10926 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10927                                struct ieee80211_channel *chan,
10928                                unsigned int duration, gfp_t gfp)
10929 {
10930         struct wiphy *wiphy = wdev->wiphy;
10931         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10932
10933         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10934         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10935                                           rdev, wdev, cookie, chan,
10936                                           duration, gfp);
10937 }
10938 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10939
10940 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10941                                         struct ieee80211_channel *chan,
10942                                         gfp_t gfp)
10943 {
10944         struct wiphy *wiphy = wdev->wiphy;
10945         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10946
10947         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10948         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10949                                           rdev, wdev, cookie, chan, 0, gfp);
10950 }
10951 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10952
10953 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10954                       struct station_info *sinfo, gfp_t gfp)
10955 {
10956         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10957         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10958         struct sk_buff *msg;
10959
10960         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10961
10962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10963         if (!msg)
10964                 return;
10965
10966         if (nl80211_send_station(msg, 0, 0, 0,
10967                                  rdev, dev, mac_addr, sinfo) < 0) {
10968                 nlmsg_free(msg);
10969                 return;
10970         }
10971
10972         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10973                                 NL80211_MCGRP_MLME, gfp);
10974 }
10975 EXPORT_SYMBOL(cfg80211_new_sta);
10976
10977 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10978 {
10979         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10980         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10981         struct sk_buff *msg;
10982         void *hdr;
10983
10984         trace_cfg80211_del_sta(dev, mac_addr);
10985
10986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10987         if (!msg)
10988                 return;
10989
10990         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10991         if (!hdr) {
10992                 nlmsg_free(msg);
10993                 return;
10994         }
10995
10996         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10997             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10998                 goto nla_put_failure;
10999
11000         genlmsg_end(msg, hdr);
11001
11002         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11003                                 NL80211_MCGRP_MLME, gfp);
11004         return;
11005
11006  nla_put_failure:
11007         genlmsg_cancel(msg, hdr);
11008         nlmsg_free(msg);
11009 }
11010 EXPORT_SYMBOL(cfg80211_del_sta);
11011
11012 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11013                           enum nl80211_connect_failed_reason reason,
11014                           gfp_t gfp)
11015 {
11016         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11017         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11018         struct sk_buff *msg;
11019         void *hdr;
11020
11021         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11022         if (!msg)
11023                 return;
11024
11025         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11026         if (!hdr) {
11027                 nlmsg_free(msg);
11028                 return;
11029         }
11030
11031         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11032             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11033             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11034                 goto nla_put_failure;
11035
11036         genlmsg_end(msg, hdr);
11037
11038         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11039                                 NL80211_MCGRP_MLME, gfp);
11040         return;
11041
11042  nla_put_failure:
11043         genlmsg_cancel(msg, hdr);
11044         nlmsg_free(msg);
11045 }
11046 EXPORT_SYMBOL(cfg80211_conn_failed);
11047
11048 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11049                                        const u8 *addr, gfp_t gfp)
11050 {
11051         struct wireless_dev *wdev = dev->ieee80211_ptr;
11052         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11053         struct sk_buff *msg;
11054         void *hdr;
11055         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11056
11057         if (!nlportid)
11058                 return false;
11059
11060         msg = nlmsg_new(100, gfp);
11061         if (!msg)
11062                 return true;
11063
11064         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11065         if (!hdr) {
11066                 nlmsg_free(msg);
11067                 return true;
11068         }
11069
11070         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11071             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11072             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11073                 goto nla_put_failure;
11074
11075         genlmsg_end(msg, hdr);
11076         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11077         return true;
11078
11079  nla_put_failure:
11080         genlmsg_cancel(msg, hdr);
11081         nlmsg_free(msg);
11082         return true;
11083 }
11084
11085 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11086                                 const u8 *addr, gfp_t gfp)
11087 {
11088         struct wireless_dev *wdev = dev->ieee80211_ptr;
11089         bool ret;
11090
11091         trace_cfg80211_rx_spurious_frame(dev, addr);
11092
11093         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11094                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11095                 trace_cfg80211_return_bool(false);
11096                 return false;
11097         }
11098         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11099                                          addr, gfp);
11100         trace_cfg80211_return_bool(ret);
11101         return ret;
11102 }
11103 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11104
11105 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11106                                         const u8 *addr, gfp_t gfp)
11107 {
11108         struct wireless_dev *wdev = dev->ieee80211_ptr;
11109         bool ret;
11110
11111         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11112
11113         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11114                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11115                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11116                 trace_cfg80211_return_bool(false);
11117                 return false;
11118         }
11119         ret = __nl80211_unexpected_frame(dev,
11120                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11121                                          addr, gfp);
11122         trace_cfg80211_return_bool(ret);
11123         return ret;
11124 }
11125 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11126
11127 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11128                       struct wireless_dev *wdev, u32 nlportid,
11129                       int freq, int sig_dbm,
11130                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11131 {
11132         struct net_device *netdev = wdev->netdev;
11133         struct sk_buff *msg;
11134         void *hdr;
11135
11136         msg = nlmsg_new(100 + len, gfp);
11137         if (!msg)
11138                 return -ENOMEM;
11139
11140         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11141         if (!hdr) {
11142                 nlmsg_free(msg);
11143                 return -ENOMEM;
11144         }
11145
11146         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11147             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11148                                         netdev->ifindex)) ||
11149             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11150             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11151             (sig_dbm &&
11152              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11153             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11154             (flags &&
11155              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11156                 goto nla_put_failure;
11157
11158         genlmsg_end(msg, hdr);
11159
11160         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11161
11162  nla_put_failure:
11163         genlmsg_cancel(msg, hdr);
11164         nlmsg_free(msg);
11165         return -ENOBUFS;
11166 }
11167
11168 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11169                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11170 {
11171         struct wiphy *wiphy = wdev->wiphy;
11172         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11173         struct net_device *netdev = wdev->netdev;
11174         struct sk_buff *msg;
11175         void *hdr;
11176
11177         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11178
11179         msg = nlmsg_new(100 + len, gfp);
11180         if (!msg)
11181                 return;
11182
11183         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11184         if (!hdr) {
11185                 nlmsg_free(msg);
11186                 return;
11187         }
11188
11189         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11190             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11191                                    netdev->ifindex)) ||
11192             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11193             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11194             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11195             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11196                 goto nla_put_failure;
11197
11198         genlmsg_end(msg, hdr);
11199
11200         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11201                                 NL80211_MCGRP_MLME, gfp);
11202         return;
11203
11204  nla_put_failure:
11205         genlmsg_cancel(msg, hdr);
11206         nlmsg_free(msg);
11207 }
11208 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11209
11210 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11211                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11212                               gfp_t gfp)
11213 {
11214         struct wireless_dev *wdev = dev->ieee80211_ptr;
11215         struct wiphy *wiphy = wdev->wiphy;
11216         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11217         struct sk_buff *msg;
11218         struct nlattr *pinfoattr;
11219         void *hdr;
11220
11221         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11222
11223         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11224         if (!msg)
11225                 return;
11226
11227         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11228         if (!hdr) {
11229                 nlmsg_free(msg);
11230                 return;
11231         }
11232
11233         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11234             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11235                 goto nla_put_failure;
11236
11237         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11238         if (!pinfoattr)
11239                 goto nla_put_failure;
11240
11241         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11242                         rssi_event))
11243                 goto nla_put_failure;
11244
11245         nla_nest_end(msg, pinfoattr);
11246
11247         genlmsg_end(msg, hdr);
11248
11249         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11250                                 NL80211_MCGRP_MLME, gfp);
11251         return;
11252
11253  nla_put_failure:
11254         genlmsg_cancel(msg, hdr);
11255         nlmsg_free(msg);
11256 }
11257 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11258
11259 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11260                                      struct net_device *netdev, const u8 *bssid,
11261                                      const u8 *replay_ctr, gfp_t gfp)
11262 {
11263         struct sk_buff *msg;
11264         struct nlattr *rekey_attr;
11265         void *hdr;
11266
11267         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11268         if (!msg)
11269                 return;
11270
11271         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11272         if (!hdr) {
11273                 nlmsg_free(msg);
11274                 return;
11275         }
11276
11277         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11278             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11279             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11280                 goto nla_put_failure;
11281
11282         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11283         if (!rekey_attr)
11284                 goto nla_put_failure;
11285
11286         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11287                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11288                 goto nla_put_failure;
11289
11290         nla_nest_end(msg, rekey_attr);
11291
11292         genlmsg_end(msg, hdr);
11293
11294         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11295                                 NL80211_MCGRP_MLME, gfp);
11296         return;
11297
11298  nla_put_failure:
11299         genlmsg_cancel(msg, hdr);
11300         nlmsg_free(msg);
11301 }
11302
11303 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11304                                const u8 *replay_ctr, gfp_t gfp)
11305 {
11306         struct wireless_dev *wdev = dev->ieee80211_ptr;
11307         struct wiphy *wiphy = wdev->wiphy;
11308         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11309
11310         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11311         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11312 }
11313 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11314
11315 static void
11316 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11317                                struct net_device *netdev, int index,
11318                                const u8 *bssid, bool preauth, gfp_t gfp)
11319 {
11320         struct sk_buff *msg;
11321         struct nlattr *attr;
11322         void *hdr;
11323
11324         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11325         if (!msg)
11326                 return;
11327
11328         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11329         if (!hdr) {
11330                 nlmsg_free(msg);
11331                 return;
11332         }
11333
11334         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11335             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11336                 goto nla_put_failure;
11337
11338         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11339         if (!attr)
11340                 goto nla_put_failure;
11341
11342         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11343             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11344             (preauth &&
11345              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11346                 goto nla_put_failure;
11347
11348         nla_nest_end(msg, attr);
11349
11350         genlmsg_end(msg, hdr);
11351
11352         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11353                                 NL80211_MCGRP_MLME, gfp);
11354         return;
11355
11356  nla_put_failure:
11357         genlmsg_cancel(msg, hdr);
11358         nlmsg_free(msg);
11359 }
11360
11361 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11362                                      const u8 *bssid, bool preauth, gfp_t gfp)
11363 {
11364         struct wireless_dev *wdev = dev->ieee80211_ptr;
11365         struct wiphy *wiphy = wdev->wiphy;
11366         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11367
11368         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11369         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11370 }
11371 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11372
11373 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11374                                      struct net_device *netdev,
11375                                      struct cfg80211_chan_def *chandef,
11376                                      gfp_t gfp)
11377 {
11378         struct sk_buff *msg;
11379         void *hdr;
11380
11381         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11382         if (!msg)
11383                 return;
11384
11385         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11386         if (!hdr) {
11387                 nlmsg_free(msg);
11388                 return;
11389         }
11390
11391         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11392                 goto nla_put_failure;
11393
11394         if (nl80211_send_chandef(msg, chandef))
11395                 goto nla_put_failure;
11396
11397         genlmsg_end(msg, hdr);
11398
11399         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11400                                 NL80211_MCGRP_MLME, gfp);
11401         return;
11402
11403  nla_put_failure:
11404         genlmsg_cancel(msg, hdr);
11405         nlmsg_free(msg);
11406 }
11407
11408 void cfg80211_ch_switch_notify(struct net_device *dev,
11409                                struct cfg80211_chan_def *chandef)
11410 {
11411         struct wireless_dev *wdev = dev->ieee80211_ptr;
11412         struct wiphy *wiphy = wdev->wiphy;
11413         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11414
11415         ASSERT_WDEV_LOCK(wdev);
11416
11417         trace_cfg80211_ch_switch_notify(dev, chandef);
11418
11419         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11420                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11421                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11422                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11423                 return;
11424
11425         wdev->chandef = *chandef;
11426         wdev->preset_chandef = *chandef;
11427         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11428 }
11429 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11430
11431 void cfg80211_cqm_txe_notify(struct net_device *dev,
11432                              const u8 *peer, u32 num_packets,
11433                              u32 rate, u32 intvl, gfp_t gfp)
11434 {
11435         struct wireless_dev *wdev = dev->ieee80211_ptr;
11436         struct wiphy *wiphy = wdev->wiphy;
11437         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11438         struct sk_buff *msg;
11439         struct nlattr *pinfoattr;
11440         void *hdr;
11441
11442         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11443         if (!msg)
11444                 return;
11445
11446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11447         if (!hdr) {
11448                 nlmsg_free(msg);
11449                 return;
11450         }
11451
11452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11453             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11454             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11455                 goto nla_put_failure;
11456
11457         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11458         if (!pinfoattr)
11459                 goto nla_put_failure;
11460
11461         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11462                 goto nla_put_failure;
11463
11464         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11465                 goto nla_put_failure;
11466
11467         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11468                 goto nla_put_failure;
11469
11470         nla_nest_end(msg, pinfoattr);
11471
11472         genlmsg_end(msg, hdr);
11473
11474         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11475                                 NL80211_MCGRP_MLME, gfp);
11476         return;
11477
11478  nla_put_failure:
11479         genlmsg_cancel(msg, hdr);
11480         nlmsg_free(msg);
11481 }
11482 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11483
11484 void
11485 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11486                      const struct cfg80211_chan_def *chandef,
11487                      enum nl80211_radar_event event,
11488                      struct net_device *netdev, gfp_t gfp)
11489 {
11490         struct sk_buff *msg;
11491         void *hdr;
11492
11493         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11494         if (!msg)
11495                 return;
11496
11497         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11498         if (!hdr) {
11499                 nlmsg_free(msg);
11500                 return;
11501         }
11502
11503         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11504                 goto nla_put_failure;
11505
11506         /* NOP and radar events don't need a netdev parameter */
11507         if (netdev) {
11508                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11509
11510                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11511                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11512                         goto nla_put_failure;
11513         }
11514
11515         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11516                 goto nla_put_failure;
11517
11518         if (nl80211_send_chandef(msg, chandef))
11519                 goto nla_put_failure;
11520
11521         genlmsg_end(msg, hdr);
11522
11523         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11524                                 NL80211_MCGRP_MLME, gfp);
11525         return;
11526
11527  nla_put_failure:
11528         genlmsg_cancel(msg, hdr);
11529         nlmsg_free(msg);
11530 }
11531
11532 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11533                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11534 {
11535         struct wireless_dev *wdev = dev->ieee80211_ptr;
11536         struct wiphy *wiphy = wdev->wiphy;
11537         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11538         struct sk_buff *msg;
11539         struct nlattr *pinfoattr;
11540         void *hdr;
11541
11542         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11543
11544         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11545         if (!msg)
11546                 return;
11547
11548         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11549         if (!hdr) {
11550                 nlmsg_free(msg);
11551                 return;
11552         }
11553
11554         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11555             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11556             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11557                 goto nla_put_failure;
11558
11559         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11560         if (!pinfoattr)
11561                 goto nla_put_failure;
11562
11563         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11564                 goto nla_put_failure;
11565
11566         nla_nest_end(msg, pinfoattr);
11567
11568         genlmsg_end(msg, hdr);
11569
11570         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11571                                 NL80211_MCGRP_MLME, gfp);
11572         return;
11573
11574  nla_put_failure:
11575         genlmsg_cancel(msg, hdr);
11576         nlmsg_free(msg);
11577 }
11578 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11579
11580 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11581                            u64 cookie, bool acked, gfp_t gfp)
11582 {
11583         struct wireless_dev *wdev = dev->ieee80211_ptr;
11584         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11585         struct sk_buff *msg;
11586         void *hdr;
11587
11588         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11589
11590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11591
11592         if (!msg)
11593                 return;
11594
11595         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11596         if (!hdr) {
11597                 nlmsg_free(msg);
11598                 return;
11599         }
11600
11601         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11602             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11603             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11604             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11605             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11606                 goto nla_put_failure;
11607
11608         genlmsg_end(msg, hdr);
11609
11610         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11611                                 NL80211_MCGRP_MLME, gfp);
11612         return;
11613
11614  nla_put_failure:
11615         genlmsg_cancel(msg, hdr);
11616         nlmsg_free(msg);
11617 }
11618 EXPORT_SYMBOL(cfg80211_probe_status);
11619
11620 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11621                                  const u8 *frame, size_t len,
11622                                  int freq, int sig_dbm)
11623 {
11624         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11625         struct sk_buff *msg;
11626         void *hdr;
11627         struct cfg80211_beacon_registration *reg;
11628
11629         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11630
11631         spin_lock_bh(&rdev->beacon_registrations_lock);
11632         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11633                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11634                 if (!msg) {
11635                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11636                         return;
11637                 }
11638
11639                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11640                 if (!hdr)
11641                         goto nla_put_failure;
11642
11643                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11644                     (freq &&
11645                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11646                     (sig_dbm &&
11647                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11648                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11649                         goto nla_put_failure;
11650
11651                 genlmsg_end(msg, hdr);
11652
11653                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11654         }
11655         spin_unlock_bh(&rdev->beacon_registrations_lock);
11656         return;
11657
11658  nla_put_failure:
11659         spin_unlock_bh(&rdev->beacon_registrations_lock);
11660         if (hdr)
11661                 genlmsg_cancel(msg, hdr);
11662         nlmsg_free(msg);
11663 }
11664 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11665
11666 #ifdef CONFIG_PM
11667 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11668                                    struct cfg80211_wowlan_wakeup *wakeup,
11669                                    gfp_t gfp)
11670 {
11671         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11672         struct sk_buff *msg;
11673         void *hdr;
11674         int size = 200;
11675
11676         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11677
11678         if (wakeup)
11679                 size += wakeup->packet_present_len;
11680
11681         msg = nlmsg_new(size, gfp);
11682         if (!msg)
11683                 return;
11684
11685         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11686         if (!hdr)
11687                 goto free_msg;
11688
11689         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11690             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11691                 goto free_msg;
11692
11693         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11694                                         wdev->netdev->ifindex))
11695                 goto free_msg;
11696
11697         if (wakeup) {
11698                 struct nlattr *reasons;
11699
11700                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11701                 if (!reasons)
11702                         goto free_msg;
11703
11704                 if (wakeup->disconnect &&
11705                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11706                         goto free_msg;
11707                 if (wakeup->magic_pkt &&
11708                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11709                         goto free_msg;
11710                 if (wakeup->gtk_rekey_failure &&
11711                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11712                         goto free_msg;
11713                 if (wakeup->eap_identity_req &&
11714                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11715                         goto free_msg;
11716                 if (wakeup->four_way_handshake &&
11717                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11718                         goto free_msg;
11719                 if (wakeup->rfkill_release &&
11720                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11721                         goto free_msg;
11722
11723                 if (wakeup->pattern_idx >= 0 &&
11724                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11725                                 wakeup->pattern_idx))
11726                         goto free_msg;
11727
11728                 if (wakeup->tcp_match &&
11729                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11730                         goto free_msg;
11731
11732                 if (wakeup->tcp_connlost &&
11733                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11734                         goto free_msg;
11735
11736                 if (wakeup->tcp_nomoretokens &&
11737                     nla_put_flag(msg,
11738                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11739                         goto free_msg;
11740
11741                 if (wakeup->packet) {
11742                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11743                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11744
11745                         if (!wakeup->packet_80211) {
11746                                 pkt_attr =
11747                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11748                                 len_attr =
11749                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11750                         }
11751
11752                         if (wakeup->packet_len &&
11753                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11754                                 goto free_msg;
11755
11756                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11757                                     wakeup->packet))
11758                                 goto free_msg;
11759                 }
11760
11761                 nla_nest_end(msg, reasons);
11762         }
11763
11764         genlmsg_end(msg, hdr);
11765
11766         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11767                                 NL80211_MCGRP_MLME, gfp);
11768         return;
11769
11770  free_msg:
11771         nlmsg_free(msg);
11772 }
11773 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11774 #endif
11775
11776 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11777                                 enum nl80211_tdls_operation oper,
11778                                 u16 reason_code, gfp_t gfp)
11779 {
11780         struct wireless_dev *wdev = dev->ieee80211_ptr;
11781         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11782         struct sk_buff *msg;
11783         void *hdr;
11784
11785         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11786                                          reason_code);
11787
11788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11789         if (!msg)
11790                 return;
11791
11792         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11793         if (!hdr) {
11794                 nlmsg_free(msg);
11795                 return;
11796         }
11797
11798         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11799             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11800             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11801             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11802             (reason_code > 0 &&
11803              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11804                 goto nla_put_failure;
11805
11806         genlmsg_end(msg, hdr);
11807
11808         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11809                                 NL80211_MCGRP_MLME, gfp);
11810         return;
11811
11812  nla_put_failure:
11813         genlmsg_cancel(msg, hdr);
11814         nlmsg_free(msg);
11815 }
11816 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11817
11818 static int nl80211_netlink_notify(struct notifier_block * nb,
11819                                   unsigned long state,
11820                                   void *_notify)
11821 {
11822         struct netlink_notify *notify = _notify;
11823         struct cfg80211_registered_device *rdev;
11824         struct wireless_dev *wdev;
11825         struct cfg80211_beacon_registration *reg, *tmp;
11826
11827         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
11828                 return NOTIFY_DONE;
11829
11830         rcu_read_lock();
11831
11832         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11833                 bool schedule_destroy_work = false;
11834
11835                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
11836                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11837
11838                         if (wdev->owner_nlportid == notify->portid)
11839                                 schedule_destroy_work = true;
11840                 }
11841
11842                 spin_lock_bh(&rdev->beacon_registrations_lock);
11843                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11844                                          list) {
11845                         if (reg->nlportid == notify->portid) {
11846                                 list_del(&reg->list);
11847                                 kfree(reg);
11848                                 break;
11849                         }
11850                 }
11851                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11852
11853                 if (schedule_destroy_work) {
11854                         struct cfg80211_iface_destroy *destroy;
11855
11856                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
11857                         if (destroy) {
11858                                 destroy->nlportid = notify->portid;
11859                                 spin_lock(&rdev->destroy_list_lock);
11860                                 list_add(&destroy->list, &rdev->destroy_list);
11861                                 spin_unlock(&rdev->destroy_list_lock);
11862                                 schedule_work(&rdev->destroy_work);
11863                         }
11864                 }
11865         }
11866
11867         rcu_read_unlock();
11868
11869         return NOTIFY_OK;
11870 }
11871
11872 static struct notifier_block nl80211_netlink_notifier = {
11873         .notifier_call = nl80211_netlink_notify,
11874 };
11875
11876 void cfg80211_ft_event(struct net_device *netdev,
11877                        struct cfg80211_ft_event_params *ft_event)
11878 {
11879         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11880         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11881         struct sk_buff *msg;
11882         void *hdr;
11883
11884         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11885
11886         if (!ft_event->target_ap)
11887                 return;
11888
11889         msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
11890         if (!msg)
11891                 return;
11892
11893         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11894         if (!hdr)
11895                 goto out;
11896
11897         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11898             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11899             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11900                 goto out;
11901
11902         if (ft_event->ies &&
11903             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11904                 goto out;
11905         if (ft_event->ric_ies &&
11906             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11907                     ft_event->ric_ies))
11908                 goto out;
11909
11910         genlmsg_end(msg, hdr);
11911
11912         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11913                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11914         return;
11915  out:
11916         nlmsg_free(msg);
11917 }
11918 EXPORT_SYMBOL(cfg80211_ft_event);
11919
11920 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11921 {
11922         struct cfg80211_registered_device *rdev;
11923         struct sk_buff *msg;
11924         void *hdr;
11925         u32 nlportid;
11926
11927         rdev = wiphy_to_rdev(wdev->wiphy);
11928         if (!rdev->crit_proto_nlportid)
11929                 return;
11930
11931         nlportid = rdev->crit_proto_nlportid;
11932         rdev->crit_proto_nlportid = 0;
11933
11934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11935         if (!msg)
11936                 return;
11937
11938         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11939         if (!hdr)
11940                 goto nla_put_failure;
11941
11942         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11943             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11944                 goto nla_put_failure;
11945
11946         genlmsg_end(msg, hdr);
11947
11948         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11949         return;
11950
11951  nla_put_failure:
11952         if (hdr)
11953                 genlmsg_cancel(msg, hdr);
11954         nlmsg_free(msg);
11955
11956 }
11957 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11958
11959 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
11960 {
11961         struct wiphy *wiphy = wdev->wiphy;
11962         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11963         struct sk_buff *msg;
11964         void *hdr;
11965
11966         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11967         if (!msg)
11968                 return;
11969
11970         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
11971         if (!hdr)
11972                 goto out;
11973
11974         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11975             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
11976             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11977                 goto out;
11978
11979         genlmsg_end(msg, hdr);
11980
11981         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
11982                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11983         return;
11984  out:
11985         nlmsg_free(msg);
11986 }
11987
11988 /* initialisation/exit functions */
11989
11990 int nl80211_init(void)
11991 {
11992         int err;
11993
11994         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11995                                                    nl80211_mcgrps);
11996         if (err)
11997                 return err;
11998
11999         err = netlink_register_notifier(&nl80211_netlink_notifier);
12000         if (err)
12001                 goto err_out;
12002
12003         return 0;
12004  err_out:
12005         genl_unregister_family(&nl80211_fam);
12006         return err;
12007 }
12008
12009 void nl80211_exit(void)
12010 {
12011         netlink_unregister_notifier(&nl80211_netlink_notifier);
12012         genl_unregister_family(&nl80211_fam);
12013 }