net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_dev(
 172                                                 netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         dev_put(netdev);
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 344                                       .len = IEEE80211_MAX_DATA_LEN },
 345         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 346         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 347         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 348                 .len = NL80211_HT_CAPABILITY_LEN
 349         },
 350         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 351         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 352         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 353         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 354         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 355         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 356         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 357         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 358         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 359         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 360         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 361         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 362         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 363         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 364         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 365         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 367                 .len = NL80211_VHT_CAPABILITY_LEN,
 368         },
 369         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 370         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 371                                   .len = IEEE80211_MAX_DATA_LEN },
 372         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 373         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 374         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 376         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 377         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 378         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 381         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 382         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 383         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 385         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 386                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 387 };
 388
 389 /* policy for the key attributes */
 390 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 391         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 392         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 393         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 394         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 395         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 396         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 397         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 398         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 399 };
 400
 401 /* policy for the key default flags */
 402 static const struct nla_policy
 403 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 404         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 405         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 406 };
 407
 408 /* policy for WoWLAN attributes */
 409 static const struct nla_policy
 410 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 411         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 413         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 415         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 417         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 418         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 420 };
 421
 422 static const struct nla_policy
 423 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 424         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 425         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 426         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 427         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 428         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 429         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 430         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 431                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 432         },
 433         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 434                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 435         },
 436         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 437         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 438         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 439 };
 440
 441 /* policy for coalesce rule attributes */
 442 static const struct nla_policy
 443 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 444         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 445         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 446         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 447 };
 448
 449 /* policy for GTK rekey offload attributes */
 450 static const struct nla_policy
 451 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 452         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 453         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 454         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 455 };
 456
 457 static const struct nla_policy
 458 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 459         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 460                                                  .len = IEEE80211_MAX_SSID_LEN },
 461         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 462 };
 463
 464 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 465                                      struct netlink_callback *cb,
 466                                      struct cfg80211_registered_device **rdev,
 467                                      struct wireless_dev **wdev)
 468 {
 469         int err;
 470
 471         rtnl_lock();
 472
 473         if (!cb->args[0]) {
 474                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 475                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 476                                   nl80211_policy);
 477                 if (err)
 478                         goto out_unlock;
 479
 480                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 481                                                    nl80211_fam.attrbuf);
 482                 if (IS_ERR(*wdev)) {
 483                         err = PTR_ERR(*wdev);
 484                         goto out_unlock;
 485                 }
 486                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 487                 /* 0 is the first index - add 1 to parse only once */
 488                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 489                 cb->args[1] = (*wdev)->identifier;
 490         } else {
 491                 /* subtract the 1 again here */
 492                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 493                 struct wireless_dev *tmp;
 494
 495                 if (!wiphy) {
 496                         err = -ENODEV;
 497                         goto out_unlock;
 498                 }
 499                 *rdev = wiphy_to_dev(wiphy);
 500                 *wdev = NULL;
 501
 502                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 503                         if (tmp->identifier == cb->args[1]) {
 504                                 *wdev = tmp;
 505                                 break;
 506                         }
 507                 }
 508
 509                 if (!*wdev) {
 510                         err = -ENODEV;
 511                         goto out_unlock;
 512                 }
 513         }
 514
 515         return 0;
 516  out_unlock:
 517         rtnl_unlock();
 518         return err;
 519 }
 520
 521 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 522 {
 523         rtnl_unlock();
 524 }
 525
 526 /* IE validation */
 527 static bool is_valid_ie_attr(const struct nlattr *attr)
 528 {
 529         const u8 *pos;
 530         int len;
 531
 532         if (!attr)
 533                 return true;
 534
 535         pos = nla_data(attr);
 536         len = nla_len(attr);
 537
 538         while (len) {
 539                 u8 elemlen;
 540
 541                 if (len < 2)
 542                         return false;
 543                 len -= 2;
 544
 545                 elemlen = pos[1];
 546                 if (elemlen > len)
 547                         return false;
 548
 549                 len -= elemlen;
 550                 pos += 2 + elemlen;
 551         }
 552
 553         return true;
 554 }
 555
 556 /* message building helper */
 557 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 558                                    int flags, u8 cmd)
 559 {
 560         /* since there is no private header just add the generic one */
 561         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 562 }
 563
 564 static int nl80211_msg_put_channel(struct sk_buff *msg,
 565                                    struct ieee80211_channel *chan,
 566                                    bool large)
 567 {
 568         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 569                         chan->center_freq))
 570                 goto nla_put_failure;
 571
 572         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 573             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 574                 goto nla_put_failure;
 575         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 576                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 577                         goto nla_put_failure;
 578                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 579                         goto nla_put_failure;
 580         }
 581         if (chan->flags & IEEE80211_CHAN_RADAR) {
 582                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 583                         goto nla_put_failure;
 584                 if (large) {
 585                         u32 time;
 586
 587                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 588
 589                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 590                                         chan->dfs_state))
 591                                 goto nla_put_failure;
 592                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 593                                         time))
 594                                 goto nla_put_failure;
 595                 }
 596         }
 597
 598         if (large) {
 599                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 600                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 601                         goto nla_put_failure;
 602                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 603                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 604                         goto nla_put_failure;
 605                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 606                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 607                         goto nla_put_failure;
 608                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 609                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 610                         goto nla_put_failure;
 611         }
 612
 613         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 614                         DBM_TO_MBM(chan->max_power)))
 615                 goto nla_put_failure;
 616
 617         return 0;
 618
 619  nla_put_failure:
 620         return -ENOBUFS;
 621 }
 622
 623 /* netlink command implementations */
 624
 625 struct key_parse {
 626         struct key_params p;
 627         int idx;
 628         int type;
 629         bool def, defmgmt;
 630         bool def_uni, def_multi;
 631 };
 632
 633 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 634 {
 635         struct nlattr *tb[NL80211_KEY_MAX + 1];
 636         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 637                                    nl80211_key_policy);
 638         if (err)
 639                 return err;
 640
 641         k->def = !!tb[NL80211_KEY_DEFAULT];
 642         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 643
 644         if (k->def) {
 645                 k->def_uni = true;
 646                 k->def_multi = true;
 647         }
 648         if (k->defmgmt)
 649                 k->def_multi = true;
 650
 651         if (tb[NL80211_KEY_IDX])
 652                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 653
 654         if (tb[NL80211_KEY_DATA]) {
 655                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 656                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 657         }
 658
 659         if (tb[NL80211_KEY_SEQ]) {
 660                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 661                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 662         }
 663
 664         if (tb[NL80211_KEY_CIPHER])
 665                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 666
 667         if (tb[NL80211_KEY_TYPE]) {
 668                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 669                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 670                         return -EINVAL;
 671         }
 672
 673         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 674                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 675                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 676                                        tb[NL80211_KEY_DEFAULT_TYPES],
 677                                        nl80211_key_default_policy);
 678                 if (err)
 679                         return err;
 680
 681                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 682                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 683         }
 684
 685         return 0;
 686 }
 687
 688 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 689 {
 690         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 691                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 692                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 693         }
 694
 695         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 696                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 697                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 698         }
 699
 700         if (info->attrs[NL80211_ATTR_KEY_IDX])
 701                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 702
 703         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 704                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 705
 706         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 707         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 708
 709         if (k->def) {
 710                 k->def_uni = true;
 711                 k->def_multi = true;
 712         }
 713         if (k->defmgmt)
 714                 k->def_multi = true;
 715
 716         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 717                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 718                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 719                         return -EINVAL;
 720         }
 721
 722         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 723                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 724                 int err = nla_parse_nested(
 725                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 726                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 727                                 nl80211_key_default_policy);
 728                 if (err)
 729                         return err;
 730
 731                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 732                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 733         }
 734
 735         return 0;
 736 }
 737
 738 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 739 {
 740         int err;
 741
 742         memset(k, 0, sizeof(*k));
 743         k->idx = -1;
 744         k->type = -1;
 745
 746         if (info->attrs[NL80211_ATTR_KEY])
 747                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 748         else
 749                 err = nl80211_parse_key_old(info, k);
 750
 751         if (err)
 752                 return err;
 753
 754         if (k->def && k->defmgmt)
 755                 return -EINVAL;
 756
 757         if (k->defmgmt) {
 758                 if (k->def_uni || !k->def_multi)
 759                         return -EINVAL;
 760         }
 761
 762         if (k->idx != -1) {
 763                 if (k->defmgmt) {
 764                         if (k->idx < 4 || k->idx > 5)
 765                                 return -EINVAL;
 766                 } else if (k->def) {
 767                         if (k->idx < 0 || k->idx > 3)
 768                                 return -EINVAL;
 769                 } else {
 770                         if (k->idx < 0 || k->idx > 5)
 771                                 return -EINVAL;
 772                 }
 773         }
 774
 775         return 0;
 776 }
 777
 778 static struct cfg80211_cached_keys *
 779 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 780                        struct nlattr *keys, bool *no_ht)
 781 {
 782         struct key_parse parse;
 783         struct nlattr *key;
 784         struct cfg80211_cached_keys *result;
 785         int rem, err, def = 0;
 786
 787         result = kzalloc(sizeof(*result), GFP_KERNEL);
 788         if (!result)
 789                 return ERR_PTR(-ENOMEM);
 790
 791         result->def = -1;
 792         result->defmgmt = -1;
 793
 794         nla_for_each_nested(key, keys, rem) {
 795                 memset(&parse, 0, sizeof(parse));
 796                 parse.idx = -1;
 797
 798                 err = nl80211_parse_key_new(key, &parse);
 799                 if (err)
 800                         goto error;
 801                 err = -EINVAL;
 802                 if (!parse.p.key)
 803                         goto error;
 804                 if (parse.idx < 0 || parse.idx > 4)
 805                         goto error;
 806                 if (parse.def) {
 807                         if (def)
 808                                 goto error;
 809                         def = 1;
 810                         result->def = parse.idx;
 811                         if (!parse.def_uni || !parse.def_multi)
 812                                 goto error;
 813                 } else if (parse.defmgmt)
 814                         goto error;
 815                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 816                                                      parse.idx, false, NULL);
 817                 if (err)
 818                         goto error;
 819                 result->params[parse.idx].cipher = parse.p.cipher;
 820                 result->params[parse.idx].key_len = parse.p.key_len;
 821                 result->params[parse.idx].key = result->data[parse.idx];
 822                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 823
 824                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 825                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 826                         if (no_ht)
 827                                 *no_ht = true;
 828                 }
 829         }
 830
 831         return result;
 832  error:
 833         kfree(result);
 834         return ERR_PTR(err);
 835 }
 836
 837 static int nl80211_key_allowed(struct wireless_dev *wdev)
 838 {
 839         ASSERT_WDEV_LOCK(wdev);
 840
 841         switch (wdev->iftype) {
 842         case NL80211_IFTYPE_AP:
 843         case NL80211_IFTYPE_AP_VLAN:
 844         case NL80211_IFTYPE_P2P_GO:
 845         case NL80211_IFTYPE_MESH_POINT:
 846                 break;
 847         case NL80211_IFTYPE_ADHOC:
 848         case NL80211_IFTYPE_STATION:
 849         case NL80211_IFTYPE_P2P_CLIENT:
 850                 if (!wdev->current_bss)
 851                         return -ENOLINK;
 852                 break;
 853         default:
 854                 return -EINVAL;
 855         }
 856
 857         return 0;
 858 }
 859
 860 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 861 {
 862         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 863         int i;
 864
 865         if (!nl_modes)
 866                 goto nla_put_failure;
 867
 868         i = 0;
 869         while (ifmodes) {
 870                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 871                         goto nla_put_failure;
 872                 ifmodes >>= 1;
 873                 i++;
 874         }
 875
 876         nla_nest_end(msg, nl_modes);
 877         return 0;
 878
 879 nla_put_failure:
 880         return -ENOBUFS;
 881 }
 882
 883 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 884                                           struct sk_buff *msg,
 885                                           bool large)
 886 {
 887         struct nlattr *nl_combis;
 888         int i, j;
 889
 890         nl_combis = nla_nest_start(msg,
 891                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 892         if (!nl_combis)
 893                 goto nla_put_failure;
 894
 895         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 896                 const struct ieee80211_iface_combination *c;
 897                 struct nlattr *nl_combi, *nl_limits;
 898
 899                 c = &wiphy->iface_combinations[i];
 900
 901                 nl_combi = nla_nest_start(msg, i + 1);
 902                 if (!nl_combi)
 903                         goto nla_put_failure;
 904
 905                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 906                 if (!nl_limits)
 907                         goto nla_put_failure;
 908
 909                 for (j = 0; j < c->n_limits; j++) {
 910                         struct nlattr *nl_limit;
 911
 912                         nl_limit = nla_nest_start(msg, j + 1);
 913                         if (!nl_limit)
 914                                 goto nla_put_failure;
 915                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 916                                         c->limits[j].max))
 917                                 goto nla_put_failure;
 918                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 919                                                 c->limits[j].types))
 920                                 goto nla_put_failure;
 921                         nla_nest_end(msg, nl_limit);
 922                 }
 923
 924                 nla_nest_end(msg, nl_limits);
 925
 926                 if (c->beacon_int_infra_match &&
 927                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 928                         goto nla_put_failure;
 929                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 930                                 c->num_different_channels) ||
 931                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 932                                 c->max_interfaces))
 933                         goto nla_put_failure;
 934                 if (large &&
 935                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 936                                 c->radar_detect_widths))
 937                         goto nla_put_failure;
 938
 939                 nla_nest_end(msg, nl_combi);
 940         }
 941
 942         nla_nest_end(msg, nl_combis);
 943
 944         return 0;
 945 nla_put_failure:
 946         return -ENOBUFS;
 947 }
 948
 949 #ifdef CONFIG_PM
 950 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 951                                         struct sk_buff *msg)
 952 {
 953         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 954         struct nlattr *nl_tcp;
 955
 956         if (!tcp)
 957                 return 0;
 958
 959         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 960         if (!nl_tcp)
 961                 return -ENOBUFS;
 962
 963         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 964                         tcp->data_payload_max))
 965                 return -ENOBUFS;
 966
 967         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 968                         tcp->data_payload_max))
 969                 return -ENOBUFS;
 970
 971         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 972                 return -ENOBUFS;
 973
 974         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 975                                 sizeof(*tcp->tok), tcp->tok))
 976                 return -ENOBUFS;
 977
 978         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 979                         tcp->data_interval_max))
 980                 return -ENOBUFS;
 981
 982         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 983                         tcp->wake_payload_max))
 984                 return -ENOBUFS;
 985
 986         nla_nest_end(msg, nl_tcp);
 987         return 0;
 988 }
 989
 990 static int nl80211_send_wowlan(struct sk_buff *msg,
 991                                struct cfg80211_registered_device *dev,
 992                                bool large)
 993 {
 994         struct nlattr *nl_wowlan;
 995
 996         if (!dev->wiphy.wowlan)
 997                 return 0;
 998
 999         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1000         if (!nl_wowlan)
1001                 return -ENOBUFS;
1002
1003         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1005             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1007             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1008              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1009             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1010              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1011             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1012              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1013             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1014              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1015             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1016              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1017             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1018              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1019                 return -ENOBUFS;
1020
1021         if (dev->wiphy.wowlan->n_patterns) {
1022                 struct nl80211_pattern_support pat = {
1023                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1024                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1025                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1026                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1027                 };
1028
1029                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1030                             sizeof(pat), &pat))
1031                         return -ENOBUFS;
1032         }
1033
1034         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1035                 return -ENOBUFS;
1036
1037         nla_nest_end(msg, nl_wowlan);
1038
1039         return 0;
1040 }
1041 #endif
1042
1043 static int nl80211_send_coalesce(struct sk_buff *msg,
1044                                  struct cfg80211_registered_device *dev)
1045 {
1046         struct nl80211_coalesce_rule_support rule;
1047
1048         if (!dev->wiphy.coalesce)
1049                 return 0;
1050
1051         rule.max_rules = dev->wiphy.coalesce->n_rules;
1052         rule.max_delay = dev->wiphy.coalesce->max_delay;
1053         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1054         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1055         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1056         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1057
1058         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1059                 return -ENOBUFS;
1060
1061         return 0;
1062 }
1063
1064 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1065                                       struct ieee80211_supported_band *sband)
1066 {
1067         struct nlattr *nl_rates, *nl_rate;
1068         struct ieee80211_rate *rate;
1069         int i;
1070
1071         /* add HT info */
1072         if (sband->ht_cap.ht_supported &&
1073             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1074                      sizeof(sband->ht_cap.mcs),
1075                      &sband->ht_cap.mcs) ||
1076              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1077                          sband->ht_cap.cap) ||
1078              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1079                         sband->ht_cap.ampdu_factor) ||
1080              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1081                         sband->ht_cap.ampdu_density)))
1082                 return -ENOBUFS;
1083
1084         /* add VHT info */
1085         if (sband->vht_cap.vht_supported &&
1086             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1087                      sizeof(sband->vht_cap.vht_mcs),
1088                      &sband->vht_cap.vht_mcs) ||
1089              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1090                          sband->vht_cap.cap)))
1091                 return -ENOBUFS;
1092
1093         /* add bitrates */
1094         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1095         if (!nl_rates)
1096                 return -ENOBUFS;
1097
1098         for (i = 0; i < sband->n_bitrates; i++) {
1099                 nl_rate = nla_nest_start(msg, i);
1100                 if (!nl_rate)
1101                         return -ENOBUFS;
1102
1103                 rate = &sband->bitrates[i];
1104                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1105                                 rate->bitrate))
1106                         return -ENOBUFS;
1107                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1108                     nla_put_flag(msg,
1109                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1110                         return -ENOBUFS;
1111
1112                 nla_nest_end(msg, nl_rate);
1113         }
1114
1115         nla_nest_end(msg, nl_rates);
1116
1117         return 0;
1118 }
1119
1120 static int
1121 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1122                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1123 {
1124         u16 stypes;
1125         struct nlattr *nl_ftypes, *nl_ifs;
1126         enum nl80211_iftype ift;
1127         int i;
1128
1129         if (!mgmt_stypes)
1130                 return 0;
1131
1132         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1133         if (!nl_ifs)
1134                 return -ENOBUFS;
1135
1136         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1137                 nl_ftypes = nla_nest_start(msg, ift);
1138                 if (!nl_ftypes)
1139                         return -ENOBUFS;
1140                 i = 0;
1141                 stypes = mgmt_stypes[ift].tx;
1142                 while (stypes) {
1143                         if ((stypes & 1) &&
1144                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1145                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1146                                 return -ENOBUFS;
1147                         stypes >>= 1;
1148                         i++;
1149                 }
1150                 nla_nest_end(msg, nl_ftypes);
1151         }
1152
1153         nla_nest_end(msg, nl_ifs);
1154
1155         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1156         if (!nl_ifs)
1157                 return -ENOBUFS;
1158
1159         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1160                 nl_ftypes = nla_nest_start(msg, ift);
1161                 if (!nl_ftypes)
1162                         return -ENOBUFS;
1163                 i = 0;
1164                 stypes = mgmt_stypes[ift].rx;
1165                 while (stypes) {
1166                         if ((stypes & 1) &&
1167                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1168                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1169                                 return -ENOBUFS;
1170                         stypes >>= 1;
1171                         i++;
1172                 }
1173                 nla_nest_end(msg, nl_ftypes);
1174         }
1175         nla_nest_end(msg, nl_ifs);
1176
1177         return 0;
1178 }
1179
1180 struct nl80211_dump_wiphy_state {
1181         s64 filter_wiphy;
1182         long start;
1183         long split_start, band_start, chan_start;
1184         bool split;
1185 };
1186
1187 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1188                               struct sk_buff *msg, u32 portid, u32 seq,
1189                               int flags, struct nl80211_dump_wiphy_state *state)
1190 {
1191         void *hdr;
1192         struct nlattr *nl_bands, *nl_band;
1193         struct nlattr *nl_freqs, *nl_freq;
1194         struct nlattr *nl_cmds;
1195         enum ieee80211_band band;
1196         struct ieee80211_channel *chan;
1197         int i;
1198         const struct ieee80211_txrx_stypes *mgmt_stypes =
1199                                 dev->wiphy.mgmt_stypes;
1200         u32 features;
1201
1202         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1203         if (!hdr)
1204                 return -ENOBUFS;
1205
1206         if (WARN_ON(!state))
1207                 return -EINVAL;
1208
1209         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1210             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1211                            wiphy_name(&dev->wiphy)) ||
1212             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1213                         cfg80211_rdev_list_generation))
1214                 goto nla_put_failure;
1215
1216         switch (state->split_start) {
1217         case 0:
1218                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1219                                dev->wiphy.retry_short) ||
1220                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1221                                dev->wiphy.retry_long) ||
1222                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1223                                 dev->wiphy.frag_threshold) ||
1224                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1225                                 dev->wiphy.rts_threshold) ||
1226                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1227                                dev->wiphy.coverage_class) ||
1228                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1229                                dev->wiphy.max_scan_ssids) ||
1230                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1231                                dev->wiphy.max_sched_scan_ssids) ||
1232                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1233                                 dev->wiphy.max_scan_ie_len) ||
1234                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1235                                 dev->wiphy.max_sched_scan_ie_len) ||
1236                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1237                                dev->wiphy.max_match_sets))
1238                         goto nla_put_failure;
1239
1240                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1241                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1242                         goto nla_put_failure;
1243                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1244                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1245                         goto nla_put_failure;
1246                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1247                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1248                         goto nla_put_failure;
1249                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1250                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1251                         goto nla_put_failure;
1252                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1253                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1254                         goto nla_put_failure;
1255                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1256                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1257                         goto nla_put_failure;
1258                 state->split_start++;
1259                 if (state->split)
1260                         break;
1261         case 1:
1262                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1263                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1264                             dev->wiphy.cipher_suites))
1265                         goto nla_put_failure;
1266
1267                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1268                                dev->wiphy.max_num_pmkids))
1269                         goto nla_put_failure;
1270
1271                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1272                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1273                         goto nla_put_failure;
1274
1275                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1276                                 dev->wiphy.available_antennas_tx) ||
1277                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1278                                 dev->wiphy.available_antennas_rx))
1279                         goto nla_put_failure;
1280
1281                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1282                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1283                                 dev->wiphy.probe_resp_offload))
1284                         goto nla_put_failure;
1285
1286                 if ((dev->wiphy.available_antennas_tx ||
1287                      dev->wiphy.available_antennas_rx) &&
1288                     dev->ops->get_antenna) {
1289                         u32 tx_ant = 0, rx_ant = 0;
1290                         int res;
1291                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1292                         if (!res) {
1293                                 if (nla_put_u32(msg,
1294                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1295                                                 tx_ant) ||
1296                                     nla_put_u32(msg,
1297                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1298                                                 rx_ant))
1299                                         goto nla_put_failure;
1300                         }
1301                 }
1302
1303                 state->split_start++;
1304                 if (state->split)
1305                         break;
1306         case 2:
1307                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1308                                         dev->wiphy.interface_modes))
1309                                 goto nla_put_failure;
1310                 state->split_start++;
1311                 if (state->split)
1312                         break;
1313         case 3:
1314                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1315                 if (!nl_bands)
1316                         goto nla_put_failure;
1317
1318                 for (band = state->band_start;
1319                      band < IEEE80211_NUM_BANDS; band++) {
1320                         struct ieee80211_supported_band *sband;
1321
1322                         sband = dev->wiphy.bands[band];
1323
1324                         if (!sband)
1325                                 continue;
1326
1327                         nl_band = nla_nest_start(msg, band);
1328                         if (!nl_band)
1329                                 goto nla_put_failure;
1330
1331                         switch (state->chan_start) {
1332                         case 0:
1333                                 if (nl80211_send_band_rateinfo(msg, sband))
1334                                         goto nla_put_failure;
1335                                 state->chan_start++;
1336                                 if (state->split)
1337                                         break;
1338                         default:
1339                                 /* add frequencies */
1340                                 nl_freqs = nla_nest_start(
1341                                         msg, NL80211_BAND_ATTR_FREQS);
1342                                 if (!nl_freqs)
1343                                         goto nla_put_failure;
1344
1345                                 for (i = state->chan_start - 1;
1346                                      i < sband->n_channels;
1347                                      i++) {
1348                                         nl_freq = nla_nest_start(msg, i);
1349                                         if (!nl_freq)
1350                                                 goto nla_put_failure;
1351
1352                                         chan = &sband->channels[i];
1353
1354                                         if (nl80211_msg_put_channel(
1355                                                         msg, chan,
1356                                                         state->split))
1357                                                 goto nla_put_failure;
1358
1359                                         nla_nest_end(msg, nl_freq);
1360                                         if (state->split)
1361                                                 break;
1362                                 }
1363                                 if (i < sband->n_channels)
1364                                         state->chan_start = i + 2;
1365                                 else
1366                                         state->chan_start = 0;
1367                                 nla_nest_end(msg, nl_freqs);
1368                         }
1369
1370                         nla_nest_end(msg, nl_band);
1371
1372                         if (state->split) {
1373                                 /* start again here */
1374                                 if (state->chan_start)
1375                                         band--;
1376                                 break;
1377                         }
1378                 }
1379                 nla_nest_end(msg, nl_bands);
1380
1381                 if (band < IEEE80211_NUM_BANDS)
1382                         state->band_start = band + 1;
1383                 else
1384                         state->band_start = 0;
1385
1386                 /* if bands & channels are done, continue outside */
1387                 if (state->band_start == 0 && state->chan_start == 0)
1388                         state->split_start++;
1389                 if (state->split)
1390                         break;
1391         case 4:
1392                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1393                 if (!nl_cmds)
1394                         goto nla_put_failure;
1395
1396                 i = 0;
1397 #define CMD(op, n)                                                      \
1398                  do {                                                   \
1399                         if (dev->ops->op) {                             \
1400                                 i++;                                    \
1401                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1402                                         goto nla_put_failure;           \
1403                         }                                               \
1404                 } while (0)
1405
1406                 CMD(add_virtual_intf, NEW_INTERFACE);
1407                 CMD(change_virtual_intf, SET_INTERFACE);
1408                 CMD(add_key, NEW_KEY);
1409                 CMD(start_ap, START_AP);
1410                 CMD(add_station, NEW_STATION);
1411                 CMD(add_mpath, NEW_MPATH);
1412                 CMD(update_mesh_config, SET_MESH_CONFIG);
1413                 CMD(change_bss, SET_BSS);
1414                 CMD(auth, AUTHENTICATE);
1415                 CMD(assoc, ASSOCIATE);
1416                 CMD(deauth, DEAUTHENTICATE);
1417                 CMD(disassoc, DISASSOCIATE);
1418                 CMD(join_ibss, JOIN_IBSS);
1419                 CMD(join_mesh, JOIN_MESH);
1420                 CMD(set_pmksa, SET_PMKSA);
1421                 CMD(del_pmksa, DEL_PMKSA);
1422                 CMD(flush_pmksa, FLUSH_PMKSA);
1423                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1424                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1425                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1426                 CMD(mgmt_tx, FRAME);
1427                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1428                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1429                         i++;
1430                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1431                                 goto nla_put_failure;
1432                 }
1433                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1434                     dev->ops->join_mesh) {
1435                         i++;
1436                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1437                                 goto nla_put_failure;
1438                 }
1439                 CMD(set_wds_peer, SET_WDS_PEER);
1440                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1441                         CMD(tdls_mgmt, TDLS_MGMT);
1442                         CMD(tdls_oper, TDLS_OPER);
1443                 }
1444                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1445                         CMD(sched_scan_start, START_SCHED_SCAN);
1446                 CMD(probe_client, PROBE_CLIENT);
1447                 CMD(set_noack_map, SET_NOACK_MAP);
1448                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1449                         i++;
1450                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1451                                 goto nla_put_failure;
1452                 }
1453                 CMD(start_p2p_device, START_P2P_DEVICE);
1454                 CMD(set_mcast_rate, SET_MCAST_RATE);
1455                 if (state->split) {
1456                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1457                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1458                         if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1459                                 CMD(channel_switch, CHANNEL_SWITCH);
1460                 }
1461                 CMD(set_qos_map, SET_QOS_MAP);
1462
1463 #ifdef CONFIG_NL80211_TESTMODE
1464                 CMD(testmode_cmd, TESTMODE);
1465 #endif
1466
1467 #undef CMD
1468
1469                 if (dev->ops->connect || dev->ops->auth) {
1470                         i++;
1471                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1472                                 goto nla_put_failure;
1473                 }
1474
1475                 if (dev->ops->disconnect || dev->ops->deauth) {
1476                         i++;
1477                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1478                                 goto nla_put_failure;
1479                 }
1480
1481                 nla_nest_end(msg, nl_cmds);
1482                 state->split_start++;
1483                 if (state->split)
1484                         break;
1485         case 5:
1486                 if (dev->ops->remain_on_channel &&
1487                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1488                     nla_put_u32(msg,
1489                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1490                                 dev->wiphy.max_remain_on_channel_duration))
1491                         goto nla_put_failure;
1492
1493                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1494                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1495                         goto nla_put_failure;
1496
1497                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1498                         goto nla_put_failure;
1499                 state->split_start++;
1500                 if (state->split)
1501                         break;
1502         case 6:
1503 #ifdef CONFIG_PM
1504                 if (nl80211_send_wowlan(msg, dev, state->split))
1505                         goto nla_put_failure;
1506                 state->split_start++;
1507                 if (state->split)
1508                         break;
1509 #else
1510                 state->split_start++;
1511 #endif
1512         case 7:
1513                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1514                                         dev->wiphy.software_iftypes))
1515                         goto nla_put_failure;
1516
1517                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1518                                                    state->split))
1519                         goto nla_put_failure;
1520
1521                 state->split_start++;
1522                 if (state->split)
1523                         break;
1524         case 8:
1525                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1526                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1527                                 dev->wiphy.ap_sme_capa))
1528                         goto nla_put_failure;
1529
1530                 features = dev->wiphy.features;
1531                 /*
1532                  * We can only add the per-channel limit information if the
1533                  * dump is split, otherwise it makes it too big. Therefore
1534                  * only advertise it in that case.
1535                  */
1536                 if (state->split)
1537                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1538                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1539                         goto nla_put_failure;
1540
1541                 if (dev->wiphy.ht_capa_mod_mask &&
1542                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1543                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1544                             dev->wiphy.ht_capa_mod_mask))
1545                         goto nla_put_failure;
1546
1547                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1548                     dev->wiphy.max_acl_mac_addrs &&
1549                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1550                                 dev->wiphy.max_acl_mac_addrs))
1551                         goto nla_put_failure;
1552
1553                 /*
1554                  * Any information below this point is only available to
1555                  * applications that can deal with it being split. This
1556                  * helps ensure that newly added capabilities don't break
1557                  * older tools by overrunning their buffers.
1558                  *
1559                  * We still increment split_start so that in the split
1560                  * case we'll continue with more data in the next round,
1561                  * but break unconditionally so unsplit data stops here.
1562                  */
1563                 state->split_start++;
1564                 break;
1565         case 9:
1566                 if (dev->wiphy.extended_capabilities &&
1567                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1568                              dev->wiphy.extended_capabilities_len,
1569                              dev->wiphy.extended_capabilities) ||
1570                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1571                              dev->wiphy.extended_capabilities_len,
1572                              dev->wiphy.extended_capabilities_mask)))
1573                         goto nla_put_failure;
1574
1575                 if (dev->wiphy.vht_capa_mod_mask &&
1576                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1577                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1578                             dev->wiphy.vht_capa_mod_mask))
1579                         goto nla_put_failure;
1580
1581                 state->split_start++;
1582                 break;
1583         case 10:
1584                 if (nl80211_send_coalesce(msg, dev))
1585                         goto nla_put_failure;
1586
1587                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1588                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1589                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1590                         goto nla_put_failure;
1591                 state->split_start++;
1592                 break;
1593         case 11:
1594                 if (dev->wiphy.n_vendor_commands) {
1595                         const struct nl80211_vendor_cmd_info *info;
1596                         struct nlattr *nested;
1597
1598                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1599                         if (!nested)
1600                                 goto nla_put_failure;
1601
1602                         for (i = 0; i < dev->wiphy.n_vendor_commands; i++) {
1603                                 info = &dev->wiphy.vendor_commands[i].info;
1604                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1605                                         goto nla_put_failure;
1606                         }
1607                         nla_nest_end(msg, nested);
1608                 }
1609
1610                 if (dev->wiphy.n_vendor_events) {
1611                         const struct nl80211_vendor_cmd_info *info;
1612                         struct nlattr *nested;
1613
1614                         nested = nla_nest_start(msg,
1615                                                 NL80211_ATTR_VENDOR_EVENTS);
1616                         if (!nested)
1617                                 goto nla_put_failure;
1618
1619                         for (i = 0; i < dev->wiphy.n_vendor_events; i++) {
1620                                 info = &dev->wiphy.vendor_events[i];
1621                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1622                                         goto nla_put_failure;
1623                         }
1624                         nla_nest_end(msg, nested);
1625                 }
1626
1627                 /* done */
1628                 state->split_start = 0;
1629                 break;
1630         }
1631         return genlmsg_end(msg, hdr);
1632
1633  nla_put_failure:
1634         genlmsg_cancel(msg, hdr);
1635         return -EMSGSIZE;
1636 }
1637
1638 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1639                                     struct netlink_callback *cb,
1640                                     struct nl80211_dump_wiphy_state *state)
1641 {
1642         struct nlattr **tb = nl80211_fam.attrbuf;
1643         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1644                               tb, nl80211_fam.maxattr, nl80211_policy);
1645         /* ignore parse errors for backward compatibility */
1646         if (ret)
1647                 return 0;
1648
1649         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1650         if (tb[NL80211_ATTR_WIPHY])
1651                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1652         if (tb[NL80211_ATTR_WDEV])
1653                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1654         if (tb[NL80211_ATTR_IFINDEX]) {
1655                 struct net_device *netdev;
1656                 struct cfg80211_registered_device *rdev;
1657                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1658
1659                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1660                 if (!netdev)
1661                         return -ENODEV;
1662                 if (netdev->ieee80211_ptr) {
1663                         rdev = wiphy_to_dev(
1664                                 netdev->ieee80211_ptr->wiphy);
1665                         state->filter_wiphy = rdev->wiphy_idx;
1666                 }
1667                 dev_put(netdev);
1668         }
1669
1670         return 0;
1671 }
1672
1673 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1674 {
1675         int idx = 0, ret;
1676         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1677         struct cfg80211_registered_device *dev;
1678
1679         rtnl_lock();
1680         if (!state) {
1681                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1682                 if (!state) {
1683                         rtnl_unlock();
1684                         return -ENOMEM;
1685                 }
1686                 state->filter_wiphy = -1;
1687                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1688                 if (ret) {
1689                         kfree(state);
1690                         rtnl_unlock();
1691                         return ret;
1692                 }
1693                 cb->args[0] = (long)state;
1694         }
1695
1696         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1697                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1698                         continue;
1699                 if (++idx <= state->start)
1700                         continue;
1701                 if (state->filter_wiphy != -1 &&
1702                     state->filter_wiphy != dev->wiphy_idx)
1703                         continue;
1704                 /* attempt to fit multiple wiphy data chunks into the skb */
1705                 do {
1706                         ret = nl80211_send_wiphy(dev, skb,
1707                                                  NETLINK_CB(cb->skb).portid,
1708                                                  cb->nlh->nlmsg_seq,
1709                                                  NLM_F_MULTI, state);
1710                         if (ret < 0) {
1711                                 /*
1712                                  * If sending the wiphy data didn't fit (ENOBUFS
1713                                  * or EMSGSIZE returned), this SKB is still
1714                                  * empty (so it's not too big because another
1715                                  * wiphy dataset is already in the skb) and
1716                                  * we've not tried to adjust the dump allocation
1717                                  * yet ... then adjust the alloc size to be
1718                                  * bigger, and return 1 but with the empty skb.
1719                                  * This results in an empty message being RX'ed
1720                                  * in userspace, but that is ignored.
1721                                  *
1722                                  * We can then retry with the larger buffer.
1723                                  */
1724                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1725                                     !skb->len &&
1726                                     cb->min_dump_alloc < 4096) {
1727                                         cb->min_dump_alloc = 4096;
1728                                         rtnl_unlock();
1729                                         return 1;
1730                                 }
1731                                 idx--;
1732                                 break;
1733                         }
1734                 } while (state->split_start > 0);
1735                 break;
1736         }
1737         rtnl_unlock();
1738
1739         state->start = idx;
1740
1741         return skb->len;
1742 }
1743
1744 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1745 {
1746         kfree((void *)cb->args[0]);
1747         return 0;
1748 }
1749
1750 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1751 {
1752         struct sk_buff *msg;
1753         struct cfg80211_registered_device *dev = info->user_ptr[0];
1754         struct nl80211_dump_wiphy_state state = {};
1755
1756         msg = nlmsg_new(4096, GFP_KERNEL);
1757         if (!msg)
1758                 return -ENOMEM;
1759
1760         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1761                                &state) < 0) {
1762                 nlmsg_free(msg);
1763                 return -ENOBUFS;
1764         }
1765
1766         return genlmsg_reply(msg, info);
1767 }
1768
1769 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1770         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1771         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1772         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1773         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1774         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1775 };
1776
1777 static int parse_txq_params(struct nlattr *tb[],
1778                             struct ieee80211_txq_params *txq_params)
1779 {
1780         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1781             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1782             !tb[NL80211_TXQ_ATTR_AIFS])
1783                 return -EINVAL;
1784
1785         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1786         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1787         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1788         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1789         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1790
1791         if (txq_params->ac >= NL80211_NUM_ACS)
1792                 return -EINVAL;
1793
1794         return 0;
1795 }
1796
1797 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1798 {
1799         /*
1800          * You can only set the channel explicitly for WDS interfaces,
1801          * all others have their channel managed via their respective
1802          * "establish a connection" command (connect, join, ...)
1803          *
1804          * For AP/GO and mesh mode, the channel can be set with the
1805          * channel userspace API, but is only stored and passed to the
1806          * low-level driver when the AP starts or the mesh is joined.
1807          * This is for backward compatibility, userspace can also give
1808          * the channel in the start-ap or join-mesh commands instead.
1809          *
1810          * Monitors are special as they are normally slaved to
1811          * whatever else is going on, so they have their own special
1812          * operation to set the monitor channel if possible.
1813          */
1814         return !wdev ||
1815                 wdev->iftype == NL80211_IFTYPE_AP ||
1816                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1817                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1818                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1819 }
1820
1821 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1822                                  struct genl_info *info,
1823                                  struct cfg80211_chan_def *chandef)
1824 {
1825         u32 control_freq;
1826
1827         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1828                 return -EINVAL;
1829
1830         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1831
1832         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1833         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1834         chandef->center_freq1 = control_freq;
1835         chandef->center_freq2 = 0;
1836
1837         /* Primary channel not allowed */
1838         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1839                 return -EINVAL;
1840
1841         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1842                 enum nl80211_channel_type chantype;
1843
1844                 chantype = nla_get_u32(
1845                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1846
1847                 switch (chantype) {
1848                 case NL80211_CHAN_NO_HT:
1849                 case NL80211_CHAN_HT20:
1850                 case NL80211_CHAN_HT40PLUS:
1851                 case NL80211_CHAN_HT40MINUS:
1852                         cfg80211_chandef_create(chandef, chandef->chan,
1853                                                 chantype);
1854                         break;
1855                 default:
1856                         return -EINVAL;
1857                 }
1858         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1859                 chandef->width =
1860                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1861                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1862                         chandef->center_freq1 =
1863                                 nla_get_u32(
1864                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1865                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1866                         chandef->center_freq2 =
1867                                 nla_get_u32(
1868                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1869         }
1870
1871         if (!cfg80211_chandef_valid(chandef))
1872                 return -EINVAL;
1873
1874         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1875                                      IEEE80211_CHAN_DISABLED))
1876                 return -EINVAL;
1877
1878         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1879              chandef->width == NL80211_CHAN_WIDTH_10) &&
1880             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1881                 return -EINVAL;
1882
1883         return 0;
1884 }
1885
1886 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1887                                  struct wireless_dev *wdev,
1888                                  struct genl_info *info)
1889 {
1890         struct cfg80211_chan_def chandef;
1891         int result;
1892         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1893
1894         if (wdev)
1895                 iftype = wdev->iftype;
1896
1897         if (!nl80211_can_set_dev_channel(wdev))
1898                 return -EOPNOTSUPP;
1899
1900         result = nl80211_parse_chandef(rdev, info, &chandef);
1901         if (result)
1902                 return result;
1903
1904         switch (iftype) {
1905         case NL80211_IFTYPE_AP:
1906         case NL80211_IFTYPE_P2P_GO:
1907                 if (wdev->beacon_interval) {
1908                         result = -EBUSY;
1909                         break;
1910                 }
1911                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1912                         result = -EINVAL;
1913                         break;
1914                 }
1915                 wdev->preset_chandef = chandef;
1916                 result = 0;
1917                 break;
1918         case NL80211_IFTYPE_MESH_POINT:
1919                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1920                 break;
1921         case NL80211_IFTYPE_MONITOR:
1922                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1923                 break;
1924         default:
1925                 result = -EINVAL;
1926         }
1927
1928         return result;
1929 }
1930
1931 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1932 {
1933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1934         struct net_device *netdev = info->user_ptr[1];
1935
1936         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1937 }
1938
1939 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1940 {
1941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1942         struct net_device *dev = info->user_ptr[1];
1943         struct wireless_dev *wdev = dev->ieee80211_ptr;
1944         const u8 *bssid;
1945
1946         if (!info->attrs[NL80211_ATTR_MAC])
1947                 return -EINVAL;
1948
1949         if (netif_running(dev))
1950                 return -EBUSY;
1951
1952         if (!rdev->ops->set_wds_peer)
1953                 return -EOPNOTSUPP;
1954
1955         if (wdev->iftype != NL80211_IFTYPE_WDS)
1956                 return -EOPNOTSUPP;
1957
1958         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1959         return rdev_set_wds_peer(rdev, dev, bssid);
1960 }
1961
1962
1963 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1964 {
1965         struct cfg80211_registered_device *rdev;
1966         struct net_device *netdev = NULL;
1967         struct wireless_dev *wdev;
1968         int result = 0, rem_txq_params = 0;
1969         struct nlattr *nl_txq_params;
1970         u32 changed;
1971         u8 retry_short = 0, retry_long = 0;
1972         u32 frag_threshold = 0, rts_threshold = 0;
1973         u8 coverage_class = 0;
1974
1975         ASSERT_RTNL();
1976
1977         /*
1978          * Try to find the wiphy and netdev. Normally this
1979          * function shouldn't need the netdev, but this is
1980          * done for backward compatibility -- previously
1981          * setting the channel was done per wiphy, but now
1982          * it is per netdev. Previous userland like hostapd
1983          * also passed a netdev to set_wiphy, so that it is
1984          * possible to let that go to the right netdev!
1985          */
1986
1987         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1988                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1989
1990                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1991                 if (netdev && netdev->ieee80211_ptr)
1992                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1993                 else
1994                         netdev = NULL;
1995         }
1996
1997         if (!netdev) {
1998                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1999                                                   info->attrs);
2000                 if (IS_ERR(rdev))
2001                         return PTR_ERR(rdev);
2002                 wdev = NULL;
2003                 netdev = NULL;
2004                 result = 0;
2005         } else
2006                 wdev = netdev->ieee80211_ptr;
2007
2008         /*
2009          * end workaround code, by now the rdev is available
2010          * and locked, and wdev may or may not be NULL.
2011          */
2012
2013         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2014                 result = cfg80211_dev_rename(
2015                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2016
2017         if (result)
2018                 goto bad_res;
2019
2020         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2021                 struct ieee80211_txq_params txq_params;
2022                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2023
2024                 if (!rdev->ops->set_txq_params) {
2025                         result = -EOPNOTSUPP;
2026                         goto bad_res;
2027                 }
2028
2029                 if (!netdev) {
2030                         result = -EINVAL;
2031                         goto bad_res;
2032                 }
2033
2034                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2035                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
2036                         result = -EINVAL;
2037                         goto bad_res;
2038                 }
2039
2040                 if (!netif_running(netdev)) {
2041                         result = -ENETDOWN;
2042                         goto bad_res;
2043                 }
2044
2045                 nla_for_each_nested(nl_txq_params,
2046                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2047                                     rem_txq_params) {
2048                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2049                                   nla_data(nl_txq_params),
2050                                   nla_len(nl_txq_params),
2051                                   txq_params_policy);
2052                         result = parse_txq_params(tb, &txq_params);
2053                         if (result)
2054                                 goto bad_res;
2055
2056                         result = rdev_set_txq_params(rdev, netdev,
2057                                                      &txq_params);
2058                         if (result)
2059                                 goto bad_res;
2060                 }
2061         }
2062
2063         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2064                 result = __nl80211_set_channel(rdev,
2065                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2066                                 info);
2067                 if (result)
2068                         goto bad_res;
2069         }
2070
2071         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2072                 struct wireless_dev *txp_wdev = wdev;
2073                 enum nl80211_tx_power_setting type;
2074                 int idx, mbm = 0;
2075
2076                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2077                         txp_wdev = NULL;
2078
2079                 if (!rdev->ops->set_tx_power) {
2080                         result = -EOPNOTSUPP;
2081                         goto bad_res;
2082                 }
2083
2084                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2085                 type = nla_get_u32(info->attrs[idx]);
2086
2087                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2088                     (type != NL80211_TX_POWER_AUTOMATIC)) {
2089                         result = -EINVAL;
2090                         goto bad_res;
2091                 }
2092
2093                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2094                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2095                         mbm = nla_get_u32(info->attrs[idx]);
2096                 }
2097
2098                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2099                 if (result)
2100                         goto bad_res;
2101         }
2102
2103         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2104             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2105                 u32 tx_ant, rx_ant;
2106                 if ((!rdev->wiphy.available_antennas_tx &&
2107                      !rdev->wiphy.available_antennas_rx) ||
2108                     !rdev->ops->set_antenna) {
2109                         result = -EOPNOTSUPP;
2110                         goto bad_res;
2111                 }
2112
2113                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2114                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2115
2116                 /* reject antenna configurations which don't match the
2117                  * available antenna masks, except for the "all" mask */
2118                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2119                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2120                         result = -EINVAL;
2121                         goto bad_res;
2122                 }
2123
2124                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2125                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2126
2127                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2128                 if (result)
2129                         goto bad_res;
2130         }
2131
2132         changed = 0;
2133
2134         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2135                 retry_short = nla_get_u8(
2136                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2137                 if (retry_short == 0) {
2138                         result = -EINVAL;
2139                         goto bad_res;
2140                 }
2141                 changed |= WIPHY_PARAM_RETRY_SHORT;
2142         }
2143
2144         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2145                 retry_long = nla_get_u8(
2146                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2147                 if (retry_long == 0) {
2148                         result = -EINVAL;
2149                         goto bad_res;
2150                 }
2151                 changed |= WIPHY_PARAM_RETRY_LONG;
2152         }
2153
2154         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2155                 frag_threshold = nla_get_u32(
2156                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2157                 if (frag_threshold < 256) {
2158                         result = -EINVAL;
2159                         goto bad_res;
2160                 }
2161                 if (frag_threshold != (u32) -1) {
2162                         /*
2163                          * Fragments (apart from the last one) are required to
2164                          * have even length. Make the fragmentation code
2165                          * simpler by stripping LSB should someone try to use
2166                          * odd threshold value.
2167                          */
2168                         frag_threshold &= ~0x1;
2169                 }
2170                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2171         }
2172
2173         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2174                 rts_threshold = nla_get_u32(
2175                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2176                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2177         }
2178
2179         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2180                 coverage_class = nla_get_u8(
2181                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2182                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2183         }
2184
2185         if (changed) {
2186                 u8 old_retry_short, old_retry_long;
2187                 u32 old_frag_threshold, old_rts_threshold;
2188                 u8 old_coverage_class;
2189
2190                 if (!rdev->ops->set_wiphy_params) {
2191                         result = -EOPNOTSUPP;
2192                         goto bad_res;
2193                 }
2194
2195                 old_retry_short = rdev->wiphy.retry_short;
2196                 old_retry_long = rdev->wiphy.retry_long;
2197                 old_frag_threshold = rdev->wiphy.frag_threshold;
2198                 old_rts_threshold = rdev->wiphy.rts_threshold;
2199                 old_coverage_class = rdev->wiphy.coverage_class;
2200
2201                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2202                         rdev->wiphy.retry_short = retry_short;
2203                 if (changed & WIPHY_PARAM_RETRY_LONG)
2204                         rdev->wiphy.retry_long = retry_long;
2205                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2206                         rdev->wiphy.frag_threshold = frag_threshold;
2207                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2208                         rdev->wiphy.rts_threshold = rts_threshold;
2209                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2210                         rdev->wiphy.coverage_class = coverage_class;
2211
2212                 result = rdev_set_wiphy_params(rdev, changed);
2213                 if (result) {
2214                         rdev->wiphy.retry_short = old_retry_short;
2215                         rdev->wiphy.retry_long = old_retry_long;
2216                         rdev->wiphy.frag_threshold = old_frag_threshold;
2217                         rdev->wiphy.rts_threshold = old_rts_threshold;
2218                         rdev->wiphy.coverage_class = old_coverage_class;
2219                 }
2220         }
2221
2222  bad_res:
2223         if (netdev)
2224                 dev_put(netdev);
2225         return result;
2226 }
2227
2228 static inline u64 wdev_id(struct wireless_dev *wdev)
2229 {
2230         return (u64)wdev->identifier |
2231                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2232 }
2233
2234 static int nl80211_send_chandef(struct sk_buff *msg,
2235                                 const struct cfg80211_chan_def *chandef)
2236 {
2237         WARN_ON(!cfg80211_chandef_valid(chandef));
2238
2239         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2240                         chandef->chan->center_freq))
2241                 return -ENOBUFS;
2242         switch (chandef->width) {
2243         case NL80211_CHAN_WIDTH_20_NOHT:
2244         case NL80211_CHAN_WIDTH_20:
2245         case NL80211_CHAN_WIDTH_40:
2246                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2247                                 cfg80211_get_chandef_type(chandef)))
2248                         return -ENOBUFS;
2249                 break;
2250         default:
2251                 break;
2252         }
2253         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2254                 return -ENOBUFS;
2255         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2256                 return -ENOBUFS;
2257         if (chandef->center_freq2 &&
2258             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2259                 return -ENOBUFS;
2260         return 0;
2261 }
2262
2263 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2264                               struct cfg80211_registered_device *rdev,
2265                               struct wireless_dev *wdev)
2266 {
2267         struct net_device *dev = wdev->netdev;
2268         void *hdr;
2269
2270         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2271         if (!hdr)
2272                 return -1;
2273
2274         if (dev &&
2275             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2276              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2277                 goto nla_put_failure;
2278
2279         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2280             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2281             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2282             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2283             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2284                         rdev->devlist_generation ^
2285                         (cfg80211_rdev_list_generation << 2)))
2286                 goto nla_put_failure;
2287
2288         if (rdev->ops->get_channel) {
2289                 int ret;
2290                 struct cfg80211_chan_def chandef;
2291
2292                 ret = rdev_get_channel(rdev, wdev, &chandef);
2293                 if (ret == 0) {
2294                         if (nl80211_send_chandef(msg, &chandef))
2295                                 goto nla_put_failure;
2296                 }
2297         }
2298
2299         if (wdev->ssid_len) {
2300                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2301                         goto nla_put_failure;
2302         }
2303
2304         return genlmsg_end(msg, hdr);
2305
2306  nla_put_failure:
2307         genlmsg_cancel(msg, hdr);
2308         return -EMSGSIZE;
2309 }
2310
2311 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2312 {
2313         int wp_idx = 0;
2314         int if_idx = 0;
2315         int wp_start = cb->args[0];
2316         int if_start = cb->args[1];
2317         struct cfg80211_registered_device *rdev;
2318         struct wireless_dev *wdev;
2319
2320         rtnl_lock();
2321         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2322                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2323                         continue;
2324                 if (wp_idx < wp_start) {
2325                         wp_idx++;
2326                         continue;
2327                 }
2328                 if_idx = 0;
2329
2330                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2331                         if (if_idx < if_start) {
2332                                 if_idx++;
2333                                 continue;
2334                         }
2335                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2336                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2337                                                rdev, wdev) < 0) {
2338                                 goto out;
2339                         }
2340                         if_idx++;
2341                 }
2342
2343                 wp_idx++;
2344         }
2345  out:
2346         rtnl_unlock();
2347
2348         cb->args[0] = wp_idx;
2349         cb->args[1] = if_idx;
2350
2351         return skb->len;
2352 }
2353
2354 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2355 {
2356         struct sk_buff *msg;
2357         struct cfg80211_registered_device *dev = info->user_ptr[0];
2358         struct wireless_dev *wdev = info->user_ptr[1];
2359
2360         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2361         if (!msg)
2362                 return -ENOMEM;
2363
2364         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2365                                dev, wdev) < 0) {
2366                 nlmsg_free(msg);
2367                 return -ENOBUFS;
2368         }
2369
2370         return genlmsg_reply(msg, info);
2371 }
2372
2373 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2374         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2375         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2376         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2377         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2378         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2379         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2380 };
2381
2382 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2383 {
2384         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2385         int flag;
2386
2387         *mntrflags = 0;
2388
2389         if (!nla)
2390                 return -EINVAL;
2391
2392         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2393                              nla, mntr_flags_policy))
2394                 return -EINVAL;
2395
2396         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2397                 if (flags[flag])
2398                         *mntrflags |= (1<<flag);
2399
2400         return 0;
2401 }
2402
2403 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2404                                struct net_device *netdev, u8 use_4addr,
2405                                enum nl80211_iftype iftype)
2406 {
2407         if (!use_4addr) {
2408                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2409                         return -EBUSY;
2410                 return 0;
2411         }
2412
2413         switch (iftype) {
2414         case NL80211_IFTYPE_AP_VLAN:
2415                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2416                         return 0;
2417                 break;
2418         case NL80211_IFTYPE_STATION:
2419                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2420                         return 0;
2421                 break;
2422         default:
2423                 break;
2424         }
2425
2426         return -EOPNOTSUPP;
2427 }
2428
2429 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2430 {
2431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2432         struct vif_params params;
2433         int err;
2434         enum nl80211_iftype otype, ntype;
2435         struct net_device *dev = info->user_ptr[1];
2436         u32 _flags, *flags = NULL;
2437         bool change = false;
2438
2439         memset(&params, 0, sizeof(params));
2440
2441         otype = ntype = dev->ieee80211_ptr->iftype;
2442
2443         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2444                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2445                 if (otype != ntype)
2446                         change = true;
2447                 if (ntype > NL80211_IFTYPE_MAX)
2448                         return -EINVAL;
2449         }
2450
2451         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2452                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2453
2454                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2455                         return -EINVAL;
2456                 if (netif_running(dev))
2457                         return -EBUSY;
2458
2459                 wdev_lock(wdev);
2460                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2461                              IEEE80211_MAX_MESH_ID_LEN);
2462                 wdev->mesh_id_up_len =
2463                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2464                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2465                        wdev->mesh_id_up_len);
2466                 wdev_unlock(wdev);
2467         }
2468
2469         if (info->attrs[NL80211_ATTR_4ADDR]) {
2470                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2471                 change = true;
2472                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2473                 if (err)
2474                         return err;
2475         } else {
2476                 params.use_4addr = -1;
2477         }
2478
2479         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2480                 if (ntype != NL80211_IFTYPE_MONITOR)
2481                         return -EINVAL;
2482                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2483                                           &_flags);
2484                 if (err)
2485                         return err;
2486
2487                 flags = &_flags;
2488                 change = true;
2489         }
2490
2491         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2492             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2493                 return -EOPNOTSUPP;
2494
2495         if (change)
2496                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2497         else
2498                 err = 0;
2499
2500         if (!err && params.use_4addr != -1)
2501                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2502
2503         return err;
2504 }
2505
2506 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2507 {
2508         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2509         struct vif_params params;
2510         struct wireless_dev *wdev;
2511         struct sk_buff *msg;
2512         int err;
2513         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2514         u32 flags;
2515
2516         memset(&params, 0, sizeof(params));
2517
2518         if (!info->attrs[NL80211_ATTR_IFNAME])
2519                 return -EINVAL;
2520
2521         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2522                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2523                 if (type > NL80211_IFTYPE_MAX)
2524                         return -EINVAL;
2525         }
2526
2527         if (!rdev->ops->add_virtual_intf ||
2528             !(rdev->wiphy.interface_modes & (1 << type)))
2529                 return -EOPNOTSUPP;
2530
2531         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2532                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2533                            ETH_ALEN);
2534                 if (!is_valid_ether_addr(params.macaddr))
2535                         return -EADDRNOTAVAIL;
2536         }
2537
2538         if (info->attrs[NL80211_ATTR_4ADDR]) {
2539                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2540                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2541                 if (err)
2542                         return err;
2543         }
2544
2545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2546         if (!msg)
2547                 return -ENOMEM;
2548
2549         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2550                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2551                                   &flags);
2552
2553         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2554             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2555                 return -EOPNOTSUPP;
2556
2557         wdev = rdev_add_virtual_intf(rdev,
2558                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2559                                 type, err ? NULL : &flags, &params);
2560         if (IS_ERR(wdev)) {
2561                 nlmsg_free(msg);
2562                 return PTR_ERR(wdev);
2563         }
2564
2565         switch (type) {
2566         case NL80211_IFTYPE_MESH_POINT:
2567                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2568                         break;
2569                 wdev_lock(wdev);
2570                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2571                              IEEE80211_MAX_MESH_ID_LEN);
2572                 wdev->mesh_id_up_len =
2573                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2574                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2575                        wdev->mesh_id_up_len);
2576                 wdev_unlock(wdev);
2577                 break;
2578         case NL80211_IFTYPE_P2P_DEVICE:
2579                 /*
2580                  * P2P Device doesn't have a netdev, so doesn't go
2581                  * through the netdev notifier and must be added here
2582                  */
2583                 mutex_init(&wdev->mtx);
2584                 INIT_LIST_HEAD(&wdev->event_list);
2585                 spin_lock_init(&wdev->event_lock);
2586                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2587                 spin_lock_init(&wdev->mgmt_registrations_lock);
2588
2589                 wdev->identifier = ++rdev->wdev_id;
2590                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2591                 rdev->devlist_generation++;
2592                 break;
2593         default:
2594                 break;
2595         }
2596
2597         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2598                                rdev, wdev) < 0) {
2599                 nlmsg_free(msg);
2600                 return -ENOBUFS;
2601         }
2602
2603         return genlmsg_reply(msg, info);
2604 }
2605
2606 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2607 {
2608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2609         struct wireless_dev *wdev = info->user_ptr[1];
2610
2611         if (!rdev->ops->del_virtual_intf)
2612                 return -EOPNOTSUPP;
2613
2614         /*
2615          * If we remove a wireless device without a netdev then clear
2616          * user_ptr[1] so that nl80211_post_doit won't dereference it
2617          * to check if it needs to do dev_put(). Otherwise it crashes
2618          * since the wdev has been freed, unlike with a netdev where
2619          * we need the dev_put() for the netdev to really be freed.
2620          */
2621         if (!wdev->netdev)
2622                 info->user_ptr[1] = NULL;
2623
2624         return rdev_del_virtual_intf(rdev, wdev);
2625 }
2626
2627 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2628 {
2629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2630         struct net_device *dev = info->user_ptr[1];
2631         u16 noack_map;
2632
2633         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2634                 return -EINVAL;
2635
2636         if (!rdev->ops->set_noack_map)
2637                 return -EOPNOTSUPP;
2638
2639         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2640
2641         return rdev_set_noack_map(rdev, dev, noack_map);
2642 }
2643
2644 struct get_key_cookie {
2645         struct sk_buff *msg;
2646         int error;
2647         int idx;
2648 };
2649
2650 static void get_key_callback(void *c, struct key_params *params)
2651 {
2652         struct nlattr *key;
2653         struct get_key_cookie *cookie = c;
2654
2655         if ((params->key &&
2656              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2657                      params->key_len, params->key)) ||
2658             (params->seq &&
2659              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2660                      params->seq_len, params->seq)) ||
2661             (params->cipher &&
2662              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2663                          params->cipher)))
2664                 goto nla_put_failure;
2665
2666         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2667         if (!key)
2668                 goto nla_put_failure;
2669
2670         if ((params->key &&
2671              nla_put(cookie->msg, NL80211_KEY_DATA,
2672                      params->key_len, params->key)) ||
2673             (params->seq &&
2674              nla_put(cookie->msg, NL80211_KEY_SEQ,
2675                      params->seq_len, params->seq)) ||
2676             (params->cipher &&
2677              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2678                          params->cipher)))
2679                 goto nla_put_failure;
2680
2681         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2682                 goto nla_put_failure;
2683
2684         nla_nest_end(cookie->msg, key);
2685
2686         return;
2687  nla_put_failure:
2688         cookie->error = 1;
2689 }
2690
2691 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2692 {
2693         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2694         int err;
2695         struct net_device *dev = info->user_ptr[1];
2696         u8 key_idx = 0;
2697         const u8 *mac_addr = NULL;
2698         bool pairwise;
2699         struct get_key_cookie cookie = {
2700                 .error = 0,
2701         };
2702         void *hdr;
2703         struct sk_buff *msg;
2704
2705         if (info->attrs[NL80211_ATTR_KEY_IDX])
2706                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2707
2708         if (key_idx > 5)
2709                 return -EINVAL;
2710
2711         if (info->attrs[NL80211_ATTR_MAC])
2712                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2713
2714         pairwise = !!mac_addr;
2715         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2716                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2717                 if (kt >= NUM_NL80211_KEYTYPES)
2718                         return -EINVAL;
2719                 if (kt != NL80211_KEYTYPE_GROUP &&
2720                     kt != NL80211_KEYTYPE_PAIRWISE)
2721                         return -EINVAL;
2722                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2723         }
2724
2725         if (!rdev->ops->get_key)
2726                 return -EOPNOTSUPP;
2727
2728         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2729         if (!msg)
2730                 return -ENOMEM;
2731
2732         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2733                              NL80211_CMD_NEW_KEY);
2734         if (!hdr)
2735                 goto nla_put_failure;
2736
2737         cookie.msg = msg;
2738         cookie.idx = key_idx;
2739
2740         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2741             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2742                 goto nla_put_failure;
2743         if (mac_addr &&
2744             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2745                 goto nla_put_failure;
2746
2747         if (pairwise && mac_addr &&
2748             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2749                 return -ENOENT;
2750
2751         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2752                            get_key_callback);
2753
2754         if (err)
2755                 goto free_msg;
2756
2757         if (cookie.error)
2758                 goto nla_put_failure;
2759
2760         genlmsg_end(msg, hdr);
2761         return genlmsg_reply(msg, info);
2762
2763  nla_put_failure:
2764         err = -ENOBUFS;
2765  free_msg:
2766         nlmsg_free(msg);
2767         return err;
2768 }
2769
2770 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2771 {
2772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2773         struct key_parse key;
2774         int err;
2775         struct net_device *dev = info->user_ptr[1];
2776
2777         err = nl80211_parse_key(info, &key);
2778         if (err)
2779                 return err;
2780
2781         if (key.idx < 0)
2782                 return -EINVAL;
2783
2784         /* only support setting default key */
2785         if (!key.def && !key.defmgmt)
2786                 return -EINVAL;
2787
2788         wdev_lock(dev->ieee80211_ptr);
2789
2790         if (key.def) {
2791                 if (!rdev->ops->set_default_key) {
2792                         err = -EOPNOTSUPP;
2793                         goto out;
2794                 }
2795
2796                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2797                 if (err)
2798                         goto out;
2799
2800                 err = rdev_set_default_key(rdev, dev, key.idx,
2801                                                  key.def_uni, key.def_multi);
2802
2803                 if (err)
2804                         goto out;
2805
2806 #ifdef CONFIG_CFG80211_WEXT
2807                 dev->ieee80211_ptr->wext.default_key = key.idx;
2808 #endif
2809         } else {
2810                 if (key.def_uni || !key.def_multi) {
2811                         err = -EINVAL;
2812                         goto out;
2813                 }
2814
2815                 if (!rdev->ops->set_default_mgmt_key) {
2816                         err = -EOPNOTSUPP;
2817                         goto out;
2818                 }
2819
2820                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2821                 if (err)
2822                         goto out;
2823
2824                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2825                 if (err)
2826                         goto out;
2827
2828 #ifdef CONFIG_CFG80211_WEXT
2829                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2830 #endif
2831         }
2832
2833  out:
2834         wdev_unlock(dev->ieee80211_ptr);
2835
2836         return err;
2837 }
2838
2839 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2840 {
2841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2842         int err;
2843         struct net_device *dev = info->user_ptr[1];
2844         struct key_parse key;
2845         const u8 *mac_addr = NULL;
2846
2847         err = nl80211_parse_key(info, &key);
2848         if (err)
2849                 return err;
2850
2851         if (!key.p.key)
2852                 return -EINVAL;
2853
2854         if (info->attrs[NL80211_ATTR_MAC])
2855                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2856
2857         if (key.type == -1) {
2858                 if (mac_addr)
2859                         key.type = NL80211_KEYTYPE_PAIRWISE;
2860                 else
2861                         key.type = NL80211_KEYTYPE_GROUP;
2862         }
2863
2864         /* for now */
2865         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2866             key.type != NL80211_KEYTYPE_GROUP)
2867                 return -EINVAL;
2868
2869         if (!rdev->ops->add_key)
2870                 return -EOPNOTSUPP;
2871
2872         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2873                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2874                                            mac_addr))
2875                 return -EINVAL;
2876
2877         wdev_lock(dev->ieee80211_ptr);
2878         err = nl80211_key_allowed(dev->ieee80211_ptr);
2879         if (!err)
2880                 err = rdev_add_key(rdev, dev, key.idx,
2881                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2882                                     mac_addr, &key.p);
2883         wdev_unlock(dev->ieee80211_ptr);
2884
2885         return err;
2886 }
2887
2888 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2889 {
2890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2891         int err;
2892         struct net_device *dev = info->user_ptr[1];
2893         u8 *mac_addr = NULL;
2894         struct key_parse key;
2895
2896         err = nl80211_parse_key(info, &key);
2897         if (err)
2898                 return err;
2899
2900         if (info->attrs[NL80211_ATTR_MAC])
2901                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2902
2903         if (key.type == -1) {
2904                 if (mac_addr)
2905                         key.type = NL80211_KEYTYPE_PAIRWISE;
2906                 else
2907                         key.type = NL80211_KEYTYPE_GROUP;
2908         }
2909
2910         /* for now */
2911         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2912             key.type != NL80211_KEYTYPE_GROUP)
2913                 return -EINVAL;
2914
2915         if (!rdev->ops->del_key)
2916                 return -EOPNOTSUPP;
2917
2918         wdev_lock(dev->ieee80211_ptr);
2919         err = nl80211_key_allowed(dev->ieee80211_ptr);
2920
2921         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2922             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2923                 err = -ENOENT;
2924
2925         if (!err)
2926                 err = rdev_del_key(rdev, dev, key.idx,
2927                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2928                                    mac_addr);
2929
2930 #ifdef CONFIG_CFG80211_WEXT
2931         if (!err) {
2932                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2933                         dev->ieee80211_ptr->wext.default_key = -1;
2934                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2935                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2936         }
2937 #endif
2938         wdev_unlock(dev->ieee80211_ptr);
2939
2940         return err;
2941 }
2942
2943 /* This function returns an error or the number of nested attributes */
2944 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2945 {
2946         struct nlattr *attr;
2947         int n_entries = 0, tmp;
2948
2949         nla_for_each_nested(attr, nl_attr, tmp) {
2950                 if (nla_len(attr) != ETH_ALEN)
2951                         return -EINVAL;
2952
2953                 n_entries++;
2954         }
2955
2956         return n_entries;
2957 }
2958
2959 /*
2960  * This function parses ACL information and allocates memory for ACL data.
2961  * On successful return, the calling function is responsible to free the
2962  * ACL buffer returned by this function.
2963  */
2964 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2965                                                 struct genl_info *info)
2966 {
2967         enum nl80211_acl_policy acl_policy;
2968         struct nlattr *attr;
2969         struct cfg80211_acl_data *acl;
2970         int i = 0, n_entries, tmp;
2971
2972         if (!wiphy->max_acl_mac_addrs)
2973                 return ERR_PTR(-EOPNOTSUPP);
2974
2975         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2976                 return ERR_PTR(-EINVAL);
2977
2978         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2979         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2980             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2981                 return ERR_PTR(-EINVAL);
2982
2983         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2984                 return ERR_PTR(-EINVAL);
2985
2986         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2987         if (n_entries < 0)
2988                 return ERR_PTR(n_entries);
2989
2990         if (n_entries > wiphy->max_acl_mac_addrs)
2991                 return ERR_PTR(-ENOTSUPP);
2992
2993         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2994                       GFP_KERNEL);
2995         if (!acl)
2996                 return ERR_PTR(-ENOMEM);
2997
2998         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2999                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3000                 i++;
3001         }
3002
3003         acl->n_acl_entries = n_entries;
3004         acl->acl_policy = acl_policy;
3005
3006         return acl;
3007 }
3008
3009 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3010 {
3011         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3012         struct net_device *dev = info->user_ptr[1];
3013         struct cfg80211_acl_data *acl;
3014         int err;
3015
3016         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3017             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3018                 return -EOPNOTSUPP;
3019
3020         if (!dev->ieee80211_ptr->beacon_interval)
3021                 return -EINVAL;
3022
3023         acl = parse_acl_data(&rdev->wiphy, info);
3024         if (IS_ERR(acl))
3025                 return PTR_ERR(acl);
3026
3027         err = rdev_set_mac_acl(rdev, dev, acl);
3028
3029         kfree(acl);
3030
3031         return err;
3032 }
3033
3034 static int nl80211_parse_beacon(struct nlattr *attrs[],
3035                                 struct cfg80211_beacon_data *bcn)
3036 {
3037         bool haveinfo = false;
3038
3039         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3040             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3041             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3042             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3043                 return -EINVAL;
3044
3045         memset(bcn, 0, sizeof(*bcn));
3046
3047         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3048                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3049                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3050                 if (!bcn->head_len)
3051                         return -EINVAL;
3052                 haveinfo = true;
3053         }
3054
3055         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3056                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3057                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3058                 haveinfo = true;
3059         }
3060
3061         if (!haveinfo)
3062                 return -EINVAL;
3063
3064         if (attrs[NL80211_ATTR_IE]) {
3065                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3066                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3067         }
3068
3069         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3070                 bcn->proberesp_ies =
3071                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3072                 bcn->proberesp_ies_len =
3073                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3074         }
3075
3076         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3077                 bcn->assocresp_ies =
3078                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3079                 bcn->assocresp_ies_len =
3080                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3081         }
3082
3083         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3084                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3085                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3086         }
3087
3088         return 0;
3089 }
3090
3091 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3092                                    struct cfg80211_ap_settings *params)
3093 {
3094         struct wireless_dev *wdev;
3095         bool ret = false;
3096
3097         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3098                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3099                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3100                         continue;
3101
3102                 if (!wdev->preset_chandef.chan)
3103                         continue;
3104
3105                 params->chandef = wdev->preset_chandef;
3106                 ret = true;
3107                 break;
3108         }
3109
3110         return ret;
3111 }
3112
3113 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3114                                     enum nl80211_auth_type auth_type,
3115                                     enum nl80211_commands cmd)
3116 {
3117         if (auth_type > NL80211_AUTHTYPE_MAX)
3118                 return false;
3119
3120         switch (cmd) {
3121         case NL80211_CMD_AUTHENTICATE:
3122                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3123                     auth_type == NL80211_AUTHTYPE_SAE)
3124                         return false;
3125                 return true;
3126         case NL80211_CMD_CONNECT:
3127         case NL80211_CMD_START_AP:
3128                 /* SAE not supported yet */
3129                 if (auth_type == NL80211_AUTHTYPE_SAE)
3130                         return false;
3131                 return true;
3132         default:
3133                 return false;
3134         }
3135 }
3136
3137 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3138 {
3139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3140         struct net_device *dev = info->user_ptr[1];
3141         struct wireless_dev *wdev = dev->ieee80211_ptr;
3142         struct cfg80211_ap_settings params;
3143         int err;
3144         u8 radar_detect_width = 0;
3145
3146         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3147             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3148                 return -EOPNOTSUPP;
3149
3150         if (!rdev->ops->start_ap)
3151                 return -EOPNOTSUPP;
3152
3153         if (wdev->beacon_interval)
3154                 return -EALREADY;
3155
3156         memset(&params, 0, sizeof(params));
3157
3158         /* these are required for START_AP */
3159         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3160             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3161             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3162                 return -EINVAL;
3163
3164         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3165         if (err)
3166                 return err;
3167
3168         params.beacon_interval =
3169                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3170         params.dtim_period =
3171                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3172
3173         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3174         if (err)
3175                 return err;
3176
3177         /*
3178          * In theory, some of these attributes should be required here
3179          * but since they were not used when the command was originally
3180          * added, keep them optional for old user space programs to let
3181          * them continue to work with drivers that do not need the
3182          * additional information -- drivers must check!
3183          */
3184         if (info->attrs[NL80211_ATTR_SSID]) {
3185                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3186                 params.ssid_len =
3187                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3188                 if (params.ssid_len == 0 ||
3189                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3190                         return -EINVAL;
3191         }
3192
3193         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3194                 params.hidden_ssid = nla_get_u32(
3195                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3196                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3197                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3198                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3199                         return -EINVAL;
3200         }
3201
3202         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3203
3204         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3205                 params.auth_type = nla_get_u32(
3206                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3207                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3208                                              NL80211_CMD_START_AP))
3209                         return -EINVAL;
3210         } else
3211                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3212
3213         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3214                                       NL80211_MAX_NR_CIPHER_SUITES);
3215         if (err)
3216                 return err;
3217
3218         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3219                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3220                         return -EOPNOTSUPP;
3221                 params.inactivity_timeout = nla_get_u16(
3222                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3223         }
3224
3225         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3226                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3227                         return -EINVAL;
3228                 params.p2p_ctwindow =
3229                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3230                 if (params.p2p_ctwindow > 127)
3231                         return -EINVAL;
3232                 if (params.p2p_ctwindow != 0 &&
3233                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3234                         return -EINVAL;
3235         }
3236
3237         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3238                 u8 tmp;
3239
3240                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3241                         return -EINVAL;
3242                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3243                 if (tmp > 1)
3244                         return -EINVAL;
3245                 params.p2p_opp_ps = tmp;
3246                 if (params.p2p_opp_ps != 0 &&
3247                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3248                         return -EINVAL;
3249         }
3250
3251         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3252                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3253                 if (err)
3254                         return err;
3255         } else if (wdev->preset_chandef.chan) {
3256                 params.chandef = wdev->preset_chandef;
3257         } else if (!nl80211_get_ap_channel(rdev, &params))
3258                 return -EINVAL;
3259
3260         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3261                 return -EINVAL;
3262
3263         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3264         if (err < 0)
3265                 return err;
3266         if (err) {
3267                 radar_detect_width = BIT(params.chandef.width);
3268                 params.radar_required = true;
3269         }
3270
3271         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3272                                            params.chandef.chan,
3273                                            CHAN_MODE_SHARED,
3274                                            radar_detect_width);
3275         if (err)
3276                 return err;
3277
3278         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3279                 params.acl = parse_acl_data(&rdev->wiphy, info);
3280                 if (IS_ERR(params.acl))
3281                         return PTR_ERR(params.acl);
3282         }
3283
3284         wdev_lock(wdev);
3285         err = rdev_start_ap(rdev, dev, &params);
3286         if (!err) {
3287                 wdev->preset_chandef = params.chandef;
3288                 wdev->beacon_interval = params.beacon_interval;
3289                 wdev->channel = params.chandef.chan;
3290                 wdev->ssid_len = params.ssid_len;
3291                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3292         }
3293         wdev_unlock(wdev);
3294
3295         kfree(params.acl);
3296
3297         return err;
3298 }
3299
3300 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3301 {
3302         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3303         struct net_device *dev = info->user_ptr[1];
3304         struct wireless_dev *wdev = dev->ieee80211_ptr;
3305         struct cfg80211_beacon_data params;
3306         int err;
3307
3308         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3309             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3310                 return -EOPNOTSUPP;
3311
3312         if (!rdev->ops->change_beacon)
3313                 return -EOPNOTSUPP;
3314
3315         if (!wdev->beacon_interval)
3316                 return -EINVAL;
3317
3318         err = nl80211_parse_beacon(info->attrs, &params);
3319         if (err)
3320                 return err;
3321
3322         wdev_lock(wdev);
3323         err = rdev_change_beacon(rdev, dev, &params);
3324         wdev_unlock(wdev);
3325
3326         return err;
3327 }
3328
3329 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3330 {
3331         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3332         struct net_device *dev = info->user_ptr[1];
3333
3334         return cfg80211_stop_ap(rdev, dev);
3335 }
3336
3337 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3338         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3339         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3340         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3341         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3342         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3343         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3344 };
3345
3346 static int parse_station_flags(struct genl_info *info,
3347                                enum nl80211_iftype iftype,
3348                                struct station_parameters *params)
3349 {
3350         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3351         struct nlattr *nla;
3352         int flag;
3353
3354         /*
3355          * Try parsing the new attribute first so userspace
3356          * can specify both for older kernels.
3357          */
3358         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3359         if (nla) {
3360                 struct nl80211_sta_flag_update *sta_flags;
3361
3362                 sta_flags = nla_data(nla);
3363                 params->sta_flags_mask = sta_flags->mask;
3364                 params->sta_flags_set = sta_flags->set;
3365                 params->sta_flags_set &= params->sta_flags_mask;
3366                 if ((params->sta_flags_mask |
3367                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3368                         return -EINVAL;
3369                 return 0;
3370         }
3371
3372         /* if present, parse the old attribute */
3373
3374         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3375         if (!nla)
3376                 return 0;
3377
3378         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3379                              nla, sta_flags_policy))
3380                 return -EINVAL;
3381
3382         /*
3383          * Only allow certain flags for interface types so that
3384          * other attributes are silently ignored. Remember that
3385          * this is backward compatibility code with old userspace
3386          * and shouldn't be hit in other cases anyway.
3387          */
3388         switch (iftype) {
3389         case NL80211_IFTYPE_AP:
3390         case NL80211_IFTYPE_AP_VLAN:
3391         case NL80211_IFTYPE_P2P_GO:
3392                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3393                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3394                                          BIT(NL80211_STA_FLAG_WME) |
3395                                          BIT(NL80211_STA_FLAG_MFP);
3396                 break;
3397         case NL80211_IFTYPE_P2P_CLIENT:
3398         case NL80211_IFTYPE_STATION:
3399                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3400                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3401                 break;
3402         case NL80211_IFTYPE_MESH_POINT:
3403                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3404                                          BIT(NL80211_STA_FLAG_MFP) |
3405                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3406         default:
3407                 return -EINVAL;
3408         }
3409
3410         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3411                 if (flags[flag]) {
3412                         params->sta_flags_set |= (1<<flag);
3413
3414                         /* no longer support new API additions in old API */
3415                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3416                                 return -EINVAL;
3417                 }
3418         }
3419
3420         return 0;
3421 }
3422
3423 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3424                                  int attr)
3425 {
3426         struct nlattr *rate;
3427         u32 bitrate;
3428         u16 bitrate_compat;
3429
3430         rate = nla_nest_start(msg, attr);
3431         if (!rate)
3432                 return false;
3433
3434         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3435         bitrate = cfg80211_calculate_bitrate(info);
3436         /* report 16-bit bitrate only if we can */
3437         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3438         if (bitrate > 0 &&
3439             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3440                 return false;
3441         if (bitrate_compat > 0 &&
3442             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3443                 return false;
3444
3445         if (info->flags & RATE_INFO_FLAGS_MCS) {
3446                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3447                         return false;
3448                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3449                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3450                         return false;
3451                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3452                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3453                         return false;
3454         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3455                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3456                         return false;
3457                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3458                         return false;
3459                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3460                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3461                         return false;
3462                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3463                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3464                         return false;
3465                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3466                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3467                         return false;
3468                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3469                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3470                         return false;
3471                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3472                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3473                         return false;
3474         }
3475
3476         nla_nest_end(msg, rate);
3477         return true;
3478 }
3479
3480 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3481                                int id)
3482 {
3483         void *attr;
3484         int i = 0;
3485
3486         if (!mask)
3487                 return true;
3488
3489         attr = nla_nest_start(msg, id);
3490         if (!attr)
3491                 return false;
3492
3493         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3494                 if (!(mask & BIT(i)))
3495                         continue;
3496
3497                 if (nla_put_u8(msg, i, signal[i]))
3498                         return false;
3499         }
3500
3501         nla_nest_end(msg, attr);
3502
3503         return true;
3504 }
3505
3506 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3507                                 int flags,
3508                                 struct cfg80211_registered_device *rdev,
3509                                 struct net_device *dev,
3510                                 const u8 *mac_addr, struct station_info *sinfo)
3511 {
3512         void *hdr;
3513         struct nlattr *sinfoattr, *bss_param;
3514
3515         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3516         if (!hdr)
3517                 return -1;
3518
3519         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3520             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3521             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3522                 goto nla_put_failure;
3523
3524         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3525         if (!sinfoattr)
3526                 goto nla_put_failure;
3527         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3528             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3529                         sinfo->connected_time))
3530                 goto nla_put_failure;
3531         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3532             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3533                         sinfo->inactive_time))
3534                 goto nla_put_failure;
3535         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3536                               STATION_INFO_RX_BYTES64)) &&
3537             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3538                         (u32)sinfo->rx_bytes))
3539                 goto nla_put_failure;
3540         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3541                               STATION_INFO_TX_BYTES64)) &&
3542             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3543                         (u32)sinfo->tx_bytes))
3544                 goto nla_put_failure;
3545         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3546             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3547                         sinfo->rx_bytes))
3548                 goto nla_put_failure;
3549         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3550             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3551                         sinfo->tx_bytes))
3552                 goto nla_put_failure;
3553         if ((sinfo->filled & STATION_INFO_LLID) &&
3554             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3555                 goto nla_put_failure;
3556         if ((sinfo->filled & STATION_INFO_PLID) &&
3557             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3558                 goto nla_put_failure;
3559         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3560             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3561                        sinfo->plink_state))
3562                 goto nla_put_failure;
3563         switch (rdev->wiphy.signal_type) {
3564         case CFG80211_SIGNAL_TYPE_MBM:
3565                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3566                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3567                                sinfo->signal))
3568                         goto nla_put_failure;
3569                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3570                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3571                                sinfo->signal_avg))
3572                         goto nla_put_failure;
3573                 break;
3574         default:
3575                 break;
3576         }
3577         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3578                 if (!nl80211_put_signal(msg, sinfo->chains,
3579                                         sinfo->chain_signal,
3580                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3581                         goto nla_put_failure;
3582         }
3583         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3584                 if (!nl80211_put_signal(msg, sinfo->chains,
3585                                         sinfo->chain_signal_avg,
3586                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3587                         goto nla_put_failure;
3588         }
3589         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3590                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3591                                           NL80211_STA_INFO_TX_BITRATE))
3592                         goto nla_put_failure;
3593         }
3594         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3595                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3596                                           NL80211_STA_INFO_RX_BITRATE))
3597                         goto nla_put_failure;
3598         }
3599         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3600             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3601                         sinfo->rx_packets))
3602                 goto nla_put_failure;
3603         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3604             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3605                         sinfo->tx_packets))
3606                 goto nla_put_failure;
3607         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3608             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3609                         sinfo->tx_retries))
3610                 goto nla_put_failure;
3611         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3612             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3613                         sinfo->tx_failed))
3614                 goto nla_put_failure;
3615         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3616             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3617                         sinfo->beacon_loss_count))
3618                 goto nla_put_failure;
3619         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3620             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3621                         sinfo->local_pm))
3622                 goto nla_put_failure;
3623         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3624             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3625                         sinfo->peer_pm))
3626                 goto nla_put_failure;
3627         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3628             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3629                         sinfo->nonpeer_pm))
3630                 goto nla_put_failure;
3631         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3632                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3633                 if (!bss_param)
3634                         goto nla_put_failure;
3635
3636                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3637                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3638                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3639                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3640                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3641                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3642                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3643                                sinfo->bss_param.dtim_period) ||
3644                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3645                                 sinfo->bss_param.beacon_interval))
3646                         goto nla_put_failure;
3647
3648                 nla_nest_end(msg, bss_param);
3649         }
3650         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3651             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3652                     sizeof(struct nl80211_sta_flag_update),
3653                     &sinfo->sta_flags))
3654                 goto nla_put_failure;
3655         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3656                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3657                             sinfo->t_offset))
3658                 goto nla_put_failure;
3659         nla_nest_end(msg, sinfoattr);
3660
3661         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3662             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3663                     sinfo->assoc_req_ies))
3664                 goto nla_put_failure;
3665
3666         return genlmsg_end(msg, hdr);
3667
3668  nla_put_failure:
3669         genlmsg_cancel(msg, hdr);
3670         return -EMSGSIZE;
3671 }
3672
3673 static int nl80211_dump_station(struct sk_buff *skb,
3674                                 struct netlink_callback *cb)
3675 {
3676         struct station_info sinfo;
3677         struct cfg80211_registered_device *dev;
3678         struct wireless_dev *wdev;
3679         u8 mac_addr[ETH_ALEN];
3680         int sta_idx = cb->args[2];
3681         int err;
3682
3683         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3684         if (err)
3685                 return err;
3686
3687         if (!wdev->netdev) {
3688                 err = -EINVAL;
3689                 goto out_err;
3690         }
3691
3692         if (!dev->ops->dump_station) {
3693                 err = -EOPNOTSUPP;
3694                 goto out_err;
3695         }
3696
3697         while (1) {
3698                 memset(&sinfo, 0, sizeof(sinfo));
3699                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3700                                         mac_addr, &sinfo);
3701                 if (err == -ENOENT)
3702                         break;
3703                 if (err)
3704                         goto out_err;
3705
3706                 if (nl80211_send_station(skb,
3707                                 NETLINK_CB(cb->skb).portid,
3708                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3709                                 dev, wdev->netdev, mac_addr,
3710                                 &sinfo) < 0)
3711                         goto out;
3712
3713                 sta_idx++;
3714         }
3715
3716
3717  out:
3718         cb->args[2] = sta_idx;
3719         err = skb->len;
3720  out_err:
3721         nl80211_finish_wdev_dump(dev);
3722
3723         return err;
3724 }
3725
3726 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3727 {
3728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3729         struct net_device *dev = info->user_ptr[1];
3730         struct station_info sinfo;
3731         struct sk_buff *msg;
3732         u8 *mac_addr = NULL;
3733         int err;
3734
3735         memset(&sinfo, 0, sizeof(sinfo));
3736
3737         if (!info->attrs[NL80211_ATTR_MAC])
3738                 return -EINVAL;
3739
3740         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3741
3742         if (!rdev->ops->get_station)
3743                 return -EOPNOTSUPP;
3744
3745         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3746         if (err)
3747                 return err;
3748
3749         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3750         if (!msg)
3751                 return -ENOMEM;
3752
3753         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3754                                  rdev, dev, mac_addr, &sinfo) < 0) {
3755                 nlmsg_free(msg);
3756                 return -ENOBUFS;
3757         }
3758
3759         return genlmsg_reply(msg, info);
3760 }
3761
3762 int cfg80211_check_station_change(struct wiphy *wiphy,
3763                                   struct station_parameters *params,
3764                                   enum cfg80211_station_type statype)
3765 {
3766         if (params->listen_interval != -1)
3767                 return -EINVAL;
3768         if (params->aid)
3769                 return -EINVAL;
3770
3771         /* When you run into this, adjust the code below for the new flag */
3772         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3773
3774         switch (statype) {
3775         case CFG80211_STA_MESH_PEER_KERNEL:
3776         case CFG80211_STA_MESH_PEER_USER:
3777                 /*
3778                  * No ignoring the TDLS flag here -- the userspace mesh
3779                  * code doesn't have the bug of including TDLS in the
3780                  * mask everywhere.
3781                  */
3782                 if (params->sta_flags_mask &
3783                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3784                                   BIT(NL80211_STA_FLAG_MFP) |
3785                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3786                         return -EINVAL;
3787                 break;
3788         case CFG80211_STA_TDLS_PEER_SETUP:
3789         case CFG80211_STA_TDLS_PEER_ACTIVE:
3790                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3791                         return -EINVAL;
3792                 /* ignore since it can't change */
3793                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3794                 break;
3795         default:
3796                 /* disallow mesh-specific things */
3797                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3798                         return -EINVAL;
3799                 if (params->local_pm)
3800                         return -EINVAL;
3801                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3802                         return -EINVAL;
3803         }
3804
3805         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3806             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3807                 /* TDLS can't be set, ... */
3808                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3809                         return -EINVAL;
3810                 /*
3811                  * ... but don't bother the driver with it. This works around
3812                  * a hostapd/wpa_supplicant issue -- it always includes the
3813                  * TLDS_PEER flag in the mask even for AP mode.
3814                  */
3815                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3816         }
3817
3818         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3819                 /* reject other things that can't change */
3820                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3821                         return -EINVAL;
3822                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3823                         return -EINVAL;
3824                 if (params->supported_rates)
3825                         return -EINVAL;
3826                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3827                         return -EINVAL;
3828         }
3829
3830         if (statype != CFG80211_STA_AP_CLIENT) {
3831                 if (params->vlan)
3832                         return -EINVAL;
3833         }
3834
3835         switch (statype) {
3836         case CFG80211_STA_AP_MLME_CLIENT:
3837                 /* Use this only for authorizing/unauthorizing a station */
3838                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3839                         return -EOPNOTSUPP;
3840                 break;
3841         case CFG80211_STA_AP_CLIENT:
3842                 /* accept only the listed bits */
3843                 if (params->sta_flags_mask &
3844                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3845                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3846                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3847                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3848                                   BIT(NL80211_STA_FLAG_WME) |
3849                                   BIT(NL80211_STA_FLAG_MFP)))
3850                         return -EINVAL;
3851
3852                 /* but authenticated/associated only if driver handles it */
3853                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3854                     params->sta_flags_mask &
3855                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3856                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3857                         return -EINVAL;
3858                 break;
3859         case CFG80211_STA_IBSS:
3860         case CFG80211_STA_AP_STA:
3861                 /* reject any changes other than AUTHORIZED */
3862                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3863                         return -EINVAL;
3864                 break;
3865         case CFG80211_STA_TDLS_PEER_SETUP:
3866                 /* reject any changes other than AUTHORIZED or WME */
3867                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3868                                                BIT(NL80211_STA_FLAG_WME)))
3869                         return -EINVAL;
3870                 /* force (at least) rates when authorizing */
3871                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3872                     !params->supported_rates)
3873                         return -EINVAL;
3874                 break;
3875         case CFG80211_STA_TDLS_PEER_ACTIVE:
3876                 /* reject any changes */
3877                 return -EINVAL;
3878         case CFG80211_STA_MESH_PEER_KERNEL:
3879                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3880                         return -EINVAL;
3881                 break;
3882         case CFG80211_STA_MESH_PEER_USER:
3883                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3884                         return -EINVAL;
3885                 break;
3886         }
3887
3888         return 0;
3889 }
3890 EXPORT_SYMBOL(cfg80211_check_station_change);
3891
3892 /*
3893  * Get vlan interface making sure it is running and on the right wiphy.
3894  */
3895 static struct net_device *get_vlan(struct genl_info *info,
3896                                    struct cfg80211_registered_device *rdev)
3897 {
3898         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3899         struct net_device *v;
3900         int ret;
3901
3902         if (!vlanattr)
3903                 return NULL;
3904
3905         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3906         if (!v)
3907                 return ERR_PTR(-ENODEV);
3908
3909         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3910                 ret = -EINVAL;
3911                 goto error;
3912         }
3913
3914         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3915             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3916             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3917                 ret = -EINVAL;
3918                 goto error;
3919         }
3920
3921         if (!netif_running(v)) {
3922                 ret = -ENETDOWN;
3923                 goto error;
3924         }
3925
3926         return v;
3927  error:
3928         dev_put(v);
3929         return ERR_PTR(ret);
3930 }
3931
3932 static struct nla_policy
3933 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3934         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3935         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3936 };
3937
3938 static int nl80211_parse_sta_wme(struct genl_info *info,
3939                                  struct station_parameters *params)
3940 {
3941         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3942         struct nlattr *nla;
3943         int err;
3944
3945         /* parse WME attributes if present */
3946         if (!info->attrs[NL80211_ATTR_STA_WME])
3947                 return 0;
3948
3949         nla = info->attrs[NL80211_ATTR_STA_WME];
3950         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3951                                nl80211_sta_wme_policy);
3952         if (err)
3953                 return err;
3954
3955         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3956                 params->uapsd_queues = nla_get_u8(
3957                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3958         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3959                 return -EINVAL;
3960
3961         if (tb[NL80211_STA_WME_MAX_SP])
3962                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3963
3964         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3965                 return -EINVAL;
3966
3967         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3968
3969         return 0;
3970 }
3971
3972 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3973                                       struct station_parameters *params)
3974 {
3975         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3976                 params->supported_channels =
3977                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3978                 params->supported_channels_len =
3979                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3980                 /*
3981                  * Need to include at least one (first channel, number of
3982                  * channels) tuple for each subband, and must have proper
3983                  * tuples for the rest of the data as well.
3984                  */
3985                 if (params->supported_channels_len < 2)
3986                         return -EINVAL;
3987                 if (params->supported_channels_len % 2)
3988                         return -EINVAL;
3989         }
3990
3991         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3992                 params->supported_oper_classes =
3993                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3994                 params->supported_oper_classes_len =
3995                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3996                 /*
3997                  * The value of the Length field of the Supported Operating
3998                  * Classes element is between 2 and 253.
3999                  */
4000                 if (params->supported_oper_classes_len < 2 ||
4001                     params->supported_oper_classes_len > 253)
4002                         return -EINVAL;
4003         }
4004         return 0;
4005 }
4006
4007 static int nl80211_set_station_tdls(struct genl_info *info,
4008                                     struct station_parameters *params)
4009 {
4010         int err;
4011         /* Dummy STA entry gets updated once the peer capabilities are known */
4012         if (info->attrs[NL80211_ATTR_PEER_AID])
4013                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4014         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4015                 params->ht_capa =
4016                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4017         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4018                 params->vht_capa =
4019                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4020
4021         err = nl80211_parse_sta_channel_info(info, params);
4022         if (err)
4023                 return err;
4024
4025         return nl80211_parse_sta_wme(info, params);
4026 }
4027
4028 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4029 {
4030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4031         struct net_device *dev = info->user_ptr[1];
4032         struct station_parameters params;
4033         u8 *mac_addr;
4034         int err;
4035
4036         memset(&params, 0, sizeof(params));
4037
4038         params.listen_interval = -1;
4039
4040         if (!rdev->ops->change_station)
4041                 return -EOPNOTSUPP;
4042
4043         if (info->attrs[NL80211_ATTR_STA_AID])
4044                 return -EINVAL;
4045
4046         if (!info->attrs[NL80211_ATTR_MAC])
4047                 return -EINVAL;
4048
4049         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4050
4051         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4052                 params.supported_rates =
4053                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4054                 params.supported_rates_len =
4055                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4056         }
4057
4058         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4059                 params.capability =
4060                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4061                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4062         }
4063
4064         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4065                 params.ext_capab =
4066                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4067                 params.ext_capab_len =
4068                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4069         }
4070
4071         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4072                 return -EINVAL;
4073
4074         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4075                 return -EINVAL;
4076
4077         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4078                 params.plink_action =
4079                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4080                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4081                         return -EINVAL;
4082         }
4083
4084         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4085                 params.plink_state =
4086                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4087                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4088                         return -EINVAL;
4089                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4090         }
4091
4092         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4093                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4094                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4095
4096                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4097                     pm > NL80211_MESH_POWER_MAX)
4098                         return -EINVAL;
4099
4100                 params.local_pm = pm;
4101         }
4102
4103         /* Include parameters for TDLS peer (will check later) */
4104         err = nl80211_set_station_tdls(info, &params);
4105         if (err)
4106                 return err;
4107
4108         params.vlan = get_vlan(info, rdev);
4109         if (IS_ERR(params.vlan))
4110                 return PTR_ERR(params.vlan);
4111
4112         switch (dev->ieee80211_ptr->iftype) {
4113         case NL80211_IFTYPE_AP:
4114         case NL80211_IFTYPE_AP_VLAN:
4115         case NL80211_IFTYPE_P2P_GO:
4116         case NL80211_IFTYPE_P2P_CLIENT:
4117         case NL80211_IFTYPE_STATION:
4118         case NL80211_IFTYPE_ADHOC:
4119         case NL80211_IFTYPE_MESH_POINT:
4120                 break;
4121         default:
4122                 err = -EOPNOTSUPP;
4123                 goto out_put_vlan;
4124         }
4125
4126         /* driver will call cfg80211_check_station_change() */
4127         err = rdev_change_station(rdev, dev, mac_addr, &params);
4128
4129  out_put_vlan:
4130         if (params.vlan)
4131                 dev_put(params.vlan);
4132
4133         return err;
4134 }
4135
4136 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4137 {
4138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4139         int err;
4140         struct net_device *dev = info->user_ptr[1];
4141         struct station_parameters params;
4142         u8 *mac_addr = NULL;
4143
4144         memset(&params, 0, sizeof(params));
4145
4146         if (!rdev->ops->add_station)
4147                 return -EOPNOTSUPP;
4148
4149         if (!info->attrs[NL80211_ATTR_MAC])
4150                 return -EINVAL;
4151
4152         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4153                 return -EINVAL;
4154
4155         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4156                 return -EINVAL;
4157
4158         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4159             !info->attrs[NL80211_ATTR_PEER_AID])
4160                 return -EINVAL;
4161
4162         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4163         params.supported_rates =
4164                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4165         params.supported_rates_len =
4166                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4167         params.listen_interval =
4168                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4169
4170         if (info->attrs[NL80211_ATTR_PEER_AID])
4171                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4172         else
4173                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4174         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4175                 return -EINVAL;
4176
4177         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4178                 params.capability =
4179                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4180                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4181         }
4182
4183         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4184                 params.ext_capab =
4185                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4186                 params.ext_capab_len =
4187                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4188         }
4189
4190         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4191                 params.ht_capa =
4192                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4193
4194         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4195                 params.vht_capa =
4196                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4197
4198         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4199                 params.opmode_notif_used = true;
4200                 params.opmode_notif =
4201                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4202         }
4203
4204         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4205                 params.plink_action =
4206                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4207                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4208                         return -EINVAL;
4209         }
4210
4211         err = nl80211_parse_sta_channel_info(info, &params);
4212         if (err)
4213                 return err;
4214
4215         err = nl80211_parse_sta_wme(info, &params);
4216         if (err)
4217                 return err;
4218
4219         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4220                 return -EINVAL;
4221
4222         /* When you run into this, adjust the code below for the new flag */
4223         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4224
4225         switch (dev->ieee80211_ptr->iftype) {
4226         case NL80211_IFTYPE_AP:
4227         case NL80211_IFTYPE_AP_VLAN:
4228         case NL80211_IFTYPE_P2P_GO:
4229                 /* ignore WME attributes if iface/sta is not capable */
4230                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4231                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4232                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4233
4234                 /* TDLS peers cannot be added */
4235                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4236                     info->attrs[NL80211_ATTR_PEER_AID])
4237                         return -EINVAL;
4238                 /* but don't bother the driver with it */
4239                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4240
4241                 /* allow authenticated/associated only if driver handles it */
4242                 if (!(rdev->wiphy.features &
4243                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4244                     params.sta_flags_mask &
4245                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4246                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4247                         return -EINVAL;
4248
4249                 /* must be last in here for error handling */
4250                 params.vlan = get_vlan(info, rdev);
4251                 if (IS_ERR(params.vlan))
4252                         return PTR_ERR(params.vlan);
4253                 break;
4254         case NL80211_IFTYPE_MESH_POINT:
4255                 /* ignore uAPSD data */
4256                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4257
4258                 /* associated is disallowed */
4259                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4260                         return -EINVAL;
4261                 /* TDLS peers cannot be added */
4262                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4263                     info->attrs[NL80211_ATTR_PEER_AID])
4264                         return -EINVAL;
4265                 break;
4266         case NL80211_IFTYPE_STATION:
4267         case NL80211_IFTYPE_P2P_CLIENT:
4268                 /* ignore uAPSD data */
4269                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4270
4271                 /* these are disallowed */
4272                 if (params.sta_flags_mask &
4273                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4274                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4275                         return -EINVAL;
4276                 /* Only TDLS peers can be added */
4277                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4278                         return -EINVAL;
4279                 /* Can only add if TDLS ... */
4280                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4281                         return -EOPNOTSUPP;
4282                 /* ... with external setup is supported */
4283                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4284                         return -EOPNOTSUPP;
4285                 /*
4286                  * Older wpa_supplicant versions always mark the TDLS peer
4287                  * as authorized, but it shouldn't yet be.
4288                  */
4289                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4290                 break;
4291         default:
4292                 return -EOPNOTSUPP;
4293         }
4294
4295         /* be aware of params.vlan when changing code here */
4296
4297         err = rdev_add_station(rdev, dev, mac_addr, &params);
4298
4299         if (params.vlan)
4300                 dev_put(params.vlan);
4301         return err;
4302 }
4303
4304 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4305 {
4306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4307         struct net_device *dev = info->user_ptr[1];
4308         u8 *mac_addr = NULL;
4309
4310         if (info->attrs[NL80211_ATTR_MAC])
4311                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4312
4313         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4314             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4315             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4316             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4317                 return -EINVAL;
4318
4319         if (!rdev->ops->del_station)
4320                 return -EOPNOTSUPP;
4321
4322         return rdev_del_station(rdev, dev, mac_addr);
4323 }
4324
4325 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4326                                 int flags, struct net_device *dev,
4327                                 u8 *dst, u8 *next_hop,
4328                                 struct mpath_info *pinfo)
4329 {
4330         void *hdr;
4331         struct nlattr *pinfoattr;
4332
4333         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4334         if (!hdr)
4335                 return -1;
4336
4337         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4338             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4339             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4340             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4341                 goto nla_put_failure;
4342
4343         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4344         if (!pinfoattr)
4345                 goto nla_put_failure;
4346         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4347             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4348                         pinfo->frame_qlen))
4349                 goto nla_put_failure;
4350         if (((pinfo->filled & MPATH_INFO_SN) &&
4351              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4352             ((pinfo->filled & MPATH_INFO_METRIC) &&
4353              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4354                          pinfo->metric)) ||
4355             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4356              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4357                          pinfo->exptime)) ||
4358             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4359              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4360                         pinfo->flags)) ||
4361             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4362              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4363                          pinfo->discovery_timeout)) ||
4364             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4365              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4366                         pinfo->discovery_retries)))
4367                 goto nla_put_failure;
4368
4369         nla_nest_end(msg, pinfoattr);
4370
4371         return genlmsg_end(msg, hdr);
4372
4373  nla_put_failure:
4374         genlmsg_cancel(msg, hdr);
4375         return -EMSGSIZE;
4376 }
4377
4378 static int nl80211_dump_mpath(struct sk_buff *skb,
4379                               struct netlink_callback *cb)
4380 {
4381         struct mpath_info pinfo;
4382         struct cfg80211_registered_device *dev;
4383         struct wireless_dev *wdev;
4384         u8 dst[ETH_ALEN];
4385         u8 next_hop[ETH_ALEN];
4386         int path_idx = cb->args[2];
4387         int err;
4388
4389         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4390         if (err)
4391                 return err;
4392
4393         if (!dev->ops->dump_mpath) {
4394                 err = -EOPNOTSUPP;
4395                 goto out_err;
4396         }
4397
4398         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4399                 err = -EOPNOTSUPP;
4400                 goto out_err;
4401         }
4402
4403         while (1) {
4404                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4405                                       next_hop, &pinfo);
4406                 if (err == -ENOENT)
4407                         break;
4408                 if (err)
4409                         goto out_err;
4410
4411                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4412                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4413                                        wdev->netdev, dst, next_hop,
4414                                        &pinfo) < 0)
4415                         goto out;
4416
4417                 path_idx++;
4418         }
4419
4420
4421  out:
4422         cb->args[2] = path_idx;
4423         err = skb->len;
4424  out_err:
4425         nl80211_finish_wdev_dump(dev);
4426         return err;
4427 }
4428
4429 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4430 {
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         int err;
4433         struct net_device *dev = info->user_ptr[1];
4434         struct mpath_info pinfo;
4435         struct sk_buff *msg;
4436         u8 *dst = NULL;
4437         u8 next_hop[ETH_ALEN];
4438
4439         memset(&pinfo, 0, sizeof(pinfo));
4440
4441         if (!info->attrs[NL80211_ATTR_MAC])
4442                 return -EINVAL;
4443
4444         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4445
4446         if (!rdev->ops->get_mpath)
4447                 return -EOPNOTSUPP;
4448
4449         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4450                 return -EOPNOTSUPP;
4451
4452         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4453         if (err)
4454                 return err;
4455
4456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4457         if (!msg)
4458                 return -ENOMEM;
4459
4460         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4461                                  dev, dst, next_hop, &pinfo) < 0) {
4462                 nlmsg_free(msg);
4463                 return -ENOBUFS;
4464         }
4465
4466         return genlmsg_reply(msg, info);
4467 }
4468
4469 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4470 {
4471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4472         struct net_device *dev = info->user_ptr[1];
4473         u8 *dst = NULL;
4474         u8 *next_hop = NULL;
4475
4476         if (!info->attrs[NL80211_ATTR_MAC])
4477                 return -EINVAL;
4478
4479         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4480                 return -EINVAL;
4481
4482         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4483         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4484
4485         if (!rdev->ops->change_mpath)
4486                 return -EOPNOTSUPP;
4487
4488         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4489                 return -EOPNOTSUPP;
4490
4491         return rdev_change_mpath(rdev, dev, dst, next_hop);
4492 }
4493
4494 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4495 {
4496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4497         struct net_device *dev = info->user_ptr[1];
4498         u8 *dst = NULL;
4499         u8 *next_hop = NULL;
4500
4501         if (!info->attrs[NL80211_ATTR_MAC])
4502                 return -EINVAL;
4503
4504         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4505                 return -EINVAL;
4506
4507         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4508         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4509
4510         if (!rdev->ops->add_mpath)
4511                 return -EOPNOTSUPP;
4512
4513         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4514                 return -EOPNOTSUPP;
4515
4516         return rdev_add_mpath(rdev, dev, dst, next_hop);
4517 }
4518
4519 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4520 {
4521         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4522         struct net_device *dev = info->user_ptr[1];
4523         u8 *dst = NULL;
4524
4525         if (info->attrs[NL80211_ATTR_MAC])
4526                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4527
4528         if (!rdev->ops->del_mpath)
4529                 return -EOPNOTSUPP;
4530
4531         return rdev_del_mpath(rdev, dev, dst);
4532 }
4533
4534 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4535 {
4536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4537         struct net_device *dev = info->user_ptr[1];
4538         struct wireless_dev *wdev = dev->ieee80211_ptr;
4539         struct bss_parameters params;
4540         int err;
4541
4542         memset(&params, 0, sizeof(params));
4543         /* default to not changing parameters */
4544         params.use_cts_prot = -1;
4545         params.use_short_preamble = -1;
4546         params.use_short_slot_time = -1;
4547         params.ap_isolate = -1;
4548         params.ht_opmode = -1;
4549         params.p2p_ctwindow = -1;
4550         params.p2p_opp_ps = -1;
4551
4552         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4553                 params.use_cts_prot =
4554                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4555         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4556                 params.use_short_preamble =
4557                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4558         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4559                 params.use_short_slot_time =
4560                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4561         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4562                 params.basic_rates =
4563                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4564                 params.basic_rates_len =
4565                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4566         }
4567         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4568                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4569         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4570                 params.ht_opmode =
4571                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4572
4573         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4574                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4575                         return -EINVAL;
4576                 params.p2p_ctwindow =
4577                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4578                 if (params.p2p_ctwindow < 0)
4579                         return -EINVAL;
4580                 if (params.p2p_ctwindow != 0 &&
4581                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4582                         return -EINVAL;
4583         }
4584
4585         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4586                 u8 tmp;
4587
4588                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4589                         return -EINVAL;
4590                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4591                 if (tmp > 1)
4592                         return -EINVAL;
4593                 params.p2p_opp_ps = tmp;
4594                 if (params.p2p_opp_ps &&
4595                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4596                         return -EINVAL;
4597         }
4598
4599         if (!rdev->ops->change_bss)
4600                 return -EOPNOTSUPP;
4601
4602         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4603             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4604                 return -EOPNOTSUPP;
4605
4606         wdev_lock(wdev);
4607         err = rdev_change_bss(rdev, dev, &params);
4608         wdev_unlock(wdev);
4609
4610         return err;
4611 }
4612
4613 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4614         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4615         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4616         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4617         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4618         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4619         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4620 };
4621
4622 static int parse_reg_rule(struct nlattr *tb[],
4623         struct ieee80211_reg_rule *reg_rule)
4624 {
4625         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4626         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4627
4628         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4629                 return -EINVAL;
4630         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4631                 return -EINVAL;
4632         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4633                 return -EINVAL;
4634         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4635                 return -EINVAL;
4636         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4637                 return -EINVAL;
4638
4639         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4640
4641         freq_range->start_freq_khz =
4642                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4643         freq_range->end_freq_khz =
4644                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4645         freq_range->max_bandwidth_khz =
4646                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4647
4648         power_rule->max_eirp =
4649                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4650
4651         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4652                 power_rule->max_antenna_gain =
4653                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4654
4655         return 0;
4656 }
4657
4658 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4659 {
4660         int r;
4661         char *data = NULL;
4662         enum nl80211_user_reg_hint_type user_reg_hint_type;
4663
4664         /*
4665          * You should only get this when cfg80211 hasn't yet initialized
4666          * completely when built-in to the kernel right between the time
4667          * window between nl80211_init() and regulatory_init(), if that is
4668          * even possible.
4669          */
4670         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4671                 return -EINPROGRESS;
4672
4673         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4674                 return -EINVAL;
4675
4676         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4677
4678         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4679                 user_reg_hint_type =
4680                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4681         else
4682                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4683
4684         switch (user_reg_hint_type) {
4685         case NL80211_USER_REG_HINT_USER:
4686         case NL80211_USER_REG_HINT_CELL_BASE:
4687                 break;
4688         default:
4689                 return -EINVAL;
4690         }
4691
4692         r = regulatory_hint_user(data, user_reg_hint_type);
4693
4694         return r;
4695 }
4696
4697 static int nl80211_get_mesh_config(struct sk_buff *skb,
4698                                    struct genl_info *info)
4699 {
4700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4701         struct net_device *dev = info->user_ptr[1];
4702         struct wireless_dev *wdev = dev->ieee80211_ptr;
4703         struct mesh_config cur_params;
4704         int err = 0;
4705         void *hdr;
4706         struct nlattr *pinfoattr;
4707         struct sk_buff *msg;
4708
4709         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4710                 return -EOPNOTSUPP;
4711
4712         if (!rdev->ops->get_mesh_config)
4713                 return -EOPNOTSUPP;
4714
4715         wdev_lock(wdev);
4716         /* If not connected, get default parameters */
4717         if (!wdev->mesh_id_len)
4718                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4719         else
4720                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4721         wdev_unlock(wdev);
4722
4723         if (err)
4724                 return err;
4725
4726         /* Draw up a netlink message to send back */
4727         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4728         if (!msg)
4729                 return -ENOMEM;
4730         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4731                              NL80211_CMD_GET_MESH_CONFIG);
4732         if (!hdr)
4733                 goto out;
4734         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4735         if (!pinfoattr)
4736                 goto nla_put_failure;
4737         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4738             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4739                         cur_params.dot11MeshRetryTimeout) ||
4740             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4741                         cur_params.dot11MeshConfirmTimeout) ||
4742             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4743                         cur_params.dot11MeshHoldingTimeout) ||
4744             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4745                         cur_params.dot11MeshMaxPeerLinks) ||
4746             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4747                        cur_params.dot11MeshMaxRetries) ||
4748             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4749                        cur_params.dot11MeshTTL) ||
4750             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4751                        cur_params.element_ttl) ||
4752             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4753                        cur_params.auto_open_plinks) ||
4754             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4755                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4756             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4757                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4758             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4759                         cur_params.path_refresh_time) ||
4760             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4761                         cur_params.min_discovery_timeout) ||
4762             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4763                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4764             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4765                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4766             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4767                         cur_params.dot11MeshHWMPperrMinInterval) ||
4768             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4769                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4770             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4771                        cur_params.dot11MeshHWMPRootMode) ||
4772             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4773                         cur_params.dot11MeshHWMPRannInterval) ||
4774             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4775                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4776             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4777                        cur_params.dot11MeshForwarding) ||
4778             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4779                         cur_params.rssi_threshold) ||
4780             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4781                         cur_params.ht_opmode) ||
4782             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4783                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4784             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4785                         cur_params.dot11MeshHWMProotInterval) ||
4786             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4787                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4788             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4789                         cur_params.power_mode) ||
4790             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4791                         cur_params.dot11MeshAwakeWindowDuration) ||
4792             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4793                         cur_params.plink_timeout))
4794                 goto nla_put_failure;
4795         nla_nest_end(msg, pinfoattr);
4796         genlmsg_end(msg, hdr);
4797         return genlmsg_reply(msg, info);
4798
4799  nla_put_failure:
4800         genlmsg_cancel(msg, hdr);
4801  out:
4802         nlmsg_free(msg);
4803         return -ENOBUFS;
4804 }
4805
4806 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4807         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4808         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4809         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4810         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4811         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4812         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4813         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4814         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4815         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4816         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4817         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4818         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4819         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4820         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4821         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4822         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4823         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4824         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4825         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4826         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4827         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4828         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4829         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4830         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4831         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4832         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4833         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4834         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4835 };
4836
4837 static const struct nla_policy
4838         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4839         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4840         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4841         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4842         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4843         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4844         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4845         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4846                                     .len = IEEE80211_MAX_DATA_LEN },
4847         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4848 };
4849
4850 static int nl80211_parse_mesh_config(struct genl_info *info,
4851                                      struct mesh_config *cfg,
4852                                      u32 *mask_out)
4853 {
4854         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4855         u32 mask = 0;
4856
4857 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4858 do {                                                                        \
4859         if (tb[attr]) {                                                     \
4860                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4861                         return -EINVAL;                                     \
4862                 cfg->param = fn(tb[attr]);                                  \
4863                 mask |= (1 << (attr - 1));                                  \
4864         }                                                                   \
4865 } while (0)
4866
4867
4868         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4869                 return -EINVAL;
4870         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4871                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4872                              nl80211_meshconf_params_policy))
4873                 return -EINVAL;
4874
4875         /* This makes sure that there aren't more than 32 mesh config
4876          * parameters (otherwise our bitfield scheme would not work.) */
4877         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4878
4879         /* Fill in the params struct */
4880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4881                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4882                                   nla_get_u16);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4884                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4885                                   nla_get_u16);
4886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4887                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4888                                   nla_get_u16);
4889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4890                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4891                                   nla_get_u16);
4892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4893                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4894                                   nla_get_u8);
4895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4896                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4898                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4899                                   nla_get_u8);
4900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4901                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4902                                   nla_get_u8);
4903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4904                                   1, 255, mask,
4905                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4906                                   nla_get_u32);
4907         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4908                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4909                                   nla_get_u8);
4910         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4911                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4912                                   nla_get_u32);
4913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4914                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4915                                   nla_get_u16);
4916         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4917                                   1, 65535, mask,
4918                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4919                                   nla_get_u32);
4920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4921                                   1, 65535, mask,
4922                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4923                                   nla_get_u16);
4924         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4925                                   1, 65535, mask,
4926                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4927                                   nla_get_u16);
4928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4929                                   dot11MeshHWMPnetDiameterTraversalTime,
4930                                   1, 65535, mask,
4931                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4932                                   nla_get_u16);
4933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4934                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4935                                   nla_get_u8);
4936         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4937                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4938                                   nla_get_u16);
4939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4940                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4941                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4942                                   nla_get_u8);
4943         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4944                                   mask, NL80211_MESHCONF_FORWARDING,
4945                                   nla_get_u8);
4946         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4947                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4948                                   nla_get_s32);
4949         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4950                                   mask, NL80211_MESHCONF_HT_OPMODE,
4951                                   nla_get_u16);
4952         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4953                                   1, 65535, mask,
4954                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4955                                   nla_get_u32);
4956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4957                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4958                                   nla_get_u16);
4959         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4960                                   dot11MeshHWMPconfirmationInterval,
4961                                   1, 65535, mask,
4962                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4963                                   nla_get_u16);
4964         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4965                                   NL80211_MESH_POWER_ACTIVE,
4966                                   NL80211_MESH_POWER_MAX,
4967                                   mask, NL80211_MESHCONF_POWER_MODE,
4968                                   nla_get_u32);
4969         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4970                                   0, 65535, mask,
4971                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4972         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4973                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4974                                   nla_get_u32);
4975         if (mask_out)
4976                 *mask_out = mask;
4977
4978         return 0;
4979
4980 #undef FILL_IN_MESH_PARAM_IF_SET
4981 }
4982
4983 static int nl80211_parse_mesh_setup(struct genl_info *info,
4984                                      struct mesh_setup *setup)
4985 {
4986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4987         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4988
4989         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4990                 return -EINVAL;
4991         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4992                              info->attrs[NL80211_ATTR_MESH_SETUP],
4993                              nl80211_mesh_setup_params_policy))
4994                 return -EINVAL;
4995
4996         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4997                 setup->sync_method =
4998                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4999                  IEEE80211_SYNC_METHOD_VENDOR :
5000                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5001
5002         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5003                 setup->path_sel_proto =
5004                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5005                  IEEE80211_PATH_PROTOCOL_VENDOR :
5006                  IEEE80211_PATH_PROTOCOL_HWMP;
5007
5008         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5009                 setup->path_metric =
5010                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5011                  IEEE80211_PATH_METRIC_VENDOR :
5012                  IEEE80211_PATH_METRIC_AIRTIME;
5013
5014
5015         if (tb[NL80211_MESH_SETUP_IE]) {
5016                 struct nlattr *ieattr =
5017                         tb[NL80211_MESH_SETUP_IE];
5018                 if (!is_valid_ie_attr(ieattr))
5019                         return -EINVAL;
5020                 setup->ie = nla_data(ieattr);
5021                 setup->ie_len = nla_len(ieattr);
5022         }
5023         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5024             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5025                 return -EINVAL;
5026         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5027         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5028         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5029         if (setup->is_secure)
5030                 setup->user_mpm = true;
5031
5032         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5033                 if (!setup->user_mpm)
5034                         return -EINVAL;
5035                 setup->auth_id =
5036                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5037         }
5038
5039         return 0;
5040 }
5041
5042 static int nl80211_update_mesh_config(struct sk_buff *skb,
5043                                       struct genl_info *info)
5044 {
5045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5046         struct net_device *dev = info->user_ptr[1];
5047         struct wireless_dev *wdev = dev->ieee80211_ptr;
5048         struct mesh_config cfg;
5049         u32 mask;
5050         int err;
5051
5052         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5053                 return -EOPNOTSUPP;
5054
5055         if (!rdev->ops->update_mesh_config)
5056                 return -EOPNOTSUPP;
5057
5058         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5059         if (err)
5060                 return err;
5061
5062         wdev_lock(wdev);
5063         if (!wdev->mesh_id_len)
5064                 err = -ENOLINK;
5065
5066         if (!err)
5067                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5068
5069         wdev_unlock(wdev);
5070
5071         return err;
5072 }
5073
5074 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5075 {
5076         const struct ieee80211_regdomain *regdom;
5077         struct sk_buff *msg;
5078         void *hdr = NULL;
5079         struct nlattr *nl_reg_rules;
5080         unsigned int i;
5081
5082         if (!cfg80211_regdomain)
5083                 return -EINVAL;
5084
5085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5086         if (!msg)
5087                 return -ENOBUFS;
5088
5089         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5090                              NL80211_CMD_GET_REG);
5091         if (!hdr)
5092                 goto put_failure;
5093
5094         if (reg_last_request_cell_base() &&
5095             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5096                         NL80211_USER_REG_HINT_CELL_BASE))
5097                 goto nla_put_failure;
5098
5099         rcu_read_lock();
5100         regdom = rcu_dereference(cfg80211_regdomain);
5101
5102         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5103             (regdom->dfs_region &&
5104              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5105                 goto nla_put_failure_rcu;
5106
5107         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5108         if (!nl_reg_rules)
5109                 goto nla_put_failure_rcu;
5110
5111         for (i = 0; i < regdom->n_reg_rules; i++) {
5112                 struct nlattr *nl_reg_rule;
5113                 const struct ieee80211_reg_rule *reg_rule;
5114                 const struct ieee80211_freq_range *freq_range;
5115                 const struct ieee80211_power_rule *power_rule;
5116
5117                 reg_rule = &regdom->reg_rules[i];
5118                 freq_range = &reg_rule->freq_range;
5119                 power_rule = &reg_rule->power_rule;
5120
5121                 nl_reg_rule = nla_nest_start(msg, i);
5122                 if (!nl_reg_rule)
5123                         goto nla_put_failure_rcu;
5124
5125                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5126                                 reg_rule->flags) ||
5127                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5128                                 freq_range->start_freq_khz) ||
5129                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5130                                 freq_range->end_freq_khz) ||
5131                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5132                                 freq_range->max_bandwidth_khz) ||
5133                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5134                                 power_rule->max_antenna_gain) ||
5135                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5136                                 power_rule->max_eirp))
5137                         goto nla_put_failure_rcu;
5138
5139                 nla_nest_end(msg, nl_reg_rule);
5140         }
5141         rcu_read_unlock();
5142
5143         nla_nest_end(msg, nl_reg_rules);
5144
5145         genlmsg_end(msg, hdr);
5146         return genlmsg_reply(msg, info);
5147
5148 nla_put_failure_rcu:
5149         rcu_read_unlock();
5150 nla_put_failure:
5151         genlmsg_cancel(msg, hdr);
5152 put_failure:
5153         nlmsg_free(msg);
5154         return -EMSGSIZE;
5155 }
5156
5157 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5158 {
5159         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5160         struct nlattr *nl_reg_rule;
5161         char *alpha2 = NULL;
5162         int rem_reg_rules = 0, r = 0;
5163         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5164         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5165         struct ieee80211_regdomain *rd = NULL;
5166
5167         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5168                 return -EINVAL;
5169
5170         if (!info->attrs[NL80211_ATTR_REG_RULES])
5171                 return -EINVAL;
5172
5173         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5174
5175         if (info->attrs[NL80211_ATTR_DFS_REGION])
5176                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5177
5178         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5179                             rem_reg_rules) {
5180                 num_rules++;
5181                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5182                         return -EINVAL;
5183         }
5184
5185         if (!reg_is_valid_request(alpha2))
5186                 return -EINVAL;
5187
5188         size_of_regd = sizeof(struct ieee80211_regdomain) +
5189                        num_rules * sizeof(struct ieee80211_reg_rule);
5190
5191         rd = kzalloc(size_of_regd, GFP_KERNEL);
5192         if (!rd)
5193                 return -ENOMEM;
5194
5195         rd->n_reg_rules = num_rules;
5196         rd->alpha2[0] = alpha2[0];
5197         rd->alpha2[1] = alpha2[1];
5198
5199         /*
5200          * Disable DFS master mode if the DFS region was
5201          * not supported or known on this kernel.
5202          */
5203         if (reg_supported_dfs_region(dfs_region))
5204                 rd->dfs_region = dfs_region;
5205
5206         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5207                             rem_reg_rules) {
5208                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5209                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5210                           reg_rule_policy);
5211                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5212                 if (r)
5213                         goto bad_reg;
5214
5215                 rule_idx++;
5216
5217                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5218                         r = -EINVAL;
5219                         goto bad_reg;
5220                 }
5221         }
5222
5223         r = set_regdom(rd);
5224         /* set_regdom took ownership */
5225         rd = NULL;
5226
5227  bad_reg:
5228         kfree(rd);
5229         return r;
5230 }
5231
5232 static int validate_scan_freqs(struct nlattr *freqs)
5233 {
5234         struct nlattr *attr1, *attr2;
5235         int n_channels = 0, tmp1, tmp2;
5236
5237         nla_for_each_nested(attr1, freqs, tmp1) {
5238                 n_channels++;
5239                 /*
5240                  * Some hardware has a limited channel list for
5241                  * scanning, and it is pretty much nonsensical
5242                  * to scan for a channel twice, so disallow that
5243                  * and don't require drivers to check that the
5244                  * channel list they get isn't longer than what
5245                  * they can scan, as long as they can scan all
5246                  * the channels they registered at once.
5247                  */
5248                 nla_for_each_nested(attr2, freqs, tmp2)
5249                         if (attr1 != attr2 &&
5250                             nla_get_u32(attr1) == nla_get_u32(attr2))
5251                                 return 0;
5252         }
5253
5254         return n_channels;
5255 }
5256
5257 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5258 {
5259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5260         struct wireless_dev *wdev = info->user_ptr[1];
5261         struct cfg80211_scan_request *request;
5262         struct nlattr *attr;
5263         struct wiphy *wiphy;
5264         int err, tmp, n_ssids = 0, n_channels, i;
5265         size_t ie_len;
5266
5267         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5268                 return -EINVAL;
5269
5270         wiphy = &rdev->wiphy;
5271
5272         if (!rdev->ops->scan)
5273                 return -EOPNOTSUPP;
5274
5275         if (rdev->scan_req) {
5276                 err = -EBUSY;
5277                 goto unlock;
5278         }
5279
5280         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5281                 n_channels = validate_scan_freqs(
5282                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5283                 if (!n_channels) {
5284                         err = -EINVAL;
5285                         goto unlock;
5286                 }
5287         } else {
5288                 enum ieee80211_band band;
5289                 n_channels = 0;
5290
5291                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5292                         if (wiphy->bands[band])
5293                                 n_channels += wiphy->bands[band]->n_channels;
5294         }
5295
5296         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5297                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5298                         n_ssids++;
5299
5300         if (n_ssids > wiphy->max_scan_ssids) {
5301                 err = -EINVAL;
5302                 goto unlock;
5303         }
5304
5305         if (info->attrs[NL80211_ATTR_IE])
5306                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5307         else
5308                 ie_len = 0;
5309
5310         if (ie_len > wiphy->max_scan_ie_len) {
5311                 err = -EINVAL;
5312                 goto unlock;
5313         }
5314
5315         request = kzalloc(sizeof(*request)
5316                         + sizeof(*request->ssids) * n_ssids
5317                         + sizeof(*request->channels) * n_channels
5318                         + ie_len, GFP_KERNEL);
5319         if (!request) {
5320                 err = -ENOMEM;
5321                 goto unlock;
5322         }
5323
5324         if (n_ssids)
5325                 request->ssids = (void *)&request->channels[n_channels];
5326         request->n_ssids = n_ssids;
5327         if (ie_len) {
5328                 if (request->ssids)
5329                         request->ie = (void *)(request->ssids + n_ssids);
5330                 else
5331                         request->ie = (void *)(request->channels + n_channels);
5332         }
5333
5334         i = 0;
5335         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5336                 /* user specified, bail out if channel not found */
5337                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5338                         struct ieee80211_channel *chan;
5339
5340                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5341
5342                         if (!chan) {
5343                                 err = -EINVAL;
5344                                 goto out_free;
5345                         }
5346
5347                         /* ignore disabled channels */
5348                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5349                                 continue;
5350
5351                         request->channels[i] = chan;
5352                         i++;
5353                 }
5354         } else {
5355                 enum ieee80211_band band;
5356
5357                 /* all channels */
5358                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5359                         int j;
5360                         if (!wiphy->bands[band])
5361                                 continue;
5362                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5363                                 struct ieee80211_channel *chan;
5364
5365                                 chan = &wiphy->bands[band]->channels[j];
5366
5367                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5368                                         continue;
5369
5370                                 request->channels[i] = chan;
5371                                 i++;
5372                         }
5373                 }
5374         }
5375
5376         if (!i) {
5377                 err = -EINVAL;
5378                 goto out_free;
5379         }
5380
5381         request->n_channels = i;
5382
5383         i = 0;
5384         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5385                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5386                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5387                                 err = -EINVAL;
5388                                 goto out_free;
5389                         }
5390                         request->ssids[i].ssid_len = nla_len(attr);
5391                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5392                         i++;
5393                 }
5394         }
5395
5396         if (info->attrs[NL80211_ATTR_IE]) {
5397                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5398                 memcpy((void *)request->ie,
5399                        nla_data(info->attrs[NL80211_ATTR_IE]),
5400                        request->ie_len);
5401         }
5402
5403         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5404                 if (wiphy->bands[i])
5405                         request->rates[i] =
5406                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5407
5408         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5409                 nla_for_each_nested(attr,
5410                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5411                                     tmp) {
5412                         enum ieee80211_band band = nla_type(attr);
5413
5414                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5415                                 err = -EINVAL;
5416                                 goto out_free;
5417                         }
5418
5419                         if (!wiphy->bands[band])
5420                                 continue;
5421
5422                         err = ieee80211_get_ratemask(wiphy->bands[band],
5423                                                      nla_data(attr),
5424                                                      nla_len(attr),
5425                                                      &request->rates[band]);
5426                         if (err)
5427                                 goto out_free;
5428                 }
5429         }
5430
5431         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5432                 request->flags = nla_get_u32(
5433                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5434                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5435                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5436                         err = -EOPNOTSUPP;
5437                         goto out_free;
5438                 }
5439         }
5440
5441         request->no_cck =
5442                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5443
5444         request->wdev = wdev;
5445         request->wiphy = &rdev->wiphy;
5446         request->scan_start = jiffies;
5447
5448         rdev->scan_req = request;
5449         err = rdev_scan(rdev, request);
5450
5451         if (!err) {
5452                 nl80211_send_scan_start(rdev, wdev);
5453                 if (wdev->netdev)
5454                         dev_hold(wdev->netdev);
5455         } else {
5456  out_free:
5457                 rdev->scan_req = NULL;
5458                 kfree(request);
5459         }
5460
5461  unlock:
5462         return err;
5463 }
5464
5465 static int nl80211_start_sched_scan(struct sk_buff *skb,
5466                                     struct genl_info *info)
5467 {
5468         struct cfg80211_sched_scan_request *request;
5469         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5470         struct net_device *dev = info->user_ptr[1];
5471         struct nlattr *attr;
5472         struct wiphy *wiphy;
5473         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5474         u32 interval;
5475         enum ieee80211_band band;
5476         size_t ie_len;
5477         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5478
5479         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5480             !rdev->ops->sched_scan_start)
5481                 return -EOPNOTSUPP;
5482
5483         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5484                 return -EINVAL;
5485
5486         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5487                 return -EINVAL;
5488
5489         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5490         if (interval == 0)
5491                 return -EINVAL;
5492
5493         wiphy = &rdev->wiphy;
5494
5495         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5496                 n_channels = validate_scan_freqs(
5497                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5498                 if (!n_channels)
5499                         return -EINVAL;
5500         } else {
5501                 n_channels = 0;
5502
5503                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5504                         if (wiphy->bands[band])
5505                                 n_channels += wiphy->bands[band]->n_channels;
5506         }
5507
5508         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5509                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5510                                     tmp)
5511                         n_ssids++;
5512
5513         if (n_ssids > wiphy->max_sched_scan_ssids)
5514                 return -EINVAL;
5515
5516         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5517                 nla_for_each_nested(attr,
5518                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5519                                     tmp)
5520                         n_match_sets++;
5521
5522         if (n_match_sets > wiphy->max_match_sets)
5523                 return -EINVAL;
5524
5525         if (info->attrs[NL80211_ATTR_IE])
5526                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5527         else
5528                 ie_len = 0;
5529
5530         if (ie_len > wiphy->max_sched_scan_ie_len)
5531                 return -EINVAL;
5532
5533         if (rdev->sched_scan_req) {
5534                 err = -EINPROGRESS;
5535                 goto out;
5536         }
5537
5538         request = kzalloc(sizeof(*request)
5539                         + sizeof(*request->ssids) * n_ssids
5540                         + sizeof(*request->match_sets) * n_match_sets
5541                         + sizeof(*request->channels) * n_channels
5542                         + ie_len, GFP_KERNEL);
5543         if (!request) {
5544                 err = -ENOMEM;
5545                 goto out;
5546         }
5547
5548         if (n_ssids)
5549                 request->ssids = (void *)&request->channels[n_channels];
5550         request->n_ssids = n_ssids;
5551         if (ie_len) {
5552                 if (request->ssids)
5553                         request->ie = (void *)(request->ssids + n_ssids);
5554                 else
5555                         request->ie = (void *)(request->channels + n_channels);
5556         }
5557
5558         if (n_match_sets) {
5559                 if (request->ie)
5560                         request->match_sets = (void *)(request->ie + ie_len);
5561                 else if (request->ssids)
5562                         request->match_sets =
5563                                 (void *)(request->ssids + n_ssids);
5564                 else
5565                         request->match_sets =
5566                                 (void *)(request->channels + n_channels);
5567         }
5568         request->n_match_sets = n_match_sets;
5569
5570         i = 0;
5571         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5572                 /* user specified, bail out if channel not found */
5573                 nla_for_each_nested(attr,
5574                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5575                                     tmp) {
5576                         struct ieee80211_channel *chan;
5577
5578                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5579
5580                         if (!chan) {
5581                                 err = -EINVAL;
5582                                 goto out_free;
5583                         }
5584
5585                         /* ignore disabled channels */
5586                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5587                                 continue;
5588
5589                         request->channels[i] = chan;
5590                         i++;
5591                 }
5592         } else {
5593                 /* all channels */
5594                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5595                         int j;
5596                         if (!wiphy->bands[band])
5597                                 continue;
5598                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5599                                 struct ieee80211_channel *chan;
5600
5601                                 chan = &wiphy->bands[band]->channels[j];
5602
5603                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5604                                         continue;
5605
5606                                 request->channels[i] = chan;
5607                                 i++;
5608                         }
5609                 }
5610         }
5611
5612         if (!i) {
5613                 err = -EINVAL;
5614                 goto out_free;
5615         }
5616
5617         request->n_channels = i;
5618
5619         i = 0;
5620         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5621                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5622                                     tmp) {
5623                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5624                                 err = -EINVAL;
5625                                 goto out_free;
5626                         }
5627                         request->ssids[i].ssid_len = nla_len(attr);
5628                         memcpy(request->ssids[i].ssid, nla_data(attr),
5629                                nla_len(attr));
5630                         i++;
5631                 }
5632         }
5633
5634         i = 0;
5635         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5636                 nla_for_each_nested(attr,
5637                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5638                                     tmp) {
5639                         struct nlattr *ssid, *rssi;
5640
5641                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5642                                   nla_data(attr), nla_len(attr),
5643                                   nl80211_match_policy);
5644                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5645                         if (ssid) {
5646                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5647                                         err = -EINVAL;
5648                                         goto out_free;
5649                                 }
5650                                 memcpy(request->match_sets[i].ssid.ssid,
5651                                        nla_data(ssid), nla_len(ssid));
5652                                 request->match_sets[i].ssid.ssid_len =
5653                                         nla_len(ssid);
5654                         }
5655                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5656                         if (rssi)
5657                                 request->rssi_thold = nla_get_u32(rssi);
5658                         else
5659                                 request->rssi_thold =
5660                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5661                         i++;
5662                 }
5663         }
5664
5665         if (info->attrs[NL80211_ATTR_IE]) {
5666                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5667                 memcpy((void *)request->ie,
5668                        nla_data(info->attrs[NL80211_ATTR_IE]),
5669                        request->ie_len);
5670         }
5671
5672         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5673                 request->flags = nla_get_u32(
5674                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5675                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5676                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5677                         err = -EOPNOTSUPP;
5678                         goto out_free;
5679                 }
5680         }
5681
5682         request->dev = dev;
5683         request->wiphy = &rdev->wiphy;
5684         request->interval = interval;
5685         request->scan_start = jiffies;
5686
5687         err = rdev_sched_scan_start(rdev, dev, request);
5688         if (!err) {
5689                 rdev->sched_scan_req = request;
5690                 nl80211_send_sched_scan(rdev, dev,
5691                                         NL80211_CMD_START_SCHED_SCAN);
5692                 goto out;
5693         }
5694
5695 out_free:
5696         kfree(request);
5697 out:
5698         return err;
5699 }
5700
5701 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5702                                    struct genl_info *info)
5703 {
5704         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5705
5706         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5707             !rdev->ops->sched_scan_stop)
5708                 return -EOPNOTSUPP;
5709
5710         return __cfg80211_stop_sched_scan(rdev, false);
5711 }
5712
5713 static int nl80211_start_radar_detection(struct sk_buff *skb,
5714                                          struct genl_info *info)
5715 {
5716         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5717         struct net_device *dev = info->user_ptr[1];
5718         struct wireless_dev *wdev = dev->ieee80211_ptr;
5719         struct cfg80211_chan_def chandef;
5720         enum nl80211_dfs_regions dfs_region;
5721         int err;
5722
5723         dfs_region = reg_get_dfs_region(wdev->wiphy);
5724         if (dfs_region == NL80211_DFS_UNSET)
5725                 return -EINVAL;
5726
5727         err = nl80211_parse_chandef(rdev, info, &chandef);
5728         if (err)
5729                 return err;
5730
5731         if (netif_carrier_ok(dev))
5732                 return -EBUSY;
5733
5734         if (wdev->cac_started)
5735                 return -EBUSY;
5736
5737         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5738         if (err < 0)
5739                 return err;
5740
5741         if (err == 0)
5742                 return -EINVAL;
5743
5744         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5745                 return -EINVAL;
5746
5747         if (!rdev->ops->start_radar_detection)
5748                 return -EOPNOTSUPP;
5749
5750         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5751                                            chandef.chan, CHAN_MODE_SHARED,
5752                                            BIT(chandef.width));
5753         if (err)
5754                 return err;
5755
5756         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5757         if (!err) {
5758                 wdev->channel = chandef.chan;
5759                 wdev->cac_started = true;
5760                 wdev->cac_start_time = jiffies;
5761         }
5762         return err;
5763 }
5764
5765 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5766 {
5767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5768         struct net_device *dev = info->user_ptr[1];
5769         struct wireless_dev *wdev = dev->ieee80211_ptr;
5770         struct cfg80211_csa_settings params;
5771         /* csa_attrs is defined static to avoid waste of stack size - this
5772          * function is called under RTNL lock, so this should not be a problem.
5773          */
5774         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5775         u8 radar_detect_width = 0;
5776         int err;
5777         bool need_new_beacon = false;
5778
5779         if (!rdev->ops->channel_switch ||
5780             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5781                 return -EOPNOTSUPP;
5782
5783         switch (dev->ieee80211_ptr->iftype) {
5784         case NL80211_IFTYPE_AP:
5785         case NL80211_IFTYPE_P2P_GO:
5786                 need_new_beacon = true;
5787
5788                 /* useless if AP is not running */
5789                 if (!wdev->beacon_interval)
5790                         return -EINVAL;
5791                 break;
5792         case NL80211_IFTYPE_ADHOC:
5793         case NL80211_IFTYPE_MESH_POINT:
5794                 break;
5795         default:
5796                 return -EOPNOTSUPP;
5797         }
5798
5799         memset(&params, 0, sizeof(params));
5800
5801         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5802             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5803                 return -EINVAL;
5804
5805         /* only important for AP, IBSS and mesh create IEs internally */
5806         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5807                 return -EINVAL;
5808
5809         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5810
5811         if (!need_new_beacon)
5812                 goto skip_beacons;
5813
5814         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5815         if (err)
5816                 return err;
5817
5818         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5819                                info->attrs[NL80211_ATTR_CSA_IES],
5820                                nl80211_policy);
5821         if (err)
5822                 return err;
5823
5824         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5825         if (err)
5826                 return err;
5827
5828         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5829                 return -EINVAL;
5830
5831         params.counter_offset_beacon =
5832                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5833         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5834                 return -EINVAL;
5835
5836         /* sanity check - counters should be the same */
5837         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5838             params.count)
5839                 return -EINVAL;
5840
5841         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5842                 params.counter_offset_presp =
5843                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5844                 if (params.counter_offset_presp >=
5845                     params.beacon_csa.probe_resp_len)
5846                         return -EINVAL;
5847
5848                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5849                     params.count)
5850                         return -EINVAL;
5851         }
5852
5853 skip_beacons:
5854         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5855         if (err)
5856                 return err;
5857
5858         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
5859                 return -EINVAL;
5860
5861         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5862             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
5863             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5864                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
5865                                                     &params.chandef);
5866                 if (err < 0) {
5867                         return err;
5868                 } else if (err) {
5869                         radar_detect_width = BIT(params.chandef.width);
5870                         params.radar_required = true;
5871                 }
5872         }
5873
5874         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5875                                            params.chandef.chan,
5876                                            CHAN_MODE_SHARED,
5877                                            radar_detect_width);
5878         if (err)
5879                 return err;
5880
5881         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5882                 params.block_tx = true;
5883
5884         wdev_lock(wdev);
5885         err = rdev_channel_switch(rdev, dev, &params);
5886         wdev_unlock(wdev);
5887
5888         return err;
5889 }
5890
5891 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5892                             u32 seq, int flags,
5893                             struct cfg80211_registered_device *rdev,
5894                             struct wireless_dev *wdev,
5895                             struct cfg80211_internal_bss *intbss)
5896 {
5897         struct cfg80211_bss *res = &intbss->pub;
5898         const struct cfg80211_bss_ies *ies;
5899         void *hdr;
5900         struct nlattr *bss;
5901         bool tsf = false;
5902
5903         ASSERT_WDEV_LOCK(wdev);
5904
5905         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5906                              NL80211_CMD_NEW_SCAN_RESULTS);
5907         if (!hdr)
5908                 return -1;
5909
5910         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5911
5912         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5913                 goto nla_put_failure;
5914         if (wdev->netdev &&
5915             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5916                 goto nla_put_failure;
5917         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5918                 goto nla_put_failure;
5919
5920         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5921         if (!bss)
5922                 goto nla_put_failure;
5923         if ((!is_zero_ether_addr(res->bssid) &&
5924              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5925                 goto nla_put_failure;
5926
5927         rcu_read_lock();
5928         ies = rcu_dereference(res->ies);
5929         if (ies) {
5930                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5931                         goto fail_unlock_rcu;
5932                 tsf = true;
5933                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5934                                         ies->len, ies->data))
5935                         goto fail_unlock_rcu;
5936         }
5937         ies = rcu_dereference(res->beacon_ies);
5938         if (ies) {
5939                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5940                         goto fail_unlock_rcu;
5941                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5942                                         ies->len, ies->data))
5943                         goto fail_unlock_rcu;
5944         }
5945         rcu_read_unlock();
5946
5947         if (res->beacon_interval &&
5948             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5949                 goto nla_put_failure;
5950         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5951             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5952             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5953             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5954                         jiffies_to_msecs(jiffies - intbss->ts)))
5955                 goto nla_put_failure;
5956
5957         switch (rdev->wiphy.signal_type) {
5958         case CFG80211_SIGNAL_TYPE_MBM:
5959                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5960                         goto nla_put_failure;
5961                 break;
5962         case CFG80211_SIGNAL_TYPE_UNSPEC:
5963                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5964                         goto nla_put_failure;
5965                 break;
5966         default:
5967                 break;
5968         }
5969
5970         switch (wdev->iftype) {
5971         case NL80211_IFTYPE_P2P_CLIENT:
5972         case NL80211_IFTYPE_STATION:
5973                 if (intbss == wdev->current_bss &&
5974                     nla_put_u32(msg, NL80211_BSS_STATUS,
5975                                 NL80211_BSS_STATUS_ASSOCIATED))
5976                         goto nla_put_failure;
5977                 break;
5978         case NL80211_IFTYPE_ADHOC:
5979                 if (intbss == wdev->current_bss &&
5980                     nla_put_u32(msg, NL80211_BSS_STATUS,
5981                                 NL80211_BSS_STATUS_IBSS_JOINED))
5982                         goto nla_put_failure;
5983                 break;
5984         default:
5985                 break;
5986         }
5987
5988         nla_nest_end(msg, bss);
5989
5990         return genlmsg_end(msg, hdr);
5991
5992  fail_unlock_rcu:
5993         rcu_read_unlock();
5994  nla_put_failure:
5995         genlmsg_cancel(msg, hdr);
5996         return -EMSGSIZE;
5997 }
5998
5999 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6000 {
6001         struct cfg80211_registered_device *rdev;
6002         struct cfg80211_internal_bss *scan;
6003         struct wireless_dev *wdev;
6004         int start = cb->args[2], idx = 0;
6005         int err;
6006
6007         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6008         if (err)
6009                 return err;
6010
6011         wdev_lock(wdev);
6012         spin_lock_bh(&rdev->bss_lock);
6013         cfg80211_bss_expire(rdev);
6014
6015         cb->seq = rdev->bss_generation;
6016
6017         list_for_each_entry(scan, &rdev->bss_list, list) {
6018                 if (++idx <= start)
6019                         continue;
6020                 if (nl80211_send_bss(skb, cb,
6021                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6022                                 rdev, wdev, scan) < 0) {
6023                         idx--;
6024                         break;
6025                 }
6026         }
6027
6028         spin_unlock_bh(&rdev->bss_lock);
6029         wdev_unlock(wdev);
6030
6031         cb->args[2] = idx;
6032         nl80211_finish_wdev_dump(rdev);
6033
6034         return skb->len;
6035 }
6036
6037 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6038                                 int flags, struct net_device *dev,
6039                                 struct survey_info *survey)
6040 {
6041         void *hdr;
6042         struct nlattr *infoattr;
6043
6044         hdr = nl80211hdr_put(msg, portid, seq, flags,
6045                              NL80211_CMD_NEW_SURVEY_RESULTS);
6046         if (!hdr)
6047                 return -ENOMEM;
6048
6049         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6050                 goto nla_put_failure;
6051
6052         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6053         if (!infoattr)
6054                 goto nla_put_failure;
6055
6056         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6057                         survey->channel->center_freq))
6058                 goto nla_put_failure;
6059
6060         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6061             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6062                 goto nla_put_failure;
6063         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6064             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6065                 goto nla_put_failure;
6066         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6067             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6068                         survey->channel_time))
6069                 goto nla_put_failure;
6070         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6071             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6072                         survey->channel_time_busy))
6073                 goto nla_put_failure;
6074         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6075             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6076                         survey->channel_time_ext_busy))
6077                 goto nla_put_failure;
6078         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6079             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6080                         survey->channel_time_rx))
6081                 goto nla_put_failure;
6082         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6083             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6084                         survey->channel_time_tx))
6085                 goto nla_put_failure;
6086
6087         nla_nest_end(msg, infoattr);
6088
6089         return genlmsg_end(msg, hdr);
6090
6091  nla_put_failure:
6092         genlmsg_cancel(msg, hdr);
6093         return -EMSGSIZE;
6094 }
6095
6096 static int nl80211_dump_survey(struct sk_buff *skb,
6097                         struct netlink_callback *cb)
6098 {
6099         struct survey_info survey;
6100         struct cfg80211_registered_device *dev;
6101         struct wireless_dev *wdev;
6102         int survey_idx = cb->args[2];
6103         int res;
6104
6105         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6106         if (res)
6107                 return res;
6108
6109         if (!wdev->netdev) {
6110                 res = -EINVAL;
6111                 goto out_err;
6112         }
6113
6114         if (!dev->ops->dump_survey) {
6115                 res = -EOPNOTSUPP;
6116                 goto out_err;
6117         }
6118
6119         while (1) {
6120                 struct ieee80211_channel *chan;
6121
6122                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6123                 if (res == -ENOENT)
6124                         break;
6125                 if (res)
6126                         goto out_err;
6127
6128                 /* Survey without a channel doesn't make sense */
6129                 if (!survey.channel) {
6130                         res = -EINVAL;
6131                         goto out;
6132                 }
6133
6134                 chan = ieee80211_get_channel(&dev->wiphy,
6135                                              survey.channel->center_freq);
6136                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6137                         survey_idx++;
6138                         continue;
6139                 }
6140
6141                 if (nl80211_send_survey(skb,
6142                                 NETLINK_CB(cb->skb).portid,
6143                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6144                                 wdev->netdev, &survey) < 0)
6145                         goto out;
6146                 survey_idx++;
6147         }
6148
6149  out:
6150         cb->args[2] = survey_idx;
6151         res = skb->len;
6152  out_err:
6153         nl80211_finish_wdev_dump(dev);
6154         return res;
6155 }
6156
6157 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6158 {
6159         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6160                                   NL80211_WPA_VERSION_2));
6161 }
6162
6163 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6164 {
6165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6166         struct net_device *dev = info->user_ptr[1];
6167         struct ieee80211_channel *chan;
6168         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6169         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6170         enum nl80211_auth_type auth_type;
6171         struct key_parse key;
6172         bool local_state_change;
6173
6174         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6175                 return -EINVAL;
6176
6177         if (!info->attrs[NL80211_ATTR_MAC])
6178                 return -EINVAL;
6179
6180         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6181                 return -EINVAL;
6182
6183         if (!info->attrs[NL80211_ATTR_SSID])
6184                 return -EINVAL;
6185
6186         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6187                 return -EINVAL;
6188
6189         err = nl80211_parse_key(info, &key);
6190         if (err)
6191                 return err;
6192
6193         if (key.idx >= 0) {
6194                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6195                         return -EINVAL;
6196                 if (!key.p.key || !key.p.key_len)
6197                         return -EINVAL;
6198                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6199                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6200                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6201                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6202                         return -EINVAL;
6203                 if (key.idx > 4)
6204                         return -EINVAL;
6205         } else {
6206                 key.p.key_len = 0;
6207                 key.p.key = NULL;
6208         }
6209
6210         if (key.idx >= 0) {
6211                 int i;
6212                 bool ok = false;
6213                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6214                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6215                                 ok = true;
6216                                 break;
6217                         }
6218                 }
6219                 if (!ok)
6220                         return -EINVAL;
6221         }
6222
6223         if (!rdev->ops->auth)
6224                 return -EOPNOTSUPP;
6225
6226         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6227             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6228                 return -EOPNOTSUPP;
6229
6230         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6231         chan = ieee80211_get_channel(&rdev->wiphy,
6232                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6233         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6234                 return -EINVAL;
6235
6236         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6237         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6238
6239         if (info->attrs[NL80211_ATTR_IE]) {
6240                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6241                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6242         }
6243
6244         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6245         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6246                 return -EINVAL;
6247
6248         if (auth_type == NL80211_AUTHTYPE_SAE &&
6249             !info->attrs[NL80211_ATTR_SAE_DATA])
6250                 return -EINVAL;
6251
6252         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6253                 if (auth_type != NL80211_AUTHTYPE_SAE)
6254                         return -EINVAL;
6255                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6256                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6257                 /* need to include at least Auth Transaction and Status Code */
6258                 if (sae_data_len < 4)
6259                         return -EINVAL;
6260         }
6261
6262         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6263
6264         /*
6265          * Since we no longer track auth state, ignore
6266          * requests to only change local state.
6267          */
6268         if (local_state_change)
6269                 return 0;
6270
6271         wdev_lock(dev->ieee80211_ptr);
6272         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6273                                  ssid, ssid_len, ie, ie_len,
6274                                  key.p.key, key.p.key_len, key.idx,
6275                                  sae_data, sae_data_len);
6276         wdev_unlock(dev->ieee80211_ptr);
6277         return err;
6278 }
6279
6280 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6281                                    struct genl_info *info,
6282                                    struct cfg80211_crypto_settings *settings,
6283                                    int cipher_limit)
6284 {
6285         memset(settings, 0, sizeof(*settings));
6286
6287         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6288
6289         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6290                 u16 proto;
6291                 proto = nla_get_u16(
6292                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6293                 settings->control_port_ethertype = cpu_to_be16(proto);
6294                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6295                     proto != ETH_P_PAE)
6296                         return -EINVAL;
6297                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6298                         settings->control_port_no_encrypt = true;
6299         } else
6300                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6301
6302         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6303                 void *data;
6304                 int len, i;
6305
6306                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6307                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6308                 settings->n_ciphers_pairwise = len / sizeof(u32);
6309
6310                 if (len % sizeof(u32))
6311                         return -EINVAL;
6312
6313                 if (settings->n_ciphers_pairwise > cipher_limit)
6314                         return -EINVAL;
6315
6316                 memcpy(settings->ciphers_pairwise, data, len);
6317
6318                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6319                         if (!cfg80211_supported_cipher_suite(
6320                                         &rdev->wiphy,
6321                                         settings->ciphers_pairwise[i]))
6322                                 return -EINVAL;
6323         }
6324
6325         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6326                 settings->cipher_group =
6327                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6328                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6329                                                      settings->cipher_group))
6330                         return -EINVAL;
6331         }
6332
6333         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6334                 settings->wpa_versions =
6335                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6336                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6337                         return -EINVAL;
6338         }
6339
6340         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6341                 void *data;
6342                 int len;
6343
6344                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6345                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6346                 settings->n_akm_suites = len / sizeof(u32);
6347
6348                 if (len % sizeof(u32))
6349                         return -EINVAL;
6350
6351                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6352                         return -EINVAL;
6353
6354                 memcpy(settings->akm_suites, data, len);
6355         }
6356
6357         return 0;
6358 }
6359
6360 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6361 {
6362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6363         struct net_device *dev = info->user_ptr[1];
6364         struct ieee80211_channel *chan;
6365         struct cfg80211_assoc_request req = {};
6366         const u8 *bssid, *ssid;
6367         int err, ssid_len = 0;
6368
6369         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6370                 return -EINVAL;
6371
6372         if (!info->attrs[NL80211_ATTR_MAC] ||
6373             !info->attrs[NL80211_ATTR_SSID] ||
6374             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6375                 return -EINVAL;
6376
6377         if (!rdev->ops->assoc)
6378                 return -EOPNOTSUPP;
6379
6380         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6381             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6382                 return -EOPNOTSUPP;
6383
6384         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6385
6386         chan = ieee80211_get_channel(&rdev->wiphy,
6387                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6388         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6389                 return -EINVAL;
6390
6391         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6392         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6393
6394         if (info->attrs[NL80211_ATTR_IE]) {
6395                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6396                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6397         }
6398
6399         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6400                 enum nl80211_mfp mfp =
6401                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6402                 if (mfp == NL80211_MFP_REQUIRED)
6403                         req.use_mfp = true;
6404                 else if (mfp != NL80211_MFP_NO)
6405                         return -EINVAL;
6406         }
6407
6408         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6409                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6410
6411         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6412                 req.flags |= ASSOC_REQ_DISABLE_HT;
6413
6414         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6415                 memcpy(&req.ht_capa_mask,
6416                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6417                        sizeof(req.ht_capa_mask));
6418
6419         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6420                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6421                         return -EINVAL;
6422                 memcpy(&req.ht_capa,
6423                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6424                        sizeof(req.ht_capa));
6425         }
6426
6427         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6428                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6429
6430         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6431                 memcpy(&req.vht_capa_mask,
6432                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6433                        sizeof(req.vht_capa_mask));
6434
6435         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6436                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6437                         return -EINVAL;
6438                 memcpy(&req.vht_capa,
6439                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6440                        sizeof(req.vht_capa));
6441         }
6442
6443         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6444         if (!err) {
6445                 wdev_lock(dev->ieee80211_ptr);
6446                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6447                                           ssid, ssid_len, &req);
6448                 wdev_unlock(dev->ieee80211_ptr);
6449         }
6450
6451         return err;
6452 }
6453
6454 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6455 {
6456         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6457         struct net_device *dev = info->user_ptr[1];
6458         const u8 *ie = NULL, *bssid;
6459         int ie_len = 0, err;
6460         u16 reason_code;
6461         bool local_state_change;
6462
6463         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6464                 return -EINVAL;
6465
6466         if (!info->attrs[NL80211_ATTR_MAC])
6467                 return -EINVAL;
6468
6469         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6470                 return -EINVAL;
6471
6472         if (!rdev->ops->deauth)
6473                 return -EOPNOTSUPP;
6474
6475         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6476             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6477                 return -EOPNOTSUPP;
6478
6479         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6480
6481         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6482         if (reason_code == 0) {
6483                 /* Reason Code 0 is reserved */
6484                 return -EINVAL;
6485         }
6486
6487         if (info->attrs[NL80211_ATTR_IE]) {
6488                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6489                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6490         }
6491
6492         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6493
6494         wdev_lock(dev->ieee80211_ptr);
6495         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6496                                    local_state_change);
6497         wdev_unlock(dev->ieee80211_ptr);
6498         return err;
6499 }
6500
6501 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6502 {
6503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6504         struct net_device *dev = info->user_ptr[1];
6505         const u8 *ie = NULL, *bssid;
6506         int ie_len = 0, err;
6507         u16 reason_code;
6508         bool local_state_change;
6509
6510         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6511                 return -EINVAL;
6512
6513         if (!info->attrs[NL80211_ATTR_MAC])
6514                 return -EINVAL;
6515
6516         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6517                 return -EINVAL;
6518
6519         if (!rdev->ops->disassoc)
6520                 return -EOPNOTSUPP;
6521
6522         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6523             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6524                 return -EOPNOTSUPP;
6525
6526         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6527
6528         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6529         if (reason_code == 0) {
6530                 /* Reason Code 0 is reserved */
6531                 return -EINVAL;
6532         }
6533
6534         if (info->attrs[NL80211_ATTR_IE]) {
6535                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6536                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6537         }
6538
6539         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6540
6541         wdev_lock(dev->ieee80211_ptr);
6542         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6543                                      local_state_change);
6544         wdev_unlock(dev->ieee80211_ptr);
6545         return err;
6546 }
6547
6548 static bool
6549 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6550                          int mcast_rate[IEEE80211_NUM_BANDS],
6551                          int rateval)
6552 {
6553         struct wiphy *wiphy = &rdev->wiphy;
6554         bool found = false;
6555         int band, i;
6556
6557         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6558                 struct ieee80211_supported_band *sband;
6559
6560                 sband = wiphy->bands[band];
6561                 if (!sband)
6562                         continue;
6563
6564                 for (i = 0; i < sband->n_bitrates; i++) {
6565                         if (sband->bitrates[i].bitrate == rateval) {
6566                                 mcast_rate[band] = i + 1;
6567                                 found = true;
6568                                 break;
6569                         }
6570                 }
6571         }
6572
6573         return found;
6574 }
6575
6576 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6577 {
6578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6579         struct net_device *dev = info->user_ptr[1];
6580         struct cfg80211_ibss_params ibss;
6581         struct wiphy *wiphy;
6582         struct cfg80211_cached_keys *connkeys = NULL;
6583         int err;
6584
6585         memset(&ibss, 0, sizeof(ibss));
6586
6587         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6588                 return -EINVAL;
6589
6590         if (!info->attrs[NL80211_ATTR_SSID] ||
6591             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6592                 return -EINVAL;
6593
6594         ibss.beacon_interval = 100;
6595
6596         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6597                 ibss.beacon_interval =
6598                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6599                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6600                         return -EINVAL;
6601         }
6602
6603         if (!rdev->ops->join_ibss)
6604                 return -EOPNOTSUPP;
6605
6606         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6607                 return -EOPNOTSUPP;
6608
6609         wiphy = &rdev->wiphy;
6610
6611         if (info->attrs[NL80211_ATTR_MAC]) {
6612                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6613
6614                 if (!is_valid_ether_addr(ibss.bssid))
6615                         return -EINVAL;
6616         }
6617         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6618         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6619
6620         if (info->attrs[NL80211_ATTR_IE]) {
6621                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6622                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6623         }
6624
6625         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6626         if (err)
6627                 return err;
6628
6629         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6630                 return -EINVAL;
6631
6632         switch (ibss.chandef.width) {
6633         case NL80211_CHAN_WIDTH_5:
6634         case NL80211_CHAN_WIDTH_10:
6635         case NL80211_CHAN_WIDTH_20_NOHT:
6636                 break;
6637         case NL80211_CHAN_WIDTH_20:
6638         case NL80211_CHAN_WIDTH_40:
6639                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6640                         break;
6641         default:
6642                 return -EINVAL;
6643         }
6644
6645         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6646         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6647
6648         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6649                 u8 *rates =
6650                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6651                 int n_rates =
6652                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6653                 struct ieee80211_supported_band *sband =
6654                         wiphy->bands[ibss.chandef.chan->band];
6655
6656                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6657                                              &ibss.basic_rates);
6658                 if (err)
6659                         return err;
6660         }
6661
6662         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6663                 memcpy(&ibss.ht_capa_mask,
6664                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6665                        sizeof(ibss.ht_capa_mask));
6666
6667         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6668                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6669                         return -EINVAL;
6670                 memcpy(&ibss.ht_capa,
6671                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6672                        sizeof(ibss.ht_capa));
6673         }
6674
6675         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6676             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6677                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6678                 return -EINVAL;
6679
6680         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6681                 bool no_ht = false;
6682
6683                 connkeys = nl80211_parse_connkeys(rdev,
6684                                           info->attrs[NL80211_ATTR_KEYS],
6685                                           &no_ht);
6686                 if (IS_ERR(connkeys))
6687                         return PTR_ERR(connkeys);
6688
6689                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6690                     no_ht) {
6691                         kfree(connkeys);
6692                         return -EINVAL;
6693                 }
6694         }
6695
6696         ibss.control_port =
6697                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6698
6699         ibss.userspace_handles_dfs =
6700                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6701
6702         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6703         if (err)
6704                 kfree(connkeys);
6705         return err;
6706 }
6707
6708 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6709 {
6710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6711         struct net_device *dev = info->user_ptr[1];
6712
6713         if (!rdev->ops->leave_ibss)
6714                 return -EOPNOTSUPP;
6715
6716         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6717                 return -EOPNOTSUPP;
6718
6719         return cfg80211_leave_ibss(rdev, dev, false);
6720 }
6721
6722 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6723 {
6724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6725         struct net_device *dev = info->user_ptr[1];
6726         int mcast_rate[IEEE80211_NUM_BANDS];
6727         u32 nla_rate;
6728         int err;
6729
6730         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6731             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6732                 return -EOPNOTSUPP;
6733
6734         if (!rdev->ops->set_mcast_rate)
6735                 return -EOPNOTSUPP;
6736
6737         memset(mcast_rate, 0, sizeof(mcast_rate));
6738
6739         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6740                 return -EINVAL;
6741
6742         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6743         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6744                 return -EINVAL;
6745
6746         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6747
6748         return err;
6749 }
6750
6751 static struct sk_buff *
6752 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6753                             int approxlen, u32 portid, u32 seq,
6754                             enum nl80211_commands cmd,
6755                             enum nl80211_attrs attr,
6756                             const struct nl80211_vendor_cmd_info *info,
6757                             gfp_t gfp)
6758 {
6759         struct sk_buff *skb;
6760         void *hdr;
6761         struct nlattr *data;
6762
6763         skb = nlmsg_new(approxlen + 100, gfp);
6764         if (!skb)
6765                 return NULL;
6766
6767         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6768         if (!hdr) {
6769                 kfree_skb(skb);
6770                 return NULL;
6771         }
6772
6773         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6774                 goto nla_put_failure;
6775
6776         if (info) {
6777                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6778                                 info->vendor_id))
6779                         goto nla_put_failure;
6780                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6781                                 info->subcmd))
6782                         goto nla_put_failure;
6783         }
6784
6785         data = nla_nest_start(skb, attr);
6786
6787         ((void **)skb->cb)[0] = rdev;
6788         ((void **)skb->cb)[1] = hdr;
6789         ((void **)skb->cb)[2] = data;
6790
6791         return skb;
6792
6793  nla_put_failure:
6794         kfree_skb(skb);
6795         return NULL;
6796 }
6797
6798 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6799                                            enum nl80211_commands cmd,
6800                                            enum nl80211_attrs attr,
6801                                            int vendor_event_idx,
6802                                            int approxlen, gfp_t gfp)
6803 {
6804         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6805         const struct nl80211_vendor_cmd_info *info;
6806
6807         switch (cmd) {
6808         case NL80211_CMD_TESTMODE:
6809                 if (WARN_ON(vendor_event_idx != -1))
6810                         return NULL;
6811                 info = NULL;
6812                 break;
6813         case NL80211_CMD_VENDOR:
6814                 if (WARN_ON(vendor_event_idx < 0 ||
6815                             vendor_event_idx >= wiphy->n_vendor_events))
6816                         return NULL;
6817                 info = &wiphy->vendor_events[vendor_event_idx];
6818                 break;
6819         default:
6820                 WARN_ON(1);
6821                 return NULL;
6822         }
6823
6824         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6825                                            cmd, attr, info, gfp);
6826 }
6827 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6828
6829 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6830 {
6831         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6832         void *hdr = ((void **)skb->cb)[1];
6833         struct nlattr *data = ((void **)skb->cb)[2];
6834         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6835
6836         nla_nest_end(skb, data);
6837         genlmsg_end(skb, hdr);
6838
6839         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6840                 mcgrp = NL80211_MCGRP_VENDOR;
6841
6842         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6843                                 mcgrp, gfp);
6844 }
6845 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6846
6847 #ifdef CONFIG_NL80211_TESTMODE
6848 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6849 {
6850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6851         struct wireless_dev *wdev =
6852                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6853         int err;
6854
6855         if (!rdev->ops->testmode_cmd)
6856                 return -EOPNOTSUPP;
6857
6858         if (IS_ERR(wdev)) {
6859                 err = PTR_ERR(wdev);
6860                 if (err != -EINVAL)
6861                         return err;
6862                 wdev = NULL;
6863         } else if (wdev->wiphy != &rdev->wiphy) {
6864                 return -EINVAL;
6865         }
6866
6867         if (!info->attrs[NL80211_ATTR_TESTDATA])
6868                 return -EINVAL;
6869
6870         rdev->cur_cmd_info = info;
6871         err = rdev_testmode_cmd(rdev, wdev,
6872                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6873                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6874         rdev->cur_cmd_info = NULL;
6875
6876         return err;
6877 }
6878
6879 static int nl80211_testmode_dump(struct sk_buff *skb,
6880                                  struct netlink_callback *cb)
6881 {
6882         struct cfg80211_registered_device *rdev;
6883         int err;
6884         long phy_idx;
6885         void *data = NULL;
6886         int data_len = 0;
6887
6888         rtnl_lock();
6889
6890         if (cb->args[0]) {
6891                 /*
6892                  * 0 is a valid index, but not valid for args[0],
6893                  * so we need to offset by 1.
6894                  */
6895                 phy_idx = cb->args[0] - 1;
6896         } else {
6897                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6898                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6899                                   nl80211_policy);
6900                 if (err)
6901                         goto out_err;
6902
6903                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6904                                                   nl80211_fam.attrbuf);
6905                 if (IS_ERR(rdev)) {
6906                         err = PTR_ERR(rdev);
6907                         goto out_err;
6908                 }
6909                 phy_idx = rdev->wiphy_idx;
6910                 rdev = NULL;
6911
6912                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6913                         cb->args[1] =
6914                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6915         }
6916
6917         if (cb->args[1]) {
6918                 data = nla_data((void *)cb->args[1]);
6919                 data_len = nla_len((void *)cb->args[1]);
6920         }
6921
6922         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6923         if (!rdev) {
6924                 err = -ENOENT;
6925                 goto out_err;
6926         }
6927
6928         if (!rdev->ops->testmode_dump) {
6929                 err = -EOPNOTSUPP;
6930                 goto out_err;
6931         }
6932
6933         while (1) {
6934                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6935                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6936                                            NL80211_CMD_TESTMODE);
6937                 struct nlattr *tmdata;
6938
6939                 if (!hdr)
6940                         break;
6941
6942                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6943                         genlmsg_cancel(skb, hdr);
6944                         break;
6945                 }
6946
6947                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6948                 if (!tmdata) {
6949                         genlmsg_cancel(skb, hdr);
6950                         break;
6951                 }
6952                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6953                 nla_nest_end(skb, tmdata);
6954
6955                 if (err == -ENOBUFS || err == -ENOENT) {
6956                         genlmsg_cancel(skb, hdr);
6957                         break;
6958                 } else if (err) {
6959                         genlmsg_cancel(skb, hdr);
6960                         goto out_err;
6961                 }
6962
6963                 genlmsg_end(skb, hdr);
6964         }
6965
6966         err = skb->len;
6967         /* see above */
6968         cb->args[0] = phy_idx + 1;
6969  out_err:
6970         rtnl_unlock();
6971         return err;
6972 }
6973 #endif
6974
6975 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6976 {
6977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6978         struct net_device *dev = info->user_ptr[1];
6979         struct cfg80211_connect_params connect;
6980         struct wiphy *wiphy;
6981         struct cfg80211_cached_keys *connkeys = NULL;
6982         int err;
6983
6984         memset(&connect, 0, sizeof(connect));
6985
6986         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6987                 return -EINVAL;
6988
6989         if (!info->attrs[NL80211_ATTR_SSID] ||
6990             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6991                 return -EINVAL;
6992
6993         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6994                 connect.auth_type =
6995                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6996                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6997                                              NL80211_CMD_CONNECT))
6998                         return -EINVAL;
6999         } else
7000                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7001
7002         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7003
7004         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7005                                       NL80211_MAX_NR_CIPHER_SUITES);
7006         if (err)
7007                 return err;
7008
7009         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7010             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7011                 return -EOPNOTSUPP;
7012
7013         wiphy = &rdev->wiphy;
7014
7015         connect.bg_scan_period = -1;
7016         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7017                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7018                 connect.bg_scan_period =
7019                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7020         }
7021
7022         if (info->attrs[NL80211_ATTR_MAC])
7023                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7024         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7025         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7026
7027         if (info->attrs[NL80211_ATTR_IE]) {
7028                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7029                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7030         }
7031
7032         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7033                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7034                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7035                     connect.mfp != NL80211_MFP_NO)
7036                         return -EINVAL;
7037         } else {
7038                 connect.mfp = NL80211_MFP_NO;
7039         }
7040
7041         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7042                 connect.channel =
7043                         ieee80211_get_channel(wiphy,
7044                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
7045                 if (!connect.channel ||
7046                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
7047                         return -EINVAL;
7048         }
7049
7050         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7051                 connkeys = nl80211_parse_connkeys(rdev,
7052                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7053                 if (IS_ERR(connkeys))
7054                         return PTR_ERR(connkeys);
7055         }
7056
7057         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7058                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7059
7060         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7061                 memcpy(&connect.ht_capa_mask,
7062                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7063                        sizeof(connect.ht_capa_mask));
7064
7065         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7066                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7067                         kfree(connkeys);
7068                         return -EINVAL;
7069                 }
7070                 memcpy(&connect.ht_capa,
7071                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7072                        sizeof(connect.ht_capa));
7073         }
7074
7075         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7076                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7077
7078         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7079                 memcpy(&connect.vht_capa_mask,
7080                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7081                        sizeof(connect.vht_capa_mask));
7082
7083         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7084                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7085                         kfree(connkeys);
7086                         return -EINVAL;
7087                 }
7088                 memcpy(&connect.vht_capa,
7089                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7090                        sizeof(connect.vht_capa));
7091         }
7092
7093         wdev_lock(dev->ieee80211_ptr);
7094         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7095         wdev_unlock(dev->ieee80211_ptr);
7096         if (err)
7097                 kfree(connkeys);
7098         return err;
7099 }
7100
7101 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7102 {
7103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7104         struct net_device *dev = info->user_ptr[1];
7105         u16 reason;
7106         int ret;
7107
7108         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7109                 reason = WLAN_REASON_DEAUTH_LEAVING;
7110         else
7111                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7112
7113         if (reason == 0)
7114                 return -EINVAL;
7115
7116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7118                 return -EOPNOTSUPP;
7119
7120         wdev_lock(dev->ieee80211_ptr);
7121         ret = cfg80211_disconnect(rdev, dev, reason, true);
7122         wdev_unlock(dev->ieee80211_ptr);
7123         return ret;
7124 }
7125
7126 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7127 {
7128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7129         struct net *net;
7130         int err;
7131         u32 pid;
7132
7133         if (!info->attrs[NL80211_ATTR_PID])
7134                 return -EINVAL;
7135
7136         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7137
7138         net = get_net_ns_by_pid(pid);
7139         if (IS_ERR(net))
7140                 return PTR_ERR(net);
7141
7142         err = 0;
7143
7144         /* check if anything to do */
7145         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7146                 err = cfg80211_switch_netns(rdev, net);
7147
7148         put_net(net);
7149         return err;
7150 }
7151
7152 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7153 {
7154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7155         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7156                         struct cfg80211_pmksa *pmksa) = NULL;
7157         struct net_device *dev = info->user_ptr[1];
7158         struct cfg80211_pmksa pmksa;
7159
7160         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7161
7162         if (!info->attrs[NL80211_ATTR_MAC])
7163                 return -EINVAL;
7164
7165         if (!info->attrs[NL80211_ATTR_PMKID])
7166                 return -EINVAL;
7167
7168         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7169         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7170
7171         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7172             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7173                 return -EOPNOTSUPP;
7174
7175         switch (info->genlhdr->cmd) {
7176         case NL80211_CMD_SET_PMKSA:
7177                 rdev_ops = rdev->ops->set_pmksa;
7178                 break;
7179         case NL80211_CMD_DEL_PMKSA:
7180                 rdev_ops = rdev->ops->del_pmksa;
7181                 break;
7182         default:
7183                 WARN_ON(1);
7184                 break;
7185         }
7186
7187         if (!rdev_ops)
7188                 return -EOPNOTSUPP;
7189
7190         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7191 }
7192
7193 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7194 {
7195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7196         struct net_device *dev = info->user_ptr[1];
7197
7198         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7199             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7200                 return -EOPNOTSUPP;
7201
7202         if (!rdev->ops->flush_pmksa)
7203                 return -EOPNOTSUPP;
7204
7205         return rdev_flush_pmksa(rdev, dev);
7206 }
7207
7208 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7209 {
7210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7211         struct net_device *dev = info->user_ptr[1];
7212         u8 action_code, dialog_token;
7213         u16 status_code;
7214         u8 *peer;
7215
7216         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7217             !rdev->ops->tdls_mgmt)
7218                 return -EOPNOTSUPP;
7219
7220         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7221             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7222             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7223             !info->attrs[NL80211_ATTR_IE] ||
7224             !info->attrs[NL80211_ATTR_MAC])
7225                 return -EINVAL;
7226
7227         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7228         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7229         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7230         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7231
7232         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7233                               dialog_token, status_code,
7234                               nla_data(info->attrs[NL80211_ATTR_IE]),
7235                               nla_len(info->attrs[NL80211_ATTR_IE]));
7236 }
7237
7238 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7239 {
7240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7241         struct net_device *dev = info->user_ptr[1];
7242         enum nl80211_tdls_operation operation;
7243         u8 *peer;
7244
7245         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7246             !rdev->ops->tdls_oper)
7247                 return -EOPNOTSUPP;
7248
7249         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7250             !info->attrs[NL80211_ATTR_MAC])
7251                 return -EINVAL;
7252
7253         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7254         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7255
7256         return rdev_tdls_oper(rdev, dev, peer, operation);
7257 }
7258
7259 static int nl80211_remain_on_channel(struct sk_buff *skb,
7260                                      struct genl_info *info)
7261 {
7262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7263         struct wireless_dev *wdev = info->user_ptr[1];
7264         struct cfg80211_chan_def chandef;
7265         struct sk_buff *msg;
7266         void *hdr;
7267         u64 cookie;
7268         u32 duration;
7269         int err;
7270
7271         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7272             !info->attrs[NL80211_ATTR_DURATION])
7273                 return -EINVAL;
7274
7275         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7276
7277         if (!rdev->ops->remain_on_channel ||
7278             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7279                 return -EOPNOTSUPP;
7280
7281         /*
7282          * We should be on that channel for at least a minimum amount of
7283          * time (10ms) but no longer than the driver supports.
7284          */
7285         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7286             duration > rdev->wiphy.max_remain_on_channel_duration)
7287                 return -EINVAL;
7288
7289         err = nl80211_parse_chandef(rdev, info, &chandef);
7290         if (err)
7291                 return err;
7292
7293         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7294         if (!msg)
7295                 return -ENOMEM;
7296
7297         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7298                              NL80211_CMD_REMAIN_ON_CHANNEL);
7299         if (!hdr) {
7300                 err = -ENOBUFS;
7301                 goto free_msg;
7302         }
7303
7304         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7305                                      duration, &cookie);
7306
7307         if (err)
7308                 goto free_msg;
7309
7310         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7311                 goto nla_put_failure;
7312
7313         genlmsg_end(msg, hdr);
7314
7315         return genlmsg_reply(msg, info);
7316
7317  nla_put_failure:
7318         err = -ENOBUFS;
7319  free_msg:
7320         nlmsg_free(msg);
7321         return err;
7322 }
7323
7324 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7325                                             struct genl_info *info)
7326 {
7327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7328         struct wireless_dev *wdev = info->user_ptr[1];
7329         u64 cookie;
7330
7331         if (!info->attrs[NL80211_ATTR_COOKIE])
7332                 return -EINVAL;
7333
7334         if (!rdev->ops->cancel_remain_on_channel)
7335                 return -EOPNOTSUPP;
7336
7337         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7338
7339         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7340 }
7341
7342 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7343                            u8 *rates, u8 rates_len)
7344 {
7345         u8 i;
7346         u32 mask = 0;
7347
7348         for (i = 0; i < rates_len; i++) {
7349                 int rate = (rates[i] & 0x7f) * 5;
7350                 int ridx;
7351                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7352                         struct ieee80211_rate *srate =
7353                                 &sband->bitrates[ridx];
7354                         if (rate == srate->bitrate) {
7355                                 mask |= 1 << ridx;
7356                                 break;
7357                         }
7358                 }
7359                 if (ridx == sband->n_bitrates)
7360                         return 0; /* rate not found */
7361         }
7362
7363         return mask;
7364 }
7365
7366 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7367                                u8 *rates, u8 rates_len,
7368                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7369 {
7370         u8 i;
7371
7372         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7373
7374         for (i = 0; i < rates_len; i++) {
7375                 int ridx, rbit;
7376
7377                 ridx = rates[i] / 8;
7378                 rbit = BIT(rates[i] % 8);
7379
7380                 /* check validity */
7381                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7382                         return false;
7383
7384                 /* check availability */
7385                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7386                         mcs[ridx] |= rbit;
7387                 else
7388                         return false;
7389         }
7390
7391         return true;
7392 }
7393
7394 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7395 {
7396         u16 mcs_mask = 0;
7397
7398         switch (vht_mcs_map) {
7399         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7400                 break;
7401         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7402                 mcs_mask = 0x00FF;
7403                 break;
7404         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7405                 mcs_mask = 0x01FF;
7406                 break;
7407         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7408                 mcs_mask = 0x03FF;
7409                 break;
7410         default:
7411                 break;
7412         }
7413
7414         return mcs_mask;
7415 }
7416
7417 static void vht_build_mcs_mask(u16 vht_mcs_map,
7418                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7419 {
7420         u8 nss;
7421
7422         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7423                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7424                 vht_mcs_map >>= 2;
7425         }
7426 }
7427
7428 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7429                              struct nl80211_txrate_vht *txrate,
7430                              u16 mcs[NL80211_VHT_NSS_MAX])
7431 {
7432         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7433         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7434         u8 i;
7435
7436         if (!sband->vht_cap.vht_supported)
7437                 return false;
7438
7439         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7440
7441         /* Build vht_mcs_mask from VHT capabilities */
7442         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7443
7444         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7445                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7446                         mcs[i] = txrate->mcs[i];
7447                 else
7448                         return false;
7449         }
7450
7451         return true;
7452 }
7453
7454 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7455         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7456                                     .len = NL80211_MAX_SUPP_RATES },
7457         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7458                                 .len = NL80211_MAX_SUPP_HT_RATES },
7459         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7460 };
7461
7462 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7463                                        struct genl_info *info)
7464 {
7465         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7466         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7467         struct cfg80211_bitrate_mask mask;
7468         int rem, i;
7469         struct net_device *dev = info->user_ptr[1];
7470         struct nlattr *tx_rates;
7471         struct ieee80211_supported_band *sband;
7472         u16 vht_tx_mcs_map;
7473
7474         if (!rdev->ops->set_bitrate_mask)
7475                 return -EOPNOTSUPP;
7476
7477         memset(&mask, 0, sizeof(mask));
7478         /* Default to all rates enabled */
7479         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7480                 sband = rdev->wiphy.bands[i];
7481
7482                 if (!sband)
7483                         continue;
7484
7485                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7486                 memcpy(mask.control[i].ht_mcs,
7487                        sband->ht_cap.mcs.rx_mask,
7488                        sizeof(mask.control[i].ht_mcs));
7489
7490                 if (!sband->vht_cap.vht_supported)
7491                         continue;
7492
7493                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7494                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7495         }
7496
7497         /* if no rates are given set it back to the defaults */
7498         if (!info->attrs[NL80211_ATTR_TX_RATES])
7499                 goto out;
7500
7501         /*
7502          * The nested attribute uses enum nl80211_band as the index. This maps
7503          * directly to the enum ieee80211_band values used in cfg80211.
7504          */
7505         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7506         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7507         {
7508                 enum ieee80211_band band = nla_type(tx_rates);
7509                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7510                         return -EINVAL;
7511                 sband = rdev->wiphy.bands[band];
7512                 if (sband == NULL)
7513                         return -EINVAL;
7514                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7515                           nla_len(tx_rates), nl80211_txattr_policy);
7516                 if (tb[NL80211_TXRATE_LEGACY]) {
7517                         mask.control[band].legacy = rateset_to_mask(
7518                                 sband,
7519                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7520                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7521                         if ((mask.control[band].legacy == 0) &&
7522                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7523                                 return -EINVAL;
7524                 }
7525                 if (tb[NL80211_TXRATE_HT]) {
7526                         if (!ht_rateset_to_mask(
7527                                         sband,
7528                                         nla_data(tb[NL80211_TXRATE_HT]),
7529                                         nla_len(tb[NL80211_TXRATE_HT]),
7530                                         mask.control[band].ht_mcs))
7531                                 return -EINVAL;
7532                 }
7533                 if (tb[NL80211_TXRATE_VHT]) {
7534                         if (!vht_set_mcs_mask(
7535                                         sband,
7536                                         nla_data(tb[NL80211_TXRATE_VHT]),
7537                                         mask.control[band].vht_mcs))
7538                                 return -EINVAL;
7539                 }
7540
7541                 if (mask.control[band].legacy == 0) {
7542                         /* don't allow empty legacy rates if HT or VHT
7543                          * are not even supported.
7544                          */
7545                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7546                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7547                                 return -EINVAL;
7548
7549                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7550                                 if (mask.control[band].ht_mcs[i])
7551                                         goto out;
7552
7553                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7554                                 if (mask.control[band].vht_mcs[i])
7555                                         goto out;
7556
7557                         /* legacy and mcs rates may not be both empty */
7558                         return -EINVAL;
7559                 }
7560         }
7561
7562 out:
7563         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7564 }
7565
7566 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7567 {
7568         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7569         struct wireless_dev *wdev = info->user_ptr[1];
7570         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7571
7572         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7573                 return -EINVAL;
7574
7575         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7576                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7577
7578         switch (wdev->iftype) {
7579         case NL80211_IFTYPE_STATION:
7580         case NL80211_IFTYPE_ADHOC:
7581         case NL80211_IFTYPE_P2P_CLIENT:
7582         case NL80211_IFTYPE_AP:
7583         case NL80211_IFTYPE_AP_VLAN:
7584         case NL80211_IFTYPE_MESH_POINT:
7585         case NL80211_IFTYPE_P2P_GO:
7586         case NL80211_IFTYPE_P2P_DEVICE:
7587                 break;
7588         default:
7589                 return -EOPNOTSUPP;
7590         }
7591
7592         /* not much point in registering if we can't reply */
7593         if (!rdev->ops->mgmt_tx)
7594                 return -EOPNOTSUPP;
7595
7596         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7597                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7598                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7599 }
7600
7601 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7602 {
7603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7604         struct wireless_dev *wdev = info->user_ptr[1];
7605         struct cfg80211_chan_def chandef;
7606         int err;
7607         void *hdr = NULL;
7608         u64 cookie;
7609         struct sk_buff *msg = NULL;
7610         struct cfg80211_mgmt_tx_params params = {
7611                 .dont_wait_for_ack =
7612                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7613         };
7614
7615         if (!info->attrs[NL80211_ATTR_FRAME])
7616                 return -EINVAL;
7617
7618         if (!rdev->ops->mgmt_tx)
7619                 return -EOPNOTSUPP;
7620
7621         switch (wdev->iftype) {
7622         case NL80211_IFTYPE_P2P_DEVICE:
7623                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7624                         return -EINVAL;
7625         case NL80211_IFTYPE_STATION:
7626         case NL80211_IFTYPE_ADHOC:
7627         case NL80211_IFTYPE_P2P_CLIENT:
7628         case NL80211_IFTYPE_AP:
7629         case NL80211_IFTYPE_AP_VLAN:
7630         case NL80211_IFTYPE_MESH_POINT:
7631         case NL80211_IFTYPE_P2P_GO:
7632                 break;
7633         default:
7634                 return -EOPNOTSUPP;
7635         }
7636
7637         if (info->attrs[NL80211_ATTR_DURATION]) {
7638                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7639                         return -EINVAL;
7640                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7641
7642                 /*
7643                  * We should wait on the channel for at least a minimum amount
7644                  * of time (10ms) but no longer than the driver supports.
7645                  */
7646                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7647                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7648                         return -EINVAL;
7649
7650         }
7651
7652         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7653
7654         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7655                 return -EINVAL;
7656
7657         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7658
7659         /* get the channel if any has been specified, otherwise pass NULL to
7660          * the driver. The latter will use the current one
7661          */
7662         chandef.chan = NULL;
7663         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7664                 err = nl80211_parse_chandef(rdev, info, &chandef);
7665                 if (err)
7666                         return err;
7667         }
7668
7669         if (!chandef.chan && params.offchan)
7670                 return -EINVAL;
7671
7672         if (!params.dont_wait_for_ack) {
7673                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7674                 if (!msg)
7675                         return -ENOMEM;
7676
7677                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7678                                      NL80211_CMD_FRAME);
7679                 if (!hdr) {
7680                         err = -ENOBUFS;
7681                         goto free_msg;
7682                 }
7683         }
7684
7685         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7686         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7687         params.chan = chandef.chan;
7688         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7689         if (err)
7690                 goto free_msg;
7691
7692         if (msg) {
7693                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7694                         goto nla_put_failure;
7695
7696                 genlmsg_end(msg, hdr);
7697                 return genlmsg_reply(msg, info);
7698         }
7699
7700         return 0;
7701
7702  nla_put_failure:
7703         err = -ENOBUFS;
7704  free_msg:
7705         nlmsg_free(msg);
7706         return err;
7707 }
7708
7709 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7710 {
7711         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7712         struct wireless_dev *wdev = info->user_ptr[1];
7713         u64 cookie;
7714
7715         if (!info->attrs[NL80211_ATTR_COOKIE])
7716                 return -EINVAL;
7717
7718         if (!rdev->ops->mgmt_tx_cancel_wait)
7719                 return -EOPNOTSUPP;
7720
7721         switch (wdev->iftype) {
7722         case NL80211_IFTYPE_STATION:
7723         case NL80211_IFTYPE_ADHOC:
7724         case NL80211_IFTYPE_P2P_CLIENT:
7725         case NL80211_IFTYPE_AP:
7726         case NL80211_IFTYPE_AP_VLAN:
7727         case NL80211_IFTYPE_P2P_GO:
7728         case NL80211_IFTYPE_P2P_DEVICE:
7729                 break;
7730         default:
7731                 return -EOPNOTSUPP;
7732         }
7733
7734         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7735
7736         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7737 }
7738
7739 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7740 {
7741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7742         struct wireless_dev *wdev;
7743         struct net_device *dev = info->user_ptr[1];
7744         u8 ps_state;
7745         bool state;
7746         int err;
7747
7748         if (!info->attrs[NL80211_ATTR_PS_STATE])
7749                 return -EINVAL;
7750
7751         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7752
7753         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7754                 return -EINVAL;
7755
7756         wdev = dev->ieee80211_ptr;
7757
7758         if (!rdev->ops->set_power_mgmt)
7759                 return -EOPNOTSUPP;
7760
7761         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7762
7763         if (state == wdev->ps)
7764                 return 0;
7765
7766         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7767         if (!err)
7768                 wdev->ps = state;
7769         return err;
7770 }
7771
7772 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7773 {
7774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7775         enum nl80211_ps_state ps_state;
7776         struct wireless_dev *wdev;
7777         struct net_device *dev = info->user_ptr[1];
7778         struct sk_buff *msg;
7779         void *hdr;
7780         int err;
7781
7782         wdev = dev->ieee80211_ptr;
7783
7784         if (!rdev->ops->set_power_mgmt)
7785                 return -EOPNOTSUPP;
7786
7787         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7788         if (!msg)
7789                 return -ENOMEM;
7790
7791         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7792                              NL80211_CMD_GET_POWER_SAVE);
7793         if (!hdr) {
7794                 err = -ENOBUFS;
7795                 goto free_msg;
7796         }
7797
7798         if (wdev->ps)
7799                 ps_state = NL80211_PS_ENABLED;
7800         else
7801                 ps_state = NL80211_PS_DISABLED;
7802
7803         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7804                 goto nla_put_failure;
7805
7806         genlmsg_end(msg, hdr);
7807         return genlmsg_reply(msg, info);
7808
7809  nla_put_failure:
7810         err = -ENOBUFS;
7811  free_msg:
7812         nlmsg_free(msg);
7813         return err;
7814 }
7815
7816 static struct nla_policy
7817 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7818         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7819         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7820         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7821         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7822         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7823         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7824 };
7825
7826 static int nl80211_set_cqm_txe(struct genl_info *info,
7827                                u32 rate, u32 pkts, u32 intvl)
7828 {
7829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7830         struct net_device *dev = info->user_ptr[1];
7831         struct wireless_dev *wdev = dev->ieee80211_ptr;
7832
7833         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7834                 return -EINVAL;
7835
7836         if (!rdev->ops->set_cqm_txe_config)
7837                 return -EOPNOTSUPP;
7838
7839         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7840             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7841                 return -EOPNOTSUPP;
7842
7843         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7844 }
7845
7846 static int nl80211_set_cqm_rssi(struct genl_info *info,
7847                                 s32 threshold, u32 hysteresis)
7848 {
7849         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7850         struct net_device *dev = info->user_ptr[1];
7851         struct wireless_dev *wdev = dev->ieee80211_ptr;
7852
7853         if (threshold > 0)
7854                 return -EINVAL;
7855
7856         /* disabling - hysteresis should also be zero then */
7857         if (threshold == 0)
7858                 hysteresis = 0;
7859
7860         if (!rdev->ops->set_cqm_rssi_config)
7861                 return -EOPNOTSUPP;
7862
7863         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7864             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7865                 return -EOPNOTSUPP;
7866
7867         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7868 }
7869
7870 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7871 {
7872         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7873         struct nlattr *cqm;
7874         int err;
7875
7876         cqm = info->attrs[NL80211_ATTR_CQM];
7877         if (!cqm)
7878                 return -EINVAL;
7879
7880         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7881                                nl80211_attr_cqm_policy);
7882         if (err)
7883                 return err;
7884
7885         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7886             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7887                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7888                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7889
7890                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7891         }
7892
7893         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7894             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7895             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7896                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7897                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7898                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7899
7900                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7901         }
7902
7903         return -EINVAL;
7904 }
7905
7906 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7907 {
7908         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7909         struct net_device *dev = info->user_ptr[1];
7910         struct mesh_config cfg;
7911         struct mesh_setup setup;
7912         int err;
7913
7914         /* start with default */
7915         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7916         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7917
7918         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7919                 /* and parse parameters if given */
7920                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7921                 if (err)
7922                         return err;
7923         }
7924
7925         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7926             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7927                 return -EINVAL;
7928
7929         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7930         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7931
7932         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7933             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7934                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7935                         return -EINVAL;
7936
7937         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7938                 setup.beacon_interval =
7939                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7940                 if (setup.beacon_interval < 10 ||
7941                     setup.beacon_interval > 10000)
7942                         return -EINVAL;
7943         }
7944
7945         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7946                 setup.dtim_period =
7947                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7948                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7949                         return -EINVAL;
7950         }
7951
7952         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7953                 /* parse additional setup parameters if given */
7954                 err = nl80211_parse_mesh_setup(info, &setup);
7955                 if (err)
7956                         return err;
7957         }
7958
7959         if (setup.user_mpm)
7960                 cfg.auto_open_plinks = false;
7961
7962         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7963                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7964                 if (err)
7965                         return err;
7966         } else {
7967                 /* cfg80211_join_mesh() will sort it out */
7968                 setup.chandef.chan = NULL;
7969         }
7970
7971         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7972                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7973                 int n_rates =
7974                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7975                 struct ieee80211_supported_band *sband;
7976
7977                 if (!setup.chandef.chan)
7978                         return -EINVAL;
7979
7980                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7981
7982                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7983                                              &setup.basic_rates);
7984                 if (err)
7985                         return err;
7986         }
7987
7988         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7989 }
7990
7991 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7992 {
7993         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7994         struct net_device *dev = info->user_ptr[1];
7995
7996         return cfg80211_leave_mesh(rdev, dev);
7997 }
7998
7999 #ifdef CONFIG_PM
8000 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8001                                         struct cfg80211_registered_device *rdev)
8002 {
8003         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8004         struct nlattr *nl_pats, *nl_pat;
8005         int i, pat_len;
8006
8007         if (!wowlan->n_patterns)
8008                 return 0;
8009
8010         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8011         if (!nl_pats)
8012                 return -ENOBUFS;
8013
8014         for (i = 0; i < wowlan->n_patterns; i++) {
8015                 nl_pat = nla_nest_start(msg, i + 1);
8016                 if (!nl_pat)
8017                         return -ENOBUFS;
8018                 pat_len = wowlan->patterns[i].pattern_len;
8019                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8020                             wowlan->patterns[i].mask) ||
8021                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8022                             wowlan->patterns[i].pattern) ||
8023                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8024                                 wowlan->patterns[i].pkt_offset))
8025                         return -ENOBUFS;
8026                 nla_nest_end(msg, nl_pat);
8027         }
8028         nla_nest_end(msg, nl_pats);
8029
8030         return 0;
8031 }
8032
8033 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8034                                    struct cfg80211_wowlan_tcp *tcp)
8035 {
8036         struct nlattr *nl_tcp;
8037
8038         if (!tcp)
8039                 return 0;
8040
8041         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8042         if (!nl_tcp)
8043                 return -ENOBUFS;
8044
8045         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8046             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8047             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8048             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8049             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8050             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8051                     tcp->payload_len, tcp->payload) ||
8052             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8053                         tcp->data_interval) ||
8054             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8055                     tcp->wake_len, tcp->wake_data) ||
8056             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8057                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8058                 return -ENOBUFS;
8059
8060         if (tcp->payload_seq.len &&
8061             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8062                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8063                 return -ENOBUFS;
8064
8065         if (tcp->payload_tok.len &&
8066             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8067                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8068                     &tcp->payload_tok))
8069                 return -ENOBUFS;
8070
8071         nla_nest_end(msg, nl_tcp);
8072
8073         return 0;
8074 }
8075
8076 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8077 {
8078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8079         struct sk_buff *msg;
8080         void *hdr;
8081         u32 size = NLMSG_DEFAULT_SIZE;
8082
8083         if (!rdev->wiphy.wowlan)
8084                 return -EOPNOTSUPP;
8085
8086         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8087                 /* adjust size to have room for all the data */
8088                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8089                         rdev->wiphy.wowlan_config->tcp->payload_len +
8090                         rdev->wiphy.wowlan_config->tcp->wake_len +
8091                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8092         }
8093
8094         msg = nlmsg_new(size, GFP_KERNEL);
8095         if (!msg)
8096                 return -ENOMEM;
8097
8098         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8099                              NL80211_CMD_GET_WOWLAN);
8100         if (!hdr)
8101                 goto nla_put_failure;
8102
8103         if (rdev->wiphy.wowlan_config) {
8104                 struct nlattr *nl_wowlan;
8105
8106                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8107                 if (!nl_wowlan)
8108                         goto nla_put_failure;
8109
8110                 if ((rdev->wiphy.wowlan_config->any &&
8111                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8112                     (rdev->wiphy.wowlan_config->disconnect &&
8113                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8114                     (rdev->wiphy.wowlan_config->magic_pkt &&
8115                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8116                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8117                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8118                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8119                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8120                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8121                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8122                     (rdev->wiphy.wowlan_config->rfkill_release &&
8123                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8124                         goto nla_put_failure;
8125
8126                 if (nl80211_send_wowlan_patterns(msg, rdev))
8127                         goto nla_put_failure;
8128
8129                 if (nl80211_send_wowlan_tcp(msg,
8130                                             rdev->wiphy.wowlan_config->tcp))
8131                         goto nla_put_failure;
8132
8133                 nla_nest_end(msg, nl_wowlan);
8134         }
8135
8136         genlmsg_end(msg, hdr);
8137         return genlmsg_reply(msg, info);
8138
8139 nla_put_failure:
8140         nlmsg_free(msg);
8141         return -ENOBUFS;
8142 }
8143
8144 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8145                                     struct nlattr *attr,
8146                                     struct cfg80211_wowlan *trig)
8147 {
8148         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8149         struct cfg80211_wowlan_tcp *cfg;
8150         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8151         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8152         u32 size;
8153         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8154         int err, port;
8155
8156         if (!rdev->wiphy.wowlan->tcp)
8157                 return -EINVAL;
8158
8159         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8160                         nla_data(attr), nla_len(attr),
8161                         nl80211_wowlan_tcp_policy);
8162         if (err)
8163                 return err;
8164
8165         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8166             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8167             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8168             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8169             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8170             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8171             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8172             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8173                 return -EINVAL;
8174
8175         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8176         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8177                 return -EINVAL;
8178
8179         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8180                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8181             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8182                 return -EINVAL;
8183
8184         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8185         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8186                 return -EINVAL;
8187
8188         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8189         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8190                 return -EINVAL;
8191
8192         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8193                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8194
8195                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8196                 tokens_size = tokln - sizeof(*tok);
8197
8198                 if (!tok->len || tokens_size % tok->len)
8199                         return -EINVAL;
8200                 if (!rdev->wiphy.wowlan->tcp->tok)
8201                         return -EINVAL;
8202                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8203                         return -EINVAL;
8204                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8205                         return -EINVAL;
8206                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8207                         return -EINVAL;
8208                 if (tok->offset + tok->len > data_size)
8209                         return -EINVAL;
8210         }
8211
8212         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8213                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8214                 if (!rdev->wiphy.wowlan->tcp->seq)
8215                         return -EINVAL;
8216                 if (seq->len == 0 || seq->len > 4)
8217                         return -EINVAL;
8218                 if (seq->len + seq->offset > data_size)
8219                         return -EINVAL;
8220         }
8221
8222         size = sizeof(*cfg);
8223         size += data_size;
8224         size += wake_size + wake_mask_size;
8225         size += tokens_size;
8226
8227         cfg = kzalloc(size, GFP_KERNEL);
8228         if (!cfg)
8229                 return -ENOMEM;
8230         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8231         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8232         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8233                ETH_ALEN);
8234         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8235                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8236         else
8237                 port = 0;
8238 #ifdef CONFIG_INET
8239         /* allocate a socket and port for it and use it */
8240         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8241                             IPPROTO_TCP, &cfg->sock, 1);
8242         if (err) {
8243                 kfree(cfg);
8244                 return err;
8245         }
8246         if (inet_csk_get_port(cfg->sock->sk, port)) {
8247                 sock_release(cfg->sock);
8248                 kfree(cfg);
8249                 return -EADDRINUSE;
8250         }
8251         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8252 #else
8253         if (!port) {
8254                 kfree(cfg);
8255                 return -EINVAL;
8256         }
8257         cfg->src_port = port;
8258 #endif
8259
8260         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8261         cfg->payload_len = data_size;
8262         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8263         memcpy((void *)cfg->payload,
8264                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8265                data_size);
8266         if (seq)
8267                 cfg->payload_seq = *seq;
8268         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8269         cfg->wake_len = wake_size;
8270         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8271         memcpy((void *)cfg->wake_data,
8272                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8273                wake_size);
8274         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8275                          data_size + wake_size;
8276         memcpy((void *)cfg->wake_mask,
8277                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8278                wake_mask_size);
8279         if (tok) {
8280                 cfg->tokens_size = tokens_size;
8281                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8282         }
8283
8284         trig->tcp = cfg;
8285
8286         return 0;
8287 }
8288
8289 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8290 {
8291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8292         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8293         struct cfg80211_wowlan new_triggers = {};
8294         struct cfg80211_wowlan *ntrig;
8295         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8296         int err, i;
8297         bool prev_enabled = rdev->wiphy.wowlan_config;
8298
8299         if (!wowlan)
8300                 return -EOPNOTSUPP;
8301
8302         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8303                 cfg80211_rdev_free_wowlan(rdev);
8304                 rdev->wiphy.wowlan_config = NULL;
8305                 goto set_wakeup;
8306         }
8307
8308         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8309                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8310                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8311                         nl80211_wowlan_policy);
8312         if (err)
8313                 return err;
8314
8315         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8316                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8317                         return -EINVAL;
8318                 new_triggers.any = true;
8319         }
8320
8321         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8322                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8323                         return -EINVAL;
8324                 new_triggers.disconnect = true;
8325         }
8326
8327         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8328                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8329                         return -EINVAL;
8330                 new_triggers.magic_pkt = true;
8331         }
8332
8333         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8334                 return -EINVAL;
8335
8336         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8337                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8338                         return -EINVAL;
8339                 new_triggers.gtk_rekey_failure = true;
8340         }
8341
8342         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8343                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8344                         return -EINVAL;
8345                 new_triggers.eap_identity_req = true;
8346         }
8347
8348         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8349                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8350                         return -EINVAL;
8351                 new_triggers.four_way_handshake = true;
8352         }
8353
8354         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8355                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8356                         return -EINVAL;
8357                 new_triggers.rfkill_release = true;
8358         }
8359
8360         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8361                 struct nlattr *pat;
8362                 int n_patterns = 0;
8363                 int rem, pat_len, mask_len, pkt_offset;
8364                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8365
8366                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8367                                     rem)
8368                         n_patterns++;
8369                 if (n_patterns > wowlan->n_patterns)
8370                         return -EINVAL;
8371
8372                 new_triggers.patterns = kcalloc(n_patterns,
8373                                                 sizeof(new_triggers.patterns[0]),
8374                                                 GFP_KERNEL);
8375                 if (!new_triggers.patterns)
8376                         return -ENOMEM;
8377
8378                 new_triggers.n_patterns = n_patterns;
8379                 i = 0;
8380
8381                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8382                                     rem) {
8383                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8384                                   nla_len(pat), NULL);
8385                         err = -EINVAL;
8386                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8387                             !pat_tb[NL80211_PKTPAT_PATTERN])
8388                                 goto error;
8389                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8390                         mask_len = DIV_ROUND_UP(pat_len, 8);
8391                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8392                                 goto error;
8393                         if (pat_len > wowlan->pattern_max_len ||
8394                             pat_len < wowlan->pattern_min_len)
8395                                 goto error;
8396
8397                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8398                                 pkt_offset = 0;
8399                         else
8400                                 pkt_offset = nla_get_u32(
8401                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8402                         if (pkt_offset > wowlan->max_pkt_offset)
8403                                 goto error;
8404                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8405
8406                         new_triggers.patterns[i].mask =
8407                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8408                         if (!new_triggers.patterns[i].mask) {
8409                                 err = -ENOMEM;
8410                                 goto error;
8411                         }
8412                         new_triggers.patterns[i].pattern =
8413                                 new_triggers.patterns[i].mask + mask_len;
8414                         memcpy(new_triggers.patterns[i].mask,
8415                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8416                                mask_len);
8417                         new_triggers.patterns[i].pattern_len = pat_len;
8418                         memcpy(new_triggers.patterns[i].pattern,
8419                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8420                                pat_len);
8421                         i++;
8422                 }
8423         }
8424
8425         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8426                 err = nl80211_parse_wowlan_tcp(
8427                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8428                         &new_triggers);
8429                 if (err)
8430                         goto error;
8431         }
8432
8433         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8434         if (!ntrig) {
8435                 err = -ENOMEM;
8436                 goto error;
8437         }
8438         cfg80211_rdev_free_wowlan(rdev);
8439         rdev->wiphy.wowlan_config = ntrig;
8440
8441  set_wakeup:
8442         if (rdev->ops->set_wakeup &&
8443             prev_enabled != !!rdev->wiphy.wowlan_config)
8444                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8445
8446         return 0;
8447  error:
8448         for (i = 0; i < new_triggers.n_patterns; i++)
8449                 kfree(new_triggers.patterns[i].mask);
8450         kfree(new_triggers.patterns);
8451         if (new_triggers.tcp && new_triggers.tcp->sock)
8452                 sock_release(new_triggers.tcp->sock);
8453         kfree(new_triggers.tcp);
8454         return err;
8455 }
8456 #endif
8457
8458 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8459                                        struct cfg80211_registered_device *rdev)
8460 {
8461         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8462         int i, j, pat_len;
8463         struct cfg80211_coalesce_rules *rule;
8464
8465         if (!rdev->coalesce->n_rules)
8466                 return 0;
8467
8468         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8469         if (!nl_rules)
8470                 return -ENOBUFS;
8471
8472         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8473                 nl_rule = nla_nest_start(msg, i + 1);
8474                 if (!nl_rule)
8475                         return -ENOBUFS;
8476
8477                 rule = &rdev->coalesce->rules[i];
8478                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8479                                 rule->delay))
8480                         return -ENOBUFS;
8481
8482                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8483                                 rule->condition))
8484                         return -ENOBUFS;
8485
8486                 nl_pats = nla_nest_start(msg,
8487                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8488                 if (!nl_pats)
8489                         return -ENOBUFS;
8490
8491                 for (j = 0; j < rule->n_patterns; j++) {
8492                         nl_pat = nla_nest_start(msg, j + 1);
8493                         if (!nl_pat)
8494                                 return -ENOBUFS;
8495                         pat_len = rule->patterns[j].pattern_len;
8496                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8497                                     DIV_ROUND_UP(pat_len, 8),
8498                                     rule->patterns[j].mask) ||
8499                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8500                                     rule->patterns[j].pattern) ||
8501                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8502                                         rule->patterns[j].pkt_offset))
8503                                 return -ENOBUFS;
8504                         nla_nest_end(msg, nl_pat);
8505                 }
8506                 nla_nest_end(msg, nl_pats);
8507                 nla_nest_end(msg, nl_rule);
8508         }
8509         nla_nest_end(msg, nl_rules);
8510
8511         return 0;
8512 }
8513
8514 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8515 {
8516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8517         struct sk_buff *msg;
8518         void *hdr;
8519
8520         if (!rdev->wiphy.coalesce)
8521                 return -EOPNOTSUPP;
8522
8523         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8524         if (!msg)
8525                 return -ENOMEM;
8526
8527         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8528                              NL80211_CMD_GET_COALESCE);
8529         if (!hdr)
8530                 goto nla_put_failure;
8531
8532         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8533                 goto nla_put_failure;
8534
8535         genlmsg_end(msg, hdr);
8536         return genlmsg_reply(msg, info);
8537
8538 nla_put_failure:
8539         nlmsg_free(msg);
8540         return -ENOBUFS;
8541 }
8542
8543 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8544 {
8545         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8546         int i, j;
8547         struct cfg80211_coalesce_rules *rule;
8548
8549         if (!coalesce)
8550                 return;
8551
8552         for (i = 0; i < coalesce->n_rules; i++) {
8553                 rule = &coalesce->rules[i];
8554                 for (j = 0; j < rule->n_patterns; j++)
8555                         kfree(rule->patterns[j].mask);
8556                 kfree(rule->patterns);
8557         }
8558         kfree(coalesce->rules);
8559         kfree(coalesce);
8560         rdev->coalesce = NULL;
8561 }
8562
8563 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8564                                        struct nlattr *rule,
8565                                        struct cfg80211_coalesce_rules *new_rule)
8566 {
8567         int err, i;
8568         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8569         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8570         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8571         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8572
8573         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8574                         nla_len(rule), nl80211_coalesce_policy);
8575         if (err)
8576                 return err;
8577
8578         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8579                 new_rule->delay =
8580                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8581         if (new_rule->delay > coalesce->max_delay)
8582                 return -EINVAL;
8583
8584         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8585                 new_rule->condition =
8586                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8587         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8588             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8589                 return -EINVAL;
8590
8591         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8592                 return -EINVAL;
8593
8594         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8595                             rem)
8596                 n_patterns++;
8597         if (n_patterns > coalesce->n_patterns)
8598                 return -EINVAL;
8599
8600         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8601                                      GFP_KERNEL);
8602         if (!new_rule->patterns)
8603                 return -ENOMEM;
8604
8605         new_rule->n_patterns = n_patterns;
8606         i = 0;
8607
8608         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8609                             rem) {
8610                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8611                           nla_len(pat), NULL);
8612                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8613                     !pat_tb[NL80211_PKTPAT_PATTERN])
8614                         return -EINVAL;
8615                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8616                 mask_len = DIV_ROUND_UP(pat_len, 8);
8617                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8618                         return -EINVAL;
8619                 if (pat_len > coalesce->pattern_max_len ||
8620                     pat_len < coalesce->pattern_min_len)
8621                         return -EINVAL;
8622
8623                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8624                         pkt_offset = 0;
8625                 else
8626                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8627                 if (pkt_offset > coalesce->max_pkt_offset)
8628                         return -EINVAL;
8629                 new_rule->patterns[i].pkt_offset = pkt_offset;
8630
8631                 new_rule->patterns[i].mask =
8632                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8633                 if (!new_rule->patterns[i].mask)
8634                         return -ENOMEM;
8635                 new_rule->patterns[i].pattern =
8636                         new_rule->patterns[i].mask + mask_len;
8637                 memcpy(new_rule->patterns[i].mask,
8638                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8639                 new_rule->patterns[i].pattern_len = pat_len;
8640                 memcpy(new_rule->patterns[i].pattern,
8641                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8642                 i++;
8643         }
8644
8645         return 0;
8646 }
8647
8648 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8649 {
8650         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8651         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8652         struct cfg80211_coalesce new_coalesce = {};
8653         struct cfg80211_coalesce *n_coalesce;
8654         int err, rem_rule, n_rules = 0, i, j;
8655         struct nlattr *rule;
8656         struct cfg80211_coalesce_rules *tmp_rule;
8657
8658         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8659                 return -EOPNOTSUPP;
8660
8661         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8662                 cfg80211_rdev_free_coalesce(rdev);
8663                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8664                 return 0;
8665         }
8666
8667         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8668                             rem_rule)
8669                 n_rules++;
8670         if (n_rules > coalesce->n_rules)
8671                 return -EINVAL;
8672
8673         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8674                                      GFP_KERNEL);
8675         if (!new_coalesce.rules)
8676                 return -ENOMEM;
8677
8678         new_coalesce.n_rules = n_rules;
8679         i = 0;
8680
8681         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8682                             rem_rule) {
8683                 err = nl80211_parse_coalesce_rule(rdev, rule,
8684                                                   &new_coalesce.rules[i]);
8685                 if (err)
8686                         goto error;
8687
8688                 i++;
8689         }
8690
8691         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8692         if (err)
8693                 goto error;
8694
8695         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8696         if (!n_coalesce) {
8697                 err = -ENOMEM;
8698                 goto error;
8699         }
8700         cfg80211_rdev_free_coalesce(rdev);
8701         rdev->coalesce = n_coalesce;
8702
8703         return 0;
8704 error:
8705         for (i = 0; i < new_coalesce.n_rules; i++) {
8706                 tmp_rule = &new_coalesce.rules[i];
8707                 for (j = 0; j < tmp_rule->n_patterns; j++)
8708                         kfree(tmp_rule->patterns[j].mask);
8709                 kfree(tmp_rule->patterns);
8710         }
8711         kfree(new_coalesce.rules);
8712
8713         return err;
8714 }
8715
8716 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8717 {
8718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8719         struct net_device *dev = info->user_ptr[1];
8720         struct wireless_dev *wdev = dev->ieee80211_ptr;
8721         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8722         struct cfg80211_gtk_rekey_data rekey_data;
8723         int err;
8724
8725         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8726                 return -EINVAL;
8727
8728         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8729                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8730                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8731                         nl80211_rekey_policy);
8732         if (err)
8733                 return err;
8734
8735         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8736                 return -ERANGE;
8737         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8738                 return -ERANGE;
8739         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8740                 return -ERANGE;
8741
8742         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8743                NL80211_KEK_LEN);
8744         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8745                NL80211_KCK_LEN);
8746         memcpy(rekey_data.replay_ctr,
8747                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8748                NL80211_REPLAY_CTR_LEN);
8749
8750         wdev_lock(wdev);
8751         if (!wdev->current_bss) {
8752                 err = -ENOTCONN;
8753                 goto out;
8754         }
8755
8756         if (!rdev->ops->set_rekey_data) {
8757                 err = -EOPNOTSUPP;
8758                 goto out;
8759         }
8760
8761         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8762  out:
8763         wdev_unlock(wdev);
8764         return err;
8765 }
8766
8767 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8768                                              struct genl_info *info)
8769 {
8770         struct net_device *dev = info->user_ptr[1];
8771         struct wireless_dev *wdev = dev->ieee80211_ptr;
8772
8773         if (wdev->iftype != NL80211_IFTYPE_AP &&
8774             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8775                 return -EINVAL;
8776
8777         if (wdev->ap_unexpected_nlportid)
8778                 return -EBUSY;
8779
8780         wdev->ap_unexpected_nlportid = info->snd_portid;
8781         return 0;
8782 }
8783
8784 static int nl80211_probe_client(struct sk_buff *skb,
8785                                 struct genl_info *info)
8786 {
8787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8788         struct net_device *dev = info->user_ptr[1];
8789         struct wireless_dev *wdev = dev->ieee80211_ptr;
8790         struct sk_buff *msg;
8791         void *hdr;
8792         const u8 *addr;
8793         u64 cookie;
8794         int err;
8795
8796         if (wdev->iftype != NL80211_IFTYPE_AP &&
8797             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8798                 return -EOPNOTSUPP;
8799
8800         if (!info->attrs[NL80211_ATTR_MAC])
8801                 return -EINVAL;
8802
8803         if (!rdev->ops->probe_client)
8804                 return -EOPNOTSUPP;
8805
8806         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8807         if (!msg)
8808                 return -ENOMEM;
8809
8810         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8811                              NL80211_CMD_PROBE_CLIENT);
8812         if (!hdr) {
8813                 err = -ENOBUFS;
8814                 goto free_msg;
8815         }
8816
8817         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8818
8819         err = rdev_probe_client(rdev, dev, addr, &cookie);
8820         if (err)
8821                 goto free_msg;
8822
8823         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8824                 goto nla_put_failure;
8825
8826         genlmsg_end(msg, hdr);
8827
8828         return genlmsg_reply(msg, info);
8829
8830  nla_put_failure:
8831         err = -ENOBUFS;
8832  free_msg:
8833         nlmsg_free(msg);
8834         return err;
8835 }
8836
8837 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8838 {
8839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8840         struct cfg80211_beacon_registration *reg, *nreg;
8841         int rv;
8842
8843         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8844                 return -EOPNOTSUPP;
8845
8846         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8847         if (!nreg)
8848                 return -ENOMEM;
8849
8850         /* First, check if already registered. */
8851         spin_lock_bh(&rdev->beacon_registrations_lock);
8852         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8853                 if (reg->nlportid == info->snd_portid) {
8854                         rv = -EALREADY;
8855                         goto out_err;
8856                 }
8857         }
8858         /* Add it to the list */
8859         nreg->nlportid = info->snd_portid;
8860         list_add(&nreg->list, &rdev->beacon_registrations);
8861
8862         spin_unlock_bh(&rdev->beacon_registrations_lock);
8863
8864         return 0;
8865 out_err:
8866         spin_unlock_bh(&rdev->beacon_registrations_lock);
8867         kfree(nreg);
8868         return rv;
8869 }
8870
8871 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8872 {
8873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8874         struct wireless_dev *wdev = info->user_ptr[1];
8875         int err;
8876
8877         if (!rdev->ops->start_p2p_device)
8878                 return -EOPNOTSUPP;
8879
8880         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8881                 return -EOPNOTSUPP;
8882
8883         if (wdev->p2p_started)
8884                 return 0;
8885
8886         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8887         if (err)
8888                 return err;
8889
8890         err = rdev_start_p2p_device(rdev, wdev);
8891         if (err)
8892                 return err;
8893
8894         wdev->p2p_started = true;
8895         rdev->opencount++;
8896
8897         return 0;
8898 }
8899
8900 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8901 {
8902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8903         struct wireless_dev *wdev = info->user_ptr[1];
8904
8905         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8906                 return -EOPNOTSUPP;
8907
8908         if (!rdev->ops->stop_p2p_device)
8909                 return -EOPNOTSUPP;
8910
8911         cfg80211_stop_p2p_device(rdev, wdev);
8912
8913         return 0;
8914 }
8915
8916 static int nl80211_get_protocol_features(struct sk_buff *skb,
8917                                          struct genl_info *info)
8918 {
8919         void *hdr;
8920         struct sk_buff *msg;
8921
8922         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8923         if (!msg)
8924                 return -ENOMEM;
8925
8926         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8927                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8928         if (!hdr)
8929                 goto nla_put_failure;
8930
8931         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8932                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8933                 goto nla_put_failure;
8934
8935         genlmsg_end(msg, hdr);
8936         return genlmsg_reply(msg, info);
8937
8938  nla_put_failure:
8939         kfree_skb(msg);
8940         return -ENOBUFS;
8941 }
8942
8943 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8944 {
8945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8946         struct cfg80211_update_ft_ies_params ft_params;
8947         struct net_device *dev = info->user_ptr[1];
8948
8949         if (!rdev->ops->update_ft_ies)
8950                 return -EOPNOTSUPP;
8951
8952         if (!info->attrs[NL80211_ATTR_MDID] ||
8953             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8954                 return -EINVAL;
8955
8956         memset(&ft_params, 0, sizeof(ft_params));
8957         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8958         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8959         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8960
8961         return rdev_update_ft_ies(rdev, dev, &ft_params);
8962 }
8963
8964 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8965                                        struct genl_info *info)
8966 {
8967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8968         struct wireless_dev *wdev = info->user_ptr[1];
8969         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8970         u16 duration;
8971         int ret;
8972
8973         if (!rdev->ops->crit_proto_start)
8974                 return -EOPNOTSUPP;
8975
8976         if (WARN_ON(!rdev->ops->crit_proto_stop))
8977                 return -EINVAL;
8978
8979         if (rdev->crit_proto_nlportid)
8980                 return -EBUSY;
8981
8982         /* determine protocol if provided */
8983         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8984                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8985
8986         if (proto >= NUM_NL80211_CRIT_PROTO)
8987                 return -EINVAL;
8988
8989         /* timeout must be provided */
8990         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8991                 return -EINVAL;
8992
8993         duration =
8994                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8995
8996         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8997                 return -ERANGE;
8998
8999         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9000         if (!ret)
9001                 rdev->crit_proto_nlportid = info->snd_portid;
9002
9003         return ret;
9004 }
9005
9006 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9007                                       struct genl_info *info)
9008 {
9009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9010         struct wireless_dev *wdev = info->user_ptr[1];
9011
9012         if (!rdev->ops->crit_proto_stop)
9013                 return -EOPNOTSUPP;
9014
9015         if (rdev->crit_proto_nlportid) {
9016                 rdev->crit_proto_nlportid = 0;
9017                 rdev_crit_proto_stop(rdev, wdev);
9018         }
9019         return 0;
9020 }
9021
9022 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9023 {
9024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9025         struct wireless_dev *wdev =
9026                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9027         int i, err;
9028         u32 vid, subcmd;
9029
9030         if (!rdev->wiphy.vendor_commands)
9031                 return -EOPNOTSUPP;
9032
9033         if (IS_ERR(wdev)) {
9034                 err = PTR_ERR(wdev);
9035                 if (err != -EINVAL)
9036                         return err;
9037                 wdev = NULL;
9038         } else if (wdev->wiphy != &rdev->wiphy) {
9039                 return -EINVAL;
9040         }
9041
9042         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9043             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9044                 return -EINVAL;
9045
9046         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9047         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9048         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9049                 const struct wiphy_vendor_command *vcmd;
9050                 void *data = NULL;
9051                 int len = 0;
9052
9053                 vcmd = &rdev->wiphy.vendor_commands[i];
9054
9055                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9056                         continue;
9057
9058                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9059                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9060                         if (!wdev)
9061                                 return -EINVAL;
9062                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9063                             !wdev->netdev)
9064                                 return -EINVAL;
9065
9066                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9067                                 if (wdev->netdev &&
9068                                     !netif_running(wdev->netdev))
9069                                         return -ENETDOWN;
9070                                 if (!wdev->netdev && !wdev->p2p_started)
9071                                         return -ENETDOWN;
9072                         }
9073                 } else {
9074                         wdev = NULL;
9075                 }
9076
9077                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9078                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9079                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9080                 }
9081
9082                 rdev->cur_cmd_info = info;
9083                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9084                                                           data, len);
9085                 rdev->cur_cmd_info = NULL;
9086                 return err;
9087         }
9088
9089         return -EOPNOTSUPP;
9090 }
9091
9092 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9093                                            enum nl80211_commands cmd,
9094                                            enum nl80211_attrs attr,
9095                                            int approxlen)
9096 {
9097         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9098
9099         if (WARN_ON(!rdev->cur_cmd_info))
9100                 return NULL;
9101
9102         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9103                                            rdev->cur_cmd_info->snd_portid,
9104                                            rdev->cur_cmd_info->snd_seq,
9105                                            cmd, attr, NULL, GFP_KERNEL);
9106 }
9107 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9108
9109 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9110 {
9111         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9112         void *hdr = ((void **)skb->cb)[1];
9113         struct nlattr *data = ((void **)skb->cb)[2];
9114
9115         if (WARN_ON(!rdev->cur_cmd_info)) {
9116                 kfree_skb(skb);
9117                 return -EINVAL;
9118         }
9119
9120         nla_nest_end(skb, data);
9121         genlmsg_end(skb, hdr);
9122         return genlmsg_reply(skb, rdev->cur_cmd_info);
9123 }
9124 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9125
9126
9127 static int nl80211_set_qos_map(struct sk_buff *skb,
9128                                struct genl_info *info)
9129 {
9130         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9131         struct cfg80211_qos_map *qos_map = NULL;
9132         struct net_device *dev = info->user_ptr[1];
9133         u8 *pos, len, num_des, des_len, des;
9134         int ret;
9135
9136         if (!rdev->ops->set_qos_map)
9137                 return -EOPNOTSUPP;
9138
9139         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9140                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9141                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9142
9143                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9144                     len > IEEE80211_QOS_MAP_LEN_MAX)
9145                         return -EINVAL;
9146
9147                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9148                 if (!qos_map)
9149                         return -ENOMEM;
9150
9151                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9152                 if (num_des) {
9153                         des_len = num_des *
9154                                 sizeof(struct cfg80211_dscp_exception);
9155                         memcpy(qos_map->dscp_exception, pos, des_len);
9156                         qos_map->num_des = num_des;
9157                         for (des = 0; des < num_des; des++) {
9158                                 if (qos_map->dscp_exception[des].up > 7) {
9159                                         kfree(qos_map);
9160                                         return -EINVAL;
9161                                 }
9162                         }
9163                         pos += des_len;
9164                 }
9165                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9166         }
9167
9168         wdev_lock(dev->ieee80211_ptr);
9169         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9170         if (!ret)
9171                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9172         wdev_unlock(dev->ieee80211_ptr);
9173
9174         kfree(qos_map);
9175         return ret;
9176 }
9177
9178 #define NL80211_FLAG_NEED_WIPHY         0x01
9179 #define NL80211_FLAG_NEED_NETDEV        0x02
9180 #define NL80211_FLAG_NEED_RTNL          0x04
9181 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9182 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9183                                          NL80211_FLAG_CHECK_NETDEV_UP)
9184 #define NL80211_FLAG_NEED_WDEV          0x10
9185 /* If a netdev is associated, it must be UP, P2P must be started */
9186 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9187                                          NL80211_FLAG_CHECK_NETDEV_UP)
9188
9189 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9190                             struct genl_info *info)
9191 {
9192         struct cfg80211_registered_device *rdev;
9193         struct wireless_dev *wdev;
9194         struct net_device *dev;
9195         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9196
9197         if (rtnl)
9198                 rtnl_lock();
9199
9200         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9201                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9202                 if (IS_ERR(rdev)) {
9203                         if (rtnl)
9204                                 rtnl_unlock();
9205                         return PTR_ERR(rdev);
9206                 }
9207                 info->user_ptr[0] = rdev;
9208         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9209                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9210                 ASSERT_RTNL();
9211
9212                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9213                                                   info->attrs);
9214                 if (IS_ERR(wdev)) {
9215                         if (rtnl)
9216                                 rtnl_unlock();
9217                         return PTR_ERR(wdev);
9218                 }
9219
9220                 dev = wdev->netdev;
9221                 rdev = wiphy_to_dev(wdev->wiphy);
9222
9223                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9224                         if (!dev) {
9225                                 if (rtnl)
9226                                         rtnl_unlock();
9227                                 return -EINVAL;
9228                         }
9229
9230                         info->user_ptr[1] = dev;
9231                 } else {
9232                         info->user_ptr[1] = wdev;
9233                 }
9234
9235                 if (dev) {
9236                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9237                             !netif_running(dev)) {
9238                                 if (rtnl)
9239                                         rtnl_unlock();
9240                                 return -ENETDOWN;
9241                         }
9242
9243                         dev_hold(dev);
9244                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9245                         if (!wdev->p2p_started) {
9246                                 if (rtnl)
9247                                         rtnl_unlock();
9248                                 return -ENETDOWN;
9249                         }
9250                 }
9251
9252                 info->user_ptr[0] = rdev;
9253         }
9254
9255         return 0;
9256 }
9257
9258 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9259                               struct genl_info *info)
9260 {
9261         if (info->user_ptr[1]) {
9262                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9263                         struct wireless_dev *wdev = info->user_ptr[1];
9264
9265                         if (wdev->netdev)
9266                                 dev_put(wdev->netdev);
9267                 } else {
9268                         dev_put(info->user_ptr[1]);
9269                 }
9270         }
9271         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9272                 rtnl_unlock();
9273 }
9274
9275 static const struct genl_ops nl80211_ops[] = {
9276         {
9277                 .cmd = NL80211_CMD_GET_WIPHY,
9278                 .doit = nl80211_get_wiphy,
9279                 .dumpit = nl80211_dump_wiphy,
9280                 .done = nl80211_dump_wiphy_done,
9281                 .policy = nl80211_policy,
9282                 /* can be retrieved by unprivileged users */
9283                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9284                                   NL80211_FLAG_NEED_RTNL,
9285         },
9286         {
9287                 .cmd = NL80211_CMD_SET_WIPHY,
9288                 .doit = nl80211_set_wiphy,
9289                 .policy = nl80211_policy,
9290                 .flags = GENL_ADMIN_PERM,
9291                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9292         },
9293         {
9294                 .cmd = NL80211_CMD_GET_INTERFACE,
9295                 .doit = nl80211_get_interface,
9296                 .dumpit = nl80211_dump_interface,
9297                 .policy = nl80211_policy,
9298                 /* can be retrieved by unprivileged users */
9299                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9300                                   NL80211_FLAG_NEED_RTNL,
9301         },
9302         {
9303                 .cmd = NL80211_CMD_SET_INTERFACE,
9304                 .doit = nl80211_set_interface,
9305                 .policy = nl80211_policy,
9306                 .flags = GENL_ADMIN_PERM,
9307                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9308                                   NL80211_FLAG_NEED_RTNL,
9309         },
9310         {
9311                 .cmd = NL80211_CMD_NEW_INTERFACE,
9312                 .doit = nl80211_new_interface,
9313                 .policy = nl80211_policy,
9314                 .flags = GENL_ADMIN_PERM,
9315                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9316                                   NL80211_FLAG_NEED_RTNL,
9317         },
9318         {
9319                 .cmd = NL80211_CMD_DEL_INTERFACE,
9320                 .doit = nl80211_del_interface,
9321                 .policy = nl80211_policy,
9322                 .flags = GENL_ADMIN_PERM,
9323                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9324                                   NL80211_FLAG_NEED_RTNL,
9325         },
9326         {
9327                 .cmd = NL80211_CMD_GET_KEY,
9328                 .doit = nl80211_get_key,
9329                 .policy = nl80211_policy,
9330                 .flags = GENL_ADMIN_PERM,
9331                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9332                                   NL80211_FLAG_NEED_RTNL,
9333         },
9334         {
9335                 .cmd = NL80211_CMD_SET_KEY,
9336                 .doit = nl80211_set_key,
9337                 .policy = nl80211_policy,
9338                 .flags = GENL_ADMIN_PERM,
9339                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9340                                   NL80211_FLAG_NEED_RTNL,
9341         },
9342         {
9343                 .cmd = NL80211_CMD_NEW_KEY,
9344                 .doit = nl80211_new_key,
9345                 .policy = nl80211_policy,
9346                 .flags = GENL_ADMIN_PERM,
9347                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9348                                   NL80211_FLAG_NEED_RTNL,
9349         },
9350         {
9351                 .cmd = NL80211_CMD_DEL_KEY,
9352                 .doit = nl80211_del_key,
9353                 .policy = nl80211_policy,
9354                 .flags = GENL_ADMIN_PERM,
9355                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9356                                   NL80211_FLAG_NEED_RTNL,
9357         },
9358         {
9359                 .cmd = NL80211_CMD_SET_BEACON,
9360                 .policy = nl80211_policy,
9361                 .flags = GENL_ADMIN_PERM,
9362                 .doit = nl80211_set_beacon,
9363                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9364                                   NL80211_FLAG_NEED_RTNL,
9365         },
9366         {
9367                 .cmd = NL80211_CMD_START_AP,
9368                 .policy = nl80211_policy,
9369                 .flags = GENL_ADMIN_PERM,
9370                 .doit = nl80211_start_ap,
9371                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9372                                   NL80211_FLAG_NEED_RTNL,
9373         },
9374         {
9375                 .cmd = NL80211_CMD_STOP_AP,
9376                 .policy = nl80211_policy,
9377                 .flags = GENL_ADMIN_PERM,
9378                 .doit = nl80211_stop_ap,
9379                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9380                                   NL80211_FLAG_NEED_RTNL,
9381         },
9382         {
9383                 .cmd = NL80211_CMD_GET_STATION,
9384                 .doit = nl80211_get_station,
9385                 .dumpit = nl80211_dump_station,
9386                 .policy = nl80211_policy,
9387                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9388                                   NL80211_FLAG_NEED_RTNL,
9389         },
9390         {
9391                 .cmd = NL80211_CMD_SET_STATION,
9392                 .doit = nl80211_set_station,
9393                 .policy = nl80211_policy,
9394                 .flags = GENL_ADMIN_PERM,
9395                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9396                                   NL80211_FLAG_NEED_RTNL,
9397         },
9398         {
9399                 .cmd = NL80211_CMD_NEW_STATION,
9400                 .doit = nl80211_new_station,
9401                 .policy = nl80211_policy,
9402                 .flags = GENL_ADMIN_PERM,
9403                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9404                                   NL80211_FLAG_NEED_RTNL,
9405         },
9406         {
9407                 .cmd = NL80211_CMD_DEL_STATION,
9408                 .doit = nl80211_del_station,
9409                 .policy = nl80211_policy,
9410                 .flags = GENL_ADMIN_PERM,
9411                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9412                                   NL80211_FLAG_NEED_RTNL,
9413         },
9414         {
9415                 .cmd = NL80211_CMD_GET_MPATH,
9416                 .doit = nl80211_get_mpath,
9417                 .dumpit = nl80211_dump_mpath,
9418                 .policy = nl80211_policy,
9419                 .flags = GENL_ADMIN_PERM,
9420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9421                                   NL80211_FLAG_NEED_RTNL,
9422         },
9423         {
9424                 .cmd = NL80211_CMD_SET_MPATH,
9425                 .doit = nl80211_set_mpath,
9426                 .policy = nl80211_policy,
9427                 .flags = GENL_ADMIN_PERM,
9428                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9429                                   NL80211_FLAG_NEED_RTNL,
9430         },
9431         {
9432                 .cmd = NL80211_CMD_NEW_MPATH,
9433                 .doit = nl80211_new_mpath,
9434                 .policy = nl80211_policy,
9435                 .flags = GENL_ADMIN_PERM,
9436                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9437                                   NL80211_FLAG_NEED_RTNL,
9438         },
9439         {
9440                 .cmd = NL80211_CMD_DEL_MPATH,
9441                 .doit = nl80211_del_mpath,
9442                 .policy = nl80211_policy,
9443                 .flags = GENL_ADMIN_PERM,
9444                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9445                                   NL80211_FLAG_NEED_RTNL,
9446         },
9447         {
9448                 .cmd = NL80211_CMD_SET_BSS,
9449                 .doit = nl80211_set_bss,
9450                 .policy = nl80211_policy,
9451                 .flags = GENL_ADMIN_PERM,
9452                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9453                                   NL80211_FLAG_NEED_RTNL,
9454         },
9455         {
9456                 .cmd = NL80211_CMD_GET_REG,
9457                 .doit = nl80211_get_reg,
9458                 .policy = nl80211_policy,
9459                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9460                 /* can be retrieved by unprivileged users */
9461         },
9462         {
9463                 .cmd = NL80211_CMD_SET_REG,
9464                 .doit = nl80211_set_reg,
9465                 .policy = nl80211_policy,
9466                 .flags = GENL_ADMIN_PERM,
9467                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9468         },
9469         {
9470                 .cmd = NL80211_CMD_REQ_SET_REG,
9471                 .doit = nl80211_req_set_reg,
9472                 .policy = nl80211_policy,
9473                 .flags = GENL_ADMIN_PERM,
9474         },
9475         {
9476                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9477                 .doit = nl80211_get_mesh_config,
9478                 .policy = nl80211_policy,
9479                 /* can be retrieved by unprivileged users */
9480                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9481                                   NL80211_FLAG_NEED_RTNL,
9482         },
9483         {
9484                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9485                 .doit = nl80211_update_mesh_config,
9486                 .policy = nl80211_policy,
9487                 .flags = GENL_ADMIN_PERM,
9488                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9489                                   NL80211_FLAG_NEED_RTNL,
9490         },
9491         {
9492                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9493                 .doit = nl80211_trigger_scan,
9494                 .policy = nl80211_policy,
9495                 .flags = GENL_ADMIN_PERM,
9496                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9497                                   NL80211_FLAG_NEED_RTNL,
9498         },
9499         {
9500                 .cmd = NL80211_CMD_GET_SCAN,
9501                 .policy = nl80211_policy,
9502                 .dumpit = nl80211_dump_scan,
9503         },
9504         {
9505                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9506                 .doit = nl80211_start_sched_scan,
9507                 .policy = nl80211_policy,
9508                 .flags = GENL_ADMIN_PERM,
9509                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9510                                   NL80211_FLAG_NEED_RTNL,
9511         },
9512         {
9513                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9514                 .doit = nl80211_stop_sched_scan,
9515                 .policy = nl80211_policy,
9516                 .flags = GENL_ADMIN_PERM,
9517                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9518                                   NL80211_FLAG_NEED_RTNL,
9519         },
9520         {
9521                 .cmd = NL80211_CMD_AUTHENTICATE,
9522                 .doit = nl80211_authenticate,
9523                 .policy = nl80211_policy,
9524                 .flags = GENL_ADMIN_PERM,
9525                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9526                                   NL80211_FLAG_NEED_RTNL,
9527         },
9528         {
9529                 .cmd = NL80211_CMD_ASSOCIATE,
9530                 .doit = nl80211_associate,
9531                 .policy = nl80211_policy,
9532                 .flags = GENL_ADMIN_PERM,
9533                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9534                                   NL80211_FLAG_NEED_RTNL,
9535         },
9536         {
9537                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9538                 .doit = nl80211_deauthenticate,
9539                 .policy = nl80211_policy,
9540                 .flags = GENL_ADMIN_PERM,
9541                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9542                                   NL80211_FLAG_NEED_RTNL,
9543         },
9544         {
9545                 .cmd = NL80211_CMD_DISASSOCIATE,
9546                 .doit = nl80211_disassociate,
9547                 .policy = nl80211_policy,
9548                 .flags = GENL_ADMIN_PERM,
9549                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9550                                   NL80211_FLAG_NEED_RTNL,
9551         },
9552         {
9553                 .cmd = NL80211_CMD_JOIN_IBSS,
9554                 .doit = nl80211_join_ibss,
9555                 .policy = nl80211_policy,
9556                 .flags = GENL_ADMIN_PERM,
9557                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9558                                   NL80211_FLAG_NEED_RTNL,
9559         },
9560         {
9561                 .cmd = NL80211_CMD_LEAVE_IBSS,
9562                 .doit = nl80211_leave_ibss,
9563                 .policy = nl80211_policy,
9564                 .flags = GENL_ADMIN_PERM,
9565                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9566                                   NL80211_FLAG_NEED_RTNL,
9567         },
9568 #ifdef CONFIG_NL80211_TESTMODE
9569         {
9570                 .cmd = NL80211_CMD_TESTMODE,
9571                 .doit = nl80211_testmode_do,
9572                 .dumpit = nl80211_testmode_dump,
9573                 .policy = nl80211_policy,
9574                 .flags = GENL_ADMIN_PERM,
9575                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9576                                   NL80211_FLAG_NEED_RTNL,
9577         },
9578 #endif
9579         {
9580                 .cmd = NL80211_CMD_CONNECT,
9581                 .doit = nl80211_connect,
9582                 .policy = nl80211_policy,
9583                 .flags = GENL_ADMIN_PERM,
9584                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9585                                   NL80211_FLAG_NEED_RTNL,
9586         },
9587         {
9588                 .cmd = NL80211_CMD_DISCONNECT,
9589                 .doit = nl80211_disconnect,
9590                 .policy = nl80211_policy,
9591                 .flags = GENL_ADMIN_PERM,
9592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9593                                   NL80211_FLAG_NEED_RTNL,
9594         },
9595         {
9596                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9597                 .doit = nl80211_wiphy_netns,
9598                 .policy = nl80211_policy,
9599                 .flags = GENL_ADMIN_PERM,
9600                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9601                                   NL80211_FLAG_NEED_RTNL,
9602         },
9603         {
9604                 .cmd = NL80211_CMD_GET_SURVEY,
9605                 .policy = nl80211_policy,
9606                 .dumpit = nl80211_dump_survey,
9607         },
9608         {
9609                 .cmd = NL80211_CMD_SET_PMKSA,
9610                 .doit = nl80211_setdel_pmksa,
9611                 .policy = nl80211_policy,
9612                 .flags = GENL_ADMIN_PERM,
9613                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9614                                   NL80211_FLAG_NEED_RTNL,
9615         },
9616         {
9617                 .cmd = NL80211_CMD_DEL_PMKSA,
9618                 .doit = nl80211_setdel_pmksa,
9619                 .policy = nl80211_policy,
9620                 .flags = GENL_ADMIN_PERM,
9621                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9622                                   NL80211_FLAG_NEED_RTNL,
9623         },
9624         {
9625                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9626                 .doit = nl80211_flush_pmksa,
9627                 .policy = nl80211_policy,
9628                 .flags = GENL_ADMIN_PERM,
9629                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9630                                   NL80211_FLAG_NEED_RTNL,
9631         },
9632         {
9633                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9634                 .doit = nl80211_remain_on_channel,
9635                 .policy = nl80211_policy,
9636                 .flags = GENL_ADMIN_PERM,
9637                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9638                                   NL80211_FLAG_NEED_RTNL,
9639         },
9640         {
9641                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9642                 .doit = nl80211_cancel_remain_on_channel,
9643                 .policy = nl80211_policy,
9644                 .flags = GENL_ADMIN_PERM,
9645                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9646                                   NL80211_FLAG_NEED_RTNL,
9647         },
9648         {
9649                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9650                 .doit = nl80211_set_tx_bitrate_mask,
9651                 .policy = nl80211_policy,
9652                 .flags = GENL_ADMIN_PERM,
9653                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9654                                   NL80211_FLAG_NEED_RTNL,
9655         },
9656         {
9657                 .cmd = NL80211_CMD_REGISTER_FRAME,
9658                 .doit = nl80211_register_mgmt,
9659                 .policy = nl80211_policy,
9660                 .flags = GENL_ADMIN_PERM,
9661                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9662                                   NL80211_FLAG_NEED_RTNL,
9663         },
9664         {
9665                 .cmd = NL80211_CMD_FRAME,
9666                 .doit = nl80211_tx_mgmt,
9667                 .policy = nl80211_policy,
9668                 .flags = GENL_ADMIN_PERM,
9669                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9670                                   NL80211_FLAG_NEED_RTNL,
9671         },
9672         {
9673                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9674                 .doit = nl80211_tx_mgmt_cancel_wait,
9675                 .policy = nl80211_policy,
9676                 .flags = GENL_ADMIN_PERM,
9677                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9678                                   NL80211_FLAG_NEED_RTNL,
9679         },
9680         {
9681                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9682                 .doit = nl80211_set_power_save,
9683                 .policy = nl80211_policy,
9684                 .flags = GENL_ADMIN_PERM,
9685                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9686                                   NL80211_FLAG_NEED_RTNL,
9687         },
9688         {
9689                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9690                 .doit = nl80211_get_power_save,
9691                 .policy = nl80211_policy,
9692                 /* can be retrieved by unprivileged users */
9693                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9694                                   NL80211_FLAG_NEED_RTNL,
9695         },
9696         {
9697                 .cmd = NL80211_CMD_SET_CQM,
9698                 .doit = nl80211_set_cqm,
9699                 .policy = nl80211_policy,
9700                 .flags = GENL_ADMIN_PERM,
9701                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9702                                   NL80211_FLAG_NEED_RTNL,
9703         },
9704         {
9705                 .cmd = NL80211_CMD_SET_CHANNEL,
9706                 .doit = nl80211_set_channel,
9707                 .policy = nl80211_policy,
9708                 .flags = GENL_ADMIN_PERM,
9709                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9710                                   NL80211_FLAG_NEED_RTNL,
9711         },
9712         {
9713                 .cmd = NL80211_CMD_SET_WDS_PEER,
9714                 .doit = nl80211_set_wds_peer,
9715                 .policy = nl80211_policy,
9716                 .flags = GENL_ADMIN_PERM,
9717                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9718                                   NL80211_FLAG_NEED_RTNL,
9719         },
9720         {
9721                 .cmd = NL80211_CMD_JOIN_MESH,
9722                 .doit = nl80211_join_mesh,
9723                 .policy = nl80211_policy,
9724                 .flags = GENL_ADMIN_PERM,
9725                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9726                                   NL80211_FLAG_NEED_RTNL,
9727         },
9728         {
9729                 .cmd = NL80211_CMD_LEAVE_MESH,
9730                 .doit = nl80211_leave_mesh,
9731                 .policy = nl80211_policy,
9732                 .flags = GENL_ADMIN_PERM,
9733                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9734                                   NL80211_FLAG_NEED_RTNL,
9735         },
9736 #ifdef CONFIG_PM
9737         {
9738                 .cmd = NL80211_CMD_GET_WOWLAN,
9739                 .doit = nl80211_get_wowlan,
9740                 .policy = nl80211_policy,
9741                 /* can be retrieved by unprivileged users */
9742                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9743                                   NL80211_FLAG_NEED_RTNL,
9744         },
9745         {
9746                 .cmd = NL80211_CMD_SET_WOWLAN,
9747                 .doit = nl80211_set_wowlan,
9748                 .policy = nl80211_policy,
9749                 .flags = GENL_ADMIN_PERM,
9750                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9751                                   NL80211_FLAG_NEED_RTNL,
9752         },
9753 #endif
9754         {
9755                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9756                 .doit = nl80211_set_rekey_data,
9757                 .policy = nl80211_policy,
9758                 .flags = GENL_ADMIN_PERM,
9759                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9760                                   NL80211_FLAG_NEED_RTNL,
9761         },
9762         {
9763                 .cmd = NL80211_CMD_TDLS_MGMT,
9764                 .doit = nl80211_tdls_mgmt,
9765                 .policy = nl80211_policy,
9766                 .flags = GENL_ADMIN_PERM,
9767                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9768                                   NL80211_FLAG_NEED_RTNL,
9769         },
9770         {
9771                 .cmd = NL80211_CMD_TDLS_OPER,
9772                 .doit = nl80211_tdls_oper,
9773                 .policy = nl80211_policy,
9774                 .flags = GENL_ADMIN_PERM,
9775                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9776                                   NL80211_FLAG_NEED_RTNL,
9777         },
9778         {
9779                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9780                 .doit = nl80211_register_unexpected_frame,
9781                 .policy = nl80211_policy,
9782                 .flags = GENL_ADMIN_PERM,
9783                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9784                                   NL80211_FLAG_NEED_RTNL,
9785         },
9786         {
9787                 .cmd = NL80211_CMD_PROBE_CLIENT,
9788                 .doit = nl80211_probe_client,
9789                 .policy = nl80211_policy,
9790                 .flags = GENL_ADMIN_PERM,
9791                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9792                                   NL80211_FLAG_NEED_RTNL,
9793         },
9794         {
9795                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9796                 .doit = nl80211_register_beacons,
9797                 .policy = nl80211_policy,
9798                 .flags = GENL_ADMIN_PERM,
9799                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9800                                   NL80211_FLAG_NEED_RTNL,
9801         },
9802         {
9803                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9804                 .doit = nl80211_set_noack_map,
9805                 .policy = nl80211_policy,
9806                 .flags = GENL_ADMIN_PERM,
9807                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9808                                   NL80211_FLAG_NEED_RTNL,
9809         },
9810         {
9811                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9812                 .doit = nl80211_start_p2p_device,
9813                 .policy = nl80211_policy,
9814                 .flags = GENL_ADMIN_PERM,
9815                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9816                                   NL80211_FLAG_NEED_RTNL,
9817         },
9818         {
9819                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9820                 .doit = nl80211_stop_p2p_device,
9821                 .policy = nl80211_policy,
9822                 .flags = GENL_ADMIN_PERM,
9823                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9824                                   NL80211_FLAG_NEED_RTNL,
9825         },
9826         {
9827                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9828                 .doit = nl80211_set_mcast_rate,
9829                 .policy = nl80211_policy,
9830                 .flags = GENL_ADMIN_PERM,
9831                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9832                                   NL80211_FLAG_NEED_RTNL,
9833         },
9834         {
9835                 .cmd = NL80211_CMD_SET_MAC_ACL,
9836                 .doit = nl80211_set_mac_acl,
9837                 .policy = nl80211_policy,
9838                 .flags = GENL_ADMIN_PERM,
9839                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9840                                   NL80211_FLAG_NEED_RTNL,
9841         },
9842         {
9843                 .cmd = NL80211_CMD_RADAR_DETECT,
9844                 .doit = nl80211_start_radar_detection,
9845                 .policy = nl80211_policy,
9846                 .flags = GENL_ADMIN_PERM,
9847                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9848                                   NL80211_FLAG_NEED_RTNL,
9849         },
9850         {
9851                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9852                 .doit = nl80211_get_protocol_features,
9853                 .policy = nl80211_policy,
9854         },
9855         {
9856                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9857                 .doit = nl80211_update_ft_ies,
9858                 .policy = nl80211_policy,
9859                 .flags = GENL_ADMIN_PERM,
9860                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9861                                   NL80211_FLAG_NEED_RTNL,
9862         },
9863         {
9864                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9865                 .doit = nl80211_crit_protocol_start,
9866                 .policy = nl80211_policy,
9867                 .flags = GENL_ADMIN_PERM,
9868                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9869                                   NL80211_FLAG_NEED_RTNL,
9870         },
9871         {
9872                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9873                 .doit = nl80211_crit_protocol_stop,
9874                 .policy = nl80211_policy,
9875                 .flags = GENL_ADMIN_PERM,
9876                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9877                                   NL80211_FLAG_NEED_RTNL,
9878         },
9879         {
9880                 .cmd = NL80211_CMD_GET_COALESCE,
9881                 .doit = nl80211_get_coalesce,
9882                 .policy = nl80211_policy,
9883                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9884                                   NL80211_FLAG_NEED_RTNL,
9885         },
9886         {
9887                 .cmd = NL80211_CMD_SET_COALESCE,
9888                 .doit = nl80211_set_coalesce,
9889                 .policy = nl80211_policy,
9890                 .flags = GENL_ADMIN_PERM,
9891                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9892                                   NL80211_FLAG_NEED_RTNL,
9893         },
9894         {
9895                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9896                 .doit = nl80211_channel_switch,
9897                 .policy = nl80211_policy,
9898                 .flags = GENL_ADMIN_PERM,
9899                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9900                                   NL80211_FLAG_NEED_RTNL,
9901         },
9902         {
9903                 .cmd = NL80211_CMD_VENDOR,
9904                 .doit = nl80211_vendor_cmd,
9905                 .policy = nl80211_policy,
9906                 .flags = GENL_ADMIN_PERM,
9907                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9908                                   NL80211_FLAG_NEED_RTNL,
9909         },
9910         {
9911                 .cmd = NL80211_CMD_SET_QOS_MAP,
9912                 .doit = nl80211_set_qos_map,
9913                 .policy = nl80211_policy,
9914                 .flags = GENL_ADMIN_PERM,
9915                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9916                                   NL80211_FLAG_NEED_RTNL,
9917         },
9918 };
9919
9920 /* notification functions */
9921
9922 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9923 {
9924         struct sk_buff *msg;
9925         struct nl80211_dump_wiphy_state state = {};
9926
9927         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9928         if (!msg)
9929                 return;
9930
9931         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9932                 nlmsg_free(msg);
9933                 return;
9934         }
9935
9936         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9937                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
9938 }
9939
9940 static int nl80211_add_scan_req(struct sk_buff *msg,
9941                                 struct cfg80211_registered_device *rdev)
9942 {
9943         struct cfg80211_scan_request *req = rdev->scan_req;
9944         struct nlattr *nest;
9945         int i;
9946
9947         if (WARN_ON(!req))
9948                 return 0;
9949
9950         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9951         if (!nest)
9952                 goto nla_put_failure;
9953         for (i = 0; i < req->n_ssids; i++) {
9954                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9955                         goto nla_put_failure;
9956         }
9957         nla_nest_end(msg, nest);
9958
9959         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9960         if (!nest)
9961                 goto nla_put_failure;
9962         for (i = 0; i < req->n_channels; i++) {
9963                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9964                         goto nla_put_failure;
9965         }
9966         nla_nest_end(msg, nest);
9967
9968         if (req->ie &&
9969             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9970                 goto nla_put_failure;
9971
9972         if (req->flags &&
9973             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
9974                 goto nla_put_failure;
9975
9976         return 0;
9977  nla_put_failure:
9978         return -ENOBUFS;
9979 }
9980
9981 static int nl80211_send_scan_msg(struct sk_buff *msg,
9982                                  struct cfg80211_registered_device *rdev,
9983                                  struct wireless_dev *wdev,
9984                                  u32 portid, u32 seq, int flags,
9985                                  u32 cmd)
9986 {
9987         void *hdr;
9988
9989         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9990         if (!hdr)
9991                 return -1;
9992
9993         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9994             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9995                                          wdev->netdev->ifindex)) ||
9996             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9997                 goto nla_put_failure;
9998
9999         /* ignore errors and send incomplete event anyway */
10000         nl80211_add_scan_req(msg, rdev);
10001
10002         return genlmsg_end(msg, hdr);
10003
10004  nla_put_failure:
10005         genlmsg_cancel(msg, hdr);
10006         return -EMSGSIZE;
10007 }
10008
10009 static int
10010 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10011                             struct cfg80211_registered_device *rdev,
10012                             struct net_device *netdev,
10013                             u32 portid, u32 seq, int flags, u32 cmd)
10014 {
10015         void *hdr;
10016
10017         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10018         if (!hdr)
10019                 return -1;
10020
10021         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10022             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10023                 goto nla_put_failure;
10024
10025         return genlmsg_end(msg, hdr);
10026
10027  nla_put_failure:
10028         genlmsg_cancel(msg, hdr);
10029         return -EMSGSIZE;
10030 }
10031
10032 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10033                              struct wireless_dev *wdev)
10034 {
10035         struct sk_buff *msg;
10036
10037         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10038         if (!msg)
10039                 return;
10040
10041         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10042                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10043                 nlmsg_free(msg);
10044                 return;
10045         }
10046
10047         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10048                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10049 }
10050
10051 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
10052                             struct wireless_dev *wdev)
10053 {
10054         struct sk_buff *msg;
10055
10056         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10057         if (!msg)
10058                 return;
10059
10060         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10061                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10062                 nlmsg_free(msg);
10063                 return;
10064         }
10065
10066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10067                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10068 }
10069
10070 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
10071                                struct wireless_dev *wdev)
10072 {
10073         struct sk_buff *msg;
10074
10075         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10076         if (!msg)
10077                 return;
10078
10079         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10080                                   NL80211_CMD_SCAN_ABORTED) < 0) {
10081                 nlmsg_free(msg);
10082                 return;
10083         }
10084
10085         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10086                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10087 }
10088
10089 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10090                                      struct net_device *netdev)
10091 {
10092         struct sk_buff *msg;
10093
10094         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10095         if (!msg)
10096                 return;
10097
10098         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10099                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10100                 nlmsg_free(msg);
10101                 return;
10102         }
10103
10104         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10105                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10106 }
10107
10108 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10109                              struct net_device *netdev, u32 cmd)
10110 {
10111         struct sk_buff *msg;
10112
10113         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10114         if (!msg)
10115                 return;
10116
10117         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10118                 nlmsg_free(msg);
10119                 return;
10120         }
10121
10122         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10123                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10124 }
10125
10126 /*
10127  * This can happen on global regulatory changes or device specific settings
10128  * based on custom world regulatory domains.
10129  */
10130 void nl80211_send_reg_change_event(struct regulatory_request *request)
10131 {
10132         struct sk_buff *msg;
10133         void *hdr;
10134
10135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10136         if (!msg)
10137                 return;
10138
10139         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10140         if (!hdr) {
10141                 nlmsg_free(msg);
10142                 return;
10143         }
10144
10145         /* Userspace can always count this one always being set */
10146         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10147                 goto nla_put_failure;
10148
10149         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10150                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10151                                NL80211_REGDOM_TYPE_WORLD))
10152                         goto nla_put_failure;
10153         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10154                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10155                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10156                         goto nla_put_failure;
10157         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10158                    request->intersect) {
10159                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10160                                NL80211_REGDOM_TYPE_INTERSECTION))
10161                         goto nla_put_failure;
10162         } else {
10163                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10164                                NL80211_REGDOM_TYPE_COUNTRY) ||
10165                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10166                                    request->alpha2))
10167                         goto nla_put_failure;
10168         }
10169
10170         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10171             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10172                 goto nla_put_failure;
10173
10174         genlmsg_end(msg, hdr);
10175
10176         rcu_read_lock();
10177         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10178                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10179         rcu_read_unlock();
10180
10181         return;
10182
10183 nla_put_failure:
10184         genlmsg_cancel(msg, hdr);
10185         nlmsg_free(msg);
10186 }
10187
10188 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10189                                     struct net_device *netdev,
10190                                     const u8 *buf, size_t len,
10191                                     enum nl80211_commands cmd, gfp_t gfp)
10192 {
10193         struct sk_buff *msg;
10194         void *hdr;
10195
10196         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10197         if (!msg)
10198                 return;
10199
10200         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10201         if (!hdr) {
10202                 nlmsg_free(msg);
10203                 return;
10204         }
10205
10206         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10207             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10208             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10209                 goto nla_put_failure;
10210
10211         genlmsg_end(msg, hdr);
10212
10213         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10214                                 NL80211_MCGRP_MLME, gfp);
10215         return;
10216
10217  nla_put_failure:
10218         genlmsg_cancel(msg, hdr);
10219         nlmsg_free(msg);
10220 }
10221
10222 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10223                           struct net_device *netdev, const u8 *buf,
10224                           size_t len, gfp_t gfp)
10225 {
10226         nl80211_send_mlme_event(rdev, netdev, buf, len,
10227                                 NL80211_CMD_AUTHENTICATE, gfp);
10228 }
10229
10230 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10231                            struct net_device *netdev, const u8 *buf,
10232                            size_t len, gfp_t gfp)
10233 {
10234         nl80211_send_mlme_event(rdev, netdev, buf, len,
10235                                 NL80211_CMD_ASSOCIATE, gfp);
10236 }
10237
10238 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10239                          struct net_device *netdev, const u8 *buf,
10240                          size_t len, gfp_t gfp)
10241 {
10242         nl80211_send_mlme_event(rdev, netdev, buf, len,
10243                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10244 }
10245
10246 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10247                            struct net_device *netdev, const u8 *buf,
10248                            size_t len, gfp_t gfp)
10249 {
10250         nl80211_send_mlme_event(rdev, netdev, buf, len,
10251                                 NL80211_CMD_DISASSOCIATE, gfp);
10252 }
10253
10254 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10255                                   size_t len)
10256 {
10257         struct wireless_dev *wdev = dev->ieee80211_ptr;
10258         struct wiphy *wiphy = wdev->wiphy;
10259         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10260         const struct ieee80211_mgmt *mgmt = (void *)buf;
10261         u32 cmd;
10262
10263         if (WARN_ON(len < 2))
10264                 return;
10265
10266         if (ieee80211_is_deauth(mgmt->frame_control))
10267                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10268         else
10269                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10270
10271         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10272         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10273 }
10274 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10275
10276 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10277                                       struct net_device *netdev, int cmd,
10278                                       const u8 *addr, gfp_t gfp)
10279 {
10280         struct sk_buff *msg;
10281         void *hdr;
10282
10283         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10284         if (!msg)
10285                 return;
10286
10287         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10288         if (!hdr) {
10289                 nlmsg_free(msg);
10290                 return;
10291         }
10292
10293         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10294             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10295             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10296             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10297                 goto nla_put_failure;
10298
10299         genlmsg_end(msg, hdr);
10300
10301         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10302                                 NL80211_MCGRP_MLME, gfp);
10303         return;
10304
10305  nla_put_failure:
10306         genlmsg_cancel(msg, hdr);
10307         nlmsg_free(msg);
10308 }
10309
10310 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10311                                struct net_device *netdev, const u8 *addr,
10312                                gfp_t gfp)
10313 {
10314         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10315                                   addr, gfp);
10316 }
10317
10318 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10319                                 struct net_device *netdev, const u8 *addr,
10320                                 gfp_t gfp)
10321 {
10322         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10323                                   addr, gfp);
10324 }
10325
10326 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10327                                  struct net_device *netdev, const u8 *bssid,
10328                                  const u8 *req_ie, size_t req_ie_len,
10329                                  const u8 *resp_ie, size_t resp_ie_len,
10330                                  u16 status, gfp_t gfp)
10331 {
10332         struct sk_buff *msg;
10333         void *hdr;
10334
10335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10336         if (!msg)
10337                 return;
10338
10339         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10340         if (!hdr) {
10341                 nlmsg_free(msg);
10342                 return;
10343         }
10344
10345         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10346             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10347             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10348             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10349             (req_ie &&
10350              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10351             (resp_ie &&
10352              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10353                 goto nla_put_failure;
10354
10355         genlmsg_end(msg, hdr);
10356
10357         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10358                                 NL80211_MCGRP_MLME, gfp);
10359         return;
10360
10361  nla_put_failure:
10362         genlmsg_cancel(msg, hdr);
10363         nlmsg_free(msg);
10364
10365 }
10366
10367 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10368                          struct net_device *netdev, const u8 *bssid,
10369                          const u8 *req_ie, size_t req_ie_len,
10370                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10371 {
10372         struct sk_buff *msg;
10373         void *hdr;
10374
10375         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10376         if (!msg)
10377                 return;
10378
10379         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10380         if (!hdr) {
10381                 nlmsg_free(msg);
10382                 return;
10383         }
10384
10385         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10386             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10387             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10388             (req_ie &&
10389              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10390             (resp_ie &&
10391              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10392                 goto nla_put_failure;
10393
10394         genlmsg_end(msg, hdr);
10395
10396         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10397                                 NL80211_MCGRP_MLME, gfp);
10398         return;
10399
10400  nla_put_failure:
10401         genlmsg_cancel(msg, hdr);
10402         nlmsg_free(msg);
10403
10404 }
10405
10406 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10407                                struct net_device *netdev, u16 reason,
10408                                const u8 *ie, size_t ie_len, bool from_ap)
10409 {
10410         struct sk_buff *msg;
10411         void *hdr;
10412
10413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10414         if (!msg)
10415                 return;
10416
10417         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10418         if (!hdr) {
10419                 nlmsg_free(msg);
10420                 return;
10421         }
10422
10423         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10424             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10425             (from_ap && reason &&
10426              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10427             (from_ap &&
10428              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10429             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10430                 goto nla_put_failure;
10431
10432         genlmsg_end(msg, hdr);
10433
10434         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10435                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10436         return;
10437
10438  nla_put_failure:
10439         genlmsg_cancel(msg, hdr);
10440         nlmsg_free(msg);
10441
10442 }
10443
10444 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10445                              struct net_device *netdev, const u8 *bssid,
10446                              gfp_t gfp)
10447 {
10448         struct sk_buff *msg;
10449         void *hdr;
10450
10451         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10452         if (!msg)
10453                 return;
10454
10455         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10456         if (!hdr) {
10457                 nlmsg_free(msg);
10458                 return;
10459         }
10460
10461         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10462             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10463             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10464                 goto nla_put_failure;
10465
10466         genlmsg_end(msg, hdr);
10467
10468         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10469                                 NL80211_MCGRP_MLME, gfp);
10470         return;
10471
10472  nla_put_failure:
10473         genlmsg_cancel(msg, hdr);
10474         nlmsg_free(msg);
10475 }
10476
10477 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10478                                         const u8* ie, u8 ie_len, gfp_t gfp)
10479 {
10480         struct wireless_dev *wdev = dev->ieee80211_ptr;
10481         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10482         struct sk_buff *msg;
10483         void *hdr;
10484
10485         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10486                 return;
10487
10488         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10489
10490         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10491         if (!msg)
10492                 return;
10493
10494         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10495         if (!hdr) {
10496                 nlmsg_free(msg);
10497                 return;
10498         }
10499
10500         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10501             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10502             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10503             (ie_len && ie &&
10504              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10505                 goto nla_put_failure;
10506
10507         genlmsg_end(msg, hdr);
10508
10509         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10510                                 NL80211_MCGRP_MLME, gfp);
10511         return;
10512
10513  nla_put_failure:
10514         genlmsg_cancel(msg, hdr);
10515         nlmsg_free(msg);
10516 }
10517 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10518
10519 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10520                                  struct net_device *netdev, const u8 *addr,
10521                                  enum nl80211_key_type key_type, int key_id,
10522                                  const u8 *tsc, gfp_t gfp)
10523 {
10524         struct sk_buff *msg;
10525         void *hdr;
10526
10527         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10528         if (!msg)
10529                 return;
10530
10531         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10532         if (!hdr) {
10533                 nlmsg_free(msg);
10534                 return;
10535         }
10536
10537         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10538             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10539             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10540             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10541             (key_id != -1 &&
10542              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10543             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10544                 goto nla_put_failure;
10545
10546         genlmsg_end(msg, hdr);
10547
10548         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10549                                 NL80211_MCGRP_MLME, gfp);
10550         return;
10551
10552  nla_put_failure:
10553         genlmsg_cancel(msg, hdr);
10554         nlmsg_free(msg);
10555 }
10556
10557 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10558                                     struct ieee80211_channel *channel_before,
10559                                     struct ieee80211_channel *channel_after)
10560 {
10561         struct sk_buff *msg;
10562         void *hdr;
10563         struct nlattr *nl_freq;
10564
10565         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10566         if (!msg)
10567                 return;
10568
10569         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10570         if (!hdr) {
10571                 nlmsg_free(msg);
10572                 return;
10573         }
10574
10575         /*
10576          * Since we are applying the beacon hint to a wiphy we know its
10577          * wiphy_idx is valid
10578          */
10579         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10580                 goto nla_put_failure;
10581
10582         /* Before */
10583         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10584         if (!nl_freq)
10585                 goto nla_put_failure;
10586         if (nl80211_msg_put_channel(msg, channel_before, false))
10587                 goto nla_put_failure;
10588         nla_nest_end(msg, nl_freq);
10589
10590         /* After */
10591         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10592         if (!nl_freq)
10593                 goto nla_put_failure;
10594         if (nl80211_msg_put_channel(msg, channel_after, false))
10595                 goto nla_put_failure;
10596         nla_nest_end(msg, nl_freq);
10597
10598         genlmsg_end(msg, hdr);
10599
10600         rcu_read_lock();
10601         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10602                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10603         rcu_read_unlock();
10604
10605         return;
10606
10607 nla_put_failure:
10608         genlmsg_cancel(msg, hdr);
10609         nlmsg_free(msg);
10610 }
10611
10612 static void nl80211_send_remain_on_chan_event(
10613         int cmd, struct cfg80211_registered_device *rdev,
10614         struct wireless_dev *wdev, u64 cookie,
10615         struct ieee80211_channel *chan,
10616         unsigned int duration, gfp_t gfp)
10617 {
10618         struct sk_buff *msg;
10619         void *hdr;
10620
10621         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10622         if (!msg)
10623                 return;
10624
10625         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10626         if (!hdr) {
10627                 nlmsg_free(msg);
10628                 return;
10629         }
10630
10631         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10632             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10633                                          wdev->netdev->ifindex)) ||
10634             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10635             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10636             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10637                         NL80211_CHAN_NO_HT) ||
10638             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10639                 goto nla_put_failure;
10640
10641         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10642             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10643                 goto nla_put_failure;
10644
10645         genlmsg_end(msg, hdr);
10646
10647         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10648                                 NL80211_MCGRP_MLME, gfp);
10649         return;
10650
10651  nla_put_failure:
10652         genlmsg_cancel(msg, hdr);
10653         nlmsg_free(msg);
10654 }
10655
10656 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10657                                struct ieee80211_channel *chan,
10658                                unsigned int duration, gfp_t gfp)
10659 {
10660         struct wiphy *wiphy = wdev->wiphy;
10661         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10662
10663         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10664         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10665                                           rdev, wdev, cookie, chan,
10666                                           duration, gfp);
10667 }
10668 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10669
10670 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10671                                         struct ieee80211_channel *chan,
10672                                         gfp_t gfp)
10673 {
10674         struct wiphy *wiphy = wdev->wiphy;
10675         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10676
10677         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10678         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10679                                           rdev, wdev, cookie, chan, 0, gfp);
10680 }
10681 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10682
10683 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10684                       struct station_info *sinfo, gfp_t gfp)
10685 {
10686         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10687         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10688         struct sk_buff *msg;
10689
10690         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10691
10692         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10693         if (!msg)
10694                 return;
10695
10696         if (nl80211_send_station(msg, 0, 0, 0,
10697                                  rdev, dev, mac_addr, sinfo) < 0) {
10698                 nlmsg_free(msg);
10699                 return;
10700         }
10701
10702         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10703                                 NL80211_MCGRP_MLME, gfp);
10704 }
10705 EXPORT_SYMBOL(cfg80211_new_sta);
10706
10707 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10708 {
10709         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10710         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10711         struct sk_buff *msg;
10712         void *hdr;
10713
10714         trace_cfg80211_del_sta(dev, mac_addr);
10715
10716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10717         if (!msg)
10718                 return;
10719
10720         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10721         if (!hdr) {
10722                 nlmsg_free(msg);
10723                 return;
10724         }
10725
10726         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10727             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10728                 goto nla_put_failure;
10729
10730         genlmsg_end(msg, hdr);
10731
10732         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10733                                 NL80211_MCGRP_MLME, gfp);
10734         return;
10735
10736  nla_put_failure:
10737         genlmsg_cancel(msg, hdr);
10738         nlmsg_free(msg);
10739 }
10740 EXPORT_SYMBOL(cfg80211_del_sta);
10741
10742 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10743                           enum nl80211_connect_failed_reason reason,
10744                           gfp_t gfp)
10745 {
10746         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10747         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10748         struct sk_buff *msg;
10749         void *hdr;
10750
10751         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10752         if (!msg)
10753                 return;
10754
10755         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10756         if (!hdr) {
10757                 nlmsg_free(msg);
10758                 return;
10759         }
10760
10761         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10762             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10763             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10764                 goto nla_put_failure;
10765
10766         genlmsg_end(msg, hdr);
10767
10768         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10769                                 NL80211_MCGRP_MLME, gfp);
10770         return;
10771
10772  nla_put_failure:
10773         genlmsg_cancel(msg, hdr);
10774         nlmsg_free(msg);
10775 }
10776 EXPORT_SYMBOL(cfg80211_conn_failed);
10777
10778 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10779                                        const u8 *addr, gfp_t gfp)
10780 {
10781         struct wireless_dev *wdev = dev->ieee80211_ptr;
10782         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10783         struct sk_buff *msg;
10784         void *hdr;
10785         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10786
10787         if (!nlportid)
10788                 return false;
10789
10790         msg = nlmsg_new(100, gfp);
10791         if (!msg)
10792                 return true;
10793
10794         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10795         if (!hdr) {
10796                 nlmsg_free(msg);
10797                 return true;
10798         }
10799
10800         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10801             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10802             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10803                 goto nla_put_failure;
10804
10805         genlmsg_end(msg, hdr);
10806         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10807         return true;
10808
10809  nla_put_failure:
10810         genlmsg_cancel(msg, hdr);
10811         nlmsg_free(msg);
10812         return true;
10813 }
10814
10815 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10816                                 const u8 *addr, gfp_t gfp)
10817 {
10818         struct wireless_dev *wdev = dev->ieee80211_ptr;
10819         bool ret;
10820
10821         trace_cfg80211_rx_spurious_frame(dev, addr);
10822
10823         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10824                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10825                 trace_cfg80211_return_bool(false);
10826                 return false;
10827         }
10828         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10829                                          addr, gfp);
10830         trace_cfg80211_return_bool(ret);
10831         return ret;
10832 }
10833 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10834
10835 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10836                                         const u8 *addr, gfp_t gfp)
10837 {
10838         struct wireless_dev *wdev = dev->ieee80211_ptr;
10839         bool ret;
10840
10841         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10842
10843         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10844                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10845                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10846                 trace_cfg80211_return_bool(false);
10847                 return false;
10848         }
10849         ret = __nl80211_unexpected_frame(dev,
10850                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10851                                          addr, gfp);
10852         trace_cfg80211_return_bool(ret);
10853         return ret;
10854 }
10855 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10856
10857 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10858                       struct wireless_dev *wdev, u32 nlportid,
10859                       int freq, int sig_dbm,
10860                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10861 {
10862         struct net_device *netdev = wdev->netdev;
10863         struct sk_buff *msg;
10864         void *hdr;
10865
10866         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10867         if (!msg)
10868                 return -ENOMEM;
10869
10870         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10871         if (!hdr) {
10872                 nlmsg_free(msg);
10873                 return -ENOMEM;
10874         }
10875
10876         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10877             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10878                                         netdev->ifindex)) ||
10879             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10880             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10881             (sig_dbm &&
10882              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10883             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10884             (flags &&
10885              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10886                 goto nla_put_failure;
10887
10888         genlmsg_end(msg, hdr);
10889
10890         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10891
10892  nla_put_failure:
10893         genlmsg_cancel(msg, hdr);
10894         nlmsg_free(msg);
10895         return -ENOBUFS;
10896 }
10897
10898 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10899                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10900 {
10901         struct wiphy *wiphy = wdev->wiphy;
10902         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10903         struct net_device *netdev = wdev->netdev;
10904         struct sk_buff *msg;
10905         void *hdr;
10906
10907         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10908
10909         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10910         if (!msg)
10911                 return;
10912
10913         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10914         if (!hdr) {
10915                 nlmsg_free(msg);
10916                 return;
10917         }
10918
10919         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10920             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10921                                    netdev->ifindex)) ||
10922             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10923             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10924             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10925             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10926                 goto nla_put_failure;
10927
10928         genlmsg_end(msg, hdr);
10929
10930         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10931                                 NL80211_MCGRP_MLME, gfp);
10932         return;
10933
10934  nla_put_failure:
10935         genlmsg_cancel(msg, hdr);
10936         nlmsg_free(msg);
10937 }
10938 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10939
10940 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10941                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10942                               gfp_t gfp)
10943 {
10944         struct wireless_dev *wdev = dev->ieee80211_ptr;
10945         struct wiphy *wiphy = wdev->wiphy;
10946         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10947         struct sk_buff *msg;
10948         struct nlattr *pinfoattr;
10949         void *hdr;
10950
10951         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10952
10953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10954         if (!msg)
10955                 return;
10956
10957         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10958         if (!hdr) {
10959                 nlmsg_free(msg);
10960                 return;
10961         }
10962
10963         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10964             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10965                 goto nla_put_failure;
10966
10967         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10968         if (!pinfoattr)
10969                 goto nla_put_failure;
10970
10971         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10972                         rssi_event))
10973                 goto nla_put_failure;
10974
10975         nla_nest_end(msg, pinfoattr);
10976
10977         genlmsg_end(msg, hdr);
10978
10979         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10980                                 NL80211_MCGRP_MLME, gfp);
10981         return;
10982
10983  nla_put_failure:
10984         genlmsg_cancel(msg, hdr);
10985         nlmsg_free(msg);
10986 }
10987 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10988
10989 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10990                                      struct net_device *netdev, const u8 *bssid,
10991                                      const u8 *replay_ctr, gfp_t gfp)
10992 {
10993         struct sk_buff *msg;
10994         struct nlattr *rekey_attr;
10995         void *hdr;
10996
10997         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10998         if (!msg)
10999                 return;
11000
11001         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11002         if (!hdr) {
11003                 nlmsg_free(msg);
11004                 return;
11005         }
11006
11007         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11008             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11009             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11010                 goto nla_put_failure;
11011
11012         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11013         if (!rekey_attr)
11014                 goto nla_put_failure;
11015
11016         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11017                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11018                 goto nla_put_failure;
11019
11020         nla_nest_end(msg, rekey_attr);
11021
11022         genlmsg_end(msg, hdr);
11023
11024         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11025                                 NL80211_MCGRP_MLME, gfp);
11026         return;
11027
11028  nla_put_failure:
11029         genlmsg_cancel(msg, hdr);
11030         nlmsg_free(msg);
11031 }
11032
11033 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11034                                const u8 *replay_ctr, gfp_t gfp)
11035 {
11036         struct wireless_dev *wdev = dev->ieee80211_ptr;
11037         struct wiphy *wiphy = wdev->wiphy;
11038         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11039
11040         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11041         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11042 }
11043 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11044
11045 static void
11046 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11047                                struct net_device *netdev, int index,
11048                                const u8 *bssid, bool preauth, gfp_t gfp)
11049 {
11050         struct sk_buff *msg;
11051         struct nlattr *attr;
11052         void *hdr;
11053
11054         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11055         if (!msg)
11056                 return;
11057
11058         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11059         if (!hdr) {
11060                 nlmsg_free(msg);
11061                 return;
11062         }
11063
11064         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11065             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11066                 goto nla_put_failure;
11067
11068         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11069         if (!attr)
11070                 goto nla_put_failure;
11071
11072         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11073             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11074             (preauth &&
11075              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11076                 goto nla_put_failure;
11077
11078         nla_nest_end(msg, attr);
11079
11080         genlmsg_end(msg, hdr);
11081
11082         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11083                                 NL80211_MCGRP_MLME, gfp);
11084         return;
11085
11086  nla_put_failure:
11087         genlmsg_cancel(msg, hdr);
11088         nlmsg_free(msg);
11089 }
11090
11091 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11092                                      const u8 *bssid, bool preauth, gfp_t gfp)
11093 {
11094         struct wireless_dev *wdev = dev->ieee80211_ptr;
11095         struct wiphy *wiphy = wdev->wiphy;
11096         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11097
11098         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11099         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11100 }
11101 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11102
11103 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11104                                      struct net_device *netdev,
11105                                      struct cfg80211_chan_def *chandef,
11106                                      gfp_t gfp)
11107 {
11108         struct sk_buff *msg;
11109         void *hdr;
11110
11111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11112         if (!msg)
11113                 return;
11114
11115         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11116         if (!hdr) {
11117                 nlmsg_free(msg);
11118                 return;
11119         }
11120
11121         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11122                 goto nla_put_failure;
11123
11124         if (nl80211_send_chandef(msg, chandef))
11125                 goto nla_put_failure;
11126
11127         genlmsg_end(msg, hdr);
11128
11129         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11130                                 NL80211_MCGRP_MLME, gfp);
11131         return;
11132
11133  nla_put_failure:
11134         genlmsg_cancel(msg, hdr);
11135         nlmsg_free(msg);
11136 }
11137
11138 void cfg80211_ch_switch_notify(struct net_device *dev,
11139                                struct cfg80211_chan_def *chandef)
11140 {
11141         struct wireless_dev *wdev = dev->ieee80211_ptr;
11142         struct wiphy *wiphy = wdev->wiphy;
11143         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11144
11145         ASSERT_WDEV_LOCK(wdev);
11146
11147         trace_cfg80211_ch_switch_notify(dev, chandef);
11148
11149         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11150                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11151                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11152                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11153                 return;
11154
11155         wdev->channel = chandef->chan;
11156         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11157 }
11158 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11159
11160 void cfg80211_cqm_txe_notify(struct net_device *dev,
11161                              const u8 *peer, u32 num_packets,
11162                              u32 rate, u32 intvl, gfp_t gfp)
11163 {
11164         struct wireless_dev *wdev = dev->ieee80211_ptr;
11165         struct wiphy *wiphy = wdev->wiphy;
11166         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11167         struct sk_buff *msg;
11168         struct nlattr *pinfoattr;
11169         void *hdr;
11170
11171         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11172         if (!msg)
11173                 return;
11174
11175         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11176         if (!hdr) {
11177                 nlmsg_free(msg);
11178                 return;
11179         }
11180
11181         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11182             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11183             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11184                 goto nla_put_failure;
11185
11186         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11187         if (!pinfoattr)
11188                 goto nla_put_failure;
11189
11190         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11191                 goto nla_put_failure;
11192
11193         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11194                 goto nla_put_failure;
11195
11196         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11197                 goto nla_put_failure;
11198
11199         nla_nest_end(msg, pinfoattr);
11200
11201         genlmsg_end(msg, hdr);
11202
11203         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11204                                 NL80211_MCGRP_MLME, gfp);
11205         return;
11206
11207  nla_put_failure:
11208         genlmsg_cancel(msg, hdr);
11209         nlmsg_free(msg);
11210 }
11211 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11212
11213 void
11214 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11215                      const struct cfg80211_chan_def *chandef,
11216                      enum nl80211_radar_event event,
11217                      struct net_device *netdev, gfp_t gfp)
11218 {
11219         struct sk_buff *msg;
11220         void *hdr;
11221
11222         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11223         if (!msg)
11224                 return;
11225
11226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11227         if (!hdr) {
11228                 nlmsg_free(msg);
11229                 return;
11230         }
11231
11232         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11233                 goto nla_put_failure;
11234
11235         /* NOP and radar events don't need a netdev parameter */
11236         if (netdev) {
11237                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11238
11239                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11240                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11241                         goto nla_put_failure;
11242         }
11243
11244         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11245                 goto nla_put_failure;
11246
11247         if (nl80211_send_chandef(msg, chandef))
11248                 goto nla_put_failure;
11249
11250         genlmsg_end(msg, hdr);
11251
11252         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11253                                 NL80211_MCGRP_MLME, gfp);
11254         return;
11255
11256  nla_put_failure:
11257         genlmsg_cancel(msg, hdr);
11258         nlmsg_free(msg);
11259 }
11260
11261 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11262                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11263 {
11264         struct wireless_dev *wdev = dev->ieee80211_ptr;
11265         struct wiphy *wiphy = wdev->wiphy;
11266         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11267         struct sk_buff *msg;
11268         struct nlattr *pinfoattr;
11269         void *hdr;
11270
11271         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11272
11273         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11274         if (!msg)
11275                 return;
11276
11277         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11278         if (!hdr) {
11279                 nlmsg_free(msg);
11280                 return;
11281         }
11282
11283         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11284             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11285             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11286                 goto nla_put_failure;
11287
11288         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11289         if (!pinfoattr)
11290                 goto nla_put_failure;
11291
11292         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11293                 goto nla_put_failure;
11294
11295         nla_nest_end(msg, pinfoattr);
11296
11297         genlmsg_end(msg, hdr);
11298
11299         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11300                                 NL80211_MCGRP_MLME, gfp);
11301         return;
11302
11303  nla_put_failure:
11304         genlmsg_cancel(msg, hdr);
11305         nlmsg_free(msg);
11306 }
11307 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11308
11309 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11310                            u64 cookie, bool acked, gfp_t gfp)
11311 {
11312         struct wireless_dev *wdev = dev->ieee80211_ptr;
11313         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11314         struct sk_buff *msg;
11315         void *hdr;
11316
11317         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11318
11319         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11320
11321         if (!msg)
11322                 return;
11323
11324         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11325         if (!hdr) {
11326                 nlmsg_free(msg);
11327                 return;
11328         }
11329
11330         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11331             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11332             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11333             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11334             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11335                 goto nla_put_failure;
11336
11337         genlmsg_end(msg, hdr);
11338
11339         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11340                                 NL80211_MCGRP_MLME, gfp);
11341         return;
11342
11343  nla_put_failure:
11344         genlmsg_cancel(msg, hdr);
11345         nlmsg_free(msg);
11346 }
11347 EXPORT_SYMBOL(cfg80211_probe_status);
11348
11349 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11350                                  const u8 *frame, size_t len,
11351                                  int freq, int sig_dbm)
11352 {
11353         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11354         struct sk_buff *msg;
11355         void *hdr;
11356         struct cfg80211_beacon_registration *reg;
11357
11358         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11359
11360         spin_lock_bh(&rdev->beacon_registrations_lock);
11361         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11362                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11363                 if (!msg) {
11364                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11365                         return;
11366                 }
11367
11368                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11369                 if (!hdr)
11370                         goto nla_put_failure;
11371
11372                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11373                     (freq &&
11374                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11375                     (sig_dbm &&
11376                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11377                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11378                         goto nla_put_failure;
11379
11380                 genlmsg_end(msg, hdr);
11381
11382                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11383         }
11384         spin_unlock_bh(&rdev->beacon_registrations_lock);
11385         return;
11386
11387  nla_put_failure:
11388         spin_unlock_bh(&rdev->beacon_registrations_lock);
11389         if (hdr)
11390                 genlmsg_cancel(msg, hdr);
11391         nlmsg_free(msg);
11392 }
11393 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11394
11395 #ifdef CONFIG_PM
11396 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11397                                    struct cfg80211_wowlan_wakeup *wakeup,
11398                                    gfp_t gfp)
11399 {
11400         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11401         struct sk_buff *msg;
11402         void *hdr;
11403         int size = 200;
11404
11405         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11406
11407         if (wakeup)
11408                 size += wakeup->packet_present_len;
11409
11410         msg = nlmsg_new(size, gfp);
11411         if (!msg)
11412                 return;
11413
11414         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11415         if (!hdr)
11416                 goto free_msg;
11417
11418         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11419             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11420                 goto free_msg;
11421
11422         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11423                                         wdev->netdev->ifindex))
11424                 goto free_msg;
11425
11426         if (wakeup) {
11427                 struct nlattr *reasons;
11428
11429                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11430                 if (!reasons)
11431                         goto free_msg;
11432
11433                 if (wakeup->disconnect &&
11434                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11435                         goto free_msg;
11436                 if (wakeup->magic_pkt &&
11437                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11438                         goto free_msg;
11439                 if (wakeup->gtk_rekey_failure &&
11440                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11441                         goto free_msg;
11442                 if (wakeup->eap_identity_req &&
11443                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11444                         goto free_msg;
11445                 if (wakeup->four_way_handshake &&
11446                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11447                         goto free_msg;
11448                 if (wakeup->rfkill_release &&
11449                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11450                         goto free_msg;
11451
11452                 if (wakeup->pattern_idx >= 0 &&
11453                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11454                                 wakeup->pattern_idx))
11455                         goto free_msg;
11456
11457                 if (wakeup->tcp_match &&
11458                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11459                         goto free_msg;
11460
11461                 if (wakeup->tcp_connlost &&
11462                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11463                         goto free_msg;
11464
11465                 if (wakeup->tcp_nomoretokens &&
11466                     nla_put_flag(msg,
11467                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11468                         goto free_msg;
11469
11470                 if (wakeup->packet) {
11471                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11472                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11473
11474                         if (!wakeup->packet_80211) {
11475                                 pkt_attr =
11476                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11477                                 len_attr =
11478                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11479                         }
11480
11481                         if (wakeup->packet_len &&
11482                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11483                                 goto free_msg;
11484
11485                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11486                                     wakeup->packet))
11487                                 goto free_msg;
11488                 }
11489
11490                 nla_nest_end(msg, reasons);
11491         }
11492
11493         genlmsg_end(msg, hdr);
11494
11495         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11496                                 NL80211_MCGRP_MLME, gfp);
11497         return;
11498
11499  free_msg:
11500         nlmsg_free(msg);
11501 }
11502 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11503 #endif
11504
11505 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11506                                 enum nl80211_tdls_operation oper,
11507                                 u16 reason_code, gfp_t gfp)
11508 {
11509         struct wireless_dev *wdev = dev->ieee80211_ptr;
11510         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11511         struct sk_buff *msg;
11512         void *hdr;
11513
11514         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11515                                          reason_code);
11516
11517         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11518         if (!msg)
11519                 return;
11520
11521         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11522         if (!hdr) {
11523                 nlmsg_free(msg);
11524                 return;
11525         }
11526
11527         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11528             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11529             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11530             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11531             (reason_code > 0 &&
11532              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11533                 goto nla_put_failure;
11534
11535         genlmsg_end(msg, hdr);
11536
11537         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11538                                 NL80211_MCGRP_MLME, gfp);
11539         return;
11540
11541  nla_put_failure:
11542         genlmsg_cancel(msg, hdr);
11543         nlmsg_free(msg);
11544 }
11545 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11546
11547 static int nl80211_netlink_notify(struct notifier_block * nb,
11548                                   unsigned long state,
11549                                   void *_notify)
11550 {
11551         struct netlink_notify *notify = _notify;
11552         struct cfg80211_registered_device *rdev;
11553         struct wireless_dev *wdev;
11554         struct cfg80211_beacon_registration *reg, *tmp;
11555
11556         if (state != NETLINK_URELEASE)
11557                 return NOTIFY_DONE;
11558
11559         rcu_read_lock();
11560
11561         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11562                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11563                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11564
11565                 spin_lock_bh(&rdev->beacon_registrations_lock);
11566                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11567                                          list) {
11568                         if (reg->nlportid == notify->portid) {
11569                                 list_del(&reg->list);
11570                                 kfree(reg);
11571                                 break;
11572                         }
11573                 }
11574                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11575         }
11576
11577         rcu_read_unlock();
11578
11579         return NOTIFY_DONE;
11580 }
11581
11582 static struct notifier_block nl80211_netlink_notifier = {
11583         .notifier_call = nl80211_netlink_notify,
11584 };
11585
11586 void cfg80211_ft_event(struct net_device *netdev,
11587                        struct cfg80211_ft_event_params *ft_event)
11588 {
11589         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11590         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11591         struct sk_buff *msg;
11592         void *hdr;
11593
11594         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11595
11596         if (!ft_event->target_ap)
11597                 return;
11598
11599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11600         if (!msg)
11601                 return;
11602
11603         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11604         if (!hdr)
11605                 goto out;
11606
11607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11608             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11609             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11610                 goto out;
11611
11612         if (ft_event->ies &&
11613             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11614                 goto out;
11615         if (ft_event->ric_ies &&
11616             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11617                     ft_event->ric_ies))
11618                 goto out;
11619
11620         genlmsg_end(msg, hdr);
11621
11622         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11623                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11624         return;
11625  out:
11626         nlmsg_free(msg);
11627 }
11628 EXPORT_SYMBOL(cfg80211_ft_event);
11629
11630 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11631 {
11632         struct cfg80211_registered_device *rdev;
11633         struct sk_buff *msg;
11634         void *hdr;
11635         u32 nlportid;
11636
11637         rdev = wiphy_to_dev(wdev->wiphy);
11638         if (!rdev->crit_proto_nlportid)
11639                 return;
11640
11641         nlportid = rdev->crit_proto_nlportid;
11642         rdev->crit_proto_nlportid = 0;
11643
11644         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11645         if (!msg)
11646                 return;
11647
11648         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11649         if (!hdr)
11650                 goto nla_put_failure;
11651
11652         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11653             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11654                 goto nla_put_failure;
11655
11656         genlmsg_end(msg, hdr);
11657
11658         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11659         return;
11660
11661  nla_put_failure:
11662         if (hdr)
11663                 genlmsg_cancel(msg, hdr);
11664         nlmsg_free(msg);
11665
11666 }
11667 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11668
11669 /* initialisation/exit functions */
11670
11671 int nl80211_init(void)
11672 {
11673         int err;
11674
11675         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11676                                                    nl80211_mcgrps);
11677         if (err)
11678                 return err;
11679
11680         err = netlink_register_notifier(&nl80211_netlink_notifier);
11681         if (err)
11682                 goto err_out;
11683
11684         return 0;
11685  err_out:
11686         genl_unregister_family(&nl80211_fam);
11687         return err;
11688 }
11689
11690 void nl80211_exit(void)
11691 {
11692         netlink_unregister_notifier(&nl80211_netlink_notifier);
11693         genl_unregister_family(&nl80211_fam);
11694 }